Information & Ethics Committee on March 21st, 2017

[Raj Saini, Liberal, Kitchener Centre, ON]

Thank you for that.

Mr. Bennett, I don't want you to feel left out. I'll ask you an international question, since you brought up the GDPR.

Now that we've signed the CETA deal, internally we now have the issue of the trade barriers between provinces. Three provinces do not subscribe to PIPEDA, which is considered substantially similar to the existing legislation in B.C., Quebec, and Alberta. We have a problem internally where there's no consistency, but now we've signed CETA, and I'm sure that in the future we will sign other free trade deals—and you mentioned the EU and the U.S. privacy shield. To me there seem to be two or three different standards out there, whether it's GDPR, the EU privacy shield, or our involvement in the Five Eyes alliance.

Is there some way we can normalize or standardize what our privacy regime should be and what it should look like, not only internally but also internationally, so that our international trade partners will understand it and so that domestically we will have one regime rather than two or three?

[Prof. Colin Bennett]

I wish.

On the point about the provincial laws, I think there was an assumption initially that if PIPA in B.C. and Alberta, and the law in Quebec were considered substantially similar to PIPEDA, they would, by default, be considered adequate under the European Union standards. The European Union, however, has rejected an independent application by Quebec to have its law considered adequate, so that assumption is not absolutely correct. That's something that's going to have to be figured out in the context of the upcoming review of Canadian adequacy under the EU's GDPR.

At the moment, the adequacy standards of the European Union are stipulated, but they're quite vague. They have to do with respect for the rule of your law. They have to do with the essential principles of data protection. They have to do with the existence of redress mechanisms. They're trying to walk a very fine line between protecting the rights of European citizens when their data is processed overseas and interfering with the internal politics and constitutional requirements of other countries. That's where the tension has existed with the United States.

On the EU-U.S. privacy shield issue, I think that the continuation of that arrangement is up in the air at the moment, for a number of reasons. First, the standard to which that was negotiated was the old European directive and not the new one. Second, there's litigation in Europe at the moment, specifically in Ireland, about the mechanisms by which Facebook is transferring data to the United States. On either side of the Atlantic, there could be a pulling of the plug on that agreement.

On whether or not we should take account of that, I couldn't really advise, because we don't know what the future holds.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Saini.

We'll now move to Mr. Kelly, who I believe is sharing his time with Mr. Jeneroux, if there is any.

Mr. Kelly, you have up to seven minutes, please.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

We'll see how it goes.

If I may, I would like to start by asking Professor Geist about data localization.

You spoke about that in some detail, but I was intrigued by some of the things you said and would like to have you expand.

You spoke of localization being important for Canadians, if I understood you correctly. You named some large data collectors and spoke of the necessity or desirability of localized data in Canada, while recognizing the undesirability of data localization in countries—you named China—where restrictions on the transmission of data are problematic and controlled by the state.

Would not some of our other international partners perhaps have a problem with Canada appointing itself the arbiter of where localization is good and where it is bad? How do you think this would work in the eyes of the international community?

[Dr. Michael Geist]

Thanks for the question. Let me unpack it a little bit. You've talked, in a sense, both about data transfer and data localization, and they're different things.

The issue of data localization is with regard to a country requiring businesses to store or retain personal information locally, ensuring that that information enjoys the protections that their national laws provide. In fact, it is also what our national government has done as part of a process that was started by the Conservatives, and continued by the Liberals in terms of a cloud-computing strategy, recognizing that there might be some information held by government that we would not want stored on servers elsewhere.

What I think we are likely to see in NAFTA and what we saw in the TPP, largely at the behest of the United States since they represent some of the companies that tend to store large amounts of data and tend to store it in the United States, are attempts to preclude countries from adopting mandates to require that data be stored locally. We're certainly seeing some commercial impetus for doing so.

That's why those big companies have set up those servers in Canada. They're responding, in a sense, to market demand for better protection, but I would argue that Canada should certainly be free to say that for certain kinds of information, we want to ensure that it is retained in Canada so that Canadians know that it is adequately protected and subject to Canadian rules. I am expressing concern that as part of the trade negotiations, we may find attempts to override that.

That, I should note quickly, is different from restrictions on transferring data across borders. We've also seen the United States focus on stopping restrictions doing that, but as Professor Bennett just explained, the European Union has tried to do exactly that. They have tried to create restrictions on the ability to transfer data across certain borders.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Ease of transfer, though, begets differences in localization or where the data is stored. If it's easy to transfer data across a border, it can be stored elsewhere. Do they not...?

[Dr. Michael Geist]

There are two things. First of all, data always moves easily. If we take it as nothing more than ease in moving the data, then the concern will be that the data will move and be transferred to the lowest-level jurisdiction for protection. I don't know that many Canadians would be comfortable if they were told that many of the protections they think they enjoy are lost because their data is being stored in a jurisdiction with no privacy protections at all, and it would be very difficult for a privacy commissioner to assert jurisdiction.

