Information & Ethics Committee on May 9th, 2017

[Krista Campbell]

I would say lots of businesses understand. The data-savvy businesses definitely are ready. We have regular conversations with business where they are coming in and asking us the status of our adequacy standing.

I would note that our adequacy standing does not change the date that the GDPR comes into force. Our status would only change as the result of an outcome of a review. That's why we've been trying to engage with the European Commission early. We want to ensure that we're able to determine the scope of this review. Businesses will need to ensure that they are proactive in thinking about their privacy regimes. Businesses need to stay on top of the changes happening internationally. Our adequacy status will still stand in May when this comes forward pending the review.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

I agree with my colleague Mr. Erskine-Smith that we need to be proactive instead of reactive.

I'm going to give you a quote from Ann Cavoukian, executive director of the Privacy and Big Data Institute at Ryerson University. She said that many firms think because the EU has ruled PIPEDA is adequate for complying with current European privacy regulations they are safe.

Can you comment on that?

[Krista Campbell]

I think it is probably true that we can't be complacent about what our privacy regime looks like. We know where the Europeans have gone is very citizen-oriented. It creates new rights for citizens. It creates new obligations for organizations that host data, collect data, and use data.

Our privacy regime needs to continue to evolve regardless of what the European Commission does, simply because the Internet of things is coming. Consent among children is a vital issue domestically as well as internationally. We need to make sure our regime is evolving because of changes in technology and the challenges we face—not just because the Europeans are doing it.

I completely take the point that we need to be proactive. We have been engaging the European Commission and saying we want to start this dialogue in advance of their launching a formal review process so we can help set the stage and get things started. We have told them that we don't want to wait for them to send us a letter to tell us to get going.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Do you think there are any immediate measures we could take? What can we do?

[Krista Campbell]

For us as government, I would say we should take immediate measures to engage with the European Commission and get them started in thinking about Canada. We need to ensure that they fully understand what Canada's privacy regime looks like. I wouldn't say they have spent a significant amount of time reviewing our regime yet, so we need to showcase what we do really well.

As for reviews by PIPEDA, CASL, and SCISA, these reports that committees will put out will be critical. The work plan for the Office of the Privacy Commissioner is important, and it is important to work with businesses to encourage them to think about privacy early and often in the offerings they have.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Mr. Harroun, a long line of my questioning has always been about children and PIPEDA and meaningful consent. I'll make a statement: I don't think we're doing enough to protect our children.

Can you give me some insight into what you think we could do with respect to meaningful consent and age?

[Steven Harroun]

It's an interesting question. I'm not sure I have a view. The consent models under the CASL legislative framework work well. The opt-in regime works well under CASL, as does the implied consent.

My colleague may have something to answer, but I really don't have a view.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

That's fine.

Ms. Palumbo, where do you feel the debate about privacy rights with respect to business and consumers is heading over the next few years?

[Josephine Palumbo]

Again, I am not here to speak about the collection of personal information and privacy rights. I am here to talk about the Competition Bureau: what we do and what our mandate requires us to do. We enforce our act. We detect, deter, and investigate false and misleading representations and deceptive marketing, which is an important area of focus for the bureau. We undertake civil and criminal investigations based on the evidence that we have before us.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Mr. Currie, go ahead.

[Morgan Currie]

I just want to add one thing. There is a nexus between competition law and privacy interest that may actually lead us to collaborate with our partners at the OPC in the future, and that is where advertisers may mislead consumers in order to obtain personal information for the promotion of a product or business interest—what representations are being made to people so that they give up their information. That's where our investigation would kick in as well.

[Josephine Palumbo]

I'll just pick up on the question you asked about children. While the Competition Act doesn't carve out the subject of children per se, when we investigate, we are looking at conduct that is directed toward the public, and obviously children are part of the public. As well, when we are assessing the quantum of an administrative monetary penalty, we are looking at the class of persons who are affected by the conduct, the vulnerable class of persons. So if that's children, seniors, disabled people, etc., we are going to give that a significant importance. That's how we would address the concern with respect to children.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

Our last questioner, for three minutes, is from the New Democratic Party. Madame Trudel, do you have a few more questions?

[Karine Trudel, NDP, Jonquière, QC]

Thank you, Mr. Chair.

Since I am the last speaker, I would like to thank the witnesses for all this very interesting and relevant information.

