Evidence of meeting #30 for Industry, Science and Technology in the 40th Parliament, 2nd session. (The original version is on Parliament’s site, as are the minutes.) The winning word was spam.
A recording is available from Parliament.
Deputy Commissioner of Competition, Legislative and Parliamentary Affairs Branch, Competition Bureau
No. They were internal studies. This is not a public study; it is not on our website.
Bloc
Robert Vincent Bloc Shefford, QC
Even if the study is not posted on your website, we can request to receive that study. Based on what you are telling me, you spoke with two or three people, and based on your conversation with those people, things are fine. Yet, you did not carry out any study to determine anything concrete. You are saying that you checked up on the situation in the United States, Australia and the United Kingdom. Comparisons would have been done, letting you know that you would be needing such and such a resource or a given software. You carried out an internal inquiry, which became a study. That is what you are telling me.
Deputy Commissioner of Competition, Legislative and Parliamentary Affairs Branch, Competition Bureau
Perhaps the word “study” is not the best word to use. We called our colleagues abroad and asked them what they did with respect to their legislation. We made notes, within our organization. That is how the Bureau's employees carried out the study. We did not hire anyone externally to do the study. We used our own resources.
Bloc
Robert Vincent Bloc Shefford, QC
I understand; but without having to hire anyone, notes could have been made, allowing you to tell the government that, based on your information, you would need two or three extra employees and additional software. You could submit that to the government to get the resources and money you need to carry out concrete work on Bill C-27.
Deputy Commissioner of Competition, Legislative and Parliamentary Affairs Branch, Competition Bureau
We have a group of people in the bureau who look at our resourcing and make those extrapolations as to what the likely impact is going to be and what's likely required. Then there's a whole cabinet process that goes through that.
Bloc
Robert Vincent Bloc Shefford, QC
Thank you.
Ms. Denham, you said that you will probably not have to carry out many investigations. However, I remember that there was an investigation to which there was no concrete follow-up. That investigation was on the national do not call list. There was an uproar that was reported in the newspapers because anyone was able to purchase the national do not call list for $35 or $50, and get thousands of names.
Will the same thing happen with the national telecommunications opt-out list, or have you taken measures to make sure that what happened with the do not call list does not happen again?
Assistant Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Well, the do-not-call list, so complaints about the do-not-call list, would have gone to the CRTC in that case. But if your question is whether we anticipate a flood of complaints about address harvesting, for example, I think it might be difficult, in a lot of cases, for individuals to actually know what organization has committed the crime, so to speak, or who's in the wrong there.
So no, we don't expect the same kind of volume of complaints under the ECPA.
Conservative
Mike Wallace Conservative Burlington, ON
Thank you, Mr. Chair.
I want to thank our guests for coming this afternoon.
Just so you know where I'm coming from, I've been asking for us to get to line-by-line here to get this legislation through, because I think it's important to get it through. We've been talking about it for a number of years here on the Hill. Things are getting worse instead of better, of course, in that spam world.
I appreciate your comments. We've heard comments from other individuals and organizations about how big the net is. I think we need to start with the big net, to be perfectly frank with you, and then make some changes if required.
I was on a previous committee--Ms. Denham, it's nice to see you again--and we reviewed PIPEDA. It has an automatic review built into it. I think it's five years.
Do you have any comments from your organization as to how you'd feel about a five-year review attached to this piece of legislation?
Assistant Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I think it's very useful to have a review process built into the statute. It is a very good process, especially when you're dealing with legislation as new as anti-spam for Canada.
We had a very thorough and good review process, as you know, in PIPEDA. We're waiting for perhaps some more amendments. We'd like to see some mandatory breach notification coming our way--I'll just slip that in--because I think that's part of this whole world.
I agree that there should be a review process, especially when we all recognize that it's a simple problem, spam, but a difficult fix, a complex fix. I would encourage a review period.
Conservative
Mike Wallace Conservative Burlington, ON
I appreciate that.
To Monsieur Vincent, our next guest in the next hour is from the CRTC. I could be wrong, but to my understanding, that story about the list being available to be bought was actually false and not accurate. I'd like to know more, so if you don't ask the question, I'll be asking the question.
My question now is for the Competition Bureau. Hopefully you're able to answer it.
There is an exception in here for business-to-business communications. Do you as an organization have any issues with that? Most organizations that have come to see us have appreciated that there's a business-to-business exemption.
