Information & Ethics Committee on March 10th, 2016

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

I wonder if you could speak to what you think are the relative advantages and disadvantages, say, of having two separate commissioners for information and privacy. We've talked a little about how these acts complement each other. Does it make sense to have one commissioner really overseeing both acts, or do you think there are advantages in the current system that trump whatever advantages may come with having one commissioner?

[Daniel Therrien]

The first thing I'll say is that our recommendations before you have to do with substantive legal rules as opposed to mechanics and architecture. We don't have recommendations before you on architecture. In large part this is because this act is so old that we need to cut to the chase and get to having improvements on a dozen or so very important substantive issues. We haven't looked in great depth at the issue of architecture.

I will say, though, that I would not be inclined to regroup the two institutions under one roof, in part because I'm responsible for the Privacy Act with respect to government. I'm also responsible for PIPEDA with respect to the private sector. So all the telcos, all of the manufacturers such as Apple and so on, Google.... I have quite a bit on my plate and we don't have infinite resources.

At the end of the day I think it is a good thing for the protection of the privacy rights or access rights of Canadians that they have two commissioners, two offices, with different responsibilities, although they share similar rules. I think Canadians are better served that way.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Blaikie.

Mr. Saini. You have up to seven minutes, please.

[Raj Saini, Liberal, Kitchener Centre, ON]

Mr. Therrien, I want to thank you and your colleagues very much for coming here this morning.

I wanted to ask you a question about something you said in your opening comments. I want to refer that back to the testimony of the Information Commissioner when she was here. Madame Legault, in her report on striking the right balance, stated categorically and unequivocally that she preferred the order-making model, and that 68% of bodies generally use that mechanism. You stated in your opening comments that you were not seeking these powers. Since we are reviewing the Privacy Act, do you not believe this should be included, and do you not believe this would be more advantageous for you to do your job in a more efficient and effective way?

[Daniel Therrien]

I'll start by saying we're not asking for order-making powers at this time. I'm not opposed in principle to order-making powers. At the end of the day I think we can get to the same place differently in a way that would satisfy all concerns and without creating certain risks potentially. Why order-making powers? Madame Legault and I agree on many things, and we're not that far apart. I think she testified—and that is the situation with us as well—that when there are complaints either to her office, or to my office, government departments ultimately agree to act in the way we recommend them to act.

Order-making powers are not empirically required to change the way that government departments respond to our complaints, because ultimately they do. The issue is more the time it takes for government to reach that stage. Part of her argument, and I agree with her, is that currently the process is quite long. I said that in my remarks as well. There is an exchange of correspondence with government departments that sometimes takes two, three, or four iterations before we get to the right place. That may be in part because all we can do is to recommend, and there is no sanction for government not to act promptly in responding to our investigations.

An order-making power would create the right incentive for departments to act promptly and respond to our requests, but I think the Newfoundland model that I'm suggesting to you gets to the same place by amending legislation. I would continue to make recommendations and not orders, but according to the Newfoundland model these recommendations have to be complied with by government, unless they take the matter to court and challenge the recommendations made.

We get to the same place, just to finish on the question of the potential risks of an order-making power. Over the years there has been much discussion around the fact that order-making powers mean a more formal process. That certainly has the potential to be costlier, to involve more in terms of procedural rights, and so on. There's the potential for that, and that's one factor.

Another factor is that if there are order-making powers in a body that also has a responsibility, which I'm recommending here, to promote privacy rights, can you have in the same place a body that promotes privacy and the same body adjudicating impartially on the rights of Canadians vis-à-vis a government institution? I'm not saying it's incompatible. It's possible perhaps in terms of structure to build Chinese walls and to make these distinctions.

[Raj Saini, Liberal, Kitchener Centre, ON]

The reason, Mr. Commissioner, that I raise this point is that you mentioned earlier that it has been 30 years since this act was revised. I'm saying it in this manner because we're in the process of reviewing the act, and we don't know in the future when it will be reviewed. You mentioned in your recommendations that you would like it done every five years. That may or may not happen. Would it not be more prudent in terms of thinking of the future if we put this provision in now so that it would not complicate or inhibit a future commissioner who may have to testify in front of a body that may not necessarily want real change?

