Mr. Speaker, I rise to discuss Bill C-54, which I believe goes in the right direction. Some very good points have been made in the bill. The minister's statements of a moment ago illustrate the significance of electronic commerce in Canada and virtually the entire world. We need to recognize and accept that, and I think we all do.
The problem I see with this bill has to do with what is really being done here. It is not as if electronic commerce developed yesterday. It has been with us for quite some time. It has existed for at least 13 years in terms of doing business, in terms of consumer shopping, and we have had ATMs for a number of years. It is almost as if suddenly something has happened, that it is recent and has happened just now, but it has not happened just now.
We need to recognize that this is really a catch-up system, and for that I want to commend the government. This bill will make it possible to use some of the modern technology, to do some of the filing that needs to be done electronically and to get information and things of that sort.
Perhaps there are some people who wonder: What is this electronic commerce anyway? What are we really talking about?
We are talking about the business of making transactions via telecommunications systems using computer technologies. It is almost as if computer technologies and telecommunications are separate. I do not think one could exist without the other. The telecommunications industry depends upon computers and computers depend upon the telecommunications industry. The two are very much involved.
How big is electronic commerce? It is big. The minister just indicated to us some of the dimensions of the electronic commerce industry and we know they are true. It looks like there will be not only a tenfold increase, but a manifold increase. Nobody knows exactly how fast this electronic commerce area is going to grow.
Why is this an issue today?
First of all, we have many laws in Canada covering paper transactions and paper commerce. Paper transactions are founded on the notion and the awareness of boundaries: provincial, federal and international. Laws and taxes are applied within these boundaries and there are agreements as to which law or tax has precedence in cross-boundary transactions.
However, traditional boundaries do not exist on the Internet. Therefore, legal rules and consumer protocols become unclear, especially when the consumer is not even aware that they have crossed a traditional border in making a transaction.
Which law or tax then applies? Can the same law be applied to the electronic world as is applied to the paper world? This is a fundamental question because it raises the kinds of principles which ought to govern legislation with regard to electronic commerce.
This bill is not complete and I think the minister would agree that it is not complete. It is be a good beginning, but it is only a beginning.
We have to be very careful that in this beginning we do not chart a course that ends up with errors of some kind. We have to be very careful that we choose the right course at the beginning.
We use electronic commerce to transfer funds in banking, to pay our bills and to access automatic teller machines. We use it in the operation and in the guidance of trucks, ships, planes; vehicles which are in the air, on land and at sea.
The global positioning system, for example, is strictly an electronic mechanism. Satellites such as RADARSAT make a very significant contribution to electronic commerce. What does it do? It provides information, for example, about what is happening to the ice caps. It also inventories and gives information almost immediately about the moisture conditions in various parts of the world.
What are some of the issues involved? The minister said that one of the big issues is privacy. Yes, privacy is a major issue, but I would like to raise another issue before I speak about privacy, and that is the integrity of the information.
Integrity means that we can have trust and confidence in the information that is made available to us by electronic means. For example, can we be assured that what we think is happening is actually happening? Is the money being transferred from my bank account to somebody else's bank account as it ought to be? Is my account being credited or debited as it ought to be? Will the person receive exactly what it is they thought they were buying via the Internet or the telephone?
Verifying signatures is a very significant issue as well.
The public information cryptography issue is involved. The business of recognizing the public key infrastructure on cryptography is something that this bill wants to control. We need to ask ourselves the question: To what degree can or ought the government be able to control the various encryption methods and systems?
Earlier this year there was a discussion regarding the type of policy the government should pursue with regard to encryption. There was a lot of resistance to this particular issue. A policy statement was finally drafted. I believe there are some good aspects to this particular policy. However, I would like to ask whether the provisions in the legislation before us are consistent with the provisions of the policy on encryption.
For example, one of the elements in this encryption policy states that Canadians are free to develop, import and use whatever cryptography products they wish.
The government will not implement mandatory key recovery requirements or licensing regimes. The government encourages industry to establish responsible practices, such as key recovery techniques for stored data. The government will act as a model user of cryptography through practices of the Government of Canada public key infrastructure program.
The policy indicates that Canada will take into consideration the export practices of other countries and the availability of comparable products when rendering export permit decisions. The export permit application process will be made more transparent and procedures will be streamlined to ensure the least regulatory intervention necessary.
If the issue is to ensure that the integrity of information from one business to another business is indeed safe, secure and private, that is one thing. However, if the issue is government intervention and the ability to intervene, to read, to uncover and to break through the encryption that is used by businesses to do their business, then all privacy will be destroyed.