I'll use the wild example--this doesn't actually happen, and I want that to be on the record--of an insurance company, let's say, that's using spam to bug me about buying insurance from them. I've had no past relationship with them and I've never bought life insurance from them. But they keep sending me e-mails. I'm not happy about that. I can take action if this bill becomes law.
In a previous life, I sold racking systems for servers and monitors. I actually sold to many of the large insurance companies. They have beautiful computer rooms in their basements, with lots of names on them. I was able to put their hardware on a lot of my racks.
Under this legislation, an insurance company would still be able to e-mail me--or I could e-mail them, because they are a customer--any discounts, anything I had, as long as there was a relationship; that's my understanding. But in terms of starting a relationship, have you read anything in here, or could you tell me what you believe this would do, with regard to me trying to start a relationship with, say, a large insurance company that I'm trying to sell something to, from a business-to-business perspective?
Deputy Commissioner of Competition, Legislative and Parliamentary Affairs Branch, Competition Bureau
I think I'm going to let you ask that question of Mr. von Finckenstein, perhaps, when he comes here.
The reason I say that is that the way the amendments to the Competition Act work, there is no exemption for business-to-business communication. If you engage in false and misleading advertising, it's false and misleading advertising regardless.
Conservative
Mike Wallace Conservative Burlington, ON
It's just the advertising side. Okay.
So your role at the Competition Bureau is that if somebody, through the use of the electronic system, is promoting something that's not accurate, then we could take action on that, through you.
Deputy Commissioner of Competition, Legislative and Parliamentary Affairs Branch, Competition Bureau
That's exactly right.
Conservative
Conservative
Conservative
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
Yes. I have a couple of them.
First, as we're reviewing the legislation and potentially getting ready to go to clause-by-clause eventually, have there been any changes since the legislation has been drafted that you have identified and want to point out now? I'll just give you the opportunity to point out anything that you think you've heard in testimony, or whatever the case may be, where you might say, “You know, that's a legitimate point.”
Perhaps there's a minor tweak or something. It doesn't sound like there are any major ones, or you would have brought them up by now.
Acting Senior Counsel, Office of the Privacy Commissioner of Canada
We've identified a few things to Industry Canada for their consideration. Some are really just technical errors that were made in the final hours of drafting.
Perhaps one matter that we have been discussing with Industry Canada would be worth mentioning. We're permitted to share information, under the amendments that are being made here, with the CRTC and Competition Bureau. An amendment was made to PIPEDA to accommodate that. What wasn't done, and what we believe would be useful, was an expansion of that provision to enable us also to disclose information when we are intervening in a private right of action.
That was an oversight. Without such a provision, we would be prohibited under the confidentiality provisions in PIPEDA from effectively intervening in such a matter. We've brought that to the attention of Industry Canada.
Deputy Commissioner of Competition, Legislative and Parliamentary Affairs Branch, Competition Bureau
From the Competition Bureau's perspective—and we don't see it as a significant problem at this point—we want the most effective way possible to share information with our international counterparts so that we can take action quickly. Our concern is to make sure there are appropriate safeguards in the use of that information when it's shared, but whatever can be done to facilitate the sharing of information with international enforcement agencies is important in this borderless world of spam.
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
Going back to comments from the last committee meeting, I'll just read a quote from one of the witnesses, who said:
The bill would literally also prohibit consumers from e-mailing retailers, demanding a refund, asking for support, making a warranty claim within 18 months after purchasing a product.
Ms. Denham, in your interpretation of the bill, does the bill actually do those things? Would it, for example, make it impossible for someone to make a warranty claim 18 months after purchasing a product?
Assistant Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
No, I don't see that. I don't see that kind of prohibition. If a consumer needs to contact the retail organization, they can do so.
Again, if somebody purchases an expensive television and they're giving their e-mail address to the company, there's going to be a notice provision there. They're collecting an e-mail address, so again, I don't see the difficulty with warranties and recalls.
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
Okay.
There was also some talk about general updates on computers. We all have this. Windows needs an update and Microsoft just automatically accesses the computer and updates the software. But there was some concern that there would be cases in which there was an urgent need for an update on the computer and, under the provisions of this bill, a company wouldn't be able to actually access the computer to put that urgent update on there.
It seems to me that if there is a need for an outside source to access their computer, and they actually have the means to do that--they know where the IP address is to be able to get in and get onto your computer--there has to be a way that they got that information in the first place. Thus, there would be a mechanism for me to say yes, when there's an urgent situation on my computer, I'd like you to fix it.
Am I misreading that in any way, or is there anything you want to add to that?
