Evidence of meeting #40 for Industry, Science and Technology in the 41st Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was amendment.
A recording is available from Parliament.
Conservative
Director, Privacy and Data Protection Policy Directorate, Department of Industry
Thank you, Mr. Chair.
The amendment is substantively the same as the Liberal amendment, so the analysis is the same. You have to have the knowledge and the consent of the individual in producing the information, and the personal information has to be incidental to the work product.
Conservative
The Chair Conservative David Sweet
All right. We're looking at PV-4 and PV-5.
(Amendments negatived [See Minutes of Proceedings])
Thank you very much. Now we'll go to amendment Liberal-2.
Liberal
Judy Sgro Liberal York West, ON
Thank you, Mr. Chair.
Clearly, this is an area that many of us on this side have concerns with. The CBA, as well as others, flagged it as having potential problems. Clearly, a work product exemption to the definition of “personal information” is generally understood to encompass non-sensitive personal information incidentally created in the course of one's employment, which you referenced.
But it's that whole issue of consent that continues to be a problem. Again, my amendment is going to restrict the exception to circumstances where the employee is aware that the information is being collected and where the intended use of the information collected is consistent with the intent of the original work, such as during a job interview, and would meet that definition.
Again, it's that same issue. You must be aware of the fact that we all have concerns about it on this side. Do you not think there is some way we can clarify this particular issue to make it clear what kind of definition we're talking about?
Director, Privacy and Data Protection Policy Directorate, Department of Industry
I think there are two ways in which the issues you're raising are addressed. The first is that part of PIPEDA, in section 5, provides this overarching requirement that any collection, use, and disclosure be reasonable in the circumstances. Notwithstanding whether you get someone's consent, notwithstanding whether an exception applies, a court or the Privacy Commissioner looking at a complaint under any of these exceptions would first determine whether the actions of the organization were reasonable.
That applies in a lot of situations in the workplace, for example with video surveillance. It may be reasonable to install video surveillance in the teller area of a bank, but it wouldn't be reasonable to install that surveillance in the bathroom. That's already been applied, and that reasonableness standard would apply to this exception as well.
The other point is that the use has to be consistent with the purpose for which the information was collected. The example that I use is that if I'm an employee of Industry Canada and my boss says, we want to put you in a video to talk about how great it is to work for the public service, and I agree to do that, they can turn around a year later and recut that video and still use my personal information, my image. They don't necessarily have to go back and get my consent, provided that the video they produced is consistent with the original purpose, which is to promote the public service. What they couldn't do is take that video and then, say, sell it to an advertiser to then use my image for offering products for training to public servants, or something like that, because that wouldn't be consistent with the purpose for which the information was originally collected.
Liberal
Judy Sgro Liberal York West, ON
Mr. Chair, what about the issue of monitoring computer keystrokes as a way of punishing an employee?
Director, Privacy and Data Protection Policy Directorate, Department of Industry
To the extent that they're collecting personal information, if their use of that personal information they're collecting is consistent with the purpose for which it was collected.... Monitoring keystrokes is the same as looking at the document you've typed. If they're using the document for a purpose that's consistent with why it was originally created, then it would qualify for the exception. If they're using those keystrokes in some completely unconnected way, it's inconsistent with the original purpose, it wouldn't be permissible under the exception. If they were doing it in a manner that a court considered unreasonable, in other words it wasn't fair, it didn't demonstrate a use of good judgment, if it was patently unreasonable then the exception wouldn't apply either.
Conservative
The Chair Conservative David Sweet
Is there any other discussion?
(Amendment negatived [See Minutes of Proceedings])
Now to amendment NDP-2.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Thank you, Mr. Chair.
The amendment being moved corresponds exactly to the testimony of the Privacy Commissioner of Canada. I think his testimony is essential and must be considered when we study a bill that directly concerns his sector of responsibility. The Privacy Commissioner suggested that the threshold that allows for the sharing of information without consent had to be raised. There has to be more than simple suspicion.
Through this amendment, I suggest that we lift the threshold so that the organization must have reasonable grounds to believe that the information relates to an investigation.
I think that this amendment is greatly needed. I hope the government will accept it, even though we know it does not intend to change the bill and simply wants to ignore the testimony we have heard.
Conservative
Mike Lake Conservative Edmonton—Mill Woods—Beaumont, AB
Again, in the interest of time and grouping some things together here, I believe there are six NDP amendments in this area of private investigation, fraud prevention. There's one additional Green Party amendment. Maybe I'll ask the officials to comment on that group of amendments so I don't have to go back and forth seven times.
Director, Privacy and Data Protection Policy Directorate, Department of Industry
Thank you, Mr. Chair.
This is a recurring theme through about four of these amendments of replacing the standard as proposed in Bill S-4, which is that the investigation or the fraud prevention activities would need to be reasonable for those purposes, with the standard of the organization having to have reasonable grounds to believe that something had happened warranting an investigation, or that fraud had occurred warranting the fraud detection, suppression, or prevention activities.
