Evidence of meeting #88 for Access to Information, Privacy and Ethics in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was question.
A recording is available from Parliament.
9:20 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Well, that would require a pretty extensive change in the mandate of the Information Commissioner. The balance doesn't come up the same way in the private sector. The Information Commissioner is responsible for access in the public sector only. The balancing of interests in the public sector is more vis-à-vis organizations, unless the Information Commissioner were given a mandate to be a champion for access to information broadly speaking, but that's not at all the current mandate of that commissioner.
9:20 a.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
In your paper regarding online reputation, you raised some interesting points when it came to de-indexing, and you had some critiques of that. One critique you had was that the information was still available, so that if people wanted to find it, they still could. It actually has not been eliminated. You've just broken—and I use the word “broken”—the link between the information and that individual.
You've also said that there is a role for the private sector in the balancing of rights. In the paper, you've written, “Search engines, in particular, already have in place mechanisms to consider de-indexing requests and remove content which is potentially harmful”.
Could you just elaborate? What mechanisms were you talking about? Can you elaborate on what mechanisms there are right now?
9:20 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Let's talk about copyright. Search engines and other organizations have processes today whereby they do not put up material for access to the public that in their view would breach the copyright of copyright owners. To go back to the experience in Europe, the number of takedowns or de-indexings based on infringement of copyright is many times the number based on the protection of privacy. I think it's about 1,000 to one where search engines de-indexed or took down information based on copyright infringement as opposed to protecting privacy rights.
This idea that corporations do not just make available everything that is available on the net, but that there is some kind of screening for legality—copyright being an example, revenge porn being another—all kinds of legal criteria are currently being applied by corporations that lead either to de-indexing or takedown. Frankly, I don't see why compliance with the federal private sector privacy law would be any different from an infringement of copyright or other laws.
9:20 a.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
The other point you mentioned—and I think one of my colleagues mentioned too—was that the search engines should provide the first level of review of de-indexing requests, which is fine.
If someone doesn't agree with that decision, then they would have to appeal it to a court, I'm assuming. If a search engine denies the request, what is the recourse for the person who's making the request for de-indexing?
9:20 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Initially it would be a complaint to my office for non-compliance with PIPEDA, and then to the courts.
9:25 a.m.
Liberal
Raj Saini Liberal Kitchener Centre, ON
The other question that we had some debate about was in reference to youth. You've made some references in your paper that specific protections should be in place for them. You've given a different age range. What age does your office consider to be youth, because in the United States, the penal code considers someone 13 and under as a minor? The GDPR or the European Union privacy regulations have, I believe, the age of 16. You've given a range. Can you guide us on that?
9:25 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
For consent purposes, we have proposed 13 as the relevant age. For the purpose of whether a youth can give meaningful consent to the collection, use, and disclosure of information, we propose 13 as the better age for this, but really it's a question of some arbitrariness because whether the consent is meaningful depends on the maturity of the child. We say that under the age of 13, it would be very exceptional for a child to be able to give meaningful consent. For the purpose of making a de-indexing or takedown request, we say the age of 18, essentially on the basis that there's no doubt that as of 18, they become, how do you say, majeur, they reach the age of majority and from that point on, there's no doubt they can speak for themselves and they could make a request.
9:25 a.m.
Conservative
The Chair Conservative Bob Zimmer
Your time is up. Thank you, Mr. Saini.
Next up, for five minutes, is Mr. Gourde.
February 1st, 2018 / 9:25 a.m.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Thank you, Mr. Chair.
There are certain cases I don't like to talk about, but this week an important case was drawn to my attention. It is also really complicated because it involves access to private information and the right to access information.
In some circumstances, Canadians sign contracts with governments. They must then provide information on their private life by filling out forms. They become consultants or self-employed workers because they have a certain specialty that allows them to obtain special contracts. If such Canadians are harmed because they are refused access to the information contained in their file, or because they are given redacted documents for reasons of national security or because this is privileged information, they find themselves in a bind and have no way to defend themselves.
Would you advise that those Canadians turn to you to defend their right to access information on their private life and to have access to certain documents that might enable them to solve their problem?
9:25 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
If I understood your question correctly, you are talking here about a request submitted under the Personal Information Protection Act by someone who had to provide personal information to the government as an employer or an entity that grants contracts, in order to establish the reliability of the person who wants to be employed or to provide services.
9:25 a.m.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Yes, the purpose is to ensure that that person is reliable and eligible. There is then an agreement between the government and the employee.
9:25 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
So, the person submits an access request under the Personal Information Protection and Electronic Documents Act. Some information may be denied for reasons of national security. I think we are talking about the application of the criteria in the current act. In that context, the threat to national or public security is one of the grounds for refusing access to information. I am talking about applying the law. First you have to ask whether the government has applied the exemption properly. That's the main question.
If the individual concerned believes that the government did not apply the exemption correctly, he may submit a complaint to us and eventually obtain recourse to Federal Court. This then becomes a matter of fact, I believe. The issue is to determine whether the exemption was applied properly.
9:25 a.m.
Conservative
9:30 a.m.
Conservative
The Chair Conservative Bob Zimmer
Thank you, Monsieur Gourde.
Next up is Mr. Baylis for five minutes.
9:30 a.m.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
Good morning. You talked about the de-indexing and erasing of information. If I understood correctly, there are no procedures to erase information, or people have to be much more specific when they request the removal of information rather than de-indexing.
9:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
When information is erased, we are not just removing a link; information is actually removed from the infrastructure.
There's a difference between the two. In the first case, the individual himself provided information that can be found on the Internet, for instance, on a social network. In that context, the individual should have an absolute right. He or she should be able to exercise that right without difficulty and in fact withdraw his consent. The information was placed on a site after the individual consented to it, but he may revoke that consent.
9:30 a.m.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
There were other criteria. In the context of such an approach, the fact that it is accurate or not does not raise any questions.
9:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That is true.
The other case in point is more frequent. For the purposes of this example, let's say that person A makes the request. Suppose A publishes information on a social network and that B, a friend of A's, then shares the information about A more broadly. This is where B's freedom of expression is at play, and that is where we have to find a balance between A's right to protect his reputation, and what we must take into account to remove information; is the information accurate, complete and up to date, and how is public interest served, if it is involved at all?
9:30 a.m.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
If I understand correctly, we are missing some specific procedures to make such decisions.
9:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The current act states that companies—and that includes social networks and search engines—have the obligation to develop procedures. However, there is nothing about the nature of those procedures or the rules that might underlie them. Principle 10 in provision 4.10 of PIPEDA states that it is incumbent upon the companies to create procedures to ensure the respect of substantive rights such as the right to accuracy of information. However, there are no regulations at all and that is a problem.
9:30 a.m.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
That problem, if I understand it, should not reside with the company to decide. Are you saying that we should have an overriding principle or procedures if such a situation were to come up?
9:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
One of the issues that arises is whether companies faced with a request for de-indexing or takedown must take into consideration the interests of the publisher of the information. The law is currently completely silent about this. In Europe, the interests of the publisher of the information are not normally taken into consideration. That has led to criticism in Canada that the interests of these stakeholders are not considered. That's certainly an issue worth considering. The law doesn't provide for it. One of the things that would add value to your recommendation would be to speak to these issues. What rights should publishers of the information have to have their interests taken into consideration, I would add without making the right to de-indexing moot. If the publisher is made aware of the request for de-indexing, and then publicizes the fact that a request for de-indexing was made, that can make the request of the individual quite moot. The publisher needs to have their interests taken into consideration, but the fact their interests are taken into consideration should not lead to the publication of what the person thinks is inaccurate and should not be in the public domain.