Evidence of meeting #73 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was c-58.
A recording is available from Parliament.
4:30 p.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, everyone, for being so quick.
I want to thank our witnesses for coming, especially a fellow British Columbian for coming all this way to present.
We will briefly suspend until our next witnesses can take their places.
4:35 p.m.
Conservative
The Chair Conservative Bob Zimmer
I would like to bring the meeting back to order.
I would like to welcome, from the Office of the Privacy Commissioner of Canada, Mr. Daniel Therrien, Julia Barss, and Sue Lajoie.
Mr. Therrien has asked for a few extra minutes for his presentation. I think that's okay. I'm looking for consent. Thank you.
Go ahead, Privacy Commissioner.
4:35 p.m.
Daniel Therrien Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Thank you very much, Mr. Chair.
Members of the committee,
thank you for inviting me to provide my views on Bill C-58.
First of all, I want to say that we support the government's commitment to open government, and we see this review of the Access to Information Act as welcome and long overdue. Making more government information available to the public is crucial to fostering transparency, accountability, and trust.
The OPC has frequently championed transparency. For example, as part of Privacy Act reform, but also in our submission to Treasury Board Secretariat on revitalizing access to information, we expressed support for open government, particularly in enabling informed citizens to participate fully in democratic debate. However, it is recognized internationally that open government can and should only be achieved in conjunction with appropriate privacy protections, for societal acceptance is predicated on trust that privacy will not be unduly infringed.
The online environment requires rigorous de-identification techniques to be applied and validated by experts prior to disclosure. The OPC and Statistics Canada can play key roles in minimizing the inadvertent release of personal information by government in the course of implementing open data initiatives.
We are confident that access and privacy are parallel goals that can be reconciled. The Access to Information Act and the Privacy Act have long been considered by the Supreme Court to be a “seamless code” of informational rights, the combined purpose of which is to carefully balance both privacy and access.
The court has further held that the personal information exception to access is mandatory and “should not be given a 'cramped interpretation' by giving access pre-eminence over privacy”.
Our previous comments on the Access to Information Act focused on the importance of maintaining this balance. We spoke in favour of maintaining ATIA's public interest exception that permits the disclosure of personal information only where the public interest clearly outweighs a claim of privacy.
We had also recommended that the definition of “personal information” not be amended. We are pleased that Bill C-58 leaves these concepts unchanged.
We further recommended that Parliament defer changing the Information Commissioner's power to order the disclosure of personal information until a legislative review has been done of the Privacy Act and its interplay with the Access to Information Act.
Nonetheless, Bill C-58 proceeds to confer upon the Information Commissioner order-making powers, including in respect of personal information disclosures. This would significantly and clearly disrupt the balance struck in the current legislation. We acknowledge that Bill C-58 takes limited steps to restore balance, primarily through notification requirements and legal recourse against formal OIC orders. However, this falls far short of maintaining the required balance, as privacy would be impacted outside formal orders or through OIC recommendations or institutions' decisions to disclose personal information to avoid OIC orders. I would not be notified or given the opportunity to intervene in such cases, even though the OIC and OPC may diverge on key legal issues relating to the balance of both rights.
For example, the offices may disagree on the degree of risk of re-identifying anonymized information or metadata, which could be determinative in assessing whether it constitutes personal information that should not be disclosed. The commissioners may also diverge on whether personal information is publicly available and whether the public interest clearly outweighs a privacy invasion, particularly in light of the new purpose clause in Bill C-58, which the Information Commissioner finds concerning, but which I find helpful.
Recently, in response to the bill before you, the Information Commissioner has taken issue with the proposed obligation to consult the Privacy Commissioner. She says consultation is unnecessary as the OIC has years of experience in interpreting the relevant provisions. This is very unfortunate, and clearly inappropriate as the Supreme Court has recognized the—quote, unquote—“central role” of my office in protecting privacy.
It is true that the OIC has significant experience in interpreting the personal information exception to access, but that experience has been developed as a champion for access rights. To ignore the views of other actors who have a legal role in ensuring the balance between access to information and other rights plainly makes the case that, as legislators, you must recognize in Bill C-58 the role of the OPC as privacy champion. Furthermore, this should be extended to all situations where privacy is in need of protection. The quasi-constitutional nature of the right to privacy is another reason to enshrine this role in the bill before you.
