Evidence of meeting #104 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was use.
A recording is available from Parliament.
President, Canadian Association of Professional Employees
No. We expect much more in the future.
Bloc
René Villemure Bloc Trois-Rivières, QC
I see.
The officials who appeared before the committee said that they were using the tools, that they had had them for a long time and that they were going to carry out privacy impact assessments. I think we were surprised to hear them say that they were going to do the assessments. We'll see if they end up doing them.
Do you think that's a way to downplay the situation, that they were negligent? Is it a problem with the corporate culture, do you think?
President, Canadian Association of Professional Employees
I think this is a government-wide problem. I think there needs to be strong direction from the Treasury Board to explain exactly how privacy policies are going to be actually implemented in practice.
With that in mind, any new technology that's being rolled out that will impact our members' privacy requires these privacy impact assessments and these proactive disclosures. It's fairly clear in the directive and it's fairly clear in the Privacy Commissioner's statements what is needed here.
Whether it's installed remotely, whether it's installed—
Bloc
Bloc
René Villemure Bloc Trois-Rivières, QC
The directives were not followed. I don't know what's going to happen.
Ms. Carr, do you think it's a corporate culture problem?
President, The Professional Institute of the Public Service of Canada
It definitely is.
Again, when we have departments that can decide what to do on their own without any kind of oversight, if we're not watching, then they're not doing.
When it comes to the privacy assessment, I did hear, “Well, they said we did one way back.” I would say that we need to update things, so that when new versions come out and new technology comes out, we start to use them. I equated it to saying that we're still subscribing to Napster when everybody is now on Spotify or Apple Music.
We can't have an assessment that has been done on really old technology.
Bloc
René Villemure Bloc Trois-Rivières, QC
That's a good comparison.
Policies are already in place, and those policies are part of the organization's structure. It seems to me that the structure isn't the problem, because the directives and policies are there. The problem is that they aren't followed.
Do we need more directives and policies, or should we instead focus on the culture that exists? As I listened to the officials, I thought to myself that leadership starts at the top. That isn't happening, so what do we do?
President, The Professional Institute of the Public Service of Canada
Again, let's talk about repercussions. You now have 13 departments that said they didn't do them: “Oops, sorry.” There are no repercussions.
It's going to take repercussions. It's going to take you taking away authority from deputy ministers. It's going to take you actually getting into the weeds and saying that since they didn't follow, you're going to roll back their authorities.
Bloc
René Villemure Bloc Trois-Rivières, QC
Say we take those actions. Do you think it will restore the trust of your 75,000 members?
President, The Professional Institute of the Public Service of Canada
If there are actually repercussions for people who don't follow the policies and directives, it will, 100%.
We are really good at making sure that public servants are following the policies. Why are we not putting that same scrutiny on deputy ministers?
Bloc
René Villemure Bloc Trois-Rivières, QC
All right.
I'm going to ask you the same question, Mr. Prier. Do you think that would help restore people's trust?
President, Canadian Association of Professional Employees
I agree completely with Jennifer on this one.
Enforcement measures and serious consequences for breaches of privacy need to be taken seriously. The next steps that need to be taken are entirely at the level of senior management being disciplined for allowing these breaches to occur in the first place.
We talk about a culture change. Culture is a very vague thing to change. I think serious consequences for breaches of privacy are, in fact, the steps we need and we need to get specific on what those are each time this happens.
Bloc
René Villemure Bloc Trois-Rivières, QC
When deputy ministers are told that they are expected to do X, Y and Z, should we include privacy protection as one of those things?
President, The Professional Institute of the Public Service of Canada
Again, every public servant is a Canadian citizen, as you are a Canadian citizen. I think we have to have clear lines on what your privacy is. We should expect a level of privacy. You should not be able to look at my kids' photos just because—
President, The Professional Institute of the Public Service of Canada
Yes, go ahead.
Bloc
René Villemure Bloc Trois-Rivières, QC
I'm almost out of time, so I'm going to be quick.
The government communicates its expectations to deputy ministers. Should those expectations include protecting privacy?
President, The Professional Institute of the Public Service of Canada
There is no short answer to that.
President, The Professional Institute of the Public Service of Canada
All right.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Villemure.
Ms. Carr, you'll be glad to know that Mr. Brock and I still play Pong on our Commodore 64.