Even in the context of data transfer, what we often find takes place in Canada is that you might send me an email, and if you're on a provider like Bell and I'm on a provider like Rogers, that data may actually transfer across borders and boomerang back into Canada. So the issue of even allowing data to go across borders—I grant you that it is easy to do—has been raised as a potential concern by some jurisdictions.

I wanted primarily to flag this issue of localization because we've seen a strong commercial impetus for it. We've also heard the Government of Canada talk about it, and we've started to see it enter into the lexicon of trade negotiations. Given what we've heard from the Trump administration, it seems quite likely that we'll see that resurface as part of the NAFTA renegotiation.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

Mr. Fraser in his remarks about the Romanian extortion case made me think about this business of localization and the ease of transfer and the connection between the two. I'll ask anyone who would care to jump in and talk about the level of understanding, adoption, and adherence to PIPEDA as it stands now. Many of you have spoken of the desirability of strong penalties to encourage compliance. Owing to my having had a career in small business, I know there's a lot of awareness among business holders that there is a Privacy Act, that there is a desirability to comply, and that there is a fear of consequences for failure to comply. Apart from that, however, there is very little understanding of what any of this means.

I'll open that up to whoever would like to comment.

[David Fraser]

As somebody who practises privacy law on a daily basis and advises businesses, I think one thing that's notable—certainly it's been my experience and I've heard it anecdotally from others—is that the large banks, the large telcos, and the large Internet companies have squads of lawyers on staff. They have compliance people. They have international compliance people. In fact, their level of compliance is pretty high, although their risk threshold might be slightly different from that of a small or medium-sized business.

The level of awareness of the mechanics of how to actually comply with Canadian privacy law—how to get people's consent, how to manage all that, and how to protect information—is actually quite low in the very large portion of our economy. Here I refer to the SMEs across the board.

One thing I think is worth discussing—and I don't have a ready solution for it—is that although the Privacy Commissioner has done a lot of work with big banks, telcos, and Internet companies, how do you educate and reach those SMEs and incentivize them to protect Canadians' personal information better? I don't have an out-of-the-box solution for that.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Kelly.

We now move to Mr. Blaikie.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Thank you very much.

I'm interested in picking up on the conversation about our international partners and how much of Canadian privacy law ends up getting dictated in a trade agreement or by our desire to have easy transfer of information, as is the case with Europe. Presumably CETA was an opportunity to try to get some further protection—having Canadian privacy practices more formally recognized and having them less in doubt. It seems, though, to have been an opportunity missed.

To what extent, as things go forward with technology and trade agreements, do you anticipate these questions being decided by international trade partners instead of Canadian legislators? What's the interplay between Canadian law and the trade agreements?

[Dr. Michael Geist]

I'll give it a try. I don't doubt Michael and Colin may have responses, and David, too.

I'll quickly say that it is readily apparent that these issues have entered into the realm of trade negotiations. We saw it unquestionably within the Trans-Pacific Partnership, within the TPP. The Secretary of Commerce in the United States, Wilbur Ross, has talked about the need to address the digital economy as part of renegotiating NAFTA.

If you look at the e-commerce chapter in the TPP, you see there's a blueprint for the kinds of issues that we are likely to see come up within NAFTA. They include things like data localization and data transfer. I should note that they also included in the TPP a provision on countries being required to have a privacy law, but it was a very watered down version in light of the fact that the United States, while it has strong enforcement, doesn't have broad-based privacy rules.

I don't think there's any question that we're going to continue to face those pressures. In some instances that might be a good thing. David talked about what it would look like if the Privacy Commissioner were given order-making power. He suggested it would look like the Human Rights Commission. I would argue that it would look like just about everybody's privacy framework. It would look like the other privacy commissioners across the provinces. It would look more like what we see in the EU. It would even look like the Federal Trade Commission in the United States, where we do see order-making power and the ability to enforce the common approach in many other places. The outlier in this case, actually, is the federal Privacy Commissioner, who hasn't had those powers.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Does anybody else want to jump in?

[Prof. Colin Bennett]

I agree with that.

I'd just add one other dimension. It's something that I mentioned very briefly. In the politics of adequacy assessment, it is a political judgment, not just a legal judgment. I have a couple of points on this. One is that the Europeans really do want this system to work; they're not going to want the process of adequacy assessment to collapse. Therefore I think there would be a cost if, as I say, a country like Canada, a trade partner, were to lose its adequacy status.

Secondly, I would just reiterate that the whole issue about access by intelligence services and national security services, etc., to business-related data is also part of the equation. If you look at the EU-U.S. privacy shield, you see there's as much in that about that issue as there is about commercial transfers.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

One of the things we've heard about PIPEDA is that it has a broad statement of principles. Would you think that it makes sense...? It seems to me that it wouldn't be right to constantly have Canadians' privacy rights on the table every time we get into a trade negotiation. You can end up trading Canadians' privacy rights for something that has nothing at all to do with those rights, but with the price of rice, or whatever. Do you know what I mean?

