Evidence of meeting #55 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was pipeda.
A recording is available from Parliament.
4:55 p.m.
Conservative
The Acting Chair Conservative Pat Kelly
Yes? Is there anybody who is opposed to continuing?
Okay. Then we will continue.
4:55 p.m.
Conservative
4:55 p.m.
Conservative
The Acting Chair Conservative Pat Kelly
If I may, perhaps I'll keep it with Mr. Blaikie, and then the first, if we have two seven-minute interventions.... We'll go to Mr. Blaikie and we'll see.
4:55 p.m.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Thank you very much.
Ms. Backman, I wanted to follow up with you. You suggested some ways that we could improve the consent model. I am always curious to hear how, because when we talk about this at the policy level, what I often imagine is an expanding consent form when we talk about what else should be included.
I am wondering if you might be able to describe how you think your reforms would look from a user perspective. What would change for the user when they interact with that?
4:55 p.m.
Partner, Aird and Berlis LLP, As an Individual
First of all, there is uncertainty about on what basis an organization can rely on implied consent. I think that needs to be clarified. That can be included in a model code that's simply attached to PIPEDA, and organizations can simply refer to that. That would shorten the privacy policies. Really, then, the content of the privacy policies of organizations would focus on the supplemental information-handling practices.
I would then suggest that those practices be split into two parts, those which, although they deviate from the model code, are still necessary for the provision of the products and services requested by the individual, and then those that are secondary purposes, such as third party marketing.
5 p.m.
Partner, Aird and Berlis LLP, As an Individual
From a user perspective, you're going to get shorter privacy policies and more direct information in terms of what is the secondary purpose, and then the opt-out right from those secondary purposes becomes easier.
5 p.m.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Thank you very much.
In some of the earlier testimony, I think we heard a clear preference on the part of some witnesses to stick with the current ombudsman model. One of the debates we've been having here at committee is whether it would be appropriate to give the Privacy Commissioner order-making power. Obviously, that would be a deviation from the current model.
I appreciated your suggestions, Ms. Reynolds, about giving powers to have advance rulings. I am wondering if perhaps you and Mr. Cameron, and Ms. Backman, as well, if she wants to jump in on this, could speak to how the power for advance ruling might actually work well—or not—with order-making powers.
One of the disadvantages of conferring order-making powers, we're told by people who don't want that route, is that it becomes cumbersome, it's complicated, and you're creating a bureaucracy. However, if the Privacy Commissioner had those order-making powers, it might incentivize taking advantage of advance rulings, and advance rulings might help mitigate the quantity of order-making instances, if you will. I'm wondering if you could speak to that point.
April 6th, 2017 / 5 p.m.
Senior Associate, Torys LLP, As an Individual
My primary perspective on it is that the current ombudsman model is very close to an effective order-making power. At the end of a regulatory investigation, the Privacy Commissioner will discuss with an organization subject to an investigation ways to remediate whatever failings they found. Although it's often framed as a remediation that the organization has agreed to, the OPC certainly has persuasive power there, and much of what they might order, I believe, if they had that explicit power, we are already seeing in these results of investigative findings. I don't see that it's a necessary gap right now.
5 p.m.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Do you think it would help with compliance, though, if there were also the ability to attach fines or penalties to orders of the Privacy Commissioner? Or do you think that wouldn't have an effect on compliance?
5 p.m.
Senior Associate, Torys LLP, As an Individual
I don't disagree that if there's a bigger stick at the end, the carrot of the advance ruling may be more enticing, but I don't know that there's really a compliance gap that's so large now that additional penalties or additional proactive order-making is really necessary. What you would see with an order-making power or any power to fine is the need for some kind of administrative or judicial appeal model or review model, which would actually make it a lot more cumbersome and probably more costly overall for the public.
5 p.m.
NDP
5 p.m.