The second part deals with the last part of the test as proposed in Bill S-4, which says it would be reasonable to expect that disclosure with the knowledge and consent of the individual would compromise those activities.
This group of amendments replaces “reasonable for the purpose” with “reasonable grounds to believe”. The two thresholds are different as I've mentioned in the last response. The “reasonable for the purpose” is an objective standard. Looking at a situation, a court or the Privacy Commissioner would look at the conduct of the organization in the circumstances and look at whether their actions in disclosing the information are reasonable. Did they exercise good judgement? Were they fair? They would look at factors like the sensitivity of the information being disclosed and the seriousness of the conduct that was being investigated, in the case of investigations, or the seriousness of the fraud that was being looked for.
By changing to “reasonable grounds to believe”, it increases the threshold to the point where the organization would have to have compelling and credible evidence that something had occurred that warranted an investigation, or have compelling and credible evidence that fraud had occurred. It's a higher threshold. The reason why Bill S-4 proposes a lower threshold is that the purpose of these investigations in many circumstances, and the fraud protection prevention and suppression activity, is precisely to obtain clear and compelling evidence to meet that threshold of “reasonable grounds to believe”. The organization then can move from “I have a suspicion” or “I have an allegation of wrongdoing” to conduct some sort of internal investigation, determine that there is clear and compelling evidence that wrongdoing had occurred, and then move it to the next level. In the case of a criminal matter, that's referring it to law enforcement or in the case of an agreement among professional associations, such as lawyers or doctors, moving it into disciplinary action against the member of the organization.
Conservative
The Chair Conservative David Sweet
Is there any other discussion in that regard?
All in favour of amendment NDP-2?
(Amendment negatived [See Minutes of Proceedings])
Now, Mr. Lake, you had mentioned a grouping. I'm not privy to that information here in regard to this subject, so amendment NDP-3 would be our next one.
Is it germane to the conversation we just had?
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
Indeed, the same reasoning applies to amendment NDP-2 I presented earlier as well as to NDP-4. The objective is to increase the threshold and ensure that this information will be shared only in situations deemed reasonable.
I repeat that this is in keeping with the recommendations of the Privacy Commissioner. The same is true for amendments NDP-4 and NDP-5. It is extremely important that we take these comments into account since this is a bill that is supposed to protect privacy.
Conservative
Green
Bruce Hyer Green Thunder Bay—Superior North, ON
Thank you, Chair.
Our amendments PV-7 and PV-8 also deal with the same section. I wonder if you might want to have my comments now before further comments or vote.
Conservative
The Chair Conservative David Sweet
If it pleases everybody here, we'll deal with amendments NDP-3, NDP-4, NDP-5, and yours as well. If that pleases everybody, we'll debate them right now.
Yes, go ahead, Mr. Hyer.
Green
Bruce Hyer Green Thunder Bay—Superior North, ON
Mr. Chair, these amendments deal with deleting the lines regarding new warrantless disclosure provisions that go from company to company. As they're drafted in Bill S-4, companies will be able to share the general public's information without our knowledge or consent. Privacy experts are most concerned about this aspect of Bill S-4.
There has been a surge of recent cases of what some people call “copyright trolling”; in other words, companies sending extensive legal letters to customers threatening huge fines for downloading movies that people have never heard of.
As it stands, Bill S-4 would allow involved service providers to offer this information to anyone without the consent of the individual. Therefore, we feel that warrantless, non-notified voluntary disclosures should be removed from the bill.
Conservative
Director, Privacy and Data Protection Policy Directorate, Department of Industry
Mr. Chair, I would just point out the difference between these amendments and the NDP's amendments. The NDP amendments propose to change the threshold. These types of disclosures would still be permissible in certain circumstances, but it changes the threshold for when the disclosures would be permitted. This amendment would remove the exception entirely, so it would eliminate any exception to consent for either fraud prevention, detection, or suppression activities, or private investigations.
It's worth pointing out that the amendment in Bill S-4 that provides these exceptions.... They are not new exceptions. They change the way that these disclosures happen. Currently there are provisions in PIPEDA that allow for private investigations. We refer to it as the “investigative bodies framework”. Bill S-4 repeals the investigative bodies framework and replaces it with these exceptions. This amendment takes out the exceptions from Bill S-4, but it doesn't return back to the status quo.
Conservative
The Chair Conservative David Sweet
Are there any other comments on those amendments?
Just as a reminder to everybody, we're dealing with NDP-3, NDP-4, and NDP-5, and PV-8.
NDP
Charmaine Borg NDP Terrebonne—Blainville, QC
I would like to make one clarification in that regard.
Grouping all of the amendments together was discussed. However, to make things somewhat simpler, we could simply vote on them one at a time.