Industry Committee on March 10th, 2015

[Philippa Lawson]

Do you mean proposed subsection 20(1.1)?

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Yes.

[Philippa Lawson]

It reads:

Subject to subsections (2) to (6), 12(3), 12.2(3), 13(3), 19(1), 23(3) and 23.1(1) and section 25, the Commissioner or any person acting on behalf or under the direction of the Commissioner shall not disclose any information contained in a report made under subsection 10.1(1) or in a record obtained under subsection 10.3(2).

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Perfect. Do you have PIPEDA in front of you as well?

[Philippa Lawson]

I'm sorry...?

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Do you have PIPEDA, the actual legislation, in front of you as well?

[Philippa Lawson]

Yes, I do.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Can you read subsection 20(1), the one that is already in the act, and tell me how the two differ?

[Philippa Lawson]

The only difference is that proposed subsection 20(1.1) just adds the breach notification.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

So the new provision in Bill S-4 really just makes the new legislation consistent with the old. Is that correct?

[Philippa Lawson]

Well, it decides to treat breach.... Yes. I mean, effectively yes; it treats breach notification in the same category as everything else.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

In this area, then, the real impact, as far as our talking about the powers of the commissioner is concerned, happens in proposed subsection 20(2), I believe, where it states:

The Commissioner may, if the Commissioner considers that it is in the public interest to do so, make public any information that comes to his or her knowledge in the performance or exercise of any of his or her duties or powers under this Part.

In other words, it is in giving the commissioner the power to name and shame organizations that don't follow the law.

[Philippa Lawson]

Yes.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

That is a very significant power, if you think about organizations that may have been publicly identified as breaching privacy law. We can point to several examples in which I would say it would be—

[Philippa Lawson]

That's right. In the present writing, the subsection overrides the confidentiality.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

So I would certainly say that this new provision, in this bill, has some teeth.

I want to go to proposed section 6 with you as well, if I may, because I found your comment about its being an elephant in the room interesting. You talked about the pretence that companies are obtaining consent.

As I read it, as I look at the new legislation as written and as you identified, it uses the phrase “an individual”. It says here that it is

valid if it is reasonable to expect that

—and this is the part that you had an issue with, but that I actually love—

an individual to whom the organization’s activities are directed

—so basically any individual—

would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.

So it is for everybody. It doesn't just single out kids or any other particular group of the vulnerable; it actually applies to everybody. That consent is only valid if it is reasonable to expect that an individual to whom you're targeting your activities would understand the nature, purpose, and consequences of the collection.

You talked about the elephant in the room. I agree with you. I often think that clicking a mouse to try to get through to something else that you want to use on the Internet is just too easy. I think this clarifies that people need to understand the nature, purpose, and consequences. Don't you agree?

[Philippa Lawson]

I agree, and I like the section for that reason. It provides the clarification that the industry needs. However, the point I'm making is that those additional words that are not in the formulation from Bill C-12 actually restrict the application of this. They do not expand it; they restrict it. The earlier formulation was that consent is only valid if it's reasonable to expect that the individual understands it. That means that it has to be reasonable to expect that the individual in question in that particular transaction understands it. So the earlier formulation covers everyone. If it's a child, if it's a senior, whoever it is, that individual needs to be able to understand it.

The new formulation restricts it. The new formulation says that you only have to worry about individuals to whom you are directing your activities, and it's very easy for an organization to say, “We are directing our activities to adults, not to children.”

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

If some 11-year-old decided that he or she wanted to sign up for a service at an organization that's clearly directing its activities towards adults—for whatever reason there are no parental controls on the computer or there's not proper supervision for the kid—I think it's ridiculous to assume that organization would somehow be able to know that. I don't know how you would possibly do that.

[Philippa Lawson]

If you're looking at the protection of children, in the United States there's specific legislation called the Children's Online Privacy Protection Act. It may be a good place to start if what you want to achieve is the protection of children.

I don't think that proposed section 6.1 achieves protection of children. I think it—

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

It's an interesting dynamic, though, because I think—

[Philippa Lawson]

It does help clarify generally what you need for consent.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

I think what you're raising is probably a really important issue as well, something that probably falls outside the scope of this piece of legislation, but probably inside the scope of a lot of the legislation that we're moving these days. That might be a conversation for another day.

When we look at clause 7 and the private investigations, I found Ms. Borg's comments interesting. She seemed to suggest that somehow we should peer into the future, to see what provincial legislatures might actually do with their legislation—and she used the word “proactively” to make that change now. I don't know how we can do that. I'm not sure how we would presume to know what legislators at the provincial level will do. What we do know is what they've done, which is to pass legislation in this area that is very similar to what we're doing now to try to be consistent with what they're working on.

[Philippa Lawson]

I have a point on that, and again it's something that I'm not understanding. In this regime, the federal government is supposed to be leading and the provinces are supposed to be passing substantially similar legislation. If the provincial legislation is substandard and not achieving the level of protection that Canadians deserve, then—

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

But, to be fair, no one is actually saying that the provincial legislation is substandard and no one's able to point to anything that's wrong with the provincial legislation. Two provinces have almost identical wording in their legislation.

[Philippa Lawson]

Well, I pointed out something in Alberta's legislation that people seem to be ignoring, but I think you've heard from Dr. Geist about problems at the provincial level. We're simply not hearing about it because there's no transparency.