Finance Committee on April 29th, 2010

[Kevin Thomas]

Yes.

[Thomas Mulcair, NDP, Outremont, QC]

I read:

5.(2) The commissioner of the Financial Consumer Agency of Canada, appointed under section 4 of the Financial Consumer Agency of Canada Act, must, from time to time but at least once in each year, make or cause to be made any examination and inquiry that the commissioner considers necessary to determine whether the provisions of this act and the regulations are being complied with and, after the conclusion of each examination and inquiry, must report on it to the minister.

Further down, a list of investigative powers is spelled out. Do the same investigative powers apply in relation to the voluntary code of conduct?

[Kevin Thomas]

Yes.

[Thomas Mulcair, NDP, Outremont, QC]

In subsection 5(6), it says towards the end: “[...] information regarding the business affairs of a payment card network operator [...] is confidential and must be treated accordingly.“

Is there any penalty in case of infringement of this section? The security of information obtained by credit card companies is very important to the public. Are there any penalties for non-compliance?

[Kevin Thomas]

In the case of a voluntary code, we can't assess fines. If regulations are in place, then yes, we can.

[Thomas Mulcair, NDP, Outremont, QC]

This is a general answer to a very specific question. Thank you very much, this is useful information, but my question was more specific. Let us forget about the voluntary code of conduct for now. If this act takes effect, under subsection 5(6) this information has to be kept confidential.

What is the sanction, the penalty for non-compliance? Is there a penalty set out for non-compliance? I do not see anything in the bill.

[Leah Anderson]

Are you speaking of the information held by the commissioner, or the information—

[Thomas Mulcair, NDP, Outremont, QC]

Any legislation has to be interpreted in its context, so let us look at the context of subsection 5(6). I am trying to establish the possible implementation framework. This will not necessarily be passed, but if it is, a huge amount of information presently held only by the network operators will be placed under their protection and could easily be captured by others. This says that the information is confidential and must be treated as such.

So I am asking you a very specific question. What is the penalty if somebody does not comply with this requirement? If confidential information is not treated as such, what is the penalty? This information is very important: it can provide enormous economic advantage and its price can be negotiated. This type of information is as valuable as gold. I want to know if penalties are set out somewhere as I cannot find anything.

[Leah Anderson]

This provision is targeted at the commissioner. It's to protect the confidentiality of information, because, clearly, the commission receives a lot of sensitive business information. You see this in other legislation, with the Superintendent of Financial Institutions, for example. To the extent they receive confidential information from an institution, it is the obligation of the commissioner, and anybody acting in respect of the commissioner, to treat that information confidentially.

[Thomas Mulcair, NDP, Outremont, QC]

This I understand. I will try to give you an example. Somebody with a USB key works there and captures information. It is worth a fortune if he decides to sell it. This clause says that it must be treated confidentially, which is fine, it is a nice expression of a good intention, but if it is totally unenforceable because there is no penalty, it is an intention without value.

[Leah Anderson]

Sanctions on whom? Are you talking about sanctions on the commissioner? This is targeted at information received by the regulator.

[Thomas Mulcair, NDP, Outremont, QC]

Let us say, as in my example, that an employee of the commissioner walks around with a USB key and captures this highly valuable information and decides to sell it. The act of capturing it, transmitting it, selling it, all of that is contrary to subsection 5(6). I simply want to know what is the sanction, what is the penalty, if any, if there is a fine, if there is jail time. You cannot create an offence without setting out a penalty, it would be declared null for lack of clarity.

So I just want to know what the basis is. I see no guarantee that this information will be kept confidential, other than an expression of intent. I see no means of enforcement to make this intent real.

[Leah Anderson]

As we've said, this is really to protect information received by the commissioner. To the extent that any person contravenes their responsibilities outlined in the law, that's a clear contravention of the law. But I'm not an expert on the judicial system and how it would proceed.

[Thomas Mulcair, NDP, Outremont, QC]

Where is the offence? That is what I keep asking you. It is an offence against what? What is the penalty? Where is the offence? This clause does not create an offence.

[Pascale Dugré-Sasseville]

If I may try to answer your question, in your example you seem to talk about professional misconduct on the part of an employee of the agency.

[Thomas Mulcair, NDP, Outremont, QC]

Yes.

[Pascale Dugré-Sasseville]

This would be captured not under the Financial Consumer Agency of Canada Act, but under the Public Service Act.

As public servants, we have duties and obligations to fulfil. If there is a breach of duty, the consequences are spelled out in another legislation, not this one.

[Thomas Mulcair, NDP, Outremont, QC]

But you are referring here to a disciplinary power, which is sui generis. The same misconduct by a professional can entail penalties at different levels.

Let us leave the sphere of the federal public service and let us take for example a nurse who steals morphine destined to a patient. This could be a violation of the Narcotic Control Act or of the Criminal Code. It could lead to a sanction by an institution, for example the hospital where she works. The College of Nurses might also impose a disciplinary measure on that person: this is what you raise by referring to the Public Service Employment Act. For an offence of that nature, it is as if the only penalty were that imposed by the College of Nurses and there was nothing in criminal law. But there would at least be a penalty in this case under another law.

Here, there seems to be no sanction, neither in your answer nor in that of Ms. Anderson.

[Pascale Dugré-Sasseville]

Let me take a concrete example in order to illustrate the intent of this provision. We have the Security of Information Act. Somebody might come along and say he knows that a given person provided such and such information and seek to obtain it from the agency. This establishes clearly that this information is to be protected.

[Thomas Mulcair, NDP, Outremont, QC]

This protection is entirely fictitious if there is no penalty. You mention the Security of Information Act. It has a full range of penalties and sanctions. There are criminal penalties spelled out in this act. Here, there is really only an expression of intent.

In our view, this is a major deficiency in what is proposed. I do not believe in good intentions. I am here as a member of Parliament to legislate, in other words to enact laws that will have the effect of laws and that will be enforceable. This is not enforceable, it is merely an intent. This is nothing personal against you. I am simply saying that this is what I have before me and as a member of Parliament I find it lacking.

[The Vice-Chair, Liberal, Massimo Pacetti]

Thank you, Mr. Mulcair.

Mr. Ménard.

Let us try to limit ourselves to five minutes.

[Serge Ménard, Bloc, Marc-Aurèle-Fortin, QC]

I might be able to reassure my colleague.

My specialty is public security and justice. This is the first time I am involved in that type of thing, but I can still describe the issue for consumers.

For Mr. Mulcair's problem, I believe that once we have in the Criminal Code an offence of information theft, we will at the same time have a penalty that would be a deterrent in such a case. Like the nurse who steals medication such as morphine, this would be a criminal offence. What he describes is clearly a theft of information.

At any rate, I remain intrigued by this. We still hear complaints from the general public about the rates charged by credit card companies, which I find usurious. Is there anything in this bill that tries to solve that problem?

[Leah Anderson]

Not in this bill.

[Serge Ménard, Bloc, Marc-Aurèle-Fortin, QC]

So why do we have this bill? This is a law on payment card networks. Am I right to believe that payment card networks are what we call credit card companies in ordinary language?

[Leah Anderson]

This legislation providing the regulatory authority really targets the business practices between networks and merchants and acquirers. We have other consumer protection legislation that deals with a broader set of issues, but this is quite targeted at that relationship.