Information & Ethics Committee on March 8th, 2016

[The Chair, Conservative, Blaine Calkins]

We'll move to Mr. Badawey, who is a guest today.

Welcome to our committee, sir.

[Vance Badawey, Liberal, Niagara Centre, ON]

Thank you, Mr. Chairman. It's a pleasure to be here.

I do thank the participants. This issue has been a long-standing pet project of mine for many years. Therefore, I have a question with respect to privacy.

To the participants, this morning we talked a lot about one side of the fence with respect to releasing and being transparent with information from all levels of government. In your jurisdictions, what implications are actually built in or put in place if in fact information is released that should not have been released?

[The Chair, Conservative, Blaine Calkins]

Who would like to start?

Madame.

[Diane Poitras]

It depends on the context.

If a public body or enterprise disclosed personal information, the commission would deal with it through an investigation. People can file complaints with the commission, but the commission can also investigate on its own initiative to determine whether the disclosure was in compliance with the act or not. If it wasn't, the commission has the authority to order that the disclosure cease if it is ongoing. The commission also has the authority to order that the enterprise or public body put practices or mechanisms in place to prevent similar situations in the future.

If I understood your question correctly, that's how we would deal with the situation you described.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

Mr. Beamish, I know that you are now staying beyond the time that you have allocated, sir. If you need to go, please feel free to go, but if you can stay until the end of the questions, we would certainly welcome you.

[Brian Beamish]

Perhaps I could just provide a quick answer to this question, and then I'm afraid I am going to have to leave. I apologize for that.

Similarly to Quebec, in Ontario, if information was disclosed improperly, we would have the ability to conduct an investigation, either because we received a complaint or on our own initiative, and having conducted that investigation, we could issue a report commenting on its inappropriateness.

I think the more common scenario for us, though, is cases where institutions may have collected information for one purpose and then are repurposing that information for a secondary purpose that is not permitted by law.

[The Chair, Conservative, Blaine Calkins]

Okay.

Ms. Clayton, go ahead.

[Jill Clayton]

It's a very similar scenario in Alberta.

I can initiate an investigation on my own motion, if I am made aware of something that looks like, for example, there might be personal information that has been disclosed in contravention of the legislation. In many cases, of course, we respond to complaints made by individuals to the office. The majority of those case are resolved, as I said, through our informal mediation investigation process. We would make recommendations to modify an information system, to stop disclosing the information, or to train staff, those kinds of recommendations. However, if necessary, the matter might go to an inquiry, and we could issue a binding order, for example, to require a public body to stop collecting, using, or disclosing information.

[Vance Badawey, Liberal, Niagara Centre, ON]

Thank you, Mr. Chairman, and those who commented on this.

I just want to take it a step further and dig a bit deeper. I understand and appreciate the fact that you would comment on the inappropriateness and send an order to stop releasing information. What I am trying to drill down on, however, is what the repercussions are. Whether it be an elected official or a person from administration, what are in fact the repercussions of releasing this kind of information?

As we can all appreciate, when inappropriate information is released, it can have some serious implications for those it's being released about, whether it be legal or solicitor-client privilege, etc. My question is specific to the repercussions. What repercussions are in place for those who release that information, whether it's an elected official or administration?

[The Chair, Conservative, Blaine Calkins]

Madame Poitras, go ahead.

[Diane Poitras]

My answer is twofold.

If the disclosure is done and not ongoing, efforts will be made to prevent it from happening again. The Commission d'accès à l’information du Québec, however, does not have the authority to order any compensation for damages or injury suffered by a person as a result of the disclosure.

But if we have to manage a security breach, we will do everything in our power to stop the disclosure and we will ask the enterprise or public body to make every effort to limit the negative consequences arising from the disclosure. For instance, if the disclosure involves information about someone's credit or financial standing, the person can ask credit agencies to issue an alert or check whether their identity was improperly used.

The commission does not have the authority to order a body to make reparation for a disclosure that is no longer going on.

[The Chair, Conservative, Blaine Calkins]

Okay.

Ms. Clayton.

[Jill Clayton]

In Alberta, under all three of the statutes that I have oversight for, there are offences and penalties.

Under the FOIP Act the offences tend to be wilful contraventions of the legislation and not just a negligent human error type of incident—which is the sort of thing we mediate and make recommendations around—but wilfully not complying with the legislation, or for example destroying records that are subject to the act, or directing someone else to do that with the intent of evading an access request.

