Industry Committee on June 18th, 2009

[The Chair, Conservative, Michael Chong]

Welcome to the Standing Committee on Industry, Science and Technology and to our 30th meeting this Thursday, June 18, 2009. We're here pursuant to the order of reference of Friday, May 8, 2009, to study Bill C-27. Before us today we have two organizations: the Office of the Privacy Commissioner of Canada and the Competition Bureau.

From the Office of the Privacy Commissioner of Canada, we have Madam Denham, who is the assistant privacy commissioner of Canada.

From the Competition Bureau, we have Mr. Duane Schippers, who is the deputy commissioner of competition of the legislative and parliamentary affairs branch.

I'd also like to mention that we have Mr. Baggaley from the Office of the Privacy Commissioner. He is their strategic policy advisor.

Welcome to all of you.

We'll begin with opening statements, beginning with the Office of the Privacy Commissioner of Canada.

[Elizabeth Denham, Assistant Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair and members of the committee, for inviting our office to address you on this important government initiative. I am Elizabeth Denham, Assistant Privacy Commissioner, and I am joined today by Hedy Kirkby, Acting Senior Legal Counsel and Carman Baggaley, Strategic Policy Advisor.

The Office of the Privacy Commissioner of Canada has long called for anti-spam legislation. We welcome and support the introduction of the Electronic Commerce Protection Act. This is an important piece of legislation that addresses a serious problem. Much more than a mere nuisance, unwanted electronic messages--or spam--have significant consequences for our economy. Spam affects productivity and undermines confidence in electronic commerce.

This legislation has the potential to help individuals and organizations deal with unsolicited electronic messages, and it also provides important redress mechanisms, including a private right of action. We believe it strikes the right balance between giving people greater control over the e-mail and text messages they receive, while still allowing legitimate businesses to continue to communicate with their clients and their customers.

In the run-up to the development of PIPEDA more than 10 years ago, concerns were expressed by businesses that are similar to those we've heard in this debate about ECPA. However, interestingly, in the PIPEDA review just two years ago, the business community did not raise the same concern that privacy rules would impede business. Business is adaptable. There's evidence that there's a competitive advantage to giving consumers choice and respecting their privacy. As well, for businesses that have actually been complying with PIPEDA for the past nine years and respecting the privacy of their customers, this law should have little or no adverse effect.

The legislation will help us fulfill our mandate to promote the protection of personal information. E-mail addresses are considered personal information under the Personal Information Protection and Electronics Documents Act, PIPEDA.

Our office is concerned about e-mail addresses being collected and used to send spam without consent. We're also concerned about the growing use of spam e-mails containing malware or spyware to collect personal information in order to commit fraud such as identity theft. I should also add that we see this legislation as complementing Bill S-4, which would amend the Criminal Code to deal with identity theft and related misconduct.

The CRTC, the Competition Bureau, and our office will share enforcement of the act. We look forward to working collaboratively with these two agencies and Industry Canada in carrying out our new responsibilities, including that of educating the public about this important new legislation. ECPA contains provisions to facilitate consultation, referral, and information sharing among the three agencies to enable more effective and efficient investigations and enforcement actions.

The three agencies will also have the authority to share information under written arrangements with foreign states where the information may be relevant to an investigation under a foreign law that addresses substantially similar conduct. This is an important provision that's going to help us deal with the challenge of a problem that really knows no borders.

The CRTC and the Competition Bureau will have shared responsibility for enforcing the anti-spam provisions, and those are the provisions dealing with the sending and the content of electronic messages. The Privacy Commissioner will have responsibility for investigating related contraventions of PIPEDA, specifically, the unauthorized collection and use of personal information through e-mail address harvesting, dictionary attacks, and the use of spyware to collect personal information.

The legislation will not change the existing enforcement powers of the Office of the Privacy Commissioner, nor is it expected to create a significant increase in complaints to our office. We actually anticipate that many complaints are going to be directed elsewhere, to the CRTC and the Competition Bureau.

The bill also imports two significant sets of amendments that have been discussed in the context of the review of PIPEDA. Under the first set of amendments, the Privacy Commissioner will have the discretion to decline to investigate a complaint--something we don't have now--or to discontinue a complaint investigation, including in cases where the matter could be more appropriately dealt with by the CRTC or the Competition Bureau.

