Information & Ethics Committee on Feb. 14th, 2017

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

I'm certainly not surprised that you would go to a small business with, say, a dozen employees, and find there was perhaps not awareness that someone in each had to be designated as a privacy officer and had to undertake certain functions to be compliant.

What I really want to know and what I didn't get was whether even by anecdote, since you mentioned this process didn't have a final report, you saw evidence of harm done to the customers of these small businesses. Did you see evidence of breaches of consumers' privacy?

[Robert Dickson]

Because we weren't dealing so much with consumers—our dealings were with organizations—we didn't have a lot of organizations coming forward and—

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

You talked about focusing on small and medium-sized enterprises at the beginning of your remarks.

[Robert Dickson]

Well, that's right.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Were these small businesses that you went in to?

[Robert Dickson]

They were small businesses. What we found, generally speaking—though there were some exceptions, as you would expect—that there was an incredibly low level of awareness of PIPEDA and what was required of an organization to ensure that it was collecting the least amount of information needed for the purpose, and that it didn't keep personal information longer than it had appropriate need for it, and those kinds of things.

We found that those rules weren't being followed.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Again, you don't know whether harm resulted from the non-following....

Perhaps I will let you answer the question, then. Mr. Dickson didn't seem to have—

[Chantal Bernier]

Absolutely.

One investigation that pops to mind was of a new start-up selling widgets on the net. They were clearly very excited about their new business and didn't think about privacy. What they were focused on was being a nice start-up on the internet, until one of their customers said, I've been defrauded of so many thousands of dollars. The start-up did not find the breach themselves. Then another customer said, I've been defrauded. Then everyone tracked it down to them, and sure enough, it was them.

There are tons of examples like that. In fact, many big companies will tell you that their weakest link is the SMEs that are in their supply chain. Much of the attention is turning there.

The answer to your question, then, is yes, absolutely there is harm.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay. Excellent.

[The Chair, Conservative, Blaine Calkins]

You have about a minute.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

I don't know if we can really tackle a big topic in a minute, but I'll maybe just throw it out. I don't know if we have time to address it, but could you talk about some of the distinctions between informed and implied consent?

We have talked about quite a bit of this, and in any enterprise, particularly a small one, when you are at a point of sale or are trying to disseminate information that may lead to a sale, complying with requirements under law while being able to give the customer what they want—information—is a difficult business.

Perhaps in the next round....

[The Chair, Conservative, Blaine Calkins]

When I tell you that you have a minute left for a question and you make your question a minute long, you run out of time.

[Some hon. members]

Oh, oh!

[The Chair, Conservative, Blaine Calkins]

Mr. Blaikie.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

I recognize that you are all here as privacy experts and not as trade experts, but we just came off a third reading vote on the comprehensive economic and trade agreement. It is supposedly an agreement to eliminate non-tariff trade barriers between Canada and Europe and to give some assurances to Canadian companies that when they are trading with European companies, they are not going to run into difficulties of the kind that have come up.

As the only person on the committee who voted against that agreement, I'm interested to hear that there are some considerable issues with respect to what would be called non-tariff trade barriers that weren't addressed in CETA.

Can you expand a little bit more on what's missing from that agreement and on how we make it so that Canadian companies are not going to lose an advantage that they currently have, in spite of having just signed an agreement that's supposed to facilitate trade with Europe?

[Chantal Bernier]

The only way we can protect them is to work now at making sure that by the time our adequacy status comes under review in Europe, we have shored up our privacy protections to that level. It doesn't mean that they're exactly the same, but that the Europeans will find them adequate. Otherwise, every time we want to deal with Europe—a market of 500 million people who have money, so we want to have that competitive advantage—we will have to go through very onerous clauses.

The answer to your question goes back to what I said to Mr. Massé: we need to shore up the act now so that it passes the test after 2018.

[Dr. Éloïse Gratton]

Perhaps I could have a few words?

The Quebec data protection law was deemed substantially similar to PIPEDA. We've had this law since 1993. It's probably the most stringent across Canada. Europe looked at our law in 2014 and decided that it was not adequate—that there was question mark in its regard. So I have an issue with the adequacy of Europe's assessment or methodology.

Ideally, of course, we would like to pass that test, but I still have some concerns.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you very much.

Madame Bernier, you mentioned that if the commissioner were to have the power to fine, it would make sense to base it on the company's global revenues.

Then you talked briefly about profits. Just for clarity, are you talking about a percentage of profits or a percentage of revenue?

[Chantal Bernier]

Actually, if we follow the European model, it is annual revenues. The Chair was speaking about divergent views, but I think there's some congruence here between us. Ms. Gratton said that we have to make sure that we take into account the circumstances of the organization. Gary Dickson spoke of SMEs and how they are more sensitive to fines. Using a percentage, I feel, is fairer because then you don't slap a million dollar fine on a small company. A percentage would fit the gravity of an offence and would be fairer in practice.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

This question is for our friends at the Public Interest Advocacy Centre. Can you elaborate a bit for the committee on your comments about having either a separate act or having this act target more specifically the privacy rights of children?

How do you think legislation could try to target the kinds of sites, for instance, that children use? What do you have in mind to be able to pick out the kinds of concerns and activities that would be specific to children online?

[John Lawford]

I believe our proposal doesn't try to pick out which sites. It's based more on an adjustment to consent. In the United States, as you know, there's a requirement not to take the information of children under the age of 13. That should be standard here in Canada. It's not in the act. Europe now, with the general data protection, is going to require parental consent up to age 16 for most matters.

There is a body of social sciences research on this, on the developing maturation of the teen brain and at what point they can understand to give valid consent. It's similar to medical consent. There could be just basically those sorts of rough rules so that, as a teenager under 16, you would be protected from handing out your personal information to, for example, third-party processing. We did a paper on this, called “All in the Data Family”, which is on our website. It goes through a proposal that we made.

The last thing is, for children who may have given consent under the age of majority, our proposal was also that they have a choice, when they reach the age of 18 or 19, depending on the province, about whether to authorize the company that collected it to continue to use the information. We call it a “get out of data jail free” card. That might be something for the committee to consider.

Those were the kinds of proposals we were thinking about.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you very much.

[The Chair, Conservative, Blaine Calkins]

You have one minute.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Oh, just one? Well, I'm all right, then.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Blaikie. I appreciate it.

We'll now move to the end of the seven-minute round, with Mr. Saini for up to seven minutes, please.