Evidence of meeting #100 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was used.
A recording is available from Parliament.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That's fair.
Conservative
Larry Brock Conservative Brantford—Brant, ON
Yes...because these are the institutions that were identified by the CBC reporter. Is that correct?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes.
Conservative
Larry Brock Conservative Brantford—Brant, ON
When I take a look at this list, I might give some consideration to Fisheries and Oceans Canada, and perhaps the Competition Bureau, but when I take a look at Canada Revenue Agency, Global Affairs, Correctional Services, Canada Border Services Agency, National Defence and, most importantly, the RCMP, they all have great legal teams working behind them—in many cases the Department of Justice—who would certainly instruct not only management of those departments but its employees about the protection of privacy rights. To learn, then, that in many instances judicial authorization was not authorized, that a PIA was not submitted for your consideration and that data was collected, raises serious privacy concerns.
You mentioned earlier, sir, I think in your opening statement, that in many cases when this device was used on public sector employees it was with the consent of the device owner, but you can't say that in all cases the extraction of data pursuant to this software already had the consent of the device holder. Is that fair to say, sir?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That's fair. I don't know that for certain.
Conservative
Larry Brock Conservative Brantford—Brant, ON
Right—which again raises more privacy breaches.
The RCMP said after the fact that they submitted a PIA, I believe in December. Is that correct? Some organizations said they submitted it perhaps earlier. Can you tell us whether or not you have consulted with these departments that have not submitted the PIAs and asked them specifically why they circumvented the Treasury Board directive in these circumstances?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We reached out to all 13 organizations. As I indicated at the outset, three of them indicated that they have done a PIA on their program. The remaining ones have not. We're going to be reaching out to all of them. We're going to continue that exchange to follow up and say, “Okay, we want to understand when this is going to be done and why it wasn't done and make sure it's done in the way that it needs to be done.” However, we don't have legal authority to compel that if there's no agreement.
Conservative
Larry Brock Conservative Brantford—Brant, ON
That is something that could be enhanced with an amendment to the Privacy Act. Is that correct?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That's right. That's what I'm recommending.
Conservative
Larry Brock Conservative Brantford—Brant, ON
As the Privacy Act is constructed, not surprisingly, there are no legal consequences or any penalties for non-compliance with the PIA requirements. Is that fair, sir?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That's fair. In my office I don't have order-making powers, even for things that are in the Privacy Act. I can do an investigation and make a finding, but I have to rely on the government or the institution complying with that.
Conservative
Larry Brock Conservative Brantford—Brant, ON
Is that something that perhaps you would recommend as a possible amendment as well, sir?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes, I would, certainly.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Brock.
Thank you, Mr. Dufresne.
Mr. Erskine-Smith, you have five minutes. We're going to make sure that your technology is working. Go ahead.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Thanks, John. It's nice to see you.
It's nice to see everyone here, especially the analysts.
Commissioner, have any of the 10 of the 13 departments that have not yet done PIAs refused to do one?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
One of them has indicated that they purchased the tool and never used it. They did not indicate they were going to do one. One indicated that in their view it wasn't required. We're going to be following up to see if we agree with that and have a discussion.
Liberal
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
It was the Competition Bureau.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Okay.
In terms of the other ones, it would be helpful if you put a timeline on them of, say, 20 to 30 days. Then you could refer back to us and let us know if you haven't had a response, because you may not have powers, but we obviously do have powers to compel attendance.
On the instances, you have one department reply to say they've never used it. What's the scale of use here, depending upon the department? Do you have a sense of how often this tool has been used?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We have various answers. For some of them it seems to be more regular as part of their activities. Some have indicated a smaller number of uses. For our standpoint, whether it's used two, three or four times or whether it's used regularly, we look at it in the same way. Is it appropriate, and should they do the PIA or not?
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
Let's pull that apart.
Obviously they should do a PIA. I can't imagine anyone here disagreeing that they should do a privacy impact assessment. I take your point. It's well stated. There should be an obligation in law that these organizations, when they're using a new tool with impacts upon privacy, do a PIA.
Let's talk about appropriate use, though. In the CBC report, I saw an indication from agencies and departments that they use this tool separate to judicial authorization in some cases, and in other cases only on government-owned devices and in cases involving employees suspected of harassment.
Both of those instances, at a high level, sound quite reasonable to me. Are there other instances that you're aware of that we ought to be concerned about?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I saw the departments' responses. They've provided information about the types of programs they would use this for. There hasn't been anything that has worried me in terms of this being a completely inappropriate purpose or use. They're using this to fulfill their mandates as organizations, to apply their enabling legislation or to do some investigation.
What I'm concerned about is this: Has the privacy consideration been done well, was it done in time and have the risks been mitigated? Obviously, that's my purview. Specific questions about the legitimate authority they have or their mandates would be distinct and perhaps things this committee can ask.
My concern at this stage is that we need to consider the privacy impact in all situations where you can impact the privacy of Canadians. That's not always been done.
Liberal
Nathaniel Erskine-Smith Liberal Beaches—East York, ON
I know you're getting back to the need for a privacy impact assessment there, but even if there were a privacy impact assessment, you could imagine that the scope of a particular investigation either would be within that PIA or could go beyond what is contemplated by the PIA. There is no example or no instance that you've been provided, at least that you're aware of, where the use is obviously beyond the bounds of anyone's expectation of privacy.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
There hasn't, but it highlights, again, another recommendation that I've made and that this committee endorsed in the ODIT study, which is the element of necessity and proportionality. That too should be in the law, because that's the point you're getting at. There may be a legitimate purpose. However, are you going too far in how you're achieving it?