Under the second group of amendments in ECPA, the commissioner will have the authority to collaborate and exchange information with provincial counterparts--not just those with substantially similar legislation--and with foreign counterparts who enforce data protection laws that are similar to PIPEDA. To be clear, these amendments apply to all our activities, not just those related to spam.

Under the proposed amendments to PIPEDA, the commissioner may decide not to accept a complaint if she believes that the complaint could be more appropriately dealt with under other available procedures. This includes procedures provided for under federal or provincial laws or grievance or other procedures. A complaint may also be refused if it is not filed within a reasonable amount of time--the evidence has gone stale--from the date when the issue actually arose.

The commissioner will notify complainants and also the responding organization if she decides not to investigate a complaint, and she'll provide reasons for her decision. The commissioner may reconsider a decision not to investigate if she is satisfied that there are compelling reasons to do so.

As well, ECPA provides the commissioner with the discretion to discontinue some investigations if she is of the opinion that there is insufficient evidence to pursue the investigation or if the complaint is trivial, frivolous, or vexatious.

The Office of the Privacy Commissioner of Canada has previously asked Parliament in the context of the PIPEDA review to provide the commissioner with the discretion to refuse or to discontinue complaints.

This is important because traditionally privacy issues have arisen in the context of interaction between one person and an organization. They have come to light as a result of a complaint by an individual. More and more often, however, critical privacy issues are arising from systemic threats, from rapidly advancing information technologies, including Internet applications and surveillance. This discretion to refuse and/or to discontinue complaints will, importantly, allow our office to focus our investigative resources on privacy issues that have broader systemic interest.

In closing, I would like to thank the committee for providing us with the opportunity to explain our role in enforcing this important new legislation and the reason we believe this initiative is going to help the office better protect the privacy interests of Canadians.

I would be happy to take your questions.

I would now be pleased to answer your questions.

[The Chair, Conservative, Michael Chong]

Thank you, Ms. Denham.

We'll now hear from Mr. Schippers from the Competition Bureau.

[Duane Schippers, Deputy Commissioner of Competition, Legislative and Parliamentary Affairs Branch, Competition Bureau]

Good afternoon everyone.

Thank you, Mr. Chair, for inviting the Competition Bureau to appear before the committee to discuss Bill C-27, a legislative initiative that targets spam.

It is rare that one finds an idea or a point of view that almost every Canadian can agree upon. Unsolicited electronic communication, or spam, is one of the most universally reviled features of the Internet age. While its most malicious forms may be designed to spread viruses or facilitate identity theft, a significant proportion of spam involves the false or misleading promotion of products or services, particularly in the health and financial sectors.

For those less familiar with the Bureau, our mandate is to protect and promote competitive markets and to enable informed consumer choice in Canada. Our principle statute, the Competition Act, allows us to carry out both civil and criminal enforcement against, among other things, deceptive marketing practices.

With the passage of Bill C-10, the law implementing the federal budget, the penalties for deceptive marketing practices under the Competition Act were strengthened, both in terms of the monetary penalties and through the introduction of restitution orders to get victims their money back. These amendments were designed to harmonize the act with our international counterparts and to improve the bureau's ability to promote truth in advertising.

The proposed legislation before you, Bill C-27, the Electronic Commerce Protection Act, would amend the Competition Act to allow the Bureau to more effectively combat false or misleading advertising in electronic communications and better protect the integrity of electronic commerce in Canada.

Along with the CRTC and the Office of the Privacy Commissioner, the bureau would be one of three partners carrying out responsibilities under this initiative.

The 2005 report of the Task Force on Spam established by the Minister of Industry identified “gaps in current Canadian law that must be filled”. As it stands now, the Competition Act contains both civil and criminal provisions to curb the use of false or misleading advertising.

However, Canada still has no equivalent to laws found in other industrialized countries that relate specifically to electronic commerce, such as the CAN-SPAM Act in the United States or the Spam Act in Australia.

The additions to the Competition Act outlined in Bill C-27 would help to clarify more precisely what cannot be done in electronic messaging and how competition laws would apply in cyberspace.

Specifically Bill C-27 would add more targeted civil and criminal provisions with respect to false and misleading advertising in electronic messages. It would provide authority for court injunctions to restrain conduct that falls within these new provisions and make certain that the act is technologically neutral. False or misleading representations in header information, such as subject lines or sender names in e-mails, in the content of the communication itself, or in locators, such as web addresses or URLs, would now be more broadly covered.

