Information & Ethics Committee on Feb. 1st, 2018

[The Chair, Conservative, Bob Zimmer]

Good morning, everybody. Thanks again for coming here this morning.

Today, in meeting number 88 of the Standing Committee on Access to Information, Privacy and Ethics, pursuant to Standing Order 108(3)(h)(vi), we are studying the Personal Information Protection and Electronic Documents Act, or PIPEDA as we've all known it.

First of all, Mr. Angus would like to have the floor.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you, Mr. Chair.

I'm very pleased to be back on this committee, which does incredibly important work, certainly with access to information. One of the other key elements is that our committee is the review committee for issues of ethics and ethical breaches.

I want to take a few minutes to let the committee know that I will be bringing a notice of motion regarding the decision by this committee not to invite the Prime Minister to explain his being found guilty of ethical breaches. It is unprecedented in the history of our Parliament for a sitting prime minister to be found guilty. Normally, it is this committee where it would be dealt with. However, the committee overruled doing so, saying that the proper place would be in question period, and I think there was some logic to that.

The problem is that the Prime Minister has not been answering questions in question period. In fact, the Prime Minister skipped question period on Wednesday, which is normally the day he answers questions, to do a town hall in Winnipeg.

We were told that the Prime Minister would be accountable to the Canadian people. We were told he would answer questions. He's refusing to answer the questions, so it has to come back to this committee and all of us to ensure that ethical standards are being held to even in the highest office. Therefore, I will be bringing a notice of motion on Tuesday to that effect.

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Mr. Angus.

We'll go back to the orders of the day.

Mr. Therrien.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Ladies and gentlemen, members of the committee, I don't have a formal statement but I will make a few remarks that may situate the debate. I hope this will be useful.

Last week, my office published a draft position paper on the question of online reputation. Of course, the first question that one might ask is why; what is the relevance of this? We have been told by Canadians that they are concerned about the growing risks to their reputation online. We want to provide people with greater control to protect themselves from these reputational risks.

Those risks exist because protecting reputation is increasingly difficult in the digital age. Information about us is systematically indexed and easily accessed and shared. Online information about us can easily be distorted or taken out of context, and it is often extremely difficult to remove.

Our report makes a number of key recommendations or decisions.

First, it says that PIPEDA should be interpreted as providing the right to ask search engines to de-index web pages that contain inaccurate, incomplete, or outdated information. We think there is grounding in the current PIPEDA for that.

Second, there should be removal or amendment of information at the source in certain situations.

Third, and very importantly, we advocate for much more education on this issue, education that we can be part of within our public education mandate. However, we think, on this issue in particular, it would be important that provincial and territorial governments take up our recommendation that privacy should be part of the curriculum in schools so that children are taught at an early age, one, how to protect themselves, and two, how to behave responsibly as online citizens.

While I think there is a legal basis in PIPEDA for the remedies found in our paper, it's also important that this issue be considered by you as elected officials. We know that this is a controversial issue and that a number of people, stakeholders, are of the view that this would unduly impact freedom of expression. We know that. At the same time, it's important that we act, that the OPC acts based on the current law. However, it is a very legitimate issue to examine what the right balance should be between protecting reputation and privacy interests on one hand, and freedom of expression on the other.

When the Office of the Privacy Commissioner drafted the Draft Position on Online Reputation, and more specifically examined the role of de-indexing, we were not attempting to create new rights or powers. Rather, we were attempting to apply the Personal Information Protection and Electronic Documents Act, in its current form. However, as I just said, this raises questions in connexion with respecting freedom of expression. We think it is particularly important that elected representatives, who represent the Canadian population, examine this issue.

In addition to studying the matter of the balance between privacy and freedom of expression, you may want to take advantage of this opportunity to examine certain important natural justice or procedural issues which private sector stakeholders, particularly search engine representatives, have drawn to our attention. More particularly, if a citizen asks a search engine or a private organization to de-index or erase some information, which procedural rights may those entities cite in defence of their point of view in favour of freedom of expression, and against the de-indexing or the removal of information?

One question has already been examined by the committee in its review of PIPEDA. You may also want to examine the effects of possible differences between how these rights are exercised in Canada and in Europe, when studying the adequacy and appropriateness of Canadian legislation as compared to European law.

My last point will be this. I recognize that de-indexing is not necessarily a perfect solution for protecting reputation, but I think it's important to ask because it is important to protect reputation, and I think it's important that I act on the basis of the law that I must administer and enforce. However, there is a question as to whether the law, as it is, is the best means to protect reputation.

As you look at this question, I would ask you to consider what the alternatives are. The first question would be, is it worth protecting reputations? If you agree that it is, de-indexing and takedown are the tools I have under the current PIPEDA. If that's not good, what are the alternatives? There are not many alternatives, but maybe you should consider and hear from witnesses what the alternatives should be.

