Thank you very much, Mr. Chair.
Members of the committee,
thank you for inviting me to provide my views on Bill C-58.
First of all, I want to say that we support the government's commitment to open government, and we see this review of the Access to Information Act as welcome and long overdue. Making more government information available to the public is crucial to fostering transparency, accountability, and trust.
The OPC has frequently championed transparency. For example, as part of Privacy Act reform, but also in our submission to Treasury Board Secretariat on revitalizing access to information, we expressed support for open government, particularly in enabling informed citizens to participate fully in democratic debate. However, it is recognized internationally that open government can and should only be achieved in conjunction with appropriate privacy protections, for societal acceptance is predicated on trust that privacy will not be unduly infringed.
The online environment requires rigorous de-identification techniques to be applied and validated by experts prior to disclosure. The OPC and Statistics Canada can play key roles in minimizing the inadvertent release of personal information by government in the course of implementing open data initiatives.
We are confident that access and privacy are parallel goals that can be reconciled. The Access to Information Act and the Privacy Act have long been considered by the Supreme Court to be a “seamless code” of informational rights, the combined purpose of which is to carefully balance both privacy and access.
The court has further held that the personal information exception to access is mandatory and “should not be given a 'cramped interpretation' by giving access pre-eminence over privacy”.
Our previous comments on the Access to Information Act focused on the importance of maintaining this balance. We spoke in favour of maintaining ATIA's public interest exception that permits the disclosure of personal information only where the public interest clearly outweighs a claim of privacy.
We had also recommended that the definition of “personal information” not be amended. We are pleased that Bill C-58 leaves these concepts unchanged.
We further recommended that Parliament defer changing the Information Commissioner's power to order the disclosure of personal information until a legislative review has been done of the Privacy Act and its interplay with the Access to Information Act.
Nonetheless, Bill C-58 proceeds to confer upon the Information Commissioner order-making powers, including in respect of personal information disclosures. This would significantly and clearly disrupt the balance struck in the current legislation. We acknowledge that Bill C-58 takes limited steps to restore balance, primarily through notification requirements and legal recourse against formal OIC orders. However, this falls far short of maintaining the required balance, as privacy would be impacted outside formal orders or through OIC recommendations or institutions' decisions to disclose personal information to avoid OIC orders. I would not be notified or given the opportunity to intervene in such cases, even though the OIC and OPC may diverge on key legal issues relating to the balance of both rights.
For example, the offices may disagree on the degree of risk of re-identifying anonymized information or metadata, which could be determinative in assessing whether it constitutes personal information that should not be disclosed. The commissioners may also diverge on whether personal information is publicly available and whether the public interest clearly outweighs a privacy invasion, particularly in light of the new purpose clause in Bill C-58, which the Information Commissioner finds concerning, but which I find helpful.
Recently, in response to the bill before you, the Information Commissioner has taken issue with the proposed obligation to consult the Privacy Commissioner. She says consultation is unnecessary as the OIC has years of experience in interpreting the relevant provisions. This is very unfortunate, and clearly inappropriate as the Supreme Court has recognized the—quote, unquote—“central role” of my office in protecting privacy.
It is true that the OIC has significant experience in interpreting the personal information exception to access, but that experience has been developed as a champion for access rights. To ignore the views of other actors who have a legal role in ensuring the balance between access to information and other rights plainly makes the case that, as legislators, you must recognize in Bill C-58 the role of the OPC as privacy champion. Furthermore, this should be extended to all situations where privacy is in need of protection. The quasi-constitutional nature of the right to privacy is another reason to enshrine this role in the bill before you.
To restore the balance between access and privacy in Bill C-58, I propose two legislative solutions.
First, the bill should require mandatory notification of and consultation with the OPC in all cases where personal information is at real risk of being disclosed without the individual's consent, and not just when there is a formal order about to be issued. The point would not be to consult in every case in practice. Although the obligation to notify and consult with the OPC would be the rule, this obligation in the interests of resource efficiency would not apply to lower-risk situations where the OIC and the OPC had agreed that consultation would not be necessary. This type of agreement would support collaboration with the OIC to ensure the best balance between these two fundamental rights.
Second, I recommend that Bill C-58 give the OPC the opportunity to seek judicial redress in all cases where personal information is at material risk, and again not only those where an order has been made. Again, this right of redress would not be exercised in every case in practice, but only where necessary to protect privacy and to develop jurisprudence that would guide both commissioners, departments, and citizens on the applicable law.
To bring further clarity to my proposals, I have attempted to put them in statutory language. I believe you have these texts before you now.
Mr. Chair and the committee, with your indulgence I will spend a few more minutes to explain—I think that's crucial—why this bill disrupts the current balance between access and privacy.
The current balance upheld by the Supreme Court of Canada in several judgments is based on a number of factors including, first, the substantive provisions of the Access to Information Act and the Privacy Act, including the definition of personal information, the fact that the personal information exception in the access act is mandatory rather than discretionary, and the wording of the public interest exception, which requires that the public interest and disclosure “clearly outweigh” privacy invasions in order to prevail.
As a result, the Supreme Court held that as the law now stands, the combined purpose of the two acts is to protect both privacy and access rights and strike a careful balance between the two. The court even added that as things stand, privacy is paramount over access.
The second consideration, the roles of the two commissioners currently, one being the access champion and the other having a central role in protecting privacy, both being ombudspersons who can only make recommendations and not orders, and the role of departmental heads who ultimately have the discretion to decide on exceptions in general and specifically when the public interest and disclosure clearly outweighs privacy.
It's important to understand that while Bill C-58 maintains some of these factors, which are important for the Supreme Court in maintaining the balance, it changes others, notably the roles of the Information Commissioner and Privacy Commissioner and their authority to make binding orders. Changing the balance between the roles of the two commissioners and departmental heads may well have an impact on the interpretation of the substantive provisions. Giving the OIC the authority to make these orders could well mean that the OIC's interpretation will prevail between disclosure in the public interest and privacy.
The problem is not that the OIC is inherently unfair or unknowledgeable—it's true that they have experience—but rather that it is a champion of one side of the balance. Someone needs to speak for the other side, particularly when the Information Commissioner in her special report on this bill is on record as saying it is unnecessary and inappropriate to consider the other side.
The OPC will rarely be involved according to Bill C-58, despite having a central role according to the Supreme Court. The bill provides that the OPC will be notified only in the case of formal orders and only in these cases will we be able to see judicial redress. Yet, privacy may be at risk not only where OIC formal orders are made, but in other situations. Departments are much more likely to comply with the OIC's interpretation, knowing that the OIC ultimately has the authority to make binding orders. As government officials acknowledged to you last week, it is only in very rare cases that departments will use their resources to challenge OIC orders.
Similarly, when the OIC makes a recommendation under the new regime, or even when discussions take place between the OIC and departments during the investigation of a complaint, departments are much more likely to comply with the OIC's view, knowing that the OIC can ultimately order the department to accede to its interpretation of the law.
Bill C-58 ultimately creates an incentive to give access pre-eminence over privacy, which is contrary to the Supreme Court jurisprudence. I am deeply concerned about this and have suggested a few simple solutions to this poor balance.
Thank you for your attention, and I look forward to answering your questions.