[Daniel Therrien]

The order-making model is a legitimate model, but it's not the only model out there. In Canada I think there are eight jurisdictions without and five with. It's a very legitimate model, but it's not the only one.

I think we're getting to exactly the same place, addressing the same concerns, through this legislation that was adopted in Newfoundland after very serious consideration by a committee that included the former chief justice of the Newfoundland Court of Appeal and my predecessor, Madam Stoddart. It also, I submit, is a very prudent model that gets to the same place without some of the risks.

[Raj Saini, Liberal, Kitchener Centre, ON]

You don't think it would be prudent to put that mechanism in any review that we conduct now, to give in the future...? You talked about the Newfoundland model, which I appreciate. But do you not foresee that maybe having that in the provisions now would help in the future, help a future commissioner if something else arises, if the act is not necessarily reviewed every five years?

[Daniel Therrien]

It's a question of judgment. In my judgment, prudence is in favour of the Newfoundland model. I'm not saying the other model is imprudent, but I think overall, looking at all of the considerations I've put before you, prudence is in favour of that model.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

We'll now move to the five-minute round.

Mr. Kelly.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Previous suggestions for amending the Privacy Act have included broadening and clarifying which federal institutions are covered by the act. Could you provide us with some examples of federal institutions that are presently not covered by the act that you believe should be covered? What factors contribute to the needs to these institutions that are currently not covered to be covered?

[Daniel Therrien]

I'm recommending that all of the executive branch be covered by the Privacy Act, including the PMO and ministers' offices. Why? The Privacy Act is intended to provide access by citizens to information that government holds about them. That relates to service delivery, to conferring rights. There is personal information held in ministers' offices and the PMO that is extremely relevant to service delivery and how rights are delivered.

Many statutes provide statutory responsibilities to ministers, who then delegate them in the bureaucracy. A lot of the information that relates to these questions is in the bureaucracy, and that's currently accessible. But ultimately it's the minister who's responsible to make these determinations, and in some cases the ministers personally do make these decisions. It shouldn't matter whether the information rests in the bureaucracy or in a minister's office if it's the same kind of information that can potentially be used for the same statutory purposes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

At present, ministers' offices and the PMO are not subject to the current privacy law, and you believe that's a change that should be made.

[Daniel Therrien]

Yes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay.

This is somewhat along the line of Mr. Saini's question. The Newfoundland and Labrador model that you mentioned sounds to me like an order-making model, in that the recourse to court is the only way to avoid an institution having to apply. How is that different from an order-making model?

[Daniel Therrien]

At the end of the day, the commissioner issues a recommendation, which obviously has a lot of weight, because it needs to be heeded. Otherwise, the government needs to go to court. But it is a recommendation. I think the procedural way in which these recommendations are made potentially would be lighter, less formal, less costly, and less open to challenges that it is potentially inconsistent with the promotion roles of the commissioner.

They are not far apart, I totally agree, but I think it's a distinction that matters. As I say, I agree with my colleague on what the ills are. The ills are mostly in terms of the length and duration of the process. I'm just suggesting a different way to get to the same place with fewer risks, in my view.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

We heard from a variety of provincial commissioners in our meeting earlier this week. What I found interesting was that in each of the provinces we heard from, there's a dual mandate with the access to information and privacy. All three of the commissioners we heard from were quite forceful in their suggestions that this was the correct model, because the two pieces go hand in hand.

I listened to your presentation and to Mr. Blaikie's earlier question. You don't agree that both of those pieces should be handled by the same commissioner, and I will get you to comment again on that. All three of the commissioners were quite adamant that both pieces should belong to one commissioner.

[Daniel Therrien]

My starting point, again, is that we've not looked at this question of architecture in great detail. I'm not philosophically opposed to this; I'm just being pragmatic. I'm looking at our responsibilities and the responsibilities of the Information Commissioner. There may be a distinction between the situation federally and provincially, in that federally the mandate is somewhat broader than it is in provincial jurisdictions. But at the end of the day, I'm looking at this pragmatically, and I want to make sure Canadians are well served.

Is it possible to regroup the two institutions under one roof, with the same resources the two have? Would it work? Potentially.

This act has not been amended for 30 years. I'm not sure the thing to do is to look at architecture. I think the thing to do is look at substantive rights, and fix that. There's more time to look at architecture.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Kelly.