Thank you.

[The Chair, Conservative, Bob Zimmer]

Thank you, Commissioner.

We'll start off the seven-minute round with Mr. Erskine-Smith.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thanks very much.

I want to get into a discussion of de-indexing a little bit and the online reputation report, but we are just finalizing our broader report on PIPEDA and I first want to clarify a few things, in particular with respect to enforcement powers.

We've had some people come before us and say that, if the OPC is given additional enforcement powers and the ability to make orders and issue fines, businesses may be less open to coming forward and co-operating in the first instance with the OPC. I wonder if you could reiterate to this committee what you think the model should be for the OPC under PIPEDA in terms of enforcement powers going forward and what this committee should recommend, in addressing some of the concerns that business have expressed to us.

[Daniel Therrien]

I don't think that granting the OPC order-making powers would have that effect. I think it would actually discipline the conversations we have with the corporate sector currently if organizations know that their interlocutor has order-making powers. I think it would discipline the conversation.

An important point to make here is that when I ask—and my predecessor asked—for order-making powers, it does not mean, in my view, that order-making would be the first reaction of our office when faced with an allegation or even a finding of non-compliance with the law. My job, I think, is to bring organizations towards compliance with the law, broadly speaking. To impose orders and fines is something that may be necessary in some limited cases with recalcitrants or recidivists, but this is not my first course of action.

My first course of action to bring organizations to comply is to engage with them, to issue guidance on what we think the law provides, to consider initiatives that they may put forward, and to talk to them about how they can function commercially in a way that is compliant with PIPEDA. That's the first and by far the most often used strategy that I think I need to put forward, but there will be a few corporations/organizations that may not be amenable to that engagement. For those, I need order-making to ensure that the law is not moot and actually is applied.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Just so that we understand, the enforcement power you have right now if there's continued non-compliance is for you to in fact take that business to court, effectively?

[Daniel Therrien]

Yes, it's to make recommendations, and if they are not applied, to bring an organization to court, which is a very lengthy process.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

You've suggested that you would exercise discretion. Should that discretion be the OPC's? Or should there be, in any recommendation we make or any legislation that's drafted, some guidance to say that in the first instance it ought to be recommendations, that it ought to be guidelines put forward to business, and that if they further break those recommendations or fail to follow them, fines and further orders could follow?

[Daniel Therrien]

You could do that. My preference, frankly, would be to exercise my discretion based on considerations that you think are relevant, but without dictating the order in which the considerations must apply. But I am absolutely in favour of considerations that I would be bound to apply.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Here's my last question on this topic. You attend a number of conferences. You would be more familiar with privacy commissioners around the world and the enforcement powers their offices hold. Is providing your office with enforcement powers and the ability to make orders consistent with international practice, or is it getting ahead of international practice?

[Daniel Therrien]

It is not at all getting ahead. We are behind, so it would be more consistent with what is becoming the norm.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

How much time do I have left?

[The Chair, Conservative, Bob Zimmer]

You have about three minutes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I'll briefly turn to de-indexing. If I understand correctly, your interpretation of the current act is that it already applies to search engines and that de-indexing is already part of the potential interpretation of the act. Is that fair to say?

[Daniel Therrien]

Yes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

How open to interpretation is that? Is it necessary to clarify that in the legislation? Or are the case law and the interpretation so clear that we ought to just leave it to the current case law and precedent?

[Daniel Therrien]

I think our interpretation is sound, but it is not without other views being expressed. If you agree that this deserves remedies, I think it would absolutely be helpful to clarify that in legislation.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Maybe you could explain to this committee the right to deletion. We've talked about the right to be forgotten or the right of erasure, the right to deletion, and the right in this case maybe to de-indexing. They're all different gradations of the same idea in some ways. How far does the current interpretation of PIPEDA get us in terms of the right to deletion? You've said, okay, the right perhaps to de-indexing, but how much more broadly do we see the existing case law?

[Daniel Therrien]

Well, as I say in the paper, the basis in the current law for the remedies that I think exist is first and foremost principle 4.6, which is entitled “Accuracy”. The first principle is accuracy. The reputation of people should not be based on inaccurate information that is out there online about them. Although the heading is “Accuracy”, the words of the principle talk about “accuracy”, meaning that the information should be factual and objective; “complete”, which is a bit more subjective; and “up to date”, which is a bit more subjective also.

I need to apply the law as it is, and the law as it is has these three characteristics of information. Some are more objective than others. I think that should be part of the debate.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

If I post something online—

[The Chair, Conservative, Bob Zimmer]

Mr. Erskine-Smith, your time is actually up.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I'm out of time. Well, Mr. Saini will pick up.

[The Chair, Conservative, Bob Zimmer]

Thanks, Mr. Erskine-Smith.

Next up for seven minutes is Mr. Kent.