Evidence of meeting #26 for Public Safety and National Security in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was subamendment.
A video is available from Parliament.
Liberal
The Chair Liberal Jean-Yves Duclos
Thank you, Ms. Gibson.
Seeing no further discussion, shall CPC‑45 carry?
(Amendment negatived [See Minutes of Proceedings])
Liberal
Conservative
Dane Lloyd Conservative Parkland, AB
Yes. I'll be moving this amendment.
Similar to the last one, it's seeking to create protections on the use of private information that isn't related to provisions in this act.
Liberal
The Chair Liberal Jean-Yves Duclos
Thank you.
Is there any need for clarification or debate?
(Amendment negatived [See Minutes of Proceedings])
Liberal
The Chair Liberal Jean-Yves Duclos
BQ‑13 cannot be moved without BQ‑9 or CPC‑40 being adopted first, because there's a correlation between BQ‑13 and those other two amendments, which were not adopted.
That brings us to CPC‑47.
Is CPC-47 being moved?
Conservative
Dane Lloyd Conservative Parkland, AB
Yes, I'd like to move this amendment.
When we're giving government new powers to collect information for its mandate, I think there's a lot of concern about what happens to this data when the circumstances for which that data was collected for that purpose are no longer the case. What are the data retention rules? We're seeking to provide clarity for Canadians that this data is not going to be held somewhere. We know the government itself is subject to cyber-attacks, so we don't think it's necessary for the government to hold this information any longer than necessary if it's not needed anymore.
I want to ask the officials if they can provide their insight on that.
Thank you.
Director General, National Cyber Security Directorate, Department of Public Safety and Emergency Preparedness
A consideration we'd offer to the committee is that, again, this may unintentionally restrict some of the privacy rights of Canadians, specifically as it relates to the retention of information and their ability to access information. Under the Privacy Act, there's a requirement for the government to retain information for two years, as I mentioned. In this case, as worded, there would be an obligation, potentially, to dispose of that information prior to that two-year period, meaning that Canadians would lose that two-year window if they were looking to access their information collected under the act.
Conservative
Dane Lloyd Conservative Parkland, AB
Thank you.
I think that raises an interesting point. Obviously, we can't create legislation that directly counteracts another piece of legislation, but there's nothing in this amendment requiring any government body to dispose of that information before the two years are up. The government could keep it for two years, follow the Privacy Act rules and then dispose of it after that point, could it not? What mechanism would force it to delete it before that?
Director General, National Cyber Security Directorate, Department of Public Safety and Emergency Preparedness
I believe the issue comes in the wording that says it “must be disposed of if it is no longer necessary for the purposes for which it was collected or obtained”. If that period—
Bloc
Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC
I have a point of order, Mr. Chair.
Bloc
Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC
I know we haven't had a lot of testimony so far from Mr. MacSween, but he's speaking at lightning speed and the interpreter is having a hard time keeping up. Can he slow down?
Liberal
The Chair Liberal Jean-Yves Duclos
Yes.
Mr. MacSween, I think you understood the interpretation of what was just said.
Director General, National Cyber Security Directorate, Department of Public Safety and Emergency Preparedness
Yes, absolutely. I apologize.
I'll go back.
The issue arises specifically with the wording here that says it “must be disposed of if it is no longer necessary for the purposes for which it was collected or obtained or for verifying compliance or preventing non-compliance with this Act”. The interpretive read of that is that if I no longer need that, regardless of what the Privacy Act says, I have to get rid of it.
Conservative
Dane Lloyd Conservative Parkland, AB
I would just draw the committee's attention to the rest of the sentence. It says, “or in accordance with any requirement under the Privacy Act”—which was what you cited, the two-year Privacy Act rules—“that applies to it, whichever retention period is shorter.”
Director General, National Cyber Security Directorate, Department of Public Safety and Emergency Preparedness
I agree, but the problem is with “whichever retention period is shorter”. If you divide this up and take the first part of that sentence, “for the purposes for which it was collected...for verifying compliance”, if that period is shorter, then the information needs to be disposed of.
Conservative
Dane Lloyd Conservative Parkland, AB
I'm going to move a quick subamendment to this, then, and request that—
Liberal
The Chair Liberal Jean-Yves Duclos
I'm sorry. For procedural correctness, you yourself cannot do that, but someone else could.
Conservative
Dane Lloyd Conservative Parkland, AB
Okay.
I would just remove the last part, “whichever retention period is shorter”.
Liberal
The Chair Liberal Jean-Yves Duclos
Mrs. DeBellefeuille, you also raised your hand. I think you're looking for an explanation.
Bloc
Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC
Yes. Maybe they could talk to each other while I ask questions about the amendment.
Liberal
The Chair Liberal Jean-Yves Duclos
If that's fine with you, MP Lloyd, we'll allow you and MP Au to work together while Madame DeBellefeuille asks her questions.
Bloc
Claude DeBellefeuille Bloc Beauharnois—Salaberry—Soulanges—Huntingdon, QC
With BQ‑13 and CPC‑47, we want information to be withdrawn when it's no longer needed. However, BQ‑13 was deemed out of order and CPC‑47 is currently being debated. If we don't adopt these elements, can we have Bill C‑8 clearly set out the obligation to withdraw confidential information when it's no longer needed?
Director, National Cyber Security Directorate, Department of Public Safety and Emergency Preparedness
Yes, I think it's already there. Right now, the bill contains rules on the use of confidential information, but the Privacy Act also contains a definition and rules for using that information.
If you want to make it really explicit, you can change the wording a bit by adding “and” to it. As a result, the rules established by this amendment will exist in parallel or in accordance with the Privacy Act.