Information & Ethics Committee on June 21st, 2021

[The Chair, Conservative, Chris Warkentin]

Colleagues, I'm calling to order this meeting.

This is the 41st meeting of the House of Commons Standing Committee on Access to Information, Privacy and Ethics. Today, we are considering the certificate of nomination for Daniel Therrien as the Privacy Commissioner, pursuant to the standing orders that provide for that. As you know, Mr. Therrien's term has been extended for a further year.

I'd like to remind members that today's meeting is televised and will be available via the House of Commons website.

Commissioner, thank you so much for joining us. I believe you have some opening remarks to begin the meeting, and then we'll have some questions for you.

We'll turn it over to you, Commissioner.

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you very much, Mr. Chair and members of the committee, for having me today.

I have not prepared an opening statement, but I will say a few words as an introduction.

First, I would like to say that I am honoured that parliamentarians have placed their trust in me and that they have renewed my mandate for the coming year. I will try to be worthy of that trust.

This will be an important year of transition for privacy law in Canada and for the Office of the Privacy Commissioner. What I intend to do in the next year, obviously, will be to continue to comment on—

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

A point of order, Mr. Chair.

[Technical difficulty—Editor]

Unfortunately, there is no interpretation.

[The Chair, Conservative, Chris Warkentin]

Recognizing the point of order, we'll verify that our interpretation is available.

Can we have a test?

Commissioner, if you will continue, I'm hopeful it was just a minor technicality. We'll let you continue.

[Daniel Therrien]

As I was saying, this will be an important year of transition for privacy law in Canada, and for—

[The Chair, Conservative, Chris Warkentin]

I do apologize, Commissioner, I'm going to be speaking here. Can members indicate to me whether they hear the translation of my voice into French? Is it currently being translated?

There, I think Madame Gaudreau now has translation. I'm getting a thumbs-up.

I do apologize, Commissioner. We'll turn back to you. I believe the issue has been resolved.

[Daniel Therrien]

Thank you very much.

The next year will be an important year of transition for privacy law in Canada and for the Office of the Privacy Commissioner. I intend, during the next year, to continue to comment on legislative proposals that are being made, or may be made, both in private sector privacy law and possibly in public sector privacy law. Indeed, there was a consultation paper published by the Department of Justice in the fall of 2020 that outlined a good plan to reform the public sector Privacy Act. Therefore, first and foremost, I intend in the next year to continue to provide comment and advice to parliamentarians on the legislative proposals.

In addition, although we don't yet have, of course, the precise content of these laws that will eventually be enforced in the private and public sector, we were starting to have a good idea of some of the new roles that the Office of the Privacy Commissioner might have under reformed laws. Although this is early days, what I intend to do in the next year, given the fact that I know the Office of the Privacy Commissioner a little bit, is to prepare the office to inherit these new responsibilities. By that, I mean the order-making authority that is found in Bill C-11 and that is also mentioned in the justice department's consultation paper for the Privacy Act.

What does that mean in terms of structure and the OPC? How separate should adjudicators be from investigators? I ask this because we currently do not have adjudicators making [Technical difficulty—Editor]? What should be the profile and competency profile of adjudicators once we inherit these responsibilities, if we do?

I'll mention one other element in terms of organizational structure. Bill C-11 speaks to a greater role for the OPC in engaging with stakeholders. We have already in the past engaged with stakeholders on many policy documents. I'm thinking of the consent guidelines that we published a few years ago. I'm thinking of the proposals we made for artificial intelligence more recently. We're not foreign to the idea of consulting stakeholders before publishing important documents, but Bill C-11 certainly sends the signal that there should be more of that, and we welcome that. We want to give some thought in the next year to how we will proceed to engage with stakeholders once new legislation is enforced.

Beyond legislative reform, I'll mention very briefly, as you know, that we published a special report a week or two ago on the issue of facial recognition, which includes draft guidance for the police. We intend to engage with the police, and also civil society and other stakeholders, on that document. In the next year, we hope to be able to finalize it jointly with our provincial colleagues, because this is obviously a very important privacy issue.

Let me stop here.

I will try to answer your questions.

[The Chair, Conservative, Chris Warkentin]

Commissioner, thanks so much. You are no stranger to our committee. Thank you for always being willing to attend our meetings. We sure appreciate your being here today.

We're going to turn to Mr. Barrett for the first number of questions.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Thanks very much, Chair.

Thank you, Commissioner, for joining us this morning.

This morning, the government announced that the ArriveCAN app will be used to verify the validity of foreign vaccine records and for Canadians and permanent resident to upload domestic vaccine records as well.

Were you consulted in the process that produced the decision by the government to use the ArriveCAN app for travellers to upload their medical information?

[Daniel Therrien]

We have not seen the precise details that you mentioned this morning, but there have been a number of conversations with the government—and particularly health authorities, obviously—on how proof of vaccination could be required at the border for returning Canadians or people seeking to enter the country.

We have been consulted by the government on these general notions. We have not yet heard the precise details, but there will be a meeting later this week, where we will hear more formally from health officials and will be able to provide more precise [Technical difficulty—Editor]

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Can you tell us what privacy concerns are raised when Canadians' medical records and information are being transmitted and uploaded as a condition of post-re-entry regulations?

[Daniel Therrien]

The first point, of course, is that it is exceptional that either the public or private sector would require proof of vaccination or of medical status before providing a service, but these are not normal times. The pandemic is an exceptional situation, so we have issued, along with our provincial colleagues, certain guidelines or parameters as to when governments or private sector organizations may require the presentation of this proof of vaccination.

