Evidence of meeting #46 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
5:20 p.m.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much.
Mr. Erskine-Smith, you have five minutes, please.
5:20 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Thanks very much.
My first question is with respect to something we haven't discussed much yet, namely the civil remedies under PIPEDA. How effective do you think they are and do you believe there's a model jurisdiction we might look to that has a better structure?
5:20 p.m.
Counsel, Global Privacy and Cybersecurity Group, Dentons Canada
There are no civil remedies right now.
5:20 p.m.
Liberal
5:20 p.m.
Counsel, Global Privacy and Cybersecurity Group, Dentons Canada
Well, you go to the OPC, and then you can go to court.
5:20 p.m.
Liberal
5:20 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
—it seems to me potentially insufficient. Is there a model jurisdiction we might look to in order to improve upon our current regime?
5:25 p.m.
Counsel, Global Privacy and Cybersecurity Group, Dentons Canada
As I mentioned in my opening remarks, there's quite an array. You have the U.K., where the fines go up to 250,000 pounds. You have France, where it goes to 300,000 euros.
5:25 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
I don't mean to cut you off, but that's if the Privacy Commissioner is engaging in establishing penalties....
Say there's a consumer group that has been wronged in some way. We wouldn't necessarily have to wait under.... Well, we have to wait for a report from the commissioner, I understand, under section 14, but upon receiving that report, we can take the issue to court.
I understand that the OPC probably should have fining powers, but in addition should we expand upon the civil remedies?
5:25 p.m.
Counsel, Global Privacy and Cybersecurity Group, Dentons Canada
The civil remedies are there. In fact, Maître Gratton, Richard Dickson, Gary Dickson and I were just talking about how class actions are proliferating. That is there, that is used, and that is big money at stake. We've seen Casino Rama. There's been a big settlement. We've seen some that are in the works right now with big numbers attached to them. So that does occur.
5:25 p.m.
Executive Director and General Counsel, Public Interest Advocacy Centre
You might want to consider what they're doing with the anti-spam legislation, which is giving a private right of action, with a set amount per violation up to $200. It's the same sort of thing. That enables class actions, because it's hard to show harm. There are a number of class actions testing the waters now in Canada to see if you can get damages where there's no real harm. If you put something in the act, you could look at the anti-spam legislation as a model, and that would attract private enforcement of the regime. If the other enforcement done administratively isn't adequate, then the private bar could take cases.
5:25 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
I think that's also the case in a copyright.
Mr. Dickson or Ms. Gratton, do you have anything to add?
5:25 p.m.
Consultant, Former Saskatchewan Information and Privacy Commissioner, As an Individual
I have nothing to add to Chantal's comments.
5:25 p.m.
Partner and National Co-Leader, Privacy and Data Protection Practice Group, Borden Ladner Gervais, As an Individual
No, I have nothing to add.
5:25 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
With respect to the right to be forgotten, there are different ways it can come into play. If I, for example, could publish an article about someone and post it online, and perhaps they would say there's a right to be forgotten—and freedom of speech, as you suggested, Ms. Bernier, would be the competing value.
With respect to indexes, though, it strikes me that it's not just about freedom of speech. There's also a public interest in accessing information in archival records. Certainly, individuals may want information about themselves to be forgotten, but the public may not want it to be forgotten.
You mentioned the EU, Ms. Bernier. Have they struck a fair balance with that idea of a public interest in indexes in particular?
5:25 p.m.
Counsel, Global Privacy and Cybersecurity Group, Dentons Canada
In fact, earlier on, Gary Dickson mentioned the work we did together on guidelines that are applicable to the Internet posting of administrative tribunals, which goes exactly to your point. We wanted the privacy of the parties to be protected, but we also wanted judicial transparency to survive for the reason you say, because there is a public interest in getting the information. One solution is simply to use initials rather than the full names and identifiers. Therefore, you have the tribunal being in full glare, but the privacy of the parties, whom you don't need to know, being protected.