An example of a message that we have all received is one in which the subject line suggests that the message is a greeting from a familiar friend or trusted business, but whose content turns out to be an advertisement for a dubious product from a less than reputable source. This activity would fall under the new provisions as a false or misleading header.

An e-mail or text message advertising a bogus fuel additive, for example, falsely claiming to double your car's fuel efficiency, would be an example of a false or misleading representation made in the content of a message.

Similarly, a Canadian website that chooses a domain name or search terms to suggest that it is a source of job opportunities when it is merely a collection of links and vague advice would be caught under the “false or misleading locator” provisions.

While these examples may be covered to some extent under the current act, Bill C-27 would make it clear that they are, thus making it simpler and faster to take enforcement action against these forms of misleading advertising.

In addition to administrative monetary penalties and potentially even criminal prosecution, Bill C-27 proposes to expand court injunctive powers. The bureau will be able to seek court injunctions against spammers based in Canada or using Canadian equipment to engage in false or misleading advertising, and also against those persons and businesses supplying the spammers with the equipment and services used to carry out false or misleading advertising.

To ensure that the Competition Act remains in step with technological innovation, Bill C-27 amends definitions in the Competition Act to ensure that the act applies broadly to new technologies. For example, voice-over-Internet protocol, or VoIP, and text messaging would now clearly be within the scope of the Competition Act.

Furthermore, the framework provided for in the new Competition Act civil provisions serves as the basis to empower those affected by false or misleading spam to launch private actions under the remedial scheme in the Electronic Commerce Protection Act.

This means that enforcement will be coming from all angles, not just the Bureau or its government partners. In addition to a statutory per-message amount of damages, this scheme also allows plaintiffs to sue specifically for losses incurred as a result of the deceptive communications, ensuring that victims of scams, false advertising claims and other forms of deception have a potential way to get their money back.

In these difficult economic times, we can expect to see an increase in messages targeting not only consumers but also small and medium-sized businesses, which may suffer serious financial harm if they fall prey to misleading or false advertising messages contained in spam. It is the job of the Competition Bureau to protect Canadians from this kind of activity in all economic environments and to foster confidence in an honest marketplace.

The Competition Bureau has decades of experience in conducting investigations into false and misleading advertising and working with our domestic and international partners to achieve common enforcement objectives. For example, the bureau recently launched Project False Hope, an education and enforcement initiative that targeted false or unproven cancer cure claims found online. The project has resulted in 98% of those websites targeted by the bureau changing or removing the claims at issue in order to comply with the Competition Act. As part of the initiative, the bureau worked in collaboration with the Canadian Cancer Society to produce an awareness campaign and an informative pamphlet that has reached tens of thousands of individuals.

In other collaborative efforts, the bureau has worked with domestic and international partners, such as Health Canada, the U.S. Federal Trade Commission, and the U.S. Food and Drug Administration, to combat false or misleading claims surrounding weight loss and diabetes treatments. The bureau successfully took action against almost 100 Canadian-operated websites, with the vast majority changing or removing the claims at issue in order to comply with the Competition Act.

Cooperation is key to ensuring deceptive marketers cannot hide from authorities, in any jurisdiction. Experience conducting investigations, in both the on and offline world, combined with established cooperation networks, provides the right foundation to take action against spam.

Technological progress is a positive and powerful economic driver, but it comes with new ways to engage in deception, and Canadian law must keep pace. The new provisions, combined with the current provisions in the Competition Act, will provide a more complete framework to facilitate more effective and timely enforcement against deceptive conduct in the electronic marketplace in all of its forms.

Canada has been without anti-spam legislation and is lagging behind our major international trading partners. These changes allow the bureau, together with its partners, to more confidently and effectively enforce the law in an undeniably problematic but complex area.

We at the bureau are enthusiastic about the prospect of Bill C-27 becoming law. I welcome the opportunity to discuss the bureau's role and respond to any questions the committee members may have.

Thank you.

[The Chair, Conservative, Michael Chong]

Thank you very much, Mr. Schippers.

We'll now have approximately an hour of questions and comments from members of this committee, beginning with Madam Coady.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Thank you very much.

Thank you very much to both organizations for taking the time to appear and giving us your considered opinions on this bill, which is certainly an important one. I think both of you have indicated that there is a fair amount of support for anti-spam legislation, to say the least, and we're going to make sure that we make the best bill possible, so I appreciate your information here today.