To restore the balance between access and privacy in Bill C-58, I propose two legislative solutions.
First, the bill should require mandatory notification of and consultation with the OPC in all cases where personal information is at real risk of being disclosed without the individual's consent, and not just when there is a formal order about to be issued. The point would not be to consult in every case in practice. Although the obligation to notify and consult with the OPC would be the rule, this obligation in the interests of resource efficiency would not apply to lower-risk situations where the OIC and the OPC had agreed that consultation would not be necessary. This type of agreement would support collaboration with the OIC to ensure the best balance between these two fundamental rights.
Second, I recommend that Bill C-58 give the OPC the opportunity to seek judicial redress in all cases where personal information is at material risk, and again not only those where an order has been made. Again, this right of redress would not be exercised in every case in practice, but only where necessary to protect privacy and to develop jurisprudence that would guide both commissioners, departments, and citizens on the applicable law.
To bring further clarity to my proposals, I have attempted to put them in statutory language. I believe you have these texts before you now.
Mr. Chair and the committee, with your indulgence I will spend a few more minutes to explain—I think that's crucial—why this bill disrupts the current balance between access and privacy.
The current balance upheld by the Supreme Court of Canada in several judgments is based on a number of factors including, first, the substantive provisions of the Access to Information Act and the Privacy Act, including the definition of personal information, the fact that the personal information exception in the access act is mandatory rather than discretionary, and the wording of the public interest exception, which requires that the public interest and disclosure “clearly outweigh” privacy invasions in order to prevail.
As a result, the Supreme Court held that as the law now stands, the combined purpose of the two acts is to protect both privacy and access rights and strike a careful balance between the two. The court even added that as things stand, privacy is paramount over access.
The second consideration, the roles of the two commissioners currently, one being the access champion and the other having a central role in protecting privacy, both being ombudspersons who can only make recommendations and not orders, and the role of departmental heads who ultimately have the discretion to decide on exceptions in general and specifically when the public interest and disclosure clearly outweighs privacy.
It's important to understand that while Bill C-58 maintains some of these factors, which are important for the Supreme Court in maintaining the balance, it changes others, notably the roles of the Information Commissioner and Privacy Commissioner and their authority to make binding orders. Changing the balance between the roles of the two commissioners and departmental heads may well have an impact on the interpretation of the substantive provisions. Giving the OIC the authority to make these orders could well mean that the OIC's interpretation will prevail between disclosure in the public interest and privacy.
The problem is not that the OIC is inherently unfair or unknowledgeable—it's true that they have experience—but rather that it is a champion of one side of the balance. Someone needs to speak for the other side, particularly when the Information Commissioner in her special report on this bill is on record as saying it is unnecessary and inappropriate to consider the other side.
The OPC will rarely be involved according to Bill C-58, despite having a central role according to the Supreme Court. The bill provides that the OPC will be notified only in the case of formal orders and only in these cases will we be able to see judicial redress. Yet, privacy may be at risk not only where OIC formal orders are made, but in other situations. Departments are much more likely to comply with the OIC's interpretation, knowing that the OIC ultimately has the authority to make binding orders. As government officials acknowledged to you last week, it is only in very rare cases that departments will use their resources to challenge OIC orders.
Similarly, when the OIC makes a recommendation under the new regime, or even when discussions take place between the OIC and departments during the investigation of a complaint, departments are much more likely to comply with the OIC's view, knowing that the OIC can ultimately order the department to accede to its interpretation of the law.
Bill C-58 ultimately creates an incentive to give access pre-eminence over privacy, which is contrary to the Supreme Court jurisprudence. I am deeply concerned about this and have suggested a few simple solutions to this poor balance.
Thank you for your attention, and I look forward to answering your questions.
4:45 p.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, Commissioner.
First up for a seven-minute round is MP Erskine-Smith.
October 25th, 2017 / 4:45 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Thank you very much.
Thank you very much, Commissioner.
