Pierre De Savoye

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Mr. Speaker, the issue here is whether this bill meets the needs of Canadians and Quebeckers.

Let me say, on behalf of Canadians, that this legislation is certainly better than nothing at all. However, the bill is far from what, in my opinion, Canadians deserve. They deserve something at least as good as what Quebeckers have. Canadians are not well served by this legislation.

Worse still, because of this bill Quebeckers could lose since the federal cabinet could make the political decision to allow Quebec to implement its own legislation instead of the bill that is before us and that is inferior to the Quebec act.

Obviously, should the federal cabinet feel that the Quebec legislation is not adequate, it could—without leaving any recourse to the province, since this is a political and not a judicial process—make Quebeckers lose important rights regarding the protection of personal information.

One can reasonably assume that some businesses regulated by a federal charter might be tempted to avoid—for very questionable reasons—being subjected to the Quebec legislation and prefer to be governed by the more lenient federal act that is being proposed.

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Mr. Speaker, I am asking for unanimous consent for an extension of time in debate to no longer than 6.30 p.m.

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Will there be other people speaking after me? I feel like continuing. If there are no other speakers, I feel like asking the unanimous consent of the House to continue. Anyway, we have until 6.30 p.m. You will understand that my throat will be tired well before that, but I feel like continuing the analysis of this bill in more detail, if the House gives its unanimous consent.

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Sounds like the hon. member opposite would like to speak, Mr. Speaker. I hope you will take note of his wish and give him the floor next. In the meantime, I would appreciate it if he could be quiet and give me chance to carry on.

The debate held in Quebec was a thorough, major, serious debate. It was a societal debate that resulted in one of the best pieces of legislation in the world.

I am amazed that my colleagues from the other parties, from the rest of Canada, do not seem a bit concerned. They bow down in front of the computer god. They say “If it is electronic, it must be good and if commercial data must be protected, we will do that, no problem. Are there other things that need protection?”

Commercial data are only the tip of the iceberg. There are also medical, legal or judiciary, tax, school, family data, plus many other types of information. In fact, all the information that an individual sends directly on the Internet to an organization or an other individual should be confidential. But Bill C-54 is completely silent on all the other types of personal data when, in Quebec, they are already covered.

As I said a minute ago when I read the long title of the bill we are debating today, one must understand that it does not aim at the protection of personal data but rather at the promotion and facilitation of electronic commerce.

That is where the problem lies. In Quebec, the legislation on privacy protection in the private sector does not specify if the information is to be processed electronically, manually, verbally or otherwise. The information is protected, no matter what vehicle is used to transmit it. Since electronic commerce and all the rest are included, that legislation is a very powerful tool in Quebec, while Ottawa is making very timid efforts by talking only about electronic commerce. The federal government is kow-towing in front of electronic commerce. It says “Commerce is important. If it is electronic, it must be even more important and we will ensure that personal information is protected if the person demands so”.

That is what it says. If the person does not check off the box—and I read it earlier, it is written explicitly in the bill—the legislation does not operate. The legislation lets companies and organizations, those that have their commercial information in hand, do whatever they please.

Legislation such as this does not deserve to be passed. Legislation such as this, in order to be passed, should have all the necessary working parts, and be complete. It should be as good as the one that Quebec has had for four years. It should build on it. It should also build on improvements that could be made to it. No. We are presented with legislation that is, for all intents and purposes, only half-baked.

It will be very important for this House to ensure the real debate takes place.

Mr. Speaker, how much time do I have left and will there be other speakers after me?

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Mr. Speaker, I can see that few members are interested in addressing this issue, and I can understand that, since this is a rather complex issue.

We are dealing with electronic commerce, with EDP, with modern technology, and we tend to be in awe of this wonderful technology which, presumably, will solve all our problems.

But we know full well that such is not the case. This technology is only one of many tools that can help us achieve the best, and also the worst. I realize that Bill C-54 before us seeks to ensure that, in the area of electronic commerce, we will achieve the best, and not the worst.

Let us take a look at the title of Bill C-54, An Act to support and promote electronic commerce. The purpose of this legislation is to support and promote electronic commerce. How will this bill support and promote electronic commerce? It is stated right after, again in the title: by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending certain acts.

Bill C-54 seeks to promote electronic commerce, while protecting personal information, so that consumers can engage in electronic commerce with confidence.

For the benefit of this House and of those who are watching us on television, let me first explain in general, easy to understand terms what this legislation is all about.

When we talk about electronic commerce, what exactly are we talking about? We are talking about making purchases or transactions—bank transactions, transactions with suppliers, with manufacturers, with clients—electronically.

These types of transactions have been in existence for quite some time. Telecommunications have been with us for thirty years or so. They have been relatively well structured in terms of standards for 25 years. As for electronic data interchange, it has been governed by international standards for more than 10 years.

