Evidence of meeting #58 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was office.
A recording is available from Parliament.
4 p.m.
Conservative
The Chair Conservative Blaine Calkins
Thank you very much, Ms. Fortier.
We now move to the five-minute round with Mr. Lobb, please.
4 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
Thanks very much.
Thanks for being here today. I have just one question. I don't know if you touched on it.
For office space, where do you have offices throughout the country?
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The vast majority of our employees are in the national capital region, in Gatineau, in an office building occupied with other agents of Parliament.
We have a small local office in Toronto. Obviously, many companies that operate in a way that has an impact on privacy are in Toronto, so we have a small office there.
4 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
With regard to the one in Gatineau, is the building owned by the Government of Canada?
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
No.
4 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
It's not owned by the Government of Canada.
Okay, so you work with Public Works to secure the leases and all that.
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
4 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
All right.
That's a good one. I've read a few articles through the years about all the empty office buildings that the government owns throughout the country, and I often wonder why we don't rent more of our own buildings. I know that's none of your concern. That's more Public Works, but maybe there's an opportunity there.
I know the last person who asked questions talked about the website, and behind the scenes is the server network that you have in the data centre. Are you hosted by Shared Services Canada, or do you operate with someone else?
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'll ask Mr. Nadeau to answer that question.
4 p.m.
Director General and Chief Financial Officer, Office of the Privacy Commissioner of Canada
We own and maintain our own IT infrastructure.
4 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
Okay, so you've never had any pressure then to go with Shared Services Canada? You've been able to—
4 p.m.
Director General and Chief Financial Officer, Office of the Privacy Commissioner of Canada
No.
The initial wave was focused on larger organizations. When we moved to our new building three years ago, we had the opportunity to revisit whether it would be with Shared Services Canada, with external hosts, or with us, and we looked at the various options. At the time, we concluded that the way we went was the best way.
4 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
Do you host internally, or do you use the cloud or a private company?
4 p.m.
Director General and Chief Financial Officer, Office of the Privacy Commissioner of Canada
No, we're not in the cloud. We host internally.
4 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
You're happy with your own service then. It's better than Shared Services Canada.
4 p.m.
Director General and Chief Financial Officer, Office of the Privacy Commissioner of Canada
Yes.
4 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
That's good.
Another question I have is on health records. Let's say I'm from Ontario. I believe the Ontario privacy commissioner deals with that. Do you work back and forth with the Ontario privacy commissioner to ensure, for example, that Ontarians' health records are protected?
4 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
As we all know, we live in a beautiful federal country, and one of the areas where there is a division of power is in relation to privacy.
On health, our Ontario colleagues are responsible for overseeing privacy management for departments and institutions, including hospitals that are provincially regulated. However, federally, we are responsible for certain companies that operate in the health area and are not within provincial jurisdiction.
Therefore, we are both in the area, which requires us to work together, not only with Ontario but with every province and territory in Canada. There is good co-operation between our office and provincial commissioners who have authority over access to information and privacy.
4:05 p.m.
Conservative
Ben Lobb Conservative Huron—Bruce, ON
Say, for example, with your investigations into CSIS, if you wanted to do a search with CSIS and investigate how many hundreds of thousands or millions of Canadians have had their phones surveilled, their emails surveilled, or where they search on the Internet, is there an ability for you to work with CSIS to come up with a number, so that Canadians know how many Canadians have had their privacy investigated without them knowing about it?
4:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We have jurisdiction over all departments and agencies of the federal government with respect to privacy. You'll understand that there are resource implications that come into the picture here. There are also other review bodies. CSIS has its own review body and is overseen by SIRC. It could ask these kinds of questions. We are responsible for privacy issues as they affect CSIS.
We have jurisdiction to ask the questions you're referring to, but because we're responsible for every department, not only for national security but privacy in respect of all government activities, we have to focus our investigations. Currently, with respect to CSIS, the subject matter we're reviewing is how CSIS is implementing the decision of the Federal Court that Mr. Justice Noël rendered in late 2016 with respect to the retention of data by CSIS for people who are not security threats. We are investigating that particular issue. We have jurisdiction to ask the questions that you refer to, but we need to choose our areas of investigation.
4:05 p.m.
Conservative
4:05 p.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Thank you, and thank you very much for coming here again. I was looking at your departmental plan, and I have some questions on that.
When it comes to the response times for individuals, when they're trying to get answers to their information or requesting complaints, there seems to be a new way of measuring the success with meeting those targets. Can you give us the background on how you have changed the system, or what new way of gauging success is in play?
4:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'm not sure I have the document in question in front of me. On average, we have a response time of seven months for complaints, both under the Privacy Act and PIPEDA.
I mentioned the fact that we have early resolutions more and more, and these cases take less time, on average, than more complex cases. It's seven months on average, less so for an early resolution. We have a number of more complex cases where it's taking more than 12 months to complete an investigation. Currently, we have about 50 cases under PIPEDA that are older than 12 months, and we have in the neighbourhood of 400 under the Privacy Act. That's particularly a problem under PIPEDA, because under PIPEDA we have a legal obligation to complete our investigations within 12 months.
4:05 p.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
Here, in one of the performance indicators for the federal government institutions and private sector organizations, “are they meeting their obligations under the federal privacy legislation”, you had a target of 85%, but in 2015-16, the actual results were 79%.
Can you give me some understanding of what needs to be done? Do you have a plan in place to improve those numbers?
4:05 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
At the conclusion of an investigation, we make a recommendation. Are you referring to how often the government institution or the private sector organization complies with our recommendation? The target is 85%, and the result in 2015-16 was 79%.