Evidence of meeting #48 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was consent.
A recording is available from Parliament.
4:50 p.m.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
That would be great.
There's nothing on your end, Ms. Chassigneux, that would indicate that businesses are pleased, then, or that it's burdensome?
4:50 p.m.
Administrative Judge, Surveillance, Commission d'accès à l'information du Québec
Government directions were provided in late 2015 or early 2016. A parliamentary commission was held and people presented briefs. The only figures that come to mind don't necessarily concern time frames. The complaints may focus more on the processing times for the commission's files, both for jurisdictional matters and for the oversight of research authorizations. We've heard a lot more about this in the press, but I don't have any figures on hand. As I said, I could check with the general secretariat.
4:50 p.m.
Conservative
4:50 p.m.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
Thank you, Mr. Chair.
It's my turn to acknowledge the witnesses who presented their briefs. I want to thank them.
We're indeed always saying the subject is complicated. My first questions are for Mr. McArthur.
In your presentation, you spoke of mediation. You said that you resolve the cases submitted to you mostly through mediation. You also said that fines in Canada pale in comparison with the fines in Europe.
Given that you don't seem to impose penalties, do you agree that PIPEDA should establish penalties that are as heavy as or that are similar to the penalties in Europe?
4:50 p.m.
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
Yes, we are in favour, and have recommended to our parliamentary review committee, that the fining be increased in the public sector, and also in the private sector acts, to have more of a deterrent effect. We are not seeing cases so much in the private sector, but are in the public sector. Information there is being accessed inappropriately, and individuals, even though they are aware of their obligations not to access that information, are still doing so. We believe that we need greater deterrence in the form of larger fines.
4:50 p.m.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
Thank you.
I have one final question for you.
You must certainly know Vincent Gogolek, from the BC Freedom of Information and Privacy Association. He appeared before this committee. He told us, among other things, that the federal political parties should also be subject to PIPEDA.
What do you think?
4:55 p.m.
Acting Commissioner, Office of the Information and Privacy Commissioner of British Columbia
I agree with Mr. Gogolek that Canadians' personal information should be protected, no matter which organization is collecting that information. As I noted in my earlier remarks, in B.C. the political parties fall under the ambit of our act. If a federal political party were collecting the information of a B.C. citizen, we might argue that we would want the ability to investigate that, and we would undertake that.
February 21st, 2017 / 4:55 p.m.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
Thank you very much.
Ms. Chassigneux, in the few minutes I have left, I also want to ask you a few questions.
In your presentation, you said that consent is provided in principle only, and that the term isn't well understood by businesses. Under this legislation, consent is very important, if not crucial.
How can the concept of consent be explained to SMEs and to all businesses?
4:55 p.m.
Administrative Judge, Surveillance, Commission d'accès à l'information du Québec
First, I hope that I didn't say consent was just a principle.
4:55 p.m.
Administrative Judge, Surveillance, Commission d'accès à l'information du Québec
Consent is provided in principle only, but consent is not only a principle. It's a key aspect of privacy. I just wanted to make that clear.
The Act respecting the protection of personal information in the private sector clearly states that consent must be obtained from the person concerned as regularly as possible, and not necessarily without the person's knowledge or from a third party. If consent must be obtained from the third party, it can be done with the consent of the person concerned, or, under some circumstances, without the person's knowledge.
In its recent five-year report, the Commission d'accès à l'information also asked that consent be modified with regard to a person entering a public space or a store with surveillance cameras, for example. The people concerned must be informed about this collection of information and they must know they're in a monitored location. This type of collection of information without a person's knowledge must be shared with the person so that they know they'll be filmed when they enter that location. It's a form of implied or express consent.
4:55 p.m.
Conservative
4:55 p.m.
Liberal
Emmanuel Dubourg Liberal Bourassa, QC
I want to ask Ms. Chassigneux whether she has any information to give us. She brought up a point that I also find very important. She spoke of files and personal information found in the files. She now wants us to look at the purpose of the collection.
Ms. Chassigneux, since I don't have any more time, I would appreciate it if you could send us the information.
4:55 p.m.
Administrative Judge, Surveillance, Commission d'accès à l'information du Québec
No problem.
4:55 p.m.
Administrative Judge, Surveillance, Commission d'accès à l'information du Québec
We talked about this in our recent five-year report, but I would be happy to send you the information.
4:55 p.m.
Conservative
The Chair Conservative Blaine Calkins
Thank you, Mr. Dubourg. I appreciate that.
We have our last official time allocation of three minutes for Ms. Trudel, from the New Democratic Party.
But colleagues, we do have a little bit of time. If any of the rest of you have questions, especially those who haven't asked questions yet—I see Mr. Long indicating that he does—we'll have a little bit of time to ask some questions at the end before we break.
Then, colleagues, we do have a little bit of committee business that we need to take care of afterwards in regard to a budget for this committee, so we'll consider that as well.
Ms. Trudel, the floor is yours.
4:55 p.m.
NDP
Karine Trudel NDP Jonquière, QC
Thank you, Mr. Chair.
I'll continue to ask Ms. Chassigneux questions.
Earlier, we concluded with a discussion on the changing settings of certain websites. Are there related applications that help find information, for example, in a website and transfer it to another website?
Is platform interconnectivity part of the issue of free consent with regard to personal information?
4:55 p.m.
Administrative Judge, Surveillance, Commission d'accès à l'information du Québec
Normally, when information is collected on a site and can be transferred to another site, the people responsible for the first site should inform the people providing the information that the information could be transferred to the second site.
If you have a cellphone, you have mobile applications. You also have the possibility of knowing whether the mobile applications can collect the information in your cellphone. When information is transferred from one site to another, it must be done transparently. People must be able to know how their information is getting around.
Does the information remain on the first site? Does it go from the first site to the second site? Where is the information? Where is it retained? Is it retained in Quebec, if we use Quebec as an example? Is it retained outside Quebec?
This must all be transparent, and the businesses must be transparent. We're saying that businesses must establish a culture of privacy. I'm not saying that businesses don't currently have this type of culture. That's not what I mean. I don't remember which of the two commissioners talked about it, but I think it was Ms. Clayton. I'm referring to assessments of the impact of a program's implementation. We need to know what's true, how things are done, who things are done for and why things are done. It's important for the person and Internet user or for anyone who has information that will be collected and shared.
I don't know whether I answered your question.
5 p.m.
Conservative
5 p.m.
Liberal
Wayne Long Liberal Saint John—Rothesay, NB
Thank you, Chair.
It's great to be back on the committee again after a week away. You did miss me.
I have a question. I want to continue Mr. Saini's questioning with respect to children and ask Ms. Clayton and Ms. Chassigneux their opinions on meaningful consent.
How do you control and manage that? As Mr. Saini said, there are sites for children in the U.S. that have much more tracking software than sites for adults. I have some friends who have kids who are 10, 11, and 12 years old who are on the Internet all the time, and it's a major concern for the parents to know exactly what sites they're going to, what things they're clicking on as well, and what information they are giving away.
Maybe I'll start with Ms. Chassigneux for your opinion whether PIPEDA actually protects children enough, or on what changes you would make to it.