There are some things that seem not worth hawking because they're totally separate things. Forgive me for not having the legal background. When we talk about putting principles in legislation, if international trade is going to continue to be an important aspect for determining Canadians' privacy rights, would it make sense to have something like a statement in PIPEDA about government's seeking to defend the privacy rights of Canadians in trade negotiations, or to try to incorporate the principles of PIPEDA into trade agreements? Would this make sense rather than just leaving it an open question on whether this one department of government, when it goes off to negotiate trade agreements, cares about the mandate of other government departments mandated to protect the privacy of Canadians' personal information?

[Dr. Michael Geist]

I think the general principles do serve us quite well. But what we've experienced, especially as new technologies have emerged in recent years, is specific privacy legislation or regulation trying to address new concerns, whether identity theft, or spam, or some of the national security issues that have arisen. We're now likely to see some of these other new issues come up. We've even seen data localization at a provincial level pop up in a number of instances as well.

I think part of it is a matter of being live to the issue. If we look at the experience with the TPP, we see that the Australians were aware of exactly what I have been talking about. They obtained a side letter from the United States specifically addressing the potential for them to be be subject to EU demands on the one hand and U.S.-led demands in regard to the TPP on the other hand. Canadian negotiators, with all respect, seemed to be asleep at the switch and didn't raise the same kind of issue and didn't obtain the same sort of thing. Had the TPP, which now seems like it's dead, come to fruition, Australia would have protected itself in terms of data transfer issues and privacy protection; Canada would not have.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

We don't typically expect—though, granted trade negotiation teams are large and have a lot of expertise—the negotiating team to be able to foresee everything when we burrow down into an issue either as a committee or in various government departments.

If trade agreements are going to be determinative of a particular kind of issue, does it make sense to build somewhere into the principles of a statute governing those protections for Canadians that it's a goal of the Canadian government to try to enshrine those same protections in international agreements? It's not something binding, obviously. It's not to say you can't sign a deal. There's always going to be give and take, but it's to try to build that into the framework so that it's something that Canadian trade negotiating teams are more likely to take note of. It raises a flag for them that these are questions you have to ask when you go to the negotiating table.

Does that make sense as a tool, to try to put that on the radar?

[Dr. Michael Geist]

What I would say makes sense for Canada is to open up the trade negotiations. If there was were a fundamental problem with the way the Conservative government, with all respect, negotiated CETA and the TPP, it was that it was done with an enormous amount of secrecy and then presented on a take-it or leave-it basis.

The TPP is dead. ACTA , which it negotiated, is dead, and CETA had to largely be renegotiated by the Liberals on key issues because of that secrecy. If we want to ensure that does not happen again when we talk about the NAFTA renegotiation, open these things up. The solution isn't to ensure that every negotiator knows the nuances of every single issue; the solution is to bring in many experts into the process through the negotiating process so that these issues get flagged as we're negotiating—not after the fact when it's too late to do anything about it.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

Mr. Erskine-Smith, please, for our last seven minutes.

Colleagues, this will take us past the point where bells will start to ring. I'll assume that we'll give Mr. Erskine-Smith his full seven minutes.

I'll need the unanimous consent of the committee to carry on past that if the bells start to ring. If we were to seek it, would we have unanimous consent? The votes won't start until 5:45. Or, would you rather just let Mr. Erskine-Smith wrap it up and be done with it?

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

Are you seeking unanimous consent to let him finish the seven minutes or to continue indefinitely past the bells?

[The Chair, Conservative, Blaine Calkins]

I'm going to let him finish his seven minutes. I'm seeking time beyond that.

[Daniel Blaikie, NDP, Elmwood—Transcona, MB]

I think we should wrap it up with—

[The Chair, Conservative, Blaine Calkins]

Okay, Mr. Erskine-Smith for our last set of questions, please.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thank you to all the witnesses.

I want to start with you, Mr. Fraser. You cast some doubt or expressed some caution with respect to our recommending the granting of new powers to the commissioner. Also, you mentioned procedural fairness, so I want to get your thoughts on this.

As far as I understand, some organizations already have the power to impose administrative monetary penalties, for example, FINTRAC; the CRTC with respect to the anti-spam legislation; the Ethics Commissioner; and in 2013, the U.K. Information Commissioner issued a $250,000 fine against Sony for a breach with respect to PlayStation. Are all of these models contrary to procedural fairness? Would they not face the same hurdles you've expressed?

[David Fraser]

I think all of them face the same issues and the same scrutiny, and I think many of them have addressed them in varying ways in order to incorporate that. Many of them build within their organizations particular firewalls to prevent the investigations from being tainted by the advocacy activities of the organization.

What I'm suggesting is that if you were to build a significant or real firewall, it would end up looking like the Canada Human Rights Commission or other sorts of models.