Information & Ethics Committee on May 9th, 2017

[The Chair, Conservative, Blaine Calkins]

We will now move to the five-minute rounds, starting with Mr. Kelly, please.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you.

I'd like to talk a bit more about administrative monetary penalties, and I'll begin with you, Ms. Palumbo. You have spoken a bit about this, and you've characterized them as being very effective, particularly your consent order model, which I'm maybe going to get to later.

First of all, I'll let you comment further about the effectiveness in general, but I also would like to know where these funds are paid. You mentioned punitive fines. You mentioned restitution. Would you recommend in the case of the Privacy Act or PIPEDA that they be paid to the commissioner's office, to the Receiver General, or to the affected parties? Where should the money go? Where does it go in your case?

[Josephine Palumbo]

As I said in my opening remarks, administrative monetary penalties are there to promote compliance with the law, to act as a disincentive to targets of our investigations, and to not continue to violate our legislation.

Where do they go? They're not punitive; they are remedial. They're not punishment, and in fact, our act expressly says that. Determination of an administrative monetary penalty is not with a view to punish. That's one thing I'd like to clarify. They are a debt owed to the crown, so they are payable to the Receiver General for Canada, and fall within the consolidated revenue fund. They contribute to government as a whole, and those funds are then further distributed to benefit programs and initiatives for the benefit of all Canadians.

I'm hoping that's sufficient for you. Again, I'd like to emphasize they're not punitive in nature; they're remedial. They're there to promote compliance with our law.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Right, however, when there is non-compliance, that might be thought of as a failure to deter.

[Josephine Palumbo]

On that point, if you look at our track record on consent agreements, which become court orders, they have been respected. We have only one case on record, the Matthew Hovila case, where we had a subsequent breach of a consent order, but that's a rarity. They actually have a very positive effect, in terms of disciplining the industries within which we are engaged.

You see that in the two examples I provided to the committee today. Avis Budget and Hertz were in the same industry, and administrative monetary penalties were obtained in both of those cases. With respect to Hertz and Dollar Thrifty, the commissioner was not on a formal inquiry when that resolution was reached, and it was subsequent to the Avis Budget resolution.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

I did hear you say that the consent order does work very well, and you said that industry likes that model, if I understood correctly. The consent order model, from time to time, comes under criticism in other tribunals and other regulatory bodies wherein an accused party may, for the reasons you mentioned that people like the consent model—the reduced cost, the expediency of the thing...Yet, small operators that can't match the crown's resources may indeed opt to go into a consent order when they feel they have not broken the law or contravened any act.

Have there ever been any criticisms around any of your consent orders, or perhaps where people were pushed into a consent order they may not have really wanted to participate in?

[Josephine Palumbo]

Consent agreements—they become orders of the tribunal—are negotiated settlements between the commissioner and the targets of our investigations. We assess the evidence in each case, and within the Competition Act we have criminal and civil provisions. For example, where we have conduct that suggests a knowing or reckless behaviour, then in that context, we will refer the matter over to the Public Prosecution Service of Canada for criminal prosecution.

Where we see the evidence before us is of the nature that can be resolved through a consensual process, through a consent agreement, which is registered, which entrenches a court order before the tribunal or the courts, we will endeavour to do that. In fact, our preference is to utilize alternative case resolution to the maximum extent possible before engaging in full-blown litigation, whether it's within civil contexts or the criminal courts.

[The Chair, Conservative, Blaine Calkins]

Thank you.

Mr. Ehsassi, for five minutes.

[Ali Ehsassi, Liberal, Willowdale, ON]

Thank you very much.

The first question I have has to do with the issue of AMPs. As you know, the Privacy Commissioner has brought up the prospect of improving our legislation to have AMPs. Would you have any guidance for him? Should that be an issue to be examined closely?

[Krista Campbell]

I think there's a lot of discussion around whether or not the Office of the Privacy Commissioner has enough tools in his tool kit to do his job effectively. I think any eventual next review of PIPEDA should focus on that question about the mandate and structure of the Office of the Privacy Commissioner and whether or not the tools align well, looking at what other jurisdictions do. In many jurisdictions they do have AMPs.

I think we have a regime currently based on an ombudsman model, with a very collaborative approach where we're trying to get to a good outcome through education, negotiation, and discussion. It's very useful for creating an environment where businesses are able to test out new products and services, try to be innovative, and offer to Canadian consumers what it is they want. We want to maintain that kind of very innovative, open, inclusive kind of regime where innovation is enabled and allowed.

I'm not going to come down on a yes or a no on this one, but I would suggest that the formal review take a really good look at the nature of the concerns that are being raised and whether or not AMPs are the right mechanism at the end of the day, because it is a fairly heavy stick to be given to an office of Parliament to use. It's a balancing question, whether or not this is an effective mechanism and do we have a big enough issue that we need to apply that type of new tool to the problem, if there's a problem, and what the nature of the problem is.

[Josephine Palumbo]

In my context I can't comment on the appropriateness of the power for the Office of the Privacy Commissioner, but I can certainly say that within the Competition Bureau framework the administrative monetary penalty regime is working quite well. It is effective at achieving compliance with the law and in garnering results for Canadians, and avoiding lengthy and costly litigation that is associated with litigating a case.

Of course, when we're before the tribunal or the courts, and when we're assessing the quantum of an AMP, we're taking into consideration a number of aggravating and mitigating factors, which I think I outlined in my opening remarks. These would be taken into consideration in terms of what the right number is in a particular case.

Within our context, the administrative monetary regime is quite effective.

[Steven Harroun]

At the CRTC, I would suggest that the AMP framework that we have as part of our enforcement suite of tools has been very effective and includes education and outreach, which I think is very important as well. I think it has been really essential in ensuring compliance and encouraging parties to actively participate in an investigation or looking into their activities. I think the AMP tool definitely encourages that active participation, encourages those undertakings, and negotiates settlements so that everyone is playing along with the rules.

