Evidence of meeting #47 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was consent.
A recording is available from Parliament.
4:15 p.m.
Conservative
The Chair Conservative Blaine Calkins
Okay, I appreciate the decisiveness.
Mr. Kelly, go ahead for five minutes.
4:15 p.m.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Thank you.
I'd like to ask you to comment on consent and how this works in practice, in terms of the differences, and maybe issues that you....
Actually, let me ask this first. If I understood you correctly, you are in the process of preparing a paper on consent.
4:15 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We have issued a discussion paper seeking views, but without taking positions. We are going to take a position by mid-2017.
4:15 p.m.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
By the summer, you will have a position on consent. Okay.
For the record, could you briefly give us your own explanation, as simply as possible, of the distinctions between implied, informed, and express consent?
4:15 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Implied consent arises from the context of the situation, whereas express consent is sought specifically for a purpose for which the information is collected. That would be my simple explanation.
4:15 p.m.
Conservative
4:15 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Informed consent means that the individual giving consent knows the purpose for which the information will be used and disclosed.
4:15 p.m.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Do you currently have different models or different measurements by which you determine the appropriateness of the level of consent?
4:15 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The law is drafted generically, and I'll turn to my colleague in a second.
One problem is that organizations, companies, sometimes use extremely broad and generic language, such as saying that they will use and disclose your information “to improve customer experience”, and they seek consent on that basis. To me, that's not meaningful consent. The person cannot understand what will happen to their information if they are asked to consent to a better customer experience.
4:20 p.m.
Senior General Counsel and Director General, Legal Services, Policy, Research and Technology Analysis Branch, Office of the Privacy Commissioner of Canada
Thank you for the question.
Just to clarify whether it's explicit or implied consent, both need to be informed. In terms of PIPEDA, the validity of consent depends on it being of an informed nature.
In terms of distinguishing what form of consent is appropriate in different circumstances, whether it should be explicit or implied, in our guidance over the years, we have said that it will depend on the sensitivity of the information and the reasonable expectations of the individual. These factors will help inform whether the consent should be made explicit or whether implied consent would be acceptable in appropriate circumstances.
These factors were recently confirmed in a Supreme Court decision called Royal Bank of Canada versus Trang. In there, they confirmed those general conditions and set out a very helpful analytical framework for distinguishing situations in which explicit or implied consent would be appropriate in the circumstances.
4:20 p.m.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
Okay. How will the concept of consent affect a potential future law or legislation that defines a right to be forgotten?
4:20 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I think the two are distinct. Consent has to do with the conditions under which information is collected, used, and disclosed, and the right to be forgotten in our law has more to do with the retention period, how long a company can retain the information given the purposes for which it obtained it.
4:20 p.m.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
That would, in many commercial transactions, be part of what you consent to. I consent to the retention of information I give you for a specific period of time or I don't consent to that. Could the idea of being forgotten really be addressed that way? If a service provider has no right to retain information for longer than the period to which you've consented—
4:20 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It would help to prescribe a period of time for retention, for sure.
4:20 p.m.
Conservative
Pat Kelly Conservative Calgary Rocky Ridge, AB
All right. In the interest of keeping moving, I'll finish with that.
4:20 p.m.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
On that point, in Mission: Impossible, you agreed to this mission and the tape would be destroyed in five seconds, so why can't technology have sunset built into it, such that unless you're given a request.... I am just “blue-skying” on the subject. Could you conceive of a technological protocol that would allow for automatic destruction without consent of continuation?
4:20 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, although it would all start with either a legal rule or a legal agreement as to what the period was. Once that was set then, yes, technology could make it happen.
4:20 p.m.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
I'm sure these conversations are taking place in many parts of the world. We have the Law of the Sea, and we have the International Civil Aviation Organization regulating air traffic. Should we not be having an international conference on these topics, or have you just come back from one?
4:20 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Two years or so ago, the United Nations appointed a special rapporteur on the right to privacy, and that person has a mandate to try to develop an instrument of international application, but this is not going to happen tomorrow. It's desirable, but this is not imminent for sure.
As for the right to be forgotten, I must say that if you ask whether there should be an international rule on something like the right to be forgotten, the right to be forgotten deals, as I said earlier, with the balance between important constitutionally protected rights, such as freedom of expression and the right to privacy. One aspect of privacy is that it depends on certain international principles, but its application depends a little bit on the culture of the place. All countries do not have the same way of looking at privacy, and certainly they do not have the same constitutional protections governing it. So, yes, we should move towards or we should seriously consider something like the right to be forgotten, but we should also look at our constitutional framework and values to determine how far to go.
4:25 p.m.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
Is there any real point in the long run, given that if you look at the case with banking, where you can hide your money in the Cayman Islands or someplace else, there could be offshore havens for data so that people would just hide the data somewhere else and draw it out when they would need it? Do you not see that as part of the problem with this whole question? That's sort of a spinoff of what you just said.
4:25 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Although an international instrument is not for tomorrow—I'll be more optimistic now—there are certainly discussions among countries on how to make privacy laws more congruent—not completely consistent but more congruent. Offices like mine co-operate for the enforcement of these privacy laws, to ensure that they result in similar outcomes. So we may not reach an international set of rules soon, but I see movement towards more consistency.
4:25 p.m.
Conservative
The Chair Conservative Blaine Calkins
We don't have enough time left for another five-minute round, so, colleagues, I don't know how you want me to deal with this. I think I'll just take up the last minutes, if that's okay.
4:25 p.m.
Voices
Oh, oh!