Industry Committee on March 24th, 2015

[Prof. Avner Levin]

Right now there is this investigative body model in which the banks, typically, that are concerned about fraud—they've presented in front of you—have these investigative bodies, and then they share information through the investigative bodies. That's how they wrap their heads around these issues of fraud.

The bill is going to remove that and have these other provisions in which organizations can interchange with other organizations on the information. The concern is that it's too broad, that it's not actually what industry is requesting and it opens the doors to what we're seeing right now in the area of copyright—companies abusing the legislation and sending people thousands of notices, telling them they have to comply with Canada's Copyright Act or else.

It's an area where we don't want organizations having what I would call the “unfettered” ability to go to other organizations without the consent of the individual just because they think an agreement has been breached.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

But is there any...? This is a system that exists, I believe, in B.C. and Alberta, right?

[Prof. Avner Levin]

Correct.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

I believe that system has existed for a long time. What evidence is there that this has resulted there?

[Prof. Avner Levin]

Well, they don't have any Internet service providers, and mostly the concern here is around Internet service providers.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

It's very specific to Internet service providers?

[Prof. Avner Levin]

Yes—which this legislation regulates.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Okay.

[The Chair, Conservative, David Sweet]

Thank you very much, Mr. Levin and Mr. Lake.

Madam Papillon, you have eight minutes.

[Annick Papillon, NDP, Québec, QC]

If possible, I will let my colleague ask the first question.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I'm going to ask another question, and then I will yield the floor to Ms. Papillon.

Mr. Levin, in reply to the question put by my colleague Ms. Nash, you said we would need to have some idea of the privacy breaches which might occur, and not only of those that have already occurred

How could such a system be set up? It seems to me that this is something that we could consider in the future. How could we include the system in the act or in the mechanism regarding breach of privacy? Could you elaborate on that?

[Prof. Avner Levin]

Thank you for the question.

I think this is the classic situation in which the banks don't have to disclose their own vulnerabilities, but they can, in aggregate form through an organization like the CBA, report all the various attacks that have occurred in a certain time period and where those attacks originated from. They'll say that they've had all of these malicious people from the outside or they've had malicious insiders. The Bank of Nova Scotia has been sued in a class action lawsuit because of the actions of a rogue employee. That was not audited properly by the bank in terms of accessing personal information.

We need to know that not just when it comes up and somebody sues, but in aggregate form so that we can develop policy accurately and so we can ask where the focus should be. Should we be investing in protecting our national infrastructure, and the banks are part of that? Should we be telling customers to keep their passwords safer and so on and so forth?

These are basic questions that we don't have answers to. If we got them in aggregate form about various industries, it would be very helpful. We don't have that right now.

[Annick Papillon, NDP, Québec, QC]

I would like to get back to bill S-4. As we know, this bill would give the Privacy Commissioner new powers to conclude compliance agreements with organizations. However, given that there will likely be insufficient resources at the Office of the Commissioner, do you not think that he may be overwhelmed by the task, and that every breach that occurs will be submitted to him?

M. Levin, could you answer that question, please?

[Prof. Avner Levin]

I know that the committee asked the commissioner about the resources and received I think a very diplomatic answer in response. I think this is part of the transition that office has to go through, looking back on 15 years of private sector legislation.

When I hear that the commissioner is repeatedly talking about education, it disturbs me, because regulators don't spend a lot of time educating. You don't hear the CRTC talking about educating. You see them making the rules and changing the landscape for the businesses they're regulating. I think the same thing has to happen with respect to the Privacy Commissioner. They need to move to the model of regulator. If that means they need to move resources internally or get additional resources externally, then I think that's what has to happen.

But if we care about personal information protection, we must have an effective national regulator. Right now, we don't have that. As we've said before, we have an ombudsperson who deals with trying to solve complaints.

[Annick Papillon, NDP, Québec, QC]

I appreciate your comments very much.

Somebody is going to have to maintain a record of the breaches for the Office of the Privacy Commissioner of Canada in order for him to be able to verify them. However, if the commissioner does not have the necessary resources, I fail to see how he will be able to do that. In that case, these records may be of no use.

I will continue in this vein and ask you for your opinion. What would the solution be in that case?

