Evidence of meeting #53 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
Conservative
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
Thank you.
Thank you again for being here. I'm sorry for the delay.
Ms. Stoddart, I want to say this as politely as possible; you dated yourself already, in your opening comments, as to how long you've been around this game, if you will.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
I don't feel bad, then, about bringing up that you were here during the last PIPEDA review in 2007. At that time, you advocated for reforms to the act.
These were the three that you advocated: the commissioner's powers should not be broadened; the transborder flow of personal information should be controlled using the current laws and private sector contractual agreements; and lastly, the process for designating investigative bodies should be established and regulated under the act.
You've addressed a little bit of this list, but do you mind making clear here for us and for the analysts your stance on these over the last 10 years and whether your views have changed or not.
Do you want me to read them again?
As an Individual
I forget what your first one was, but my views have definitely changed. They changed during the time I was Privacy Commissioner. This is a fast-changing world, so what I'm concerned about now is what I talked to you about here in very broad terms.
Some of these issues have been dealt with and were no longer discussed in my subsequent reports on this issue or subsequent PIPEDA reviews. I think more recent positions would be more useful to look at.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
Okay. That's helpful. Thank you.
The GDPR is coming in 2018. It's going to be part of the European Union's privacy protections. With it ahead of us, we have talked a little bit about the right to erasure. My colleague Mr. Saini brought it up. Are there other measures under the changes being reflected in the GDPR that we should be focusing on as of importance, knowing that this is coming in about a year from now?
I'll open it up maybe to Ms. Morin to start.
Vice-President, Privacy and Access Law Section, Canadian Bar Association
I would maybe flip the question on its head, as I did at the end of my earlier remarks. We should be looking to make the changes we think we need to make to our privacy legislative framework based on our values and our own democratic system in both our common and civil law jurisdictions.
Conservative
Matt Jeneroux Conservative Edmonton Riverbend, AB
Let me interrupt. I'm sorry to do that.
The concept of my question is, knowing that this is coming already in the European Union but recognizing that while our laws and our values here in Canada are important, this could or will have an impact on us here in Canada too, is there something we should be focusing on specifically, coming through this, that would force us to focus perhaps a bit differently from the way you're focusing now.
Vice-President, Privacy and Access Law Section, Canadian Bar Association
Europe is catching up in many respects to things we've had as part of our privacy regime for a long time, such as the accountability principle. Breaches is an area that exists here that is newer in Europe. Privacy impact assessments and privacy by design, those are terms and practices that were coined here in Canada. They're actually playing catch-up and have tried to leapfrog in some respects.
The position the Canadian Bar Association is trying to present to committee members here is that we should not change our laws simply because the EU is doing so. Will it have an impact on us? Inevitably, I think it will. The fixation on adequacy, as I mentioned before, was wonderful, it was convenient, and it was very good for Canadian business, because it simplified the transfer of information. It's not the only way to do it. There are other mechanisms and the rest of the world is using those other mechanisms.
If we could get it easily, absolutely I think a lot of people would support doing so, but I don't think we want to do it at all costs. I think some of the things we're seeing in the GDPR may actually go too far.
Conservative
Staff Lawyer, Canadian Internet Policy and Public Interest Clinic
I just want to say that it's hard to predict, as my colleagues have said, how those obligations will also translate through the adequacy. It's not likely to be a direct cut-and-paste, so it probably will be easier to make a case for adequacy if we have elements addressing key new developments there, but that are also aligned with Canadian laws. Again, not to sound like a broken record, I think that enforcement will be potentially challenging in this particular process because that is one area where we are out of step with other data protection commissioners around the world, and where the EU has made substantive improvements recently.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much.
We now move to Madame Trudel for up to seven minutes, please.
Karine Trudel NDP Jonquière, QC
Thank you.
Good afternoon everyone.
First of all, I have a special request, Mr. Chair. Since there is a lag before we hear the interpretation, when there is a vote I would like us to take into account the fact that I may answer a little later. I believe you missed my answer during the first vote.
So, when there are votes, I would ask you to think of me and to the fact that there is a brief delay before we hear the interpretation.
Conservative
NDP
Karine Trudel NDP Jonquière, QC
I apologize for this intervention, but I have to find a way to be heard.
Welcome to the committee.
I also apologize for the delay; we were held up at the House.
Thank you for your presentation.
You spoke about the right to be forgotten. I know that there will be other questions, but this is a topic that drew my attention in the documentation. I'd like to go back to that question. I'm not a lawyer by training, so please forgive me if I do not use precisely the right terms.
My question is addressed to all three of you.
Concerning the right to be forgotten, children and adolescents are the most vulnerable. With tablets and telephones they have access to almost everything. Children and adolescents may sometimes do things that will last, and that could have consequences later.
Could PIPEDA include some specific provisions concerning consent for the collection of information and the online reputation of children and adolescents?
As an Individual
I can begin to answer.
I would say that the answer is no. We are looking at a lot of constitutional challenges. There is less of a risk regarding the right to be forgotten and the right to freedom of expression than there is regarding federal initiatives concerning children. Generally speaking, this falls under provincial jurisdiction. Although this is a very important matter, it is better to approach it from the angle of strengthening the principle of consent. We might have to look at the notion of sensitive data, which is present in the European regulation.
Staff Lawyer, Canadian Internet Policy and Public Interest Clinic
Yes. There was a recent provision that was added to PIPEDA that strengthened consent in situations where it's not clear that the people consenting have a full understanding of the impact of their decisions. I agree with, I won't say the commissioner, but the former commissioner, that it may be harder to draw clean, age-specific lines at the federal level than at the provincial level. However, there may be room for a more generalized policy that is framed in broader terms like that one, but that is more specifically tailored to some of the challenges that you're talking about, and to use, but without setting specific ages, like age barriers, in the way the European approach did.
Vice-President, Privacy and Access Law Section, Canadian Bar Association
Yes, briefly.
Mr. Israel explained that the last time changes were made to the act, an element was added to the notion of consent, known as valid consent. It was already covered, but a clarification was made precisely to protect the more vulnerable groups, such as the elderly and children. The purpose was to reinforce the requirement that organizations ensure that there is valid consent when children are involved. When children are very young, it is very difficult to ensure that. You have to depend on the parents, and there are limits to what you can do.