Partner and Chair, Privacy and Information Protection Group, Fasken Martineau DuMoulin LLP, As an Individual
Yes. I'd echo those sentiments. I don't think there's a problem, in my experience, that it would be solving. That's similar to the CBA's submission. If you were to go that route, of course, there would be a lot of things to consider in terms of how the office currently operates versus how it would have to operate under that kind of model.
I suppose I would be coming back to the questions of “To what end?” and “What's the purpose of this?” In my experience, and my feelings are the same as those expressed by Ms. Reynolds, if you're even at the point of being investigated by the Privacy Commissioner, you're not, typically, looking to pick fights or end up at a place where you're feeling like you need to do something that you can't do for business purposes, etc. You're seeking to find a way to work with the regulator in a way that meets your obligations, as you may accept them at the end of that process, under the act. Maybe you agree to make certain changes. We do have the new mechanism of the compliance agreements. It's very new and untested. We may see that this addresses part of what you're getting at.
In terms of the stick, as I addressed in my opening remarks, I think the stick is already there. In serious cases, complainants are going straight to court and suing organizations for privacy breaches in any event, so I don't see how changing the commissioner model would add anything to that.
5 p.m.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
Okay. Thank you very much.
Ms. Backman, do you have anything?
5 p.m.
Partner, Aird and Berlis LLP, As an Individual
[Inaudible--Editor] Mr. Cameron and Ms. Reynolds.
5:05 p.m.
NDP
Daniel Blaikie NDP Elmwood—Transcona, MB
All right.
In the interest of time, then, I'll conclude my section.
5:05 p.m.
Conservative
The Acting Chair Conservative Pat Kelly
Thank you. You're giving us an extra minute there. I appreciate that.
Now we'll go to Mr. Bratina.
5:05 p.m.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
Thank you very much.
Mr. Cameron, I was interested in your opening remarks with regard to the model continuing. We heard more discussion about that. You've been in the field since PIPEDA started 17 years ago. That was April 2000. I looked it up. Are we still waiting for further stages of technology? I'm wondering what the state of your work was 17 years ago, when you started doing this privacy stuff. Is it really ultimately technology's role to solve the problems that we're discussing right now?
It's a bit complicated, but first of all, tell me about how the business of litigation with regard to PIPEDA was 17 years ago. Has it changed much? Is there something further down the road that you would anticipate technology to solve some of the problems we're talking about?
5:05 p.m.
Partner and Chair, Privacy and Information Protection Group, Fasken Martineau DuMoulin LLP, As an Individual
There was virtually no litigation activity 17 years ago in relation to privacy. In my practice, and I'm sure in that of the other witnesses who were around at that point, the focus was on compliance. You have a new statute coming in with a new set of rules. How do we write a privacy policy? How do we develop policies and procedures, consent documents, etc.? It was very compliance oriented.
There has been a tremendous evolution since that time in what I would call a mature and maturing privacy profession. There are organizations like the International Association of Privacy Professionals. Don't quote me on the number, but I think they have somewhere in the range of 20,000 members worldwide. A great deal of maturity has evolved over these years, so certainly the work and the issues have become more focused on specific types of projects and specific types of proposed activities, which are often emerging in a new technological or innovative context. We are trying to apply those facts to the law that we have.
The point I'm trying to emphasize is that I think PIPEDA has proven very adaptable to those evolving technological contexts to this point.
5:05 p.m.
Partner and Chair, Privacy and Information Protection Group, Fasken Martineau DuMoulin LLP, As an Individual
I'm not saying there may not be room for tweaks here and there, or improvements such as those that have been made, but largely the model we have has worked quite well.
5:05 p.m.
Liberal
Bob Bratina Liberal Hamilton East—Stoney Creek, ON
You've answered my question.
Thank you very much.
5:05 p.m.
NDP
The Vice-Chair NDP Daniel Blaikie
Thank you, Mr. Cameron.
Thank you very much, witnesses, for your patience at the beginning of the meeting and at the end as well.
I'm afraid that we rather unceremoniously have to run from the meeting, but we thank you for your understanding.
We are adjourned.