Industry Committee on March 10th, 2015

[Dr. Michael Geist]

Sure. Thanks.

The Spencer decision, as I think we've all recognized and have seen raised now concerning a number of bills and committees, finally brought to a head a long-standing, simmering issue around the question of whether there was a reasonable expectation of privacy and subscriber information. The Supreme Court of Canada quite clearly left no doubt that there is.

Bill C-13, the lawful access bill, which of course has now been passed, and Bill S-4 were I believe both drafted at a time when there was some amount of uncertainty. Government in particular, I think, took the view that they could argue that there was not a reasonable expectation of privacy in that information and that, therefore, either warrantless disclosure or voluntary disclosure was consistent with the state of the law.

That uncertainty changed last June when the Supreme Court of Canada issued its Spencer decision. My view is that the spirit of that decision, which clearly recognizes that there is a reasonable expectation of privacy of the information...so much so that we now see law enforcement shifting towards a world that recognizes this point, and which has to obtain a warrant before they get the information. That recognition surely ought to be consistent with what we put in legislation within something such as Bill S-4.

The problem with Bill S-4, drafted before Spencer, is that it runs completely counter to it. The expansion of voluntary disclosure without condition, as many other courts in other kinds of cases have said, without court oversight to me appears to run directly against the spirit of Spencer.

While Spencer of course deals with a law enforcement situation and here we are dealing with a private sector situation, the information itself is the same. It's subscriber information, and the question is under what circumstances we disclose. Moving towards expanding that disclosure through voluntary measures runs directly counter to what I think the Supreme Court of Canada has identified as the appropriate standard for disclosure.

[Vincent Gogolek]

Given the complexity of the vocabulary used, I will answer in English if I may.

I agree with what Professor Geist has just said. The federal Privacy Commissioner has noted that there are difficulties with Bill S-4 as a result of the Spencer decision. Our commissioner in British Columbia has as well. Commissioner Denham has been calling for tightening of our legislation “without consent to cases where the disclosure is “necessary” for purposes related to an investigation or proceeding.” At the same time that the current version of Bill S-4 is taking one approach, one of the substantially similar provinces—one of the committees—is heading in the opposite direction as a result of their understanding and interpretation of the Spencer decision. As Professor Geist said, the drafters of Bill S-4 didn't have the advantage of Spencer. We do today. We know what the Supreme Court of Canada said about this. I think we have to take this into account.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

Mr. Gogolek, I would like go back to the Personal Information Protection and Electronic Documents Act, or PIPEDA.

You were actively involved in assessing this legislation following the Spencer decision. I read with great interest the report that was produced and that recommends amending the legislation to improve the framework for disclosing information without consent and without warrant.

Obviously, we do not want to establish 10 different privacy protection regimes in Canada. We want to ensure in some way that it is comprehensive.

If we are in the process of amending an act that Bill S-4 is supposed to resemble, should we not be proactive and amend the bill so that it corresponds to the new act?

[Vincent Gogolek]

It's more an issue of harmonization and, for that, there are two key factors to consider. The first is privacy protection of all Canadians. As you said, the fact that this protection varies from province to province is not a good thing. Why would British Columbians be better protected than Ontarians or Newfoundlanders? I don't think this is the approach we should adopt. I am convinced that it is your responsibility to make these acts similar overall. This concept of similarity is legislative.

Mr. Carmichael asked a question about this earlier.

As for there being different regimes—things that are not quite the same—this also deals with the compliance of organizations and companies. If companies have different requirements in different jurisdictions, having to do one thing in B.C. or Alberta or Quebec and then something else in the rest of Canada—which gets back to Ms. Lawson's comment about order-making power—they will decide that, well, we've been ordered to do something by the B.C. commissioner, so we have to comply with that or be in contempt of court. This is the good thing about the compliance agreements, but, ultimately, we need order-making power, because a company may decide that it doesn't want to do that. So we will end up in different situations.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much. I have one last question for you.

We are studying this bill before second reading, which is a rather unique situation. For me, this means that we have an opportunity to really improve the bill and make important amendments in order to properly protect the privacy of Canadians. We also have the opportunity to go beyond Bill S-4. We can adequately amend PIPEDA to properly protect Canadians.

