Evidence of meeting #78 for Industry, Science and Technology in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was casl.
A recording is available from Parliament.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
Without going into the criteria, can you tell me whether that is working for you, in PIPEDA, that general...?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'll just mention one criterion that is relevant to your question.
One of the criteria, which are to be assessed on a case-by-case basis under PIPEDA as to whether explicit consent is required, involves the expectation of individuals. If we apply that standard to CASL, the question becomes what the reasonable expectation of consumers is in terms of receiving unsolicited communications from organizations. Do they find them helpful, because they help them make certain decisions, or do they find them unhelpful because—
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
But in general, PIPEDA's form of consent is working, and that has not been an issue for you in applying that law or in terms of people complaining.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It works conceptually. There are huge issues in the application of it and whether consumers are properly informed so that their consent is meaningful. We could spend a couple of hours on that.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
But in terms of the concepts and whether implied consent can be permissible in certain circumstances, I think that's a workable regime.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
Thank you.
I'll pass my question time on to Mr. Lametti.
Liberal
David Lametti Liberal LaSalle—Émard—Verdun, QC
No, you covered it. Thank you. That was exactly the question.
Liberal
Frank Baylis Liberal Pierrefonds—Dollard, QC
Well, there you go, so I was rushing you for no reason then. Let me explore that a little bit further then.
In terms of PIPEDA, if I can say so, grosso modo, in general, it's working. You might have questions as to whether an individual truly understands or not, but people are not coming to you up in arms, saying, “I didn't really get this right and they've grabbed information of mine that I did not consent to, implicitly or explicitly.” Are you having—
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'll try to be more nuanced in my answer.
PIPEDA allows for implicit consent and requires explicit consent based on criteria that generally makes sense. Does it work? It all depends on whether meaningful consent is obtained, and people do come to us frequently to say, “Maybe the law allows for implicit consent, but I never understood that I was giving implicit consent for this or that conduct by the organization.” How this applies and what kind of information is given by organizations in order to obtain meaningful consent is the subject of my last annual report. It's a very open question, and I think many improvements would be required.
If I understand the question posed to me in terms of comparing CASL consent with PIPEDA consent, I concede that CASL consent is more onerous for organizations. Therefore, the PIPEDA consent regime could work if proper information was given to consumers, but in addition to that, I would suggest that you need to ask yourself, among other things, what the expectation of consumers is in terms of receiving unsolicited communications from organizations? That's the first question.
I don't have the answer to that question. Different countries have different answers, but one question is, what is the reasonable expectation of consumers?
Liberal
The Chair Liberal Dan Ruimy
Thank you very much.
We're going to move to Mr. Eglinski for five minutes.
Conservative
Jim Eglinski Conservative Yellowhead, AB
I want to thank the witnesses for coming.
Your website directs people to go to fightspam.gc.ca to report their incident. Who directs, from fightspam.gc.ca, who it goes to, you or one of the other two departments? Who decides that, or do they just throw it out to all three of you?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'll ask my colleague Brent Homan to answer.
Director General, Personal Information Protection and Electronic Documents Act Investigations, Office of the Privacy Commissioner of Canada
With respect to fightspam.gc.ca, that's one portal by which individuals can identify whether there are complaints. In terms of our process at the OPC, we can also receive complaints directly, related to CASL or other privacy matters.
We have received certain complaints, but by the nature of what we are looking at, as with harvesting and spyware, they're opaque practices, so it's less likely for us to receive complaints. It's less likely for individuals to know whether they've been affected by such practices. As a result, we look at things more proactively, but fightspam.gc.ca might be one portal to identify issues they could relay to different authorities. We have working groups where we are able to collaborate and discuss issues of commonality, but as well, the traditional intake and complaint process is available and that's what's often used.
Conservative
Jim Eglinski Conservative Yellowhead, AB
Thank you.
Daniel, we've had a number of witnesses over the last two or three meetings talk about the internal departments they have just to deal with the legal concept of CASL. I wonder if you can tell me how many cases over the last few years your department has handled. It doesn't have to be exact. As well, how many people would you have in your department basically dealing specifically with this portion of your department's enforcement role?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'll give you an answer. I'm not sure we're the most relevant organization to ask this of, because again, our role in terms of CASL is limited to two activities: address harvesting and spyware, both of which are clearly unacceptable. There are more questions around spam per se and the fact that organizations are unable under that legislation to contact individuals, but our role deals with these two types of conduct. We don't have many cases. That's not the sum total of CASL by far, but these two types of conduct in particular are essentially hidden, so it is very difficult, if not impossible, for individuals to see the harm being done. We act, in part, based on information in the CRTC's spam centre, the analysis of this, to ourselves spot trends, spot problems, and act on our own initiative.
I've mentioned two investigations that we have conducted. There are not many, just two, and they have resulted in reports of finding. We're investigating other activities currently, but they are few.
As to how many people we have to devote to these efforts, there is no one specifically on this. However, we have a handful of people who, among other duties, have as a duty to enforce this particular piece of legislation.
Conservative
Jim Eglinski Conservative Yellowhead, AB
Okay. Could I stop you there for a moment.
You did mention that you appear to be doing some proactive work—
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
Conservative
Jim Eglinski Conservative Yellowhead, AB
—and you are doing reactive work. I want to get into this.
As lawmakers, we have made this law, CASL, for you. Are we providing enough resources—and I'll just go to your department—to handle the caseloads that you're working on?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
To answer that question, I would have to look at the sum total of our responsibilities.
Again, CASL addresses two conducts out of a very large number of activities that affect privacy protection. I think it is very difficult to be effective in privacy protection writ large with the resources I have. Is CASL the biggest problem? I would not say so. It is part of the problem of insufficient resources to tackle privacy protection generally.
October 24th, 2017 / 11:45 a.m.
Conservative
Liberal
The Chair Liberal Dan Ruimy
You're done. We're very tight on time.
We're going to jump to you, Mr. Sheehan. You have a very quick five minutes.
Liberal
Terry Sheehan Liberal Sault Ste. Marie, ON
Thank you very much.
Again, to our presenters, this is very helpful in terms of providing a perspective in terms of some of the very good testimony we've heard so far.
One of the things I've observed throughout the statements being made is that it would seem for the legislation as it stands—it's not necessarily just the legislation, perhaps, but just the way the education and information has been sent out there—companies and people are being very risk averse and their lawyers are telling them, “Just don't send anything.”
In your presentation, you mentioned that you were going to be undertaking some new outreach. Could you expand on that? How will that be different and how will it help educate people? Specifically, what are you trying to educate people about?