Information & Ethics Committee on May 4th, 2017

[The Chair, Conservative, Blaine Calkins]

Good afternoon, colleagues. Welcome to meeting 58 of the Standing Committee on Access to Information, Privacy and Ethics.

Today we are pleased to have appearing, pursuant to Standing Order 81(4), on the main estimates, from the Office of the Privacy Commissioner of Canada, Mr. Daniel Therrien, who is the commissioner. With him is Ms. Patricia Kosseim, senior general counsel and director general, and Mr. Daniel Nadeau, director general and chief financial officer. They, too, are not strangers to the committee.

Welcome, Commissioner. We have one hour to go through the main estimates. Please give us your opening remarks, and then we'll proceed to questions.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you very much, Mr. Chair.

Ladies and gentlemen of the committee, thank you for the opportunity to appear before you to discuss the 2017-18 Main Estimates.

In the time allocated, I will first discuss the sustained demands on our office and the management of our financial resources. Secondly, I will talk about our policy agenda for this coming year.

In recent years, the Office of the Privacy Commissioner of Canada has maintained its efforts to find efficiencies and make optimal use of existing resources of slightly more than $24 million to be as effective as possible in addressing the privacy risks of an increasingly technological world.

Fiscal year 2017-18 will be no exception. Amidst competing demands, we will not lose sight of our mandate: ensuring that the privacy rights of Canadians are respected and that their personal information is protected.

In 2017-18, we will continue to fulfill our core mandate, which includes conducting investigations, examining breach reports, undertaking audits, reviewing privacy impact assessments or PIAs, providing guidance to individuals and organizations, and offering advice to parliamentarians.

On the investigations side, we have become more efficient in part through increased use of early resolution to find appropriate solutions. In 2015-16, 38% of complaints were resolved in this manner under the Privacy Act and 50% under the Personal Information Protection and Electronic Documents Act or PIPEDA. As a result, our response time on average was seven months for both public-sector and private-sector complaints.

However, the number of complex files is growing, which is creating a backlog of complaints that are not resolved after 12 months. In the coming year, I intend to devote temporary resources to address this situation.

In 2015-16, we received 88 new PIAs and completed 73 PIA reviews, in addition to opening 13 new consultation files. As you know, we would like to receive more PIAs and draft information sharing agreements, as we believe reviewing programs upstream is a good way to mitigate privacy risks.

In addition, we are taking steps to prepare for the coming into force of the breach provisions of Bill S-4. These new provisions will require private-sector organizations to report certain breaches to my office.

Public education and outreach are important activities to ensure Canadians are empowered to exercise their privacy rights and organizations are able to comply with their obligations. Last year, we revamped our website both in its structure and content to make it more user-friendly. This year, we will continue to update its content to provide helpful advice to Canadians.

We will continue to offer guidance to specific industry sectors deemed to be in need of greater privacy awareness, as well as vulnerable groups such as youth and seniors. We will also provide new guidance for individuals, and we will continue to advance our privacy priorities on issues such as online reputation, the body as personal information, the economics of personal information, and government surveillance.

Despite these efforts, we need to do much more to ensure that privacy rights are truly respected, a key condition for consumer trust and growth in the digital economy. Our goal is to complete all investigations within a reasonable time, to engage in some proactive enforcement, to give proactive advice to government, and to issue research-based guidance on most current and upcoming privacy issues.

In my annual report to be tabled in September, which will include our conclusions on improvements to the consent model and recommendations to amend PIPEDA, I will be able to bring more specificity to our compliance and proactive strategies. This, in turn, will inform a discussion on what might be an appropriate level of investment in OPC activities for the next few years.

I will now turn to some of the policy issues that we're seized with.

First is consent. Last May, my office released a discussion paper on issues related to privacy and consent. We then, through an extensive consultation process, sought input from industry, privacy experts, and Canadians. As mentioned, our final report will be released in September, and we will then work to implement the chosen solutions.

Second is online reputation. My office has also launched a consultation and call for submissions on the issue of online reputation as part of our efforts to address one of our strategic privacy priorities: reputation and privacy. We will share our policy position on online reputation before the end of the calendar year.