I think the policy suggests that the government will not do that. However, the issue is that it is not protected in this particular legislation. This legislation does not say that the government may not or the government shall not get into the encryption systems that various industries may use in doing their business.
I would like to deal with encryption a bit further. Someone may ask: What is encryption? It is actually a code. Someone who does not know the code cannot uncover the message. We must ensure that a message which is designed to reach a particular destination only reaches that destination.
We know that the Internet is accessible by many. That message, once it is put on the Internet, can be retrieved by virtually anyone unless it is encrypted. The person who receives the message must either decipher what the encryption is or have the key that gets them into the message immediately. There are many people who are pretty sharp at discovering encryption systems.
We need to accept that the new laser technology and the application of the laser technology is one that we need to look at carefully. There are experts in this field who say that if one human being has created a code another human being can decrypt that code. Dr. Paul Corkum of the National Research Council makes the statement that unbreakable codes for secure information transfer can be based on the basic structure of light.
When we enter the field of laser technology we are dealing with a complicated issue. Nevertheless, Dr. Corkum makes the unequivocal statement that unbreakable codes for secure information transfer can be based on the basic structure of light.
Nowhere in this legislation is there reference to unbreakable codes or the use of encryption codes being limited to business, government or anything of the kind.
If we are to have privacy we must be absolutely sure that if someone wishes to encrypt a message the message can be encrypted to the degree that no one else can understand it except those for whom the message was destined in the first place.
We need to recognize not only the need for privacy but another area in the legislation which has to do with privacy. It has nothing to do with encryption but it has something to do with the provision of privacy of information. I refer to the beginning of the bill. In division 1, which is headed “Protection of personal information”, subclause 5(2) says:
The word “should” when used in Schedule 1, indicates a recommendations and does not impose an obligation.
“Should” is a guidance and not an obligation. Let us go to schedule 1 and have a look at what is there. In section 4.2.3 it states:
identified purposes should be specified at or before the time of collection to the individual from whom the personal information is collected—
The purpose should be stated. It continues:
Depending upon the way in which the information is collected, this is can be done orally or in writing. An application form, for example, may give notice of the purposes.
This is a possibility. It should be there, but it is not a requirement that it be there. However, the next section, which is section 4.2.4, states:
When personal information that has been collected is to be used for a purpose not previously identified, the new purpose shall be identified prior to use.
Is that not an interesting contradiction or at least an implication of confusion? In the first instance it is not obligatory that the purpose be stated, but if it is stated and it is changed then there is a requirement that the individual be notified. If we wanted to protect ourselves and wanted to be flexible, we would simply never state the purpose. Then we could do whatever we wanted because section 4.2.4 would not apply.
There are some interesting questions about what is being done and being proposed in the legislation. As the committee deals with it, I hope it will be in some detail and that some of the weaknesses will perhaps be rectified.
We need to look as well at the conflict of interest issue. In the bill there is no statement about the use of private information in a conflict of interest situation. I refer particularly to the application forms currently in vogue and used by certain banking institutions in Canada.
Until very recently an application form to do business, for example with the security branch of a bank, contained the name. Underneath there was very tiny print stating: I hereby allow or give permission to this bank to use the information given for trading securities to be used in other parts of its operation.
We know that banks today own trust companies and insurance companies. Some of them are health insurance companies and life insurance companies. They have investment dealers and clearly they have the banking institution. Is it not interesting that a bank which collects information to trade securities may use it in other parts of its operation?
Let us suppose one has a loan in the particular bank and an insurance problem. Is it not interesting that individuals may suffer ill health which as a consequence, at least in the mind of the bank, places in jeopardy their ability to repay the loan?
Information was collected for the purpose of doing trading only in a particular bank. Yet the bank is now able, through its insurance branch, to transfer the information. That insurance branch may and will, if it owns an insurance company, have transactions with other insurance companies and may trade information. The potential for a conflict of interest is very real.
It is interesting that although one has given voluntary permission to the bank to use this information and suddenly withdraws that permission, the bank reserves the right, in very tiny print, to close one's account with 30 days notice.
There are some very interesting issues. Compliance is granted by giving permission, but it is used in a way that was never intended, or the customer never believed it would be used in such a way. The action is unilateral on the part of the financial institution to close the account if the individual suddenly chooses to withdraw access to the information for a purpose other than the one for which it was intended originally.
I now wish to move to the interdependence between electronic commerce and traditional or other commerce. Electronic commerce cannot exist without a traditional infrastructure for moving things and people. For example, a service may be ordered through the Internet but the product or service must be delivered. A contract must ultimately be signed and become operational. Funds must actually be moved from one state to the other.