I'd like to start with you, Ms. Denham, and ask a couple of questions on the PIPEDA legislation and its impact, and get your opinions on some concerns that have been raised at this committee and with me privately.

One is that the scope for anti-spam in these provisions may be too broad, with the consent provisions being too narrow. If I understand it correctly, the CSA model code has been adopted by PIPEDA. Basically, it defines “implied consent” as “where consent may reasonably be inferred from the action or inaction of the individual”.

This particular legislation is different from that. It's not as defined. Do you have concerns about how the act actually deals with the provisions for consent?

[Elizabeth Denham]

I don't have concerns about the level of consent that's required under ECPA.

Just to give you a bit of background, PIPEDA is a law of broad applications. It was created to work in a variety of situations. My view, our view, is that PIPEDA is a floor, not a ceiling, and that the form of consent in PIPEDA should be applied by looking at the sensitivity of the personal information. Express consent or opt-in consent is a higher form of consent; it's more privacy-sensitive than implied consent. I think that's appropriate here, because it's going to be effective in dealing with the problem that is spam.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

That's great. Thank you very much for the answer to that.

I want to ask a question now about your opinion of the anti-address harvesting, much along the same lines. Clause 78 of ECPA basically amends PIPEDA to create a private right of action with respect to it, and there are a number of things, including the collection and use of personal information under proposed paragraphs 7.1(3)(a) and 7.1(3)(b) of the Personal Information Protection and Electronic Documents Act.

Now, that departs from the structure--and we just talked about that--of PIPEDA in that PIPEDA recognizes that there are legitimate needs to collect, use, and disclose personal information without knowledge or consent. There has been discussion and concern raised to me that the anti-address harvesting prohibition may be too broad under ECPA in that PIPEDA doesn't trump law enforcement, but this particular act may. The scope is broader than that of some international legislation. No other international legislation prohibits the collection of address information for legitimate purposes. There is also the question, for example, of whether EPCA prohibits legitimate law enforcement.

I now ask you to put on your lens of PIPEDA, which does one thing, and EPCA, which does another, and give me your comments, please.

[Elizabeth Denham]

Thank you for that question.

We haven't been consulted by law enforcement, in particular, on this issue, but ECPA as a whole does not apply to the collection of personal information by law enforcement agencies, so that's our view. It applies only to harvesting and spyware activities.

The amendment you referred to in clause 78 of Bill C-27, under proposed section 7.1 of PIPEDA, does not refer to disclosures. So it doesn't refer to a disclosure, say, from a TSP to a law enforcement organization. It just uses the term “collection and use”. That's my understanding.

Perhaps my colleague, Carman Baggaley, can add to that.

[Carman Baggaley, Strategic Policy Advisor, Office of the Privacy Commissioner of Canada]

I'll add just a couple of very quick points just to reiterate that since the act applies only to commercial activities, law enforcement agencies aren't engaged in commercial activity, and therefore it doesn't affect the ability of law enforcement agencies to collect this information if necessary.

The other thing it doesn't do--and I'll use a concrete example--is in regard to the cases that you may read about in the newspaper where a law enforcement agency goes to a telecommunications service provider and needs an IP address or a name associated with an IP address. There are provisions in PIPEDA that allow that to be disclosed, either under warrant or on request under paragraph 7(3)(c.1). It wouldn't have any impact on that.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Can I use a couple of examples? Because you're using some yourself there. Do you feel that collecting information related to online harassment and stalking is fine under the ECPA? If you were involved, for example, in offline crimes like drug trafficking that might be discussed over the Internet or--I don't know even how to explain it--in some activities on the Internet related to that particular thing, do you think under the ECPA the provisions are broad enough to allow that to occur?

[Carman Baggaley]

A typical Internet service provider collects a great deal of information in the course of providing services. There's nothing in ECPA that prevents a telecommunications service provider or an ISP from disclosing that information that is already collected. What it does prohibit is someone specifically using a computer program to collect e-mail addresses. If they already have e-mail addresses in the course of their business, there is nothing that prohibits the disclosure of them.

[Siobhan Coady, Liberal, St. John's South—Mount Pearl, NL]

Thank you.

[The Chair, Conservative, Michael Chong]

Thank you, Madam Coady.

