Industry Committee on March 12th, 2015

[John Carmichael, Conservative, Don Valley West, ON]

Thank you, Chair.

Welcome to our witnesses.

I'd like to begin with the Canadian Bankers Association. Feel free to determine who answers.

In your opening comments you talked about financial abuse, specifically of our most vulnerable. In your comments you said that PIPEDA limited you in much of what you would report when you saw a potential senior abuse or elder fraud, something going on that was inappropriate.

My understanding of Bill S-4 is that much of the remedy for this is now in place. I wonder whether you could talk to what works and what doesn't work to assist you so that your members can support and improve the situation of those most vulnerable clients.

[Linda Routledge]

The banks generally speaking would see potential or suspected financial abuse in the branches. It could be a client coming in with a caregiver or whoever and there being some kind of suspicious transaction. Right now, the first step of the bank would be to try to take that client aside so that they get them away from the suspected abuser, so that they can determine what the client wants to do. But in some cases that's not possible, and so we just have a suspicion.

Many times the amount of money may not be large in that instance, and that instance may not be fraud. We are constrained in being able to approach the police or the public guardian and trustee to ask for their assistance, because there is not a contravention of the law or fraud.

What we're looking for, and what Bill S-4 is giving us, is the ability to then escalate this matter and have it investigated further—because within the banks there is an escalation process—so that we can assess whether there is somebody else out there we can contact who would be able to help our customer avoid the abuse. It may be a parent, a sibling, or someone like that. We would assess and try to determine to the best of our ability whether that person is involved in the abuse—we recognize that in many cases it's a family member—and we would do our utmost to determine that the person we're contacting is not involved in the abuse.

That is where Bill S-4 would help.

[John Carmichael, Conservative, Don Valley West, ON]

Bill S-4 provides that ability for you.

I think it's important, because this is an area we all know is growing—

[Linda Routledge]

Absolutely.

[John Carmichael, Conservative, Don Valley West, ON]

—and when there is an opportunity for somebody to report, you want to know that the report is going to fall on ears that are able to listen and respond.

Going over to the Retail Council, I'd like to refer to your opening comments on consent in Bill S-4. In this paragraph you say, “We note that the bill contains a provision specifying that 'Consent is not valid unless how the information will be used is clearly communicated in language appropriate to the target audience.'”

Could you expand on that and talk to how that is going to benefit your membership?

[Karl Littler]

The section itself is relatively quiet on the intended protections and we've understood from the minister's comments in previous testimony that it's intended primarily to protect vulnerable individuals, and that's obviously a step that we wholeheartedly support.

We have heard from other witnesses that they see the section as superfluous and in fact, the current regime prospectively provides sufficient protection for vulnerable individuals. We're not experts in the operation of that but what we would say is this. We have no difficulty with the underlying premise of this. Where we would benefit, frankly, is from specification of the groups intended to be protected under this. I had named a few, but I'm sure that it is a non-exhaustive list. We would hope to see a regulatory power in there that would in fact specify those groups—again, in a non-exhaustive fashion.

I think for retailers the challenge that requires guidance, frankly, is this. There are a lot of scenarios here. Judging whether somebody is a minor will depend upon whether it's a face-to-face situation or an online transaction. In one case, you're presumably relying on whatever parental controls exist over smart devices and otherwise. If an individual in most cases indicates that they're over the age of whatever, you don't know with certainty whether you're getting what is really valid consent. In an in-store situation, it's easy enough to tell whether it's an eight-year-old but it may not be quite so easy to determine whether it's a person of the age of majority or if indeed that's the appropriate test in all circumstances. You're getting into a lot of subjectivity on issues of whether somebody has linguistic fluency, so a lot of what we're looking for in this is more specific guidance. We do find this provision general. We hope that there will be further development from it.

[The Chair, Conservative, David Sweet]

Thank you, Mr. Littler.

That's all the time we had.

Now on to Madam Borg for five minutes.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much, Mr. Chair.

I'd also like to thank the witnesses for joining us today.

I apologize for my tardiness. Unexpected things tend to come up a lot when you're an MP. My sincere apologies for missing some of the presentations and discussions. Forgive me if any of my questions have already been asked.

My first question is for Ms. Sali, but Ms. Vonn may also wish to answer.

Previous witnesses have told the committee that an oversight mechanism is needed in order to keep abuse in check when it comes to the disclosure of personal information without consent. Do you agree with that suggestion? What might such a mechanism look like, in your view?