I want to make sure I'm clear in my head as to the concern in relation to the risk of personal information being disclosed. Section 19 of the current act provides that the head of a government institution shall refuse to disclose any record request under this act that contains personal information, but then subsection 19(2) authorizes disclosure in certain instances if the individual consents. You have no issue there as I understand it. The information is publicly available.
Paragraph 19(2)(c) refers to the disclosure being in accordance with section 8 of the Privacy Act. It's in that instance you're asking that not just the Information Commissioner would consult with you, but every department on every ATI request, provided if there's disclosure, you're looking for consultation.
4:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
With respect to consultation by departments, my request is limited to not all ATI requests.
4:45 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
No, but it's only ATI requests that implicate paragraph 19(2)(c).
4:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
And not even all of those of that group.
4:45 p.m.
Liberal
4:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Only those that lead to a complaint to the Information Commissioner, which is about 300 cases a year.
4:45 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
That's the part I can't figure out, because wouldn't we also be concerned with departments if we're concerned...? This is the privacy angle specifically, not the access to information angle. Why am I concerned about the Information Commissioner ordering disclosure of personal information, but not the department disclosing information? If there's personal information either way, I'd be equally concerned.
4:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I am concerned, but less so in the case of departments in large part because the substantive part of the legislation says that this balancing, whether the public interest clearly outweighs privacy, is an assessment that is done within the discretion of a department. In the current law it is the institutional head who ultimately decides, although I would like to be able to review these and we have not seen a major issue. The combination of institutional heads having the discretion and the Supreme Court jurisprudence to the effect that privacy must not be given a narrow or cramped interpretation that binds institutional heads, that is a regime that could be perfected, but it adequately protects privacy.
With the bill the Information Commissioner will be able to order a department on the exception to this mandatory protection of personal information, including provisions that go to the balancing between the public interest and the protection of privacy. What is the net effect of giving order-making to the Information Commissioner on the exception with the discretion remaining, at least in theory, for departmental heads? That's a bit unclear to me.
4:50 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
That's a good question.
Just so we're all clear here, I think the section you're talking about.... The way the legislation interacts is that we have paragraph 19(2)(c) which interacts with section 18 of the Privacy Act. Once we get to section 8 of the Privacy Act—correct me if I'm wrong—but you're talking about subparagraph 8(2)(m)(i)?
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
4:50 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
It occurs to me that maybe it ought to be clear.
You make a good point. An Information Commissioner here, with order-making powers, only has the ability to enforce disclosure where she feels that the department has made an improper decision pursuant to the act to refuse disclosure. But paragraph 8(2)(m) of the Privacy Act, as you said, does specifically state in the statute “for any purpose where, in the opinion of the head of the institution”. It's unclear who then has the authority where there's a dispute between the head of the institution and the Information Commissioner.
If I were resolving that, I think it would actually lie with the head of the institution, given that's the way the statute reads, but I guess your concern is clarity.
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We would like to be part of that discussion, hence being consulted, and hence being able to seek judicial redress of that issue, and not to do that 10,000 times a year forever until the jurisprudence settles the question, which will not take all that long.
However, in order for that to happen.... Yes, it could happen based on the initiative of a department, but you heard last week that judicial redresses by government will be few and far between. I think the Supreme Court has recognized a role for the institution that I head. I think it's reasonable to ask to be part of the conversation and to be able to raise before the courts these issues when privacy is at risk.
4:50 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Is the request limited to when subparagraph 8(2)(m)(i) is implicated?
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It's whenever the exceptions of section 19 apply.
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I agree that where the individual concerned consents, we will never seek judicial redress.
The question of whether information is publicly available could lead to some differences of use too. It's in part what is publicly available, in part how to balance public interests and privacy invasions.
4:50 p.m.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Well, with that, I would simply say I can appreciate that when it comes to subparagraph 8(2)(m)(i) where the head of the institution has more authority, but, frankly, when it comes to the rest of section 8, I don't see any difference between the Information Commissioner compelling disclosure and a department compelling disclosure where it implicates personal information.
Frankly, if you want to be consulted on all of section 8, I think you have to make a case as to why there's a difference between the Information Commissioner and the department.
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Sorry, I may not have been clear.
There are exceptions—