We now move to Mr. Bratina, please, for five minutes.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

Thank you so much.

On the Newfoundland case again, we're aware of the approach that you see merit in. Did you review the decision-making process or talk to your colleagues in Newfoundland and Labrador about how they arrived at that point?

[Daniel Therrien]

I'll deal with that in two stages: first, before the legislation was adopted; and then after.

Before the legislation was adopted, this recommendation followed a review by a committee or commission presided over by Mr. Wells, the former premier and chief justice, and Madam Stoddart, with a third commissioner. They did a thorough review of the legislation in place in Newfoundland.

On this question of order-making versus not, we can provide you with a summary of that report. Those are the considerations I'm putting before you. Order-making could be more formal and more costly. It could create risks in terms of conflict of roles with the promotional role. They came up with this model. That's what they recommended. That's what the legislature adopted in Newfoundland.

On the second phase, the legislation was adopted in June of last year. It's recent.

I spoke with my Newfoundland colleague, the commissioner. He said it had exactly the impact that was desired, i.e., submissions by government are more prompt and they are of better quality. To date there have not been judicial challenges of recommendations, so the government has followed all the recommendations made under that model.

It works. I'm not saying the other model cannot work, but this model, so far, has shown it can work.

[Bob Bratina, Liberal, Hamilton East—Stoney Creek, ON]

So my point, Mr. Chair, is that it seems as though it was carefully crafted. That leads me to the Bill C-44 CSIS matter, which you want to review, because it seems to have some gaps in it, such as, obviously, sharing information with other jurisdictions that may not have the same level of scrutiny that we would have, or protections rights built in, therefore leading to some sad results for the people involved.

Maybe this isn't a fair question, but would the same level of scrutiny and care have been taken to frame Bill C-44? Theoretically even though we're dealing with a 30-year-old act, it worked pretty well until there were substantive changes in the way we collect and disseminate information. It seems to me, though, after a year or two, that the bill should have stood on stronger foundations than it appears to have.

I would come back again to the decision-making process and ask you whether you feel that we have to have that level in our review of everything you bring forward, but particularly of Bill C-44.

[Daniel Therrien]

That's an interesting question. Obviously there should be rigour before legislation is amended. I will say that obviously national security legislation needs to be up to date in terms of the threat faced by Canada, and the arguments for Bill C-44 had to do with updating the legislation to be in line with the current threat environment, the fact that it's international in nature, etc., so there was some foundation for the objective.

In terms of how to ensure the protection of rights in an environment where CSIS is given more powers, absolutely this deserves more scrutiny, and perhaps Bill C-44 should be looked at at the same time as BillC-51. That might be a possibility. All of these laws deal with what should be the legal architecture in Canada to deal with the terrorist threat. Apparently the government wants to have some form of review, particularly of Bill C-51. There would be some merit to extending that more broadly.

[The Chair, Conservative, Blaine Calkins]

That's pretty much it, Mr. Bratina, for the five minutes.

We have five more minutes for the Conservatives. If it's okay with the committee, I would like to ask a few questions. Normally, I try not to do that, but if you'll humour me, then we'll move back to the Liberals for five minutes, and you can let me know who that would be.

Mr. Commissioner, as you gave your remarks and as I was going through the documents in preparation for this committee today, I had several questions.

In your opening remarks dealing with technological change, in your first two paragraphs you talk about how the technological change has allowed government information...and we know that, as the information age is continuing to evolve, there are massive amounts of information out there. You have a recommendation here “to require that all information sharing be governed by written agreements and that these agreements include specified elements”. Could you give me an example of exactly what you meant when you made that statement?

[Daniel Therrien]

There are provisions under the current Privacy Act authorizing sharing of information between federal departments. Some of these provisions are quite broad. For instance, information can be shared for “consistent purposes”. What is consistent in a given context depends on the context of the relationship between the two departments that are sharing information.

What I'm suggesting is not to change the rule about consistent use, but to add a layer of protection on top of that, whereby there would be a requirement that the departments enter into a written agreement to give more meaning to what is consistent in the context of the activity that they're undertaking together. That would better protect rights; it would be transparent; it would provide more clarity; it would allow us, as we recommend, to express certain views on whether indeed the sharing would be for a consistent purpose; and it would allow us to audit the activity after the fact.