Do you think that, in the wake of the Spencer decision, we should amend the provisions of PIPEDA that relate to the disclosure of information without consent? Should we go that far? Do you think it's necessary to do this? Should we take this opportunity?

My question is for all of the witnesses.

[The Chair, Conservative, David Sweet]

We only have enough time for one answer.

[Dr. Michael Geist]

I'll jump in quickly by saying I think you raise a great point. Even today, I think we've already heard a bunch of potential suggestions about the kinds of things we could do that go beyond the four squares of the legislation itself.

With respect to Spencer, I think it points to what would be a really problematic outcome, one in which we find that where law enforcement is seeking information, they obtain court orders, whereas where that same information might well be disclosed in a private sector circumstance, there is no oversight or no limitations other than those found in the legislation. But as Ms. Lawson pointed out, they aren't very strong.

I think finding some amount of consistency, in terms of how we address the disclosure of personal information, especially when we're talking about things like subscriber information, which nowadays tells so much about our daily lives, would be very valuable and would allow us to have a more cohesive approach to privacy protection in Canada.

[The Chair, Conservative, David Sweet]

Thank you very much, Mr. Geist.

We will now move on to Mr. Daniel for eight minutes.

[Joe Daniel, Conservative, Don Valley East, ON]

Thank you, Mr. Chair, and thank you everybody who is here.

I'd like to direct my initial question to all of you, but we'll start with Ms. Lawson.

Ms. Lawson, in your introduction, you talked about defining when a breach should be reported by saying that it should be a real risk of significant financial loss. Can you perhaps expand on that a little bit? What would you consider to be significant financial loss?

[Philippa Lawson]

I was doing this bit of turn of phrase taking the legislation as it applies to security breach notification and applying it to companies. I think you need to step back, look at the big picture, and say, “Is this going to be effective? Are there sufficient incentives for industry to comply?”

When I say “comply”, I don't just mean reporting the breach and keeping the records of it; I mean complying by putting in place adequate security measures in the first place. I would think that what we're trying to do, first and foremost, is to make sure that companies put in place reasonable security safeguards. You need incentives for that, and in the private sector those need to be financial incentives.

I'm not sure if that was your question, but the point I was making is that I'm concerned that we may not have adequate incentives. A very strong incentive is negative publicity, and I don't understand why the Privacy Commissioner is being dissuaded in this legislation, under section 20, from publicizing those reports. Why don't we make them public? Why isn't transparency reporting part of transparency disclosure?

The submissions that CIPPIC made in 2008 on this issue were that we should establish a public registry of security breaches. Why are we treating these as confidential?

[Joe Daniel, Conservative, Don Valley East, ON]

Thank you.

Mr. Geist.

[Dr. Michael Geist]

My concern with the security breach disclosure provisions, which I think quite clearly are long overdue—we've been passed by by so many other countries and jurisdictions on this—is frankly that we had it better in the earlier iterations of this bill, in Bill C-12 and Bill C-29, which, as I'm sure you know, created a two-step process.

The first step is notification to the Privacy Commissioner of a material breach, and that, of course, didn't include the necessity of the real risk of significant harm. It was more a matter of the breach itself.

Then you get into the secondary question of under what circumstances you go down the much more challenging avenue of having to disclose this breach to everyone who's affected, recognizing that there may be circumstances in which that's appropriate and others in which it's not.

What we've done here, by removing that and creating a higher threshold for all disclosures, I think means that systemic breaches don't get disclosed. It means that, many times, important material breaches simply don't get disclosed, and organizations that have underlying problems don't have to fess up at all.

I think we recognize that in some circumstances we have the incentives for organizations not to disclose because of the costs and the embarrassment factor. We also want to ensure that we don't have so many disclosures that consumers are receiving notifications on a daily basis, and they simply tune all of that out.

There is a balance to be struck, but I think we did a much better job, the government did a much better job, of striking that balance, particularly for things like systemic breaches within an organization, by saying, “Surely that's the sort of thing that we would want the Privacy Commissioner's office to know about”, and yet we've effectively removed that in this bill. It's hard to understand why.

[Joe Daniel, Conservative, Don Valley East, ON]

Mr. Gogolek, do you have any comment?

[Vincent Gogolek]

I think I would just agree with the other two witnesses. I think it is important, as Professor Geist stated, as related also to the transparency reports and making them public rather than private, that we do know about this, especially in terms of, as Professor Geist just suggested, the commissioner being aware of situations where there could be a systemic problem. I think that's vital.