Third is legislative reform. My office has long stressed the need to modernize Canada's legal and regulatory frameworks. While the introduction of Bill S-4 was a positive development, Canada's federal private sector privacy law is now more than 15 years old. Technology and business models have changed. Our work on both consent and reputation will help inform the recommendations we will make to Parliament on reforming the law.

On the public sector side, I would like to express my gratitude to members of this committee for supporting my office's recommendations for modernizing the Privacy Act. My office now looks forward to participating in the government's review of the act to ensure that it meets the needs and expectations of Canadians, and in our view this work should proceed without delay.

On government surveillance, issues related to government surveillance will also form an important part of our policy agenda in the coming year. We note your recent report on SCISA, and we thank you for it. We also note the report just made public by SECU, the committee on national security, which also touched on information sharing under SCISA. We now await the measures the government will put forward to modify Bill C-51 to ensure that Canada's national security framework protects Canadians and their privacy.

We also have a number of investigations related to national security and government surveillance, and we are seeing heightened concerns from Canadians about privacy protections at the border and in the United States. Further to the adoption by President Trump of executive order 13768 of January 25, which deals with security in the interior of the United States, I had written to ministers to ask for confirmation that administrative agreements previously reached between Canada and the U.S. will continue to offer privacy protection to Canadians in the United States. Upon receipt of the government's response, which I expect shortly, I will inform Canadians of my conclusions.

In closing, to face the sustained volume but increased complexity of our work, we will continue this year to make the most efficient use of our resources as we have tried to do in the past.

Thank you, Mr. Chair. I look forward to questions from the committee.

[The Chair, Conservative, Blaine Calkins]

Thank you, Commissioner. I appreciate that. I think we're going to have a really good discussion here today.

We'll now start the seven-minute round, please, with Mr. Long.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Thank you, Chair.

Thank you, Commissioner Therrien, for coming in, and thank you for your great work this past year and in years gone by.

As we talked about the last time you were here, my background is business. I've been through many budgeting processes, and strong budgeting processes are obviously a very important part of any business, whether government or private.

Commissioner, can you elaborate on the process of budgeting, how you work with your department and your staff, and how each department contributes to the overall budget?

[Daniel Therrien]

The first element to mention is that the strategic priorities on which we consulted Canadians when I arrived and that were developed a year after, in 2015, are a big part of the budgeting exercise. When we look every year at the activities that we want to engage in and to fund, the strategic priorities that were developed two years ago are certainly important. They're particularly important for work of a discretionary nature. We have to respond to complaints that are made. That's our statutory obligation under PIPEDA and under the Privacy Act. That's not discretionary. We have to do it. But for all the work that is discretionary—it's part of the statutory mandate but it's somewhat discretionary—the priorities are particularly relevant.

Government surveillance is part of it, and improving the privacy of Canadians. The economics of privacy is another. We also have strategies under this plan to do more public education and outreach, educating Canadians. All of these priorities and strategies are part of the mix as we look at the amount of money we want to spend every year.

More mechanically, we look at whatever discretion there might be in the budget—for instance, monies unspent or staff positions that have not been filled, or are not permanently filled at a given point—to see whether there's any discretion to devote and allocate resources to priorities.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

I used to call it “budget challenge” with some of my departments, when I would actually push back and challenge. Does that happen in your department?

[Daniel Therrien]

Certainly we have ongoing discussions about the efficiencies of processes. A big part of our work, taking about 50% of our resources, is spent investigating complaints. I can't push and say, “Are you sure you want to do this or that?”, because we have a statutory obligation to deal with complaints, but we do have ongoing conversations around whether the process we use to investigate complaints is efficient and so on.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

When you started your presentation, you talked about finding efficiencies in the department. Can you elaborate on what efficiencies you did find and on what you did about those?

[Daniel Therrien]

The most important efficiency has to do with early resolution processes. We have no choice but to investigate complaints, for the most part, but we have a choice as to how we will investigate complaints. One way in which we increase efficiency is by trying to resolve cases in a mediation-type process, which obviously is less time-consuming than a full investigation. We also categorize the complaints we receive according to either the risk they pose to the complainants themselves or to whether they raise a systemic issue that would be worth investigating in a more thorough way. It's in part risk management and in part an attempt to resolve cases in a mediation-like process to the extent possible.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

You've mentioned advances in technology—I read that somewhere yesterday—and how that will outpace your office's ability to be effective. Can you elaborate on that and on what you plan to do about it? As well, where is that reflected in your budget?