The penalties under the legislation include for individuals a fine of not less than $2,000 and not more than $10,000, and in the case of other persons a fine of not less than $200,000 and not more than $500,000.

I should note we have not had any successful prosecutions under the FOIP Act. On the other hand under our health legislation, which has similar offences and slightly different penalties, we have conducted a number of offence investigations that have resulted in successful prosecutions in court. We do the investigation, we turn our evidence over to the crown, and the crown conducts the prosecution. I believe we've had four successful prosecutions in Alberta, and this year under the Health Information Act we've had charges laid in four other offences.

Under the Health Information Act these tend to be wilfully snooping in other people's health information. I think one of the reasons we see more of that in the health sector than we do in the public sector has to do with the fact that in the public sector most of the cases in front of our office have to do with access to information. Complaints around snooping don't make up the majority of the cases in front of the office. We're far more likely to be looking at a response to a request for access and whether the information was improperly withheld. It's not always an easy thing to find evidence that somebody has wilfully destroyed records to evade a request.

I think it's the nature of the types of files that have led to prosecutions under the Health Information Act and not so much under the access to information act.

[The Chair, Conservative, Blaine Calkins]

Okay, thank you very much.

We have our last question of the day, and that's Mr. Blaikie for about three minutes, please, sir.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you very much.

There are a number of government services that get contracted out to private companies and that's something that happens more and more. I think one of our witnesses today talked briefly about solicitor-client privilege, but I'm wondering if either of you have experience in terms of people wanting access to information about the provision of services, and because they're being offered by a private contractor instead of the civil service, how the exemptions around commercial interests play, and your thoughts on that. How can an access to information regime deal with those reasonably?

[The Chair, Conservative, Blaine Calkins]

Madam Poitras.

[Diane Poitras]

Quebec's access to information legislation does indeed set out restrictions protecting the information provided by third parties and private enterprises under certain conditions. If the disclosure is likely to reduce the enterprise's competitive margin or result in profit for a competitor or third party, a person can request access to the document provided that it is held by a public body that entered into a contract with a private enterprise. But the public body can check with the enterprise to see if it consents to the disclosure in question. If not, the public body can invoke those restrictions, and it will be up to the third party or private enterprise to show that it can refuse to grant access to the document under the restriction conditions. The enterprise must demonstrate that to the commission.

[The Chair, Conservative, Blaine Calkins]

Okay.

Ms. Clayton.

[Jill Clayton]

We do have a similar exception to access in Alberta's legislation, but I think I will use my opportunity to respond to just say this. The sharing of information across public sector, private sector, health sector is something that has been of particular interest to me in the last couple of years. In fact we commissioned a research paper, available on our website, that looked at information-sharing initiatives around the world and nationally. It tried to draw some learnings from those case studies. There are potentially very significant implications for both privacy and access.

I don't want to suggest that this information-sharing should not take place, because I understand that this is vital to providing programs and services that citizens want, but it's certainly important to be aware of the access and privacy implications and risks, and to implement controls to mitigate those risks.

I'll just refer you also to a joint resolution that all commissioners signed off on and made public in January of this year. We issued the duty to document statement, but we also issued a resolution on information-sharing recognizing that there are great benefits to information-sharing, but it has to be done in a thoughtful, considered way with due regard to access and privacy for patients. We made some recommendations to governments to look at how that affects access to information, because it is something we're starting to see quite a bit of.

[The Chair, Conservative, Blaine Calkins]

Commissioners, we thank you very much. We certainly appreciate your taking the time this morning.

A shout-out to our friends in Alberta; even though this meeting is over, you're still early for work. At least you got to miss the rush hour on your way into the office this morning. As an Albertan, I know well the differences in time zones. I know how early you have to get up in the morning to be here.

I would also remind both of you, and Mr. Beamish, who had to leave, that this committee will also be studying the privacy legislation. We'll start with our Privacy Commissioner this Thursday, and then outline the scope of study, so we may very well be inviting you back to discuss the other side of your jurisdiction and responsibility, which is the privacy legislation that you administer on behalf of your respective provinces. If we should happen to make that request, we hope you will make yourselves available.

On behalf of the committee, I want to thank you very much for your considerations in our deliberations. I think it will be most helpful as we move forward in hopefully modernizing the access to information legislation that we have at the federal level. I want to thank you kindly for your time.

We will now move in camera to discuss future committee business.

[Proceedings continue in camera]