Industry Committee on March 12th, 2015

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

Finally, I get the chance to ask my last question.

Ms. Vonn, my colleague, Ms. Nash, brought up the Spencer decision and the ensuing events in British Columbia, as well as the reactions of the commissioner and industry committee thus far. If I understand correctly, your organization participated in the review of the Personal Information Protection Act in light of the Spencer decision. Is that right?

[Micheal Vonn]

No, I'm sorry, we were not. We made a written submission, but we were not able to be there in person.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

But you did submit a written statement.

[Micheal Vonn]

Yes.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

We received a letter from the privacy commissioner indicating that Bill S-4 was based somewhat on B.C.'s model. That is what it was supposed to look like, but suggestions changed in light of the report. I think that calls into question the provisions in Bill S-4. Would you agree with that? Do you think we should find a way to bring the bill in line with the report recommendations as well, in order to achieve that alignment between the acts?

[Micheal Vonn]

Yes, I believe the coherence between the acts can be achieved if the analysis in Spencer is taken into account in relation to the voluntary disclosures.

I appreciate what the member was saying about there having been a year. We would like to move forward; it is long overdue. However, in the midst of that year we have had the decision that gives new import to the notion of what constitutes personal information and how we guard it. The most problematic provision that we keep hearing about is the voluntary disclosures outside of the areas of protecting vulnerable persons, fraud abuse, etc.

The sweep of this provision is something that in British Columbia and Alberta the privacy commissioners are now calling for reconsideration of. I think it's imperative that this committee essentially participate in this now-national debate on what the sweep should be. It would make sense to essentially sever that in this discussion so that the good, uncontentious parts of the bill could move forward.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

Ms. Sali, I believe your organization contributed to the review of the Personal Information Protection Act. Do you have any comments in that connection?

[Meghan Sali]

I am not entirely certain whether or not we proceeded in PIPA. That was a little before my time with the organization.

But if I may, I would love to mention, on the note that you just asked Ms. Vonn, that some have suggested that the approach in Alberta and B.C. has been totally fine and that there have been no problems with it. But one thing we've seen—and I'd like to echo Dr. Geist's testimony on this—is that the disclosure itself is not necessarily revealed to the person whose information has been disclosed. Often, the point is to disclose the information without the consent or knowledge of that individual, meaning that the affected individual would have a very hard time knowing that their information had been disclosed and in fact wouldn't be able to complain; or there would be no evidence of harm in that case, as they hadn't known.

I think the claims made by some that those B.C. and Alberta rules are not harming people is unfortunately untrue.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you.

How much time do I have left, Mr. Chair?

[The Chair, Conservative, David Sweet]

You have a minute left.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I have a question for Mr. McLinton and Mr. Littler.

Bill S-4 provides for a mechanism to notify individuals of security breaches. You appear to support that. The model proposed under Bill S-4 will require organizations to, themselves, determine whether the breach creates a risk of significant harm to the individual or not. Do you think it would be easy for your members to make that assessment? Do you expect to receive some support to ensure you are properly complying with the bill's provisions?

[Jason McLinton]

From the discussions we have had with our members, I think there is already, first, as I mentioned, a very high level of compliance with PIPEDA's requirements. It really comes down to a question of the size of the organization, as Mr. Littler suggested. We represent retailers from the very smallest mom-and-pop shops to the very largest general merchandisers and grocers. There are valuations already occurring at every level, and some more sophisticated than others, because at the end of the day the customers are the most valuable thing our organizations have.

That is happening now, but I guess with the smaller retail businesses it may be happening less formally. Compliance with PIPEDA is high, and reviews are already occurring with members.

[The Chair, Conservative, David Sweet]

Thank you very much.

We will now move on to our final questioner, Mr. Lake.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

I just have a quick question out of curiosity to start.

Meghan, you're from Vancouver, is that right?

[Meghan Sali]

I am.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

We have the B.C. Civil Liberties Association. Previously we had the B.C. Freedom of Information and Privacy Association. It seems like there is some sort of a core group from the Vancouver and Lower Mainland area. I'm curious about that. I did a little bit of research.

It's kind of interesting that Vincent Gogolek, who was here with us on Tuesday from the B.C. Freedom of Information and Privacy Association, was formerly the policy director of the B.C. Civil Liberties Association.

Philippa Lawson, who was also a witness on Tuesday, is listed on her LinkedIn page as a consultant, and her recent clients include the the B.C. Civil Liberties Association and the B.C. Freedom of Information and Privacy Association.

[Micheal Vonn]

That's absolutely correct. Privacy is a growing concern among Canadians, but the legal community with privacy expertise is a growing and evolving community. We are in fact few on the ground.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

And speaking as one voice, or several voices, at this committee, it seems.

[Micheal Vonn]

Not always speaking with one voice, but many times we do achieve a consensus.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Okay. I found that interesting as we were listening.

To the banks, what I'm hearing is that your main complaint is that the investigative bodies section of the legislation is too restrictive. I think that's in proposed paragraphs 7(3)(d.1) and 7(3)(d.2). That's your main concern, correct?

[William Crate]

Yes, and in particular proposed paragraph 7(3)(d.2). It may be less than what we can do today.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

That previous group that I just talked about all seemed to say with one voice that maybe it was the exact opposite.

I believe I've heard you all say, in almost the same terms, that that was the exact opposite.

We've heard others say similar things to what the bankers are saying. It seems like maybe we have a balance somewhere in between, which we see with legislation like this.

As for the retailers, you talked about proposed section 6.1 in what would be the new legislation. You're saying it needs some clarity concerning vulnerable persons. Is that correct?

[Jason McLinton]

That's correct. I would not say that's our primary concern though. To sum it up in a word, our primary concern would be undue administrative burden. That's the common thread, so that there's clarity around consent.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

In terms of the reporting requirements?

[Jason McLinton]

Reporting, record keeping, and all the other requirements that are mentioned.