[Daniel Therrien]

The technology for our office is of course an extremely important factor. It affects us in that technology creates new business models, some of which create privacy risks. There are new privacy risks all the time that are created by new business models and new technologies. One of the biggest challenges we face is to keep up to date in understanding these technologies and business models to make sure that we know the privacy risks, advise Canadians appropriately, and provide appropriate guidance to organizations so that they can implement these business models in a privacy-protected way.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Okay. You noted that your new online information request form had led to a large increase. I was surprised. I read here, from 555 in 2014-15 to 2,097 in 2015-16. Do you expect to see that trend continue? Do you have numbers or a feel for what's going to happen there?

[Daniel Therrien]

It may well happen. We have had an information centre for a long while, and this has meant answering telephone calls from individuals who are interested in certain privacy issues, short of filing an official complaint. We've now developed this tool whereby people do not have to call. We're available 24-7, actually, through the Internet, so they can raise issues with us. I think if you—

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Do you feel you have the necessary resources?

[Daniel Therrien]

It's a challenge, but we have no choice but to make our services available as much as possible. We know that there are many privacy problems out there. We want to be out there and available to people. Do we have enough resources? We try to do the best we can with the resources we have.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

My last quick question is this. What percentage of your budget is salaries?

[Daniel Therrien]

It's the majority, 70% for salaries.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Thank you very much.

[The Chair, Conservative, Blaine Calkins]

Thank you.

Mr. Kelly, you have seven minutes, please.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you, Mr. Chair.

From your numerous appearances you've made at our committee we know there are quite a number of moving parts and changes that your office may go through as a result of the recommendations that this committee has already made through its reports, and may be adopted. One that I hadn't yet contemplated was what you had raised in your remarks about the implications of executive order 13768. What sorts of contingencies on resources have you contemplated?

I'll let you expand on that one first.

[Daniel Therrien]

Simply to describe what is the impact of that order, that order is an executive order that does not change U.S. law. It's an executive order by the President of the United States. It says to U.S. officials that, to the extent that privacy protections of a discretionary administrative but not legal nature were offered to non-U.S. citizens previously, these protections are at the very least at risk. Canadians who until then, and perhaps now—we'll see what ministers say in response to my letter—had certain administrative protections under, say, the Five Eyes alliance, such that those countries do not spy on one another's citizens. That's not a legal instrument, but an administrative agreement that provides certain administrative protections to Canadians. Certain border arrangements, also of an administrative nature, provide certain privacy protections to Canadians.

The executive order can be read as saying these discretionary protections for non-U.S. citizens no longer apply. The order is ambiguous. It can have that impact. I have written to three Canadian ministers so that they can determine through conversations with their U.S. counterparts how the U.S. administration will actually apply this order. I'm simply saying there's a risk here. I've asked the Canadian government to verify how the U.S. administration will apply the order. Will it reduce the privacy protections of Canadians in the U.S.? I'm told that within a few weeks I will have an answer to my query to the Canadian government.

I'll receive an answer from the Canadian government, and then I'll have to assess what the effect of that order is exactly, and I'll need to inform Canadians—I feel I need to inform Canadians—of what the effect of the order is on their level of privacy protection in the U.S., for instance, when they appear at the U.S. border, or when they use electronic means of communications where their data may go through the U.S. in going to a merchant, a colleague, a friend, etc.

In terms of resources, we will give advice to Canadians on what we think the consequences of the order are. I think that's an important activity to undertake. I don't think it will be hugely expensive. The issue is to determine what is in fact the impact of that order on the protections to privacy of Canadians in the U.S.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

At this point you've identified a potential threat to Canadian privacy, you have expressed that to government, and you are waiting for a response back from them. You think it will be incumbent upon you to inform Canadians of perceived risks, depending on how—

[Daniel Therrien]

Correct.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Is it too early then to guess whether this would trigger additional complaints that would put stress on your department?

[Daniel Therrien]

Yes. It could very well trigger complaints.