Evidence of meeting #36 for Industry, Science and Technology in the 41st Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was information.
A recording is available from Parliament.
Barrister and Solicitor, As an Individual
Do you mean proposed subsection 20(1.1)?
Barrister and Solicitor, As an Individual
It reads:
Subject to subsections (2) to (6), 12(3), 12.2(3), 13(3), 19(1), 23(3) and 23.1(1) and section 25, the Commissioner or any person acting on behalf or under the direction of the Commissioner shall not disclose any information contained in a report made under subsection 10.1(1) or in a record obtained under subsection 10.3(2).
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
Perfect. Do you have PIPEDA in front of you as well?
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
Do you have PIPEDA, the actual legislation, in front of you as well?
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
Can you read subsection 20(1), the one that is already in the act, and tell me how the two differ?
Barrister and Solicitor, As an Individual
The only difference is that proposed subsection 20(1.1) just adds the breach notification.
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
So the new provision in Bill S-4 really just makes the new legislation consistent with the old. Is that correct?
Barrister and Solicitor, As an Individual
Well, it decides to treat breach.... Yes. I mean, effectively yes; it treats breach notification in the same category as everything else.
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
In this area, then, the real impact, as far as our talking about the powers of the commissioner is concerned, happens in proposed subsection 20(2), I believe, where it states:
The Commissioner may, if the Commissioner considers that it is in the public interest to do so, make public any information that comes to his or her knowledge in the performance or exercise of any of his or her duties or powers under this Part.
In other words, it is in giving the commissioner the power to name and shame organizations that don't follow the law.
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
That is a very significant power, if you think about organizations that may have been publicly identified as breaching privacy law. We can point to several examples in which I would say it would be—
Barrister and Solicitor, As an Individual
That's right. In the present writing, the subsection overrides the confidentiality.
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
So I would certainly say that this new provision, in this bill, has some teeth.
I want to go to proposed section 6 with you as well, if I may, because I found your comment about its being an elephant in the room interesting. You talked about the pretence that companies are obtaining consent.
As I read it, as I look at the new legislation as written and as you identified, it uses the phrase “an individual”. It says here that it is
valid if it is reasonable to expect that
—and this is the part that you had an issue with, but that I actually love—
an individual to whom the organization’s activities are directed
—so basically any individual—
would understand the nature, purpose and consequences of the collection, use or disclosure of the personal information to which they are consenting.
So it is for everybody. It doesn't just single out kids or any other particular group of the vulnerable; it actually applies to everybody. That consent is only valid if it is reasonable to expect that an individual to whom you're targeting your activities would understand the nature, purpose, and consequences of the collection.
You talked about the elephant in the room. I agree with you. I often think that clicking a mouse to try to get through to something else that you want to use on the Internet is just too easy. I think this clarifies that people need to understand the nature, purpose, and consequences. Don't you agree?
Barrister and Solicitor, As an Individual
I agree, and I like the section for that reason. It provides the clarification that the industry needs. However, the point I'm making is that those additional words that are not in the formulation from Bill C-12 actually restrict the application of this. They do not expand it; they restrict it. The earlier formulation was that consent is only valid if it's reasonable to expect that the individual understands it. That means that it has to be reasonable to expect that the individual in question in that particular transaction understands it. So the earlier formulation covers everyone. If it's a child, if it's a senior, whoever it is, that individual needs to be able to understand it.
The new formulation restricts it. The new formulation says that you only have to worry about individuals to whom you are directing your activities, and it's very easy for an organization to say, “We are directing our activities to adults, not to children.”
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
If some 11-year-old decided that he or she wanted to sign up for a service at an organization that's clearly directing its activities towards adults—for whatever reason there are no parental controls on the computer or there's not proper supervision for the kid—I think it's ridiculous to assume that organization would somehow be able to know that. I don't know how you would possibly do that.
Barrister and Solicitor, As an Individual
If you're looking at the protection of children, in the United States there's specific legislation called the Children's Online Privacy Protection Act. It may be a good place to start if what you want to achieve is the protection of children.
I don't think that proposed section 6.1 achieves protection of children. I think it—
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
It's an interesting dynamic, though, because I think—
Barrister and Solicitor, As an Individual
It does help clarify generally what you need for consent.
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
I think what you're raising is probably a really important issue as well, something that probably falls outside the scope of this piece of legislation, but probably inside the scope of a lot of the legislation that we're moving these days. That might be a conversation for another day.
When we look at clause 7 and the private investigations, I found Ms. Borg's comments interesting. She seemed to suggest that somehow we should peer into the future, to see what provincial legislatures might actually do with their legislation—and she used the word “proactively” to make that change now. I don't know how we can do that. I'm not sure how we would presume to know what legislators at the provincial level will do. What we do know is what they've done, which is to pass legislation in this area that is very similar to what we're doing now to try to be consistent with what they're working on.
Barrister and Solicitor, As an Individual
I have a point on that, and again it's something that I'm not understanding. In this regime, the federal government is supposed to be leading and the provinces are supposed to be passing substantially similar legislation. If the provincial legislation is substandard and not achieving the level of protection that Canadians deserve, then—
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
But, to be fair, no one is actually saying that the provincial legislation is substandard and no one's able to point to anything that's wrong with the provincial legislation. Two provinces have almost identical wording in their legislation.
Barrister and Solicitor, As an Individual
Well, I pointed out something in Alberta's legislation that people seem to be ignoring, but I think you've heard from Dr. Geist about problems at the provincial level. We're simply not hearing about it because there's no transparency.