[Joe Daniel, Conservative, Don Valley East, ON]

Thank you.

Following on from that, clearly the Internet doesn't have any borders as such. That adds a dimension of complexity towards privacy, breach of privacy, and things like that. In fact when we actually talk about all this reporting, in my view it doesn't necessarily capture the theft of data, which the organization may not actually even know, having seen lots of different ways of hacking computers, etc.

Does the mandatory data breach reporting help to reduce the risk of identity theft? Anyone can start.

[Philippa Lawson]

Absolutely; I would say that the first and foremost most important purpose of breach notification is to put in place incentives for the companies themselves to put in place the security measures that prevent the identity theft from happening in the first place.

But I'm concerned for the reasons I've expressed. I'm concerned that the regime here is not strong enough.

[Joe Daniel, Conservative, Don Valley East, ON]

Okay.

Does anybody else want to comment on that?

[Vincent Gogolek]

Again, I'm agreeing with Ms. Lawson, but also, in terms of dealing with the question of breach notice fatigue, I think it's possible to deal with that through the notification itself. If it's something that does not relate to...or where you're just being advised that something happened that may affect your personal information, it's different from, “Okay, you'd better cancel your credit cards and get new ID”, or things like that.

So I think it can be dealt with at that stage rather than just saying there's no obligation to report.

[Dr. Michael Geist]

The answer, of course, is yes, security breach disclosure does help address identity theft, for the obvious reason that it creates a stronger incentive for organizations to do a better job of securing the information they collect. It provides notification to users in some circumstances so they can take appropriate safeguards and try to mitigate against the potential harm that could occur from identity theft. But let's be clear: we've waited nine years for this legislation. We started conducting hearings on this back in 2006. This is a long period of time. Merely saying that we have a provision that will help, but not help as much as we could otherwise....

Particularly given the kind of globalization of information that you've suggested, and particularly given, I think, our increasing awareness of the harm that can arise out of identity theft, we have to get it right. We don't just have to try to get a provision that will help. We have to get a provision that will in an optimal way ensure that Canadians are more effectively safeguarded against identity theft. As I've tried to suggest, I think we can do better.

[Joe Daniel, Conservative, Don Valley East, ON]

Okay.

How much time do I have left?

[The Chair, Conservative, David Sweet]

You have 20 seconds.

[Joe Daniel, Conservative, Don Valley East, ON]

All right.

On the consent issue, I mean, nobody actually ever reads any of that consent stuff before they use some of these products. What suggestions do you have to improve that process?

[Philippa Lawson]

I would say to stop focusing on consent so much and put in place some hard limits. Let's acknowledge that consent is unrealistic in many situations, and put in place hard limits on what companies are allowed to collect in the first place and use and disclose later on.

[The Chair, Conservative, David Sweet]

Thank you, Madam Lawson.

Ms. Sgro, you have eight minutes.

[Judy Sgro, Liberal, York West, ON]

Thank you.

That's the area that I am most concerned about. Every time we pick up our BlackBerry or whatever gadgets we have, I agree that we don't read it. I would suggest that very few people read any of that. It's just an automatic check. It's a nuisance, and we just agree to it—until we find out that we have no protection, or very little protection. I think that's what we are trying to do here: to look at how to protect the consumer.

I attended a conference on cybersecurity yesterday. Certainly the issues that were raised there about security, whether you're talking about the Internet and so on, somehow make Bill S-4 look like it's still nowhere near what it should be, or the kind of legislation we need to be putting forward to better protect Canadians. I think it's unrealistic, frankly, to think that with this legislation companies are going to be reporting all of these breaches and so on. I think they'll ignore it. I think a $100,000 penalty is insufficient for a significant breach, based on the kinds of things we're learning through this process.

Certainly, Dr. Geist, your comments about transparency and disclosure would go toward improving it, as far as the real risk that consumers are facing is concerned, before they get into things like identity theft and violation of their basic rights. I don't want all my information shared with every Tom, Dick, and Harry who wants it. If we are going along with Bill S-4—and, from my party's perspective, I'm not sure that we are, but at least we're trying to make some improvements—what else would you suggest we need to put in here to make it stronger and more enforceable? I would ask that of all three, given my timelines here.