The first principle is that there should be authority in law for this. I think there will be authority in law for border officials to require some proof of vaccination or at least health status before travellers can enter the country. That's the first point—legal authority.

Then there are issues about the protection of that information. It's one thing to upload it in a government app such as ArriveCAN, but we need to look at the security safeguards around that application. We have not yet done that. There also need to be rules for disclosure of that information. I think it's legitimate for the government to see that information for the precise purpose of allowing a person to enter its territory, but then there need to be rules around limiting further disclosures for other purposes, and that too, we need to look at in greater detail.

That would be my response in general, but I would refer you and the government and the private sector to the parameters we issued along with our provincial colleagues a few weeks ago.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

You said these are exceptional times, and so exceptional measures may be undertaken. Would you acknowledge that these types of travel documents do encroach on civil liberties?

[Daniel Therrien]

They do. It is not normal, again, that organizations, public or private, would require proof of a health status or vaccination status. There have been exceptions. School children, for instance, need to provide proof of vaccination in order to enrol in school. In travel situations, there have been exceptions as well, but the rule is that this is confidential health information that should not be required except for very precise purposes.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Would you say that it is essential, or would it be your advice, in the development of the implementation of these measures that they be specifically sunsetted, with criteria that would require their use to be discontinued, and that measures be established for the destruction of the information that was collected?

Furthermore, just because I have less than a minute for your reply, I would also ask this. Does the PEI Pass, as an example for interprovincial travel—we're not talking about international travel—present the same concerns that the ArriveCAN app does?

[Daniel Therrien]

In a word, yes. It should be time-limited because it is an exceptional measure, and it should only last when required for the specific purpose of dealing with the pandemic.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

And on the provincial programs as well, should they—

[Daniel Therrien]

It's similar. Certainly in terms of the characteristic, they should be time limited, absolutely, and the same general rules would apply.

[The Chair, Conservative, Chris Warkentin]

Thank you, Mr. Barrett.

Ms. Lattanzio, we'll turn to you for the next round of questions.

[Patricia Lattanzio, Liberal, Saint-Léonard—Saint-Michel, QC]

Thank you, Mr. Chair.

Thank you, Monsieur Therrien, for being with us once again today.

Some of my questions are with regard to the possible enactment of Bill C-11, which would significantly increase the power of your office in terms of the fines that you can recommend be levied and your ability to certify the data protection codes of practice of companies or organizations as compliant. I understand that you're concerned about a new panel that would in fact levy the fines you recommend and that would be appealable, but given that you have been calling for stronger enforcement laws for years, isn't Bill C-11 a positive step in that direction?

[Daniel Therrien]

Bill C-11 includes the authority to make orders and, as you say, to recommend fines. Is it a step in the right direction? I think the overall goal should be to ensure that Canadian consumers have access to quick and effective remedies when their privacy rights are breached or violated, and as we tried to explain in our submission, in most cases we think that the imposition of administrative penalties would result, on average, seven years after the violation has occurred. Is that a step forward?

Personally, I don't think so, particularly when the list of violations that can result in fines is extremely limited, contrary to the laws of other countries, and excludes the most central provisions in privacy law, which are obtaining consent meaningfully and for organizations to be accountable in the way they handle information. The extreme narrowness of the scope for offences and violations and the extremely long period leading to the potential imposition of a fine makes me say that this needs to be reconsidered completely.

[Patricia Lattanzio, Liberal, Saint-Léonard—Saint-Michel, QC]

What would be your recommendation?

[Daniel Therrien]

First of all, it would be that most if not all contraventions of the law should be eligible—let's put it that way—for administrative penalties, as is the situation in most other countries that have penalties. There are modalities that we can discuss if we have time, but the rule should be such that essentially all violations lead to fines if the proper authority determines that the law has been violated.

In terms of who decides between the OPC and the appeal tribunal that is proposed in Bill C-11, it is certainly possible for Parliament to create an appeals tribunal, but in privacy matters this would be, to our knowledge, exceptional. We do not know of any other jurisdiction that has such a tribunal, which is not to say that I am not concerned, obviously, about the fairness of the process under which companies would have to pay fines. If the OPC had that authority and there were no administrative appeal as proposed, the courts could intervene and control the legality and fairness of the process undertaken by the OPC. That system of the privacy regulator being authorized to impose fines subject to judicial review by the judicial courts is the normal structure in privacy laws, and we would recommend that it be adopted.

[Patricia Lattanzio, Liberal, Saint-Léonard—Saint-Michel, QC]

Would you not say that our fines are among the highest in the world? That would be a subsequent question I have for you.

More importantly, I would also like to ask you the following question. You've called for Bill C-11 to be grounded as a law in human rights. Should Parliament wish to amend it to do this, how can it best do so without infringing on provincial jurisdiction and the risk of constitutional challenges?

[Daniel Therrien]

In the submission that we presented to your committee about a month ago, we addressed that important issue. We recommend the addition of preamble and purpose clauses in a new law that would firmly ground the federal legislation in trade and commerce. This could be done by having explicit language in a preamble or purpose clause to indicate that the purpose of the federal private sector law—Bill C-11 at this point—is to ensure viable and sustainable digital commerce by protecting privacy.

That would set the purpose of the federal law squarely in the jurisdiction that Parliament has under trade and commerce. Once that is done, then Parliament can legislate to protect privacy in the best way that it feels should be part of that law. If Parliament so decides, that could include, without infringing on provincial jurisdiction, a rights-based law.