In Europe, the right to be forgotten is quite narrow compared to a discrete right to say that I want it taken down. It still has to be based on irrelevance, inaccuracy. I mean, there are criteria.
Going back to the congruence between us, I certainly have heard that it needs to have parameters so that it encroaches neither on the right to know—the freedom of access to information—nor freedom of expression. There is definitely a way to find that right spot.
5:25 p.m.
Conservative
The Chair Conservative Blaine Calkins
Okay, thank you very much.
We have our last three-minute round for Mr. Cullen, and then I'll excuse the committee. We'll have to quit because we're past our time.
In advance of that, I would just like to thank all of our witnesses. I know that some people have some tight deadlines.
Mr. Cullen, for three minutes, please.
5:25 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
I'll be right to the spot and the chair will help me out.
Thank you for the testimony. I've been reading over some research. My apologies if anything I ask has already been queried, but a politician, a microphone, and some time is a hard combination to completely resist, and ignorance has never stopped me from speaking before.
I have one question about this right to be forgotten, technologically speaking. We've seen with some technological advancements that you can rent a movie, for example, with a delete option built into it. After a certain amount of time it simply expires. Has this ever been explored with personal information, so that once such information is granted to a private company, there is a built-in algorithm to automatically delete it after a five-year period? Is this a technology that's ever been explored successfully, and is it something that could be built into law? You've talked about the onerous nature of having to audit five years later whether information is actually being destroyed or, as I think you said, ending up in a granary in Saskatchewan. I find that far too typical, somehow. Is there a technological fix to this that's been explored?
5:30 p.m.
Executive Director and General Counsel, Public Interest Advocacy Centre
I am not sure if anything has been commercialized, but certainly you could build an algorithm like that. I think there would be no trouble doing that.
5:30 p.m.
Partner and National Co-Leader, Privacy and Data Protection Practice Group, Borden Ladner Gervais, As an Individual
We should be encouraging the use of technologies that don't retain data forever, and here I can think of ephemeral messaging apps, such as Snapchat. So it's definitely possible.
5:30 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
I have a second question. Recently we had a petition on electoral reform that went through Parliament. This was an official parliamentary petition. One thing I noticed—and it's one of the first times I've noticed it—was that a lot of people were writing and asking me, will the information on their signing the petition be going to the parties? They ask because that's been the experience. Political parties use petitions for gathering data.
How much work has been done on that side of things, the retention of data both by government and, by extension, political parties—not parties as an extension of government but as another form of civic engagement? Have we seen any evidence of Canadians and certain populations of Canadians choosing to disengage from civic engagement out of fear that their data will be retained? I'm thinking of our neighbours to the south right now. If I were a Muslim American, would I want to be signing some petition that could end up in the hands even of the Government of the United States?
5:30 p.m.
Consultant, Former Saskatchewan Information and Privacy Commissioner, As an Individual
You raise a question that was explored by this very committee in looking at the Privacy Act. One of the presenters was Professor Colin Bennett from the University of Victoria, who is Canada's leading expert on privacy in the context of political parties and elections. I know that the Canadian Bar Association is doing some work on this. I know that the Chief Electoral Officer has made a recommendation—actually, it was maybe two CEOs back—that this is an issue to be looked at. This could be a great discussion, but it would be a lengthy one. I think that recommendations would come forward, if not from this committee, from other organizations, requesting that Parliament, at long last, address the protection of private information by political parties.
5:30 p.m.
Conservative
The Chair Conservative Blaine Calkins
Friends, we're at the time. Here's what I'm going to do. To our witnesses who are here today, because I know we have to shut the committee down—and I want to thank you, Mr. Cullen, for your questions—if there are any answers that you were not able to get out today, please feel free to jot those thoughts down and submit them to the committee and they will be included as the response to the questions that were asked in the testimony. If there's any other information, things that you wish you would have said or think about afterwards, by all means, please submit that to the committee as well.
We thank you very much for your time. We apologize for the late start. But thank you so much, and if we call upon you again, I know you'll help us out.
With that, the meeting is adjourned.