Information & Ethics Committee on Feb. 15th, 2024

[Jennifer Carr]

Yes. It's a shared responsibility. But if you don't tell me up front what I can and cannot do, if you do not disclose that you are going to go in.... If I access a website to get at my photos, you can then delve through those spiderwebs and touch everything I've used. That has not happened at this point.

[Nathan Prier]

I believe those boundaries are being established, and the right to the privacy of your personal use of the phone or of the other device has also been kind of established. We're finding the different guardrails as we go here.

I would say that's not what we're talking about here right now. We're talking about the proactive disclosure of a technology that should have been disclosed to those employees using those devices. When we're talking about informed consent, we believe it goes way past informed consent when we have to find out what technologies are on our devices through an access to information request and not through that proactive disclosure.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

How much time do I have, Chair?

[The Chair, Conservative, John Brassard]

You have 35 seconds.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

At this time, I just want to get a clarification. Currently, when someone is hired and joins the federal public service, and has gone through the rigours and processes, what consent or information is provided to that individual?

I'll hear from Jennifer and then Nathan, quickly.

[Jennifer Carr]

It is a mix, depending on the department you work for. Obviously, I believe you are provided with your values and ethics. That's the requirement, and you have to sign off on that. Other than that, I don't think there is a set package for every department.

Again, as we decentralize and allow departments to take over the individual policies, it depends.

[Nathan Prier]

I've worked for multiple departments and can tell you that it's wildly inconsistent in terms of how a new employee or somebody who's getting a new device is trained and given the ability to consent to what they're consenting to.

Yes, it is a shared responsibility, of course, but in some cases, it has felt more like the terms and conditions of a new iPhone when I'm being told about the various rights and responsibilities I have with a government device. Training might be something that's necessary, but again, I don't think that's exactly what we're talking about here.

[The Chair, Conservative, John Brassard]

Thank you.

Thank you, Mr. Sorbara.

It is now over to Mr. Villemure for two and a half minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

We've talked about the code of values and ethics for the public service, but let me tell you that it doesn't provide much in the way of clarity.

I'm going to follow up on a question I asked in the last round.

In the past, deputy ministers were told that they had to meet certain expectations in relation to the code. Their knowledge of the code and their ability to implement it were assessed. I'm not sure how successful that was.

Ms. Carr, do you think similar expectations as regards privacy should factor into a deputy minister's performance assessment? In other words, come the end of the year, practices they had introduced or their compliance with privacy measures would be assessed.

[Jennifer Carr]

That's a big question. We're talking about performance management. I have lots of things to say on that as well.

Yes, if you had a checklist of policies that you say they didn't comply with, then it is important to find out how many people filled out their ethics survey and that sort of stuff.

I think it's a bigger question—

[René Villemure, Bloc, Trois-Rivières, QC]

Sorry to interrupt you, Ms. Carr, but I don't have much time.

Do you want to answer that, Mr. Prier?

[Nathan Prier]

I believe performance management might be one way to do this.

I think consequences for privacy breaches should be the true tool we're using here.

[René Villemure, Bloc, Trois-Rivières, QC]

One of the things we were told a lot is that using the tool was the only way to achieve the desired outcome. Do you think that's true?

[Nathan Prier]

Do you mean whether the access to information request was the only way to get—

[René Villemure, Bloc, Trois-Rivières, QC]

I'm talking about deploying the tool on devices.

A lack of supervision tends to lead to certain behaviours. Better supervision would prevent certain behaviours and thus obviate the need for surveillance.

[Jennifer Carr]

I think that's the whole point of the privacy impact assessment. What information are you trying to get? Let's talk about the time theft. Let's talk about whether people are at the workplace. Can we obtain that information through other means, other than going invasively through a device?

That would be why the assessment exists, and it should be the primary focus of getting the data in a less intrusive manner.

[René Villemure, Bloc, Trois-Rivières, QC]

That's great.

[Nathan Prier]

I don't have much to add to that, except that the proactive disclosure element of a new technology being used is really at the core of where the trust was breached here. Keeping that in mind, regardless of the results of what the technology was trying to achieve, as much as that's a bigger conversation, I think the proactive disclosure element here, just to add to what Jennifer said—

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Villemure.

It's over to Mr. Green for two and a half minutes.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you very much.

Often, in preparing for these committees, you go through a set of questions that might be asked and review really important points you want to make. Sometimes, we fail to ask those questions.

Are there any points of interest or answers you'd like to provide this committee beyond your opening statement and beyond the questions that have been asked?

[Jennifer Carr]

I will actually be at the defence committee in two weeks, talking about contracting out.

The overall accountability and the decentralization of responsibilities to departments has created an environment where it's hard for me to tell my members what rights they have, how they're going to be applied and what policies are going to refer to them, and provide them guidance.

I would really like to say we all work for the federal government and we have one employer. However, we have many different rules and regulations, depending on where we work.

[Nathan Prier]

I believe most of my points were made today.

Thank you.

[Matthew Green, NDP, Hamilton Centre, ON]

Should you have any additional points, or should you hear information you'd wish to have a rebuttal to, notwithstanding the next session with the Treasury Board, please feel free to submit that to the committee for our consideration.

We really appreciate your work.

[Jennifer Carr]

I'll definitely get you that directive so that every committee member knows that it is allowed.