Monsieur Bouchard.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

Thank you, Mr. Chair.

Thank you for being here this afternoon to share with us on behalf of each one of your organizations, your respective expertise.

My first question can be addressed to either the Office of the Privacy Commissioner of Canada, or the Competition Bureau. Both your organizations must work with one another, but when it comes to implementing Bill C-27, the CRTC joins forces with you.

Will your respective mandates be changed? If so, what would the changes be?

[Elizabeth Denham]

Thank you for the question.

Our mandate and responsibilities under PIPEDA don't change under this act. Our powers don't change under the act. So I don't see significant changes in the operations of the Office of the Privacy Commissioner.

We do have the ability, under ECPA, to intervene in a private right of action. That's new to our organization. But our mandate and our responsibilities don't change.

[Duane Schippers]

The mandate of the Competition Bureau will not be changed by Bill C-27. It is, however, important to remember that we will work with the Office of the Privacy Commissioner of Canada and the CRTC a lot more.

We'll also be establishing, at some point, a spam reporting centre that should be a one-stop shopping place for Canadians to file complaints. We'll work cooperatively to handle those complaints so that Canadians don't have to try to figure out which of three organizations they should be trying to contact.

[Robert Bouchard, Bloc, Chicoutimi—Le Fjord, QC]

You talk about cooperation with the Office of the Privacy Commissioner of Canada, as well with your provincial and international counterparts. The representative from the Competition Bureau also talked about cooperation.

My question is for each and everyone of you.

You talk about cooperation with institutions over which you have no authority, be they abroad or in the provinces. Will this cooperation fall under any written memorandum of agreement? Will there be a verbal agreement or an actual written and signed agreement?

[Elizabeth Denham]

Our collaboration with provincial counterparts and international counterparts requires information-sharing agreements. Those will be established. It's based on information-sharing between other data protection commissioners who operate internationally and also in the provinces.

Right now the Privacy Commissioner has the ability to share information only with Alberta, B.C., and Quebec, because they have substantially similar commercial privacy legislation.

This broadens our ability to share information with other data protection commissioners. It also allows us to share information with an authority like the FTC and other foreign authorities that are combatting spam and have a similar requirement.

So there will be information-sharing agreements.

[Duane Schippers]

Information that's collected specifically under the new legislation is subject to these written agreements in order to share it with international counterparts.

That said, the Competition Bureau has a lengthy series of written cooperation agreements at a state-to-state level--with the United States, Japan, and other countries--as well as agency-to-agency cooperation arrangements, such as with the United States Postal Inspection Service. Across Canada at local levels we have a series of enforcement partnerships. We work with local police agencies as well as international counterparts.

In our Toronto strategic partnership, for example, we actually have the U.K.'s Office of Fair Trading as a member just because of the nature of misleading advertising representatives and how they.... They are borderless in the way they are transmitted to Canadians.

[The Chair, Conservative, Michael Chong]

We will now turn to Mr. Vincent.

[Robert Vincent, Bloc, Shefford, QC]

Thank you, Mr. Chair.

Ms. Denham, was an impact study done on the increased number of investigations you will have to carry out, given these requests? Are you going to receive additional resources to carry out these new investigations?

[Elizabeth Denham]

We don't anticipate carrying out a great deal of investigations under this legislation. We feel that the CRTC and the Competition Bureau will probably get the lion's share of investigative work. So we don't suspect that there will be a great deal.

In terms of the funding necessary, we think it will be incremental, that, for the first year, for example, we'll need some additional funding for inquiries and communication work. We hope to be very involved, in the centre that we talked about, with public education materials and compliance education materials. Our office does a great deal of that work. We suspect there will be some increase--a handful of FTEs--for this communications work, inquiries work. The second year, we may need some new investigators.

[The Chair, Conservative, Michael Chong]

Thank you, Ms. Denham.

Mr. Schippers, just briefly reply to the question.

[Duane Schippers]

Thank you.

We have asked for additional resources. On the one hand, we'll be building on a base of expertise that we already have, but we will require some additional resources, particularly resources to acquire computer software and other technologies to assist us in tracking false and misleading advertising spam. We've asked for the resources, and we've been assured that the resources we've asked for will be available. But they are relatively modest increases, given the mandate that we already have to work in this area on false and misleading advertising. Our part of this tranche is really limited to false and misleading advertising.