Evidence of meeting #47 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was consent.
A recording is available from Parliament.
Executive Director, B.C. Freedom of Information and Privacy Association
I don't think there is one.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
Okay. Maybe that's a problem to be identified. I mean, if personal medical records have been breached—
Executive Director, B.C. Freedom of Information and Privacy Association
Yes.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
—and people's medical histories are in the hands of God knows who and they may be shared or sold or whatever, the fact is that the government can choose not to tell anyone about it.
February 16th, 2017 / 5:10 p.m.
Executive Director, B.C. Freedom of Information and Privacy Association
Well, this is the problem, but of course this is a provincial issue.
There's also the question, and this is something that's come up here, of what happens to the people who are, let's say, in danger of ID theft. Should there be a requirement that all the money that they'll have to pay to EQUIS, to TransUnion, or to the others—
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
I'm just trying to understand the role of government with something like PharmaNet. They hold themselves apart from government; they are not part of government, and yet the Government of British Columbia—or nationally, if we're doing PIPEDA—sets the rules regarding, when a breach happens, when a company with something like personal medical information has to tell the public that this has happened.
You're suggesting that there isn't a breach notification.
Executive Director, B.C. Freedom of Information and Privacy Association
It's not mandatory.
NDP
Nathan Cullen NDP Skeena—Bulkley Valley, BC
It's not mandatory.
I have a quick question for either of our witnesses. It's about political parties and the information that political parties gather. What governs us right now federally in terms of how that data is managed and how the personal collection of private information of Canadian citizens is disclosed to those we're collecting the information from?
Executive Director, B.C. Freedom of Information and Privacy Association
You're free to do with it as you see fit. You are not subject to PIPEDA. You're not covered there.
Executive Director, B.C. Freedom of Information and Privacy Association
It can and should be changed.
Full Professor, Department of Criminology, University of Ottawa, As an Individual
I would agree, yes.
Executive Director, B.C. Freedom of Information and Privacy Association
In British Columbia the parties are covered. There's an argument that possibly federal parties that have B.C.-incorporated branches would be subject to the provincial legislation. It would create an interesting situation in which, if the federal party generally violates privacy norms, somebody in British Columbia would have the ability to file a complaint with our commissioner, but somebody in Ontario who's under PIPEDA would not. That seems unfortunate, to say the least, and it should be changed.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much.
We will now go to Monsieur Dubourg for seven minutes, please.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
Thank you, Mr. Chair.
First, I would first to thank the witnesses, Ms. Steeves and Mr. Gogolek, for being here. Your testimony is of great interest to the committee.
My first question is for Mr. Gogolek, since he is in Vancouver, very far away from us.
Did you know that the Quebec government conducted an awareness tour among high school students? Have you done anything similar where you are?
Executive Director, B.C. Freedom of Information and Privacy Association
I am not aware of what is happening in Quebec. In British Columbia, our commissioner's office has produced resources to help people better manage their personal information, for young people and the general public. We also want to inform them of their rights and provide advice on protecting themselves and how to conduct themselves on the Internet and in other contexts.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
Okay. I understand that awareness measures are ongoing.
You also stated that consent is an important issue and that is a priority for you.
Do you think there should be a time limit on consent? Do you think that would be helpful?
Executive Director, B.C. Freedom of Information and Privacy Association
I think so.
Of course, it is up to legislators to draft the laws and find ways of achieving the intended purpose. I do not have a specific recommendation regarding a time limit on retention, but, in principle, consent should not be indefinite. Information should not be kept just in case it is needed at some undetermined point in the future. Consent should be used for clear purposes, and a time limit on retention should reflect that principle.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
Okay, thank you.
Ms. Steeves, you talked a lot about children, and I do find it very worrisome that what our young people—who can be very young, as my colleague said—publish on Facebook or any other medium can catch up with them a few years later.
You also said that the legislation in Europe is much stronger, even better than what we have in Canada.
In your opinion, is the legislation in Europe much stricter as regards children than Canadian laws, PIPEDA for instance?
Full Professor, Department of Criminology, University of Ottawa, As an Individual
If you look at both the EC and the EU, they've actually undertaken a number of studies recently that have expressly rooted privacy for children in the Convention on the Rights of the Child, even if you look at something like cyber-bullying where, in the Canadian context, we've been far too ready to invade children's privacy in order to protect them. Because of this commitment to the Convention on the Rights of the Child, the European discussion is much more about balancing the need to protect with the benefits of ensuring that young people have privacy in online spaces precisely because privacy is a proto-right. It allows them to access information, learn about their own culture, and these other things. I think there are some really interesting models there.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
Okay.
Moreover, European legislation includes sanctions, which is not the case in Canada.
In your opinion, should we also impose sanctions, especially in the case of the fraudulent use of personal information?
Full Professor, Department of Criminology, University of Ottawa, As an Individual
Do you mean fraudulent use among children?
Full Professor, Department of Criminology, University of Ottawa, As an Individual
That's interesting. I think part of the problem is that, from young people's point of view, when we create those kinds of remedies, they are less likely to use them. What they're looking for is more control over their information. So even again, when you look at cyber-bullying as an example and the zero-tolerance policies that have these penalties attached to them, if someone posts something about me that falls into this catchment.... Young people tell us that the problem with that is that if they go to adults, it gets escalated all the way, and then suddenly they lose control, and what they really want is an ability to get that information taken down. They want better mechanisms to be able to report information and say, “That's about me, and I want it removed.”