[Prof. Avner Levin]

From my perspective, and just sort of blue sky, obviously you need to bolster the resources of the Privacy Commissioner to deal effectively with these issues, just as when Canada's anti-spam legislation was passed and in Canada you needed to bolster the ability of that department within the CRTC to control that.

I don't know if it's been done sufficiently or not, but to me, in legislation, you set the mechanism of what you want the organization to do, and then the resources just naturally follow from that. Why give somebody the powers and then not give them resources to do their job? To me that doesn't make any sense.

[Annick Papillon, NDP, Québec, QC]

That seems very logical to me.

What would happen if a business simply did not declare its breaches of data in order to protect its reputation? In your opinion, would the fear of contravening the law's requirements be sufficient to ensure that businesses will be diligent in this regard?

[Prof. Avner Levin]

I don't want to tar all the companies with the same brush. I think we have a lot of organizations in Canada that try to do the right thing. Certainly the big organizations that are Canadian try to be in compliance with legislation and are very concerned. That's why you see them appear here in front of the committee trying to advocate for this and that point of view. I don't want to say that people don't want to be in compliance, but we could be in situations where, again, just because of the force of business and what's a pressing issue upon them, they deal with some things more seriously than they deal with others because of the penalties they think will happen or not.

The legislation gives them the discretion to decide as it is, so they have the power to just make the decision. I think the jury will be out on whether that is an effective system or not. Time will tell. It may be one of those things that you do have to revisit and say it is not working properly and we need to move to a two-stage system, or we need to set the threshold at a lot lower level to make sure they are in compliance.

[Annick Papillon, NDP, Québec, QC]

Indeed.

Of course, we always assume that businesses will act in good faith and be diligent. However, we are here to draft a bill, and a lot of time has gone by before it was referred to the committee.

The matters raised here were also raised at the Senate as well as in previous Parliaments. That is why it is important that we draft a ''2.0 bill'', that is to say a very current, very modern piece of legislation. We fear there may be some gaps in this regard.

I would like to ask the other witnesses if they think businesses would be concerned about potentially contravening the law, while assuming of course at the outset that everyone is going to act in good faith. We have to ensure that businesses are diligent and see whether this act might generate some fear. This is the right time and place to speak out on the matter.

Mr. Brown, Ms. Romanko and Ms. Cooper, would you like to speak to this?

[Douglas Brown]

In the section that I commented on, clause 10, proposed paragraph (d.3), one of the protections in the reporting is that it's reported to a government institution, and as I said in my comments, the institution itself as it becomes defined is presumably going to have limitations on its jurisdiction and what it can do with the information. So in protecting the flow of information, at least for the sections I've commented on, that's probably a check and balance that's already built into the legislation.

[Annick Papillon, NDP, Québec, QC]

That is indeed the case. Moreover, the importance of adequate resources has been raised several times, and not only by the Privacy Commissioner. This is the essential point that is being made at this meeting, I would say.

When greater powers are granted, there must also be additional resources. We say that we have to move forward, but this means additional human and financial resources. We have to be able to ensure that they will be there, otherwise, in practice, we will be far from being able to meet the objectives. That is obvious. In my opinion, that is the point that needs to be retained.

Thank you.

[The Chair, Conservative, David Sweet]

Thanks, Ms. Papillon.

Now, Mr. Lake, you're the final questioner.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

Thank you again, Mr. Chair.

I don't think I'll need very much time. I wanted to follow up with Ms. Romanko. There was a conversation around clause 5 regarding section 6, the consent clause, and you made a comment a couple of people ago, which I believe had something to do with folks with the mental capacity to understand. Would you reiterate the point you were making there?

[Catherine Romanko]

Yes, the issue was about consent and the effect of providing consent to disclosure of information. I was simply making a point that an individual who is deemed at law to be mentally incapable is not able to provide valid legal consent for anything. That would apply also to a minor. In British Columbia the age of majority is 19. Anyone under the age of 19 cannot provide consent except in certain statutory exceptions. For example, they might be able to provide consent to treatment if they meet the mature minor test for medical treatment, but they would not be able to enter into a contractual relationship, for example, without intervention of the court.

There are other provisions to protect. The idea of consent by someone who doesn't have capacity at law to provide it was my point.

[Mike Lake, Conservative, Edmonton—Mill Woods—Beaumont, AB]

All right.

Mr. Chair, I don't actually have more. I could fill time. I could talk for six minutes, but I don't think I have any more to add to that.