Thank you to the Chair and members of the committee for your invitation to share our views on your current study.
As you said, I am accompanied by Gregory Smolynec, the Deputy Commissioner. Due to a prior engagement, I cannot be here for the entire meeting, but Mr. Smolynec will remain afterwards to address any questions that you may wish to ask.
I am here to speak to you today about what the Privacy Act does and does not allow with respect to the production of documents under provisions of the Act related to disclosures of personal information.
Let me begin by stating that the role of the Office of the Privacy Commissioner is to oversee compliance with the duties and obligations in both the Privacy Act (the public sector law) and the Personal Information Protection and Electronic Documents Act (the private sector law).
The public sector law, the Privacy Act, enacted in 1983, applies to the personal information handling practices of federal government departments and agencies. The act defines personal information as information about an identifiable individual that has been recorded in any form. The act states that personal information collected by federal institutions can only be used for the purpose for which it was collected, for uses consistent with that purpose, or for purposes specifically provided for under subsection 8(2) of the Act. I believe this to be the provision most relevant to this discussion.
According to the Privacy Act, personal information cannot be disclosed without consent unless exceptions delineated in subsection 8(2) of the Privacy Act apply, two of which are most relevant for this discussion.
The first I would highlight is paragraph 8(2)(m). This provision allows for the disclosure of personal information where, “in the opinion of the head of the institution...the public interest...clearly outweighs any invasion of privacy that could result from the disclosure, or” if the “disclosure would clearly benefit the individual to whom the information relates”. Fundamental to this exercise of discretion is that there must be a clear public interest in the disclosure. The discretion to disclose or not to disclose personal information lies with the institutional head.
The second relevant provision is paragraph 8(2)(c) of the Privacy Act, which allows for the disclosure of personal information to “a court, person or body with jurisdiction” and the power “to compel the production of information” through the issuance of an order, subpoena or warrant. In relation to this provision, we recognize Parliament's authority to compel the production of documents that may contain personal information and acknowledge that the Privacy Act therefore allows for the disclosure of personal information to a committee.
In previous instances where this issue has arisen, we have recommended that committees explore a range of options to ensure that the authority of committees is exercised in ways that do not unduly invade on privacy. For example, mechanisms that might be considered include having committees come to an agreement that they will limit the personal information sought to only those cases that are clearly necessary to resolve the public interest at issue. Another possibility would be to hold meetings in camera where personal information is to be examined and discussed, or ensuring that there are proper procedures for securing that information once it is in the possession of both the committee as a whole as well as individual members. These are examples of privacy protective measures.
We hope—