Mr. Harroun and Mr. Roussy, I will go back to what you said in your speech.

You mentioned the unsubscribe message. Could you elaborate on that? I wonder whether there is a specific procedure that companies must follow when someone wants to unsubscribe from their site. Some unsubscribe links require several steps to unsubscribe.

Have penalties already been imposed for failure to comply with the unsubscribe procedure?

[Daniel Roussy]

To put it directly, the unsubscribe process must be relatively simple. According to the CRTC regulations and the legislation, the unsubscribe link must be readily available to consumers when they want to unsubscribe from a given site.

In 2012, the CRTC issued an information bulletin advising companies of its general views on the matter. We told them that unsubscribing must not be complicated. Having to go through two or three steps to unsubscribe discourages people from doing so. I cannot be more specific because there are things going on, but I can tell you that many of our investigations address this particular point that you have raised.

Thank you for the question.

[Karine Trudel, NDP, Jonquière, QC]

You say that there are a number of investigations. I think we have often heard that, once a penalty is imposed, the problem is solved. Have you had to intervene frequently and impose monetary penalties?

[Daniel Roussy]

A number of companies have already consulted us on obligations, particularly on the unsubscribe issue. They are serious companies that want to continue doing business in Canada and do it properly. As Mr. Harroun explained, the purpose of the legislation is to get people back on track.

Once there was an agreement on a certain amount, those companies redid their link. As far as I know, it works very well right now; it is a success. Our intervention on the amount was timely since the companies responded well. They carry on their business in compliance with the unsubscribe legislation.

[Karine Trudel, NDP, Jonquière, QC]

Could some companies come to see you pre-emptively? Do they only react when complaints are filed?

[Daniel Roussy]

It is difficult to generalize. Clearly, we react when there are complaints, but some companies have come to us directly and said they had messed up. That usually happens at the same time. Complaints are received and the company reacts at the same time. Those things are corrected and there is a fairly good understanding.

We should not underestimate any of the industry's work to raise awareness either. I am talking about the information sessions held across Canada. Businesses are really interested in them. Those sessions help companies get a handle on their compliance obligations. So far, that has been working very well.

[Karine Trudel, NDP, Jonquière, QC]

Thank you.

[The Chair, Conservative, Blaine Calkins]

Thank you, Madam Trudel.

That ends the formal rounds of questions.

We have a little bit of time left, and I have in the past offered members who haven't had an opportunity to ask questions the opportunity to do so.

I believe, Mr. Dubourg, you are going to take me up on that offer. If there's anybody else who wants to, by all means do.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Thank you, Mr. Chair.

I have two short questions.

First of all, I would like to begin by welcoming the witnesses who are here.

My question is for the CRTC. We know that the anti-spam legislation has had an impact on the Privacy Act. Could you tell me whether the anti-spam legislation has made things challenging for you?

[Daniel Roussy]

So far, our mandates are quite distinct when we think of what Industry Canada, the Competition Bureau and the Office of the Privacy Commissioner will do.

In terms of challenges, the anti-spam legislation allows the three organizations to work very well, and it allows us to compartmentalize investigations and problems at that level, whether with Mr. Therrien’s office or the Competition Bureau. I myself have not seen any big problems so far, but I cannot speak for the Competition Bureau or the Office of the Privacy Commissioner.

[Emmanuel Dubourg, Liberal, Bourassa, QC]

Ms. Palumbo, what do you think about that at the Competition Bureau?

[Josephine Palumbo]

With respect to the national information sharing system between the three partner organizations, I would just like to say that the Bureau is starting its investigations and must maintain the confidentiality of those investigations.

Under the Competition Act we are obligated by law to maintain confidential our investigations under section 10. We also have our confidentiality provisions under section 29, which preclude us from sharing information.

However, as a result of CASL we are now mandated to work collaboratively and co-operatively with our three partners, with the CRTC, and with the Office of the Privacy Commissioner, and we do that. In 2013 we executed a memorandum of understanding between the three agencies in terms of our enforcement mandate. We collaborate in terms of information sharing, keeping in mind that we do have a regime that requires us in certain circumstances to maintain confidential our investigations and information.

That being said, obviously our law currently requires that we do share information. We are prepared to do that, and it falls within the mandate of the three agencies.