Evidence of meeting #47 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was consent.

A recording is available from Parliament.

On the agenda

MPs speaking

Also speaking

Daniel Therrien  Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Patricia Kosseim  Senior General Counsel and Director General, Legal Services, Policy, Research and Technology Analysis Branch, Office of the Privacy Commissioner of Canada
Valerie Steeves  Full Professor, Department of Criminology, University of Ottawa, As an Individual
Vincent Gogolek  Executive Director, B.C. Freedom of Information and Privacy Association

5:05 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

Vincent Gogolek

I don't think there is one.

5:05 p.m.

NDP

Nathan Cullen NDP Skeena—Bulkley Valley, BC

Okay. Maybe that's a problem to be identified. I mean, if personal medical records have been breached—

5:05 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

5:05 p.m.

NDP

Nathan Cullen NDP Skeena—Bulkley Valley, BC

—and people's medical histories are in the hands of God knows who and they may be shared or sold or whatever, the fact is that the government can choose not to tell anyone about it.

5:10 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

Vincent Gogolek

Well, this is the problem, but of course this is a provincial issue.

There's also the question, and this is something that's come up here, of what happens to the people who are, let's say, in danger of ID theft. Should there be a requirement that all the money that they'll have to pay to EQUIS, to TransUnion, or to the others—

5:10 p.m.

NDP

Nathan Cullen NDP Skeena—Bulkley Valley, BC

I'm just trying to understand the role of government with something like PharmaNet. They hold themselves apart from government; they are not part of government, and yet the Government of British Columbia—or nationally, if we're doing PIPEDA—sets the rules regarding, when a breach happens, when a company with something like personal medical information has to tell the public that this has happened.

You're suggesting that there isn't a breach notification.

5:10 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

Vincent Gogolek

It's not mandatory.

5:10 p.m.

NDP

Nathan Cullen NDP Skeena—Bulkley Valley, BC

It's not mandatory.

I have a quick question for either of our witnesses. It's about political parties and the information that political parties gather. What governs us right now federally in terms of how that data is managed and how the personal collection of private information of Canadian citizens is disclosed to those we're collecting the information from?

5:10 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

Vincent Gogolek

You're free to do with it as you see fit. You are not subject to PIPEDA. You're not covered there.

5:10 p.m.

NDP

Nathan Cullen NDP Skeena—Bulkley Valley, BC

Should this be changed?

5:10 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

Vincent Gogolek

It can and should be changed.

5:10 p.m.

NDP

Nathan Cullen NDP Skeena—Bulkley Valley, BC

Would you agree, Ms. Steeves?

5:10 p.m.

Full Professor, Department of Criminology, University of Ottawa, As an Individual

Dr. Valerie Steeves

I would agree, yes.

5:10 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

Vincent Gogolek

In British Columbia the parties are covered. There's an argument that possibly federal parties that have B.C.-incorporated branches would be subject to the provincial legislation. It would create an interesting situation in which, if the federal party generally violates privacy norms, somebody in British Columbia would have the ability to file a complaint with our commissioner, but somebody in Ontario who's under PIPEDA would not. That seems unfortunate, to say the least, and it should be changed.

5:10 p.m.

Conservative

The Chair Conservative Blaine Calkins

Thank you very much.

We will now go to Monsieur Dubourg for seven minutes, please.

5:10 p.m.

Liberal

Emmanuel Dubourg Liberal Bourassa, QC

Thank you, Mr. Chair.

First, I would first to thank the witnesses, Ms. Steeves and Mr. Gogolek, for being here. Your testimony is of great interest to the committee.

My first question is for Mr. Gogolek, since he is in Vancouver, very far away from us.

Did you know that the Quebec government conducted an awareness tour among high school students? Have you done anything similar where you are?

5:10 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

Vincent Gogolek

I am not aware of what is happening in Quebec. In British Columbia, our commissioner's office has produced resources to help people better manage their personal information, for young people and the general public. We also want to inform them of their rights and provide advice on protecting themselves and how to conduct themselves on the Internet and in other contexts.

5:10 p.m.

Liberal

Emmanuel Dubourg Liberal Bourassa, QC

Okay. I understand that awareness measures are ongoing.

You also stated that consent is an important issue and that is a priority for you.

Do you think there should be a time limit on consent? Do you think that would be helpful?

5:10 p.m.

Executive Director, B.C. Freedom of Information and Privacy Association

Vincent Gogolek

I think so.

Of course, it is up to legislators to draft the laws and find ways of achieving the intended purpose. I do not have a specific recommendation regarding a time limit on retention, but, in principle, consent should not be indefinite. Information should not be kept just in case it is needed at some undetermined point in the future. Consent should be used for clear purposes, and a time limit on retention should reflect that principle.

February 16th, 2017 / 5:15 p.m.

Liberal

Emmanuel Dubourg Liberal Bourassa, QC

Okay, thank you.

Ms. Steeves, you talked a lot about children, and I do find it very worrisome that what our young people—who can be very young, as my colleague said—publish on Facebook or any other medium can catch up with them a few years later.

You also said that the legislation in Europe is much stronger, even better than what we have in Canada.

In your opinion, is the legislation in Europe much stricter as regards children than Canadian laws, PIPEDA for instance?

5:15 p.m.

Full Professor, Department of Criminology, University of Ottawa, As an Individual

Dr. Valerie Steeves

If you look at both the EC and the EU, they've actually undertaken a number of studies recently that have expressly rooted privacy for children in the Convention on the Rights of the Child, even if you look at something like cyber-bullying where, in the Canadian context, we've been far too ready to invade children's privacy in order to protect them. Because of this commitment to the Convention on the Rights of the Child, the European discussion is much more about balancing the need to protect with the benefits of ensuring that young people have privacy in online spaces precisely because privacy is a proto-right. It allows them to access information, learn about their own culture, and these other things. I think there are some really interesting models there.

5:15 p.m.

Liberal

Emmanuel Dubourg Liberal Bourassa, QC

Okay.

Moreover, European legislation includes sanctions, which is not the case in Canada.

In your opinion, should we also impose sanctions, especially in the case of the fraudulent use of personal information?

5:15 p.m.

Full Professor, Department of Criminology, University of Ottawa, As an Individual

Dr. Valerie Steeves

Do you mean fraudulent use among children?

5:15 p.m.

Liberal

Emmanuel Dubourg Liberal Bourassa, QC

Among everyone, I would say.

5:15 p.m.

Full Professor, Department of Criminology, University of Ottawa, As an Individual

Dr. Valerie Steeves

That's interesting. I think part of the problem is that, from young people's point of view, when we create those kinds of remedies, they are less likely to use them. What they're looking for is more control over their information. So even again, when you look at cyber-bullying as an example and the zero-tolerance policies that have these penalties attached to them, if someone posts something about me that falls into this catchment.... Young people tell us that the problem with that is that if they go to adults, it gets escalated all the way, and then suddenly they lose control, and what they really want is an ability to get that information taken down. They want better mechanisms to be able to report information and say, “That's about me, and I want it removed.”