It is not just the ability of being able to do electronic commerce. There is an interdependence between electronic commerce and regular or traditional kinds of commerce. This requires an infrastructure that is ready and able to meet the requirements, one of which is speed.
Time delivery is all very well if it is in a beautiful computer and it has to be deliver, for example, on September 30 of a particular year at one o'clock. However, if the truck does not get there it does not help. There is no relationship. If the relationship is not there and it is not working, there are backlogs and queues and things break down.
We need to recognize that there needs to be a back-up for intercommunication. We need to trace the trail. If something goes wrong we need to know where it went wrong, why it went wrong, who is responsible and how can it be fixed. It involves all kinds of aspects. It involves many people and things. We need to know where are the airplanes, the satellites and the rockets on land. Will it be done by foot, by truck, by rail or by any other method? The situation on the sea is similar.
It is not just the business of controlling electronic commerce. It is also the matter of developing adequate human resources. The number one requirement in the whole business of electronic commerce is the ability of personnel. Ultimately people will make the system go. They need the ability to use electronic commerce information.
They must know how it works. They must understand how it works. Then they must expect to be able to apply it. There must also be confidence and faith in the integrity of the information. All else depends on it. Because it is so fast and because it allows transborder transactions very easily, errors are multiplied and magnified if they occur.
There also must be integration. We need to recognize the interconnection of nations, the interconnection of industries and the interconnection of people. There will be a tremendous requirement in the ability of management to integrate what appears to be separate and disparate parts into a corresponding and working whole.
It really does something to me when I hear our Prime Minister answer the question about how far the dollar has to sink before we become alarmed. The minister has often talked about the issue. The Prime Minister, the senior minister in the country, is the one who should know. He is the one who is asked this question because it is fundamental to our economy, to electronic commerce and to any other commerce. He answers that the problem is market decisions. He answers that either it is floating currency or monetary policy under Canadian law like in most of the countries managed by the Bank of Canada. According to him it is the way the system operates. It is never the Prime Minister; it is the Governor of the Bank of Canada who makes these daily decisions.
The Canadian economy is functioning very well. We reduced the deficit from $42 billion to a surplus that was billions of dollars for the first three months. In spite of strikes at GM, in construction and in the paper industry in Quebec, unemployment did not go up. It remained at 8.4%. We have around 1% inflation.
A few weeks ago there was a report for the first time in a long time that activity in Canada had been higher than in the United States. It is a very positive sign. The monetary policy of the Canadian government is made by the governor of the bank under the Bank of Canada Act.
We need to do better. What can we as parliamentarians learn from the complications of electronic commerce and from the need to protect the privacy of individuals and to do business successfully and well? We need to learn about a couple of issues. We need to recognize that our ability to do things has been magnified manifold. That means the responsibility of doing it right is greater than it has ever been. We also need to recognize that one error can cause many other errors and have a far broader impact than was the case before.
Above all we need to recognize the need for integrity and leadership in the country. We need to know more. The bill is not sufficient. It is a good beginning but is not a leadership document. If anything it is a document that catches up to where industry has been for the last 10 years. We need leadership. We need to understand the significance of what we are doing. We need to be confident. We need to have an attitude of co-operation, humility and self-control. We need to recognize, as never before, the absolute necessity and the centrality of integrity, truth and honesty in whatever we do.
It is not good enough for the Prime Minister to try to explain the value of the Canadian dollar and its fluctuations the way he does. It is not good enough for the Minister of Finance to say we have a surplus while recognizing full well that the surplus is built on sand. In fact it is not even good sand. It is shifting sand because it is built on the revenues collected for the EI program rather than on the management of the finances of the country.
We need to tell the truth. The Prime Minister, the Minister of Finance and the rest of the ministers need to tell the story the way it really is. If they do not it will not be long, particularly with the transfers across borders, with e-commerce and any other mechanisms available to us, that the truth will be known. Where is the confidence going to come from when in fact we recognize that the Minister of Finance has not told us the truth?
Where is the confidence when we recognize that we do not have a balanced budget, that it is a concoction of numbers which makes it look as if it is balanced but is not really balanced? This is dangerous. If there ever was a time for us to learn from a bill, it is this one which is at the cutting edge. It does not provide leadership but it is at the cutting edge, and for that I commend the minister.
We need to recognize, however, that within this lies the seed of our undoing if we do not recognize the need for integrity of information, integrity of communication of the people of Canada and integrity within the civil service of Canada so that the ministerial position, the government's position and the position of the bureaucrats are identical, and that government can be there with integrity so that we can depend on what it tells the people and base our future direction on that. That is what we need to learn from legislation like this.