Evidence of meeting #47 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was consent.
A recording is available from Parliament.
4 p.m.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much.
Mr. Cullen, go ahead, please, for seven minutes.
4 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
Thank you, Chair.
Welcome, Commissioner. I'm quite new to this topic, so forgive me if I trip over anything since I am profoundly ill-informed regarding what we're talking about. I do find it incredibly fascinating.
Can you give us a range regarding what the order-making and fining powers are like for our trading partners in Europe and the United States? What range of fines are we talking about? What is typical, and what would industry in Europe have grown accustomed to?
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
In Europe, under the new regulation that will come into force in 2018, I believe the maximum will be 4% of the global revenue of a company.
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It is extremely significant.
4 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
And is there any gradation at all between large firms and small and medium enterprises?
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
By function of the revenue of the company, the maximum, 4% of global revenue, means a small company will pay a smaller amount.
4 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
I understand, but we also know there's a grading scale of difference in the security capacity of a large multinational firm versus that of a mom-and-pop operation that has a small online retail business on the side.
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Here, I think we would take the difference in size into consideration in terms of our expectations of the kind of security a company would require.
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes. In the U.S., I don't know the maximum—perhaps one of my colleagues can say—but there are fines in the millions of dollars.
4 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
Sure. So your basic argument to Canadian industry is that, as we're in the midst of this new economic revolution, we are not realizing its full potential if Canadians don't feel trust when they go online to shop and participate, and that trust would be enhanced if they knew you had the powers to find bad actors. Is that essentially the argument?
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
4 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
I'll put that to them when they show up at committee.
I'm concerned about what happens with personal information as we cross the border to the U.S. We saw the recent executive order from President Trump in late January excluding non-U.S. residents from protections under the U.S. privacy act. The information that is made available through things like NEXUS or the FAST pass that trucking operators use is extensive.
You have calmed fears that were raised several years ago. This personal information is extensive. This is biometric. Canadians give up a great deal of information when they cross the border. In the past, there have been protections under the U.S. Privacy Act, but under this executive order, no longer. Should this be concerning to Canadians as we see certain disruptions and certain people profiled, particularly Muslim Canadians?
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, it should be a concern, although we are looking at this issue and we haven't concluded yet what the net impact of this new executive order will be.
4:05 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
We can understand the concern, though, because the order says
to the extent consistent with applicable law, ensure that their privacy policies exclude persons who are not United States citizens or lawful permanent residents from the protections of the Privacy Act regarding personally identifiable information.
That's disturbing and quite significant, considering the amount of traffic that goes across the border, including businesses seeking to do business. I spoke to a Vancouver company last week. It's an IT company. By some coincidence, half of their staff come from countries that Mr. Trump recently identified on his so-called Muslim ban list. Three-quarters of their clients are in the U.S. They do not trust their staff's ability to cross now. This is a growing Canadian company, a success story, and they can't send anyone over the border—whether because they could be stopped, demeaned, or other things that have happened so far, or because, on the information side of things, their employees no longer have confidence that there is any protection of their personal information once their NEXUS card is swiped.
Are there any concerns about that?
4:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, we are concerned. What we're looking at is that the order eliminates or reduces protections under one specific legal instrument under U.S. law, the U.S. Privacy Act. There are a number of legal instruments in the U.S. that may give some protection: certain orders made by President Obama, for instance, or constitutional protections.
4:05 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
Let's not name them. Trump might eliminate them if he hears about them.
4:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Possibly. We are concerned, but we're looking at it. It's a complex matter, and you need to look at all of the legal instruments at play.
4:05 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
I understand that it's complex. I'm not a lawyer, so I can only envy those who have to go through this. I think there is a lot of uncertainty.
4:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Absolutely.
4:05 p.m.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
That's what I am picking up from Canadian industry and from Canadians broadly about personal information in general, as you've noted in your statistics, especially with this extra element, xenophobia, placed on top by the U.S. administration. The issuance of such an order would be.... It has to be accurate, of course, but it would be incredibly helpful to be expedient in order to alleviate some of that. Does the Canadian government need to respond by informing Canadians who are seeking to cross the border to work in the United States, if they happen to be, as we have found, people of Moroccan or Iranian heritage, or anything else that happens to bother the current administration?
4:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We have received a communication from an NGO, OpenMedia, raising these issues, and we are actively looking at this issue. You asked whether the government should do something. I hope the government is looking at the impact. It should be looking at the impact of that order and communicating to Canadians what it thinks the impact of that order is.