[Meghan Sali]

I won't speak to what the mechanism could look like as I'm not an expert in that area. I definitely support the idea of a system to inform these people of what has gone on. If it doesn't put an investigation at risk—and this is obviously contained in the bill—we definitely believe that any disclosure of private information should be disclosed to the person whose personal information is being shared. As well, we also support the idea that if there is an investigation going on, where that sharing of information could possibly impinge on the investigation, the moment it no longer does, it should be shared with that customer as well. People's private information is, obviously, as previously stated, extremely revealing about their lives and about their personal activities. They have a reasonable expectation of privacy according to Spencer on this information. Definitely, we do think that there should be some sort of a reporting system in place so that people are aware of when their personal information has been shared and with whom.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Ms. Vonn, would you like to comment?

[Micheal Vonn]

I can echo the concern about failure of notice. We don't have the system that you see in the United States where essentially your third party information holder becomes the guardian of the situation relative to protecting your rights. If this is your information, you are most likely to object to its use in a meaningful fashion if you have notice. I don't see that there's a way around that if we're serious about protecting individual rights.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

Ms. Sali, I'm going to read a comment made by your executive director. I'm going to read the quote in English as I don't have it in French. It reads as follows:

...this legislation, while welcome, does almost nothing to tackle the serious problem of ongoing government surveillance against law-abiding Canadians.

Since we are studying the bill before second reading, we have the ability to propose amendments to PIPEDA that don't necessarily appear in Bill S-4. I see that as a golden opportunity. Unfortunately, the government seems convinced that the bill is going to pass as is, regardless of the amendments suggested by all the witnesses. That's truly unfortunate.

In light of your executive director's comments, do you think the committee could improve certain aspects of the bill?

[Meghan Sali]

Yes, the amendment we'd like to see is the complete removal of non-notified voluntary disclosures. We think that voluntary disclosures, as Ms. Vonn has stated, put your telecom provider specifically in our interests in the position of being a gatekeeper and deciding what information they choose to reveal about you to any other company or in fact any other entity that is doing an investigation. As we've stated before, the scope of that investigation can include a number of different things, not just as we've noted before. It can expose Canadians to issues with copyright trolls, strategic anti-expression lawsuits, attempts at uncovering whistleblowers through specious lawsuits, and a range of other potential harms.

So the amendment that we'd like to see is the removal of non-notified voluntary disclosures.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you very much.

[The Chair, Conservative, David Sweet]

Merci.

Now on to Madam Gallant for five minutes.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Thank you, Mr. Chairman.

My first question is to the Bankers Association. Which elements of the proposed framework of the investigative bodies give cause for concern, which you outlined?

[William Crate]

In particular, it's (d.2), because it does restrict the sharing of information for prevention, detection, and suppression, to just fraud. By way of background, banks are under persistent and evolving threats. And the secret sauce, I think, in the security world within the banks is trying to prevent and detect, because by the time you have an occurrence, an event, or a crime, it's too late. A lot of effort is spent on trying to prevent and detect.

By way of example, we see a lot of organized crime paying attention to theft of credentials. That's theft of consumers' information. They're attempting to do that. You see that online yourselves, probably through phishing. That's not fraud. It's theft of information. If we can identify that earlier on by sharing information, whether it's IP addresses with each other that can be blocked, and then they can start to pay attention to accounts or information that may be at risk, I think that's much better than investigating and being reactive at the end. We're just concerned that the legislation may not permit that, going forward.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

So it's not that aspects of the new framework are of concern. It's what you just described.

[William Crate]

Yes, what we'd be asking the committee to consider for our industry is greater latitude. I would suggest swapping “fraud” for “crime” because then that covers everything.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Thank you.

To the Retail Council of Canada, at the time of the review of PIPEDA, your organization stated that the current investigative bodies regime presents challenges to combatting organized crime in your industry. Would you elaborate on that, please?

[Jason McLinton]

I'll commence by saying that it was a couple of generations before my time. But, yes, I think that retailers, while not necessarily a driving force behind amendments to PIPEDA, would be generally supportive of anything that would allow for the speedy resolution of anything that was either occurring or about to occur. To perhaps restate what my colleague has said, the retail sector is generally supportive of this, primarily not just because of the specific provisions that are included in the bill, but because it supports PIPEDA, which retailers already have a very high level of compliance with, and that is working very well specifically because of its outcomes-oriented and technology-neutral approach.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

I will go back to the banking association. Financial institutions also provide insurance coverage for loans. What aspects of PIPEDA or Bill S-4 prevent the banking system from accessing the metadata or medical information on an insurance applicant under that same umbrella with the banks? The reason I ask is, the bank lender knowing a client's medical information could prejudice the lender. What you had stated previously is that you'd like to have more sharing of information to prevent a crime. How does the customer know that this barrier will not be crossed?

[Linda Routledge]

There is a specific provision in the Bank Act prohibiting it.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Thank you. I have no further questions.

[The Chair, Conservative, David Sweet]

All right.

Madame Borg, you have up to five minutes.