[Ali Ehsassi, Liberal, Willowdale, ON]

Since we are asking the CRTC questions now, I was wondering if you could perhaps comment on the Blackstone decision. You were commenting earlier to the question put to you by my colleague that it is a good idea to provide companies the opportunity to actually come before the commission to deal with questions of penalties and issues of that nature. In that particular case, first of all there was a huge delay, because I think it took two years before a decision was rendered. In addition to that, the far more important thing, the penalty was reduced by approximately 80%. I was wondering if you could comment on that.

[Steven Harroun]

I'll start and I'll let my legal counsel correct me.

The right for parties to have a recourse mechanism is extremely important. As the chief compliance and enforcement officer, I issue a notice of violation that determines the amount of the AMP that we deem is appropriate, given the circumstances. If there have been 100 violations or 100,000 violations, how participative the company has been...back to my “help negotiate with us.” In the particular Blackstone situation, we issued an AMP for a significant amount of money. The company at that time had not been very co-operative with our investigation. We issued a notice of violation for a significant amount of money.

Those in violation have 30 days to respond to the commission and say they would like to make a representation before the commission. They chose to activate that, and they said, “Okay, we have a whole bunch of additional information now and we're willing to provide some additional information to plead our case.” I think that recourse mechanism is important.

I think the Blackstone case is important in that it shows that the system works. I conduct my investigation, my team conducts their investigation with the information they have available to them, and I issue a judgment, if you will. If the party is not agreeable to that, they can choose to go to the commission and say, “Wait a minute, I don't think they included this information, I don't think they took this into consideration. Oh, we didn't have financial statements at the time but we have them now.” Whatever information they have, they can plead their case to the commission.

We've had cases where the commission has upheld the notice of violation and the amount that the CCO has issued, and there are cases like Blackstone, where they've reduced it. But it shows that the system works.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

We'll now go to Mr. Kelly, again, for five minutes.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

I'm going to follow up now still on the topic of the administrative monetary penalties.

How does compliance work with entities—and maybe this is for the CRTC as well—where an entity, if it's an e-commerce scenario where it's operating through foreign servers, or non-Canadian corporations...? How do you pursue non-Canadians who have broken Canadian law in the provision of service to Canadians?

[Morgan Currie, Associate Deputy Commissioner, Deceptive Marketing Practices Directorate, Competition Bureau]

That's a particularly important question in relation to the criminal side of our law where some of the false and misleading representations are actually perpetuated from others outside of our country, specifically in relation to violations of our amendments as amended by CASL, and this is where our international coordination becomes very important.

We work actively with our counterparts in Europe, New Zealand, Australia, the United States, and others in order to attack different levels of communication and servers where this may occur. It can be difficult because sometimes the representations to the public disappear shortly after they're made. It is an ongoing challenge in the digital economy, particularly on the criminal side of our law.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Do you have anything to add?

[Steven Harroun]

I would echo my Competition Bureau colleague's remarks.

As I indicated earlier, we have a lot of memorandums of understanding with enforcement agencies around the world. We use those relationships to execute warrants and to gather information for us. That's very useful for us and we've done the same for them.

I think we mentioned in our opening remarks that we had an international takedown of what's called Dorkbot, and I can't wait until we get another one because I'm tired of talking about Dorkbot.

We use those international relationships and they use us as well with those memorandums of understanding to execute our duties.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay.

Are there entities whose business practices are nefarious by nature and who try to avoid jurisdiction by trying to avoid countries with which you have agreements? Is this something Canadians ought to be concerned with, or is that not a major concern?

[Steven Harroun]

Our ultimate goal at the CRTC is to protect Canadians. With people who are providing services or whatever, or contacting Canadians in any way, we enforce the legislation accordingly. Certainly, if anything, CASL does reveal those nefarious actors. It reveals the bad actors. Ninety-five per cent of the persons involved want to be compliant with the legislation. The bad actors will be the bad actors and the legislation reveals those to us through our investigations.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Shifting a bit here for Ms. Campbell, in designing the privacy protection legislation in the review of PIPEDA, would your recommendation be that we should make our priority compliance, or being congruent with our trading partners in our trade agreements, or should the priority be more to examine what we think would be the best benchmark for other countries to follow, perhaps? Where should the emphasis be on compatibility?

[Krista Campbell]

That's an interesting question.

I would say I think they have to go hand in hand because the idea of having a regime that is internationally interoperable is critically important. I think many jurisdictions are increasing their focus on privacy protection for data, because of the importance of data and what data can do to drive economic development, and what data can do to drive innovation. Best practices continue to bubble up to the surface in organizations like the OECD or APEC.

For Canada, if we think about where we want to be leaders in some of the digital economy, for example, ensuring that we offer a welcoming environment for organizations that want to set up data centres here, and the idea of applying best practices and having a model that is very usable for international businesses to say that, yes, Canada is a location of choice for data, we need to be leaders in how we think about it. But we can't make a regime that doesn't work internationally with the people we want to trade data with.

[The Chair, Conservative, Blaine Calkins]

That's great.

We'll now move to Mr. Long.

[Wayne Long, Liberal, Saint John—Rothesay, NB]

Thank you, Chair, and my thanks to our presenters and your staff for helping you prepare. It's a fascinating topic we've been studying for quite a while now, and it seems as if the more we study it, the more questions we have.

I read an article the other day in IT World Canada entitled “Experts worry Canadian firms won't be ready for new European privacy rule”. This is about May 25, which is coming fast, 2018, and GDPR.

Ms. Campbell, do you feel that industry realizes the impact that GDPR will have on them if they are not ready?