In fact, electronic data interchange, or EDI, is used relatively often by many businesses. For the past ten years or so, large businesses have been using it in their dealings with suppliers. That means that a supplier does not send a written bill to his client, but rather an electronic bill that is received on the client's computer, who will then authorize payment after verifying that the goods or services have actually been delivered.

What is happening today is an acceleration—and I was going to say a democratization—of this process. Electronic data interchange is not longer restricted to large corporations and government. It is now accessible to the average person through, among other means, the Internet. One just has to sit in front of a computer screen to have access to a supplier of goods or services. Then it is as easy as filling out a form shown on the screen, pressing a key or clicking on a button, and the information is sent, through the telephone line or the coaxial cable, to the supplier, who then fills the order and, of course, bills the client.

So far so good. However, if I give my credit card number when I make such a transaction, I want to be sure that this number will not be used for other purposes than those for which I wrote it on the electronic form. I want to be sure that somebody will not use my credit card number to travel around the world. Of course, I would only find out about it when receiving my statement at the end of the month. It would be terrible.

True, particularly well equipped hackers might be able to get at that information. But we have the tools to make it very difficult for them.

One should not generalize and panic. We have to recognize that in everyday life, you and I and a lot of other people are using their credit cards in a lot of establishments, restaurants, clothing stores, to subscribe to a magazine and God knows what else. Our credit card number is handled by strangers.

When I go to a restaurant and give my card to the waiter or waitress, who takes an imprint of it or puts it through the magnetic tape reader to forward my bill to my credit card supplier, for a moment that person has my credit card number at hand and could very easily take it down and misuse it later.

However 99.99% of people are honest and such misdeeds simply do not occur. Credit card frauds do happen though, and it is wise to always check one's statement to make sure that it does not contain transactions which are not ours. It is a bit the same on-line. In the vast majority of cases, there is no risk.

But if a hacker wanted to get at some credit card numbers, it is not unlikely he would succeed, unless safeguards are put in place. This is when the notion of facilitating electronic commerce comes into play.

If I feel that my purchasing something on the Internet might reveal things I do not want to be known, such as what I am buying, how much I paid for it, what my credit card number is or other confidential information I might give, if I am not convinced it will all remain confidential and will be used for the intended purpose only, I will be very reluctant to engage in any electronic transaction. I would not do it.

Of course, if the legislation were to require businesses to take the appropriate steps to ensure that all electronic transactions are secure, confidential and protected, then the average citizen would feel much more at ease and e-commerce would blossom.

What are the two problems that can arise in terms of protection of personal information? First, there is the illegal access to the information by someone who is not entitled to see the data. Of course, none of us would like information about us to fall into the hands of people who should not have access to it. That is the first problem.

Then, there is also the misuse or illegal use of the information. Someone who should not even have had access to your information is using it to harm you or for some other illegal purposes. So, it is important to ensure that the information can only be accessed by the people who are entitled to see it, by the final recipient, and used for the purposes for which the information was made available.

In this area, Quebec has been fully protected for four years now through its Act respecting the protection of personal information in the private sector. The bill before us today, Bill C-54, only deals with businesses. It does not extend to any other activity and has some serious deficiencies. I have already mentioned one, the fact that if an individual does not clearly prohibit it, then the information can be used for other purposes than the ones stated originally. Silence gives consent. We make a stupid and foolish decision, because we are not aware of the consequences, and everything is done behind our backs.

This is extremely important because, whether we like it or not, electronic commerce is bound to expand. It is here to stay. I am somewhat surprised and disappointed that such a crucial issue for a nation like Canada is not receiving all the attention it should, and indeed did in Quebec—mind you the Liberals were in power in Quebec at the time, with Minister Lawrence Cannon sponsoring the legislation; so this is not peculiar to the sovereignists, just a good habit Quebeckers have of looking after matters that concern them and doing it well. This issue was widely debated in Quebec. I know, I was there. I was one of the players, as a computer specialist by profession.

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Mr. Speaker, if the member opposite would like to participate in the debate, he is welcome. If he would not, perhaps he would allow those who want to to do so.

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Mr. Speaker, I greatly enjoyed the speech given by my colleague and friend, the member for Kamouraska—Rivière-du-Loup—Témiscouata—Les Basques. He is perfectly right; the bill before us is not just about e-mail and the associated personal information.

I would like to give an example so that all those in the House and listeners at home will understand what we are really talking about. You go into a department store. We have all been in these stores which, in addition to selling things, offer credit cards, which record our name, address, telephone number and postal code when we buy something there.

The store collects all this information and then, with the help of its computer, is able to produce a list of people who bought a sports item, for example, and then turn this list over to the publisher of a sports magazine, say. These lists command quite a price, apparently going for a dollar and up per name.

This is how it is that members of the public receive junk mail. For anyone wondering where on earth they got our address, and how they knew we were interested in whatever it was, if in fact we even were, because sometimes we were just buying a present for somebody else, this is how.

I mentioned department stores; I could mention many other organizations, not always commercial, and various associations. In Quebec, such a practice is not allowed. It is an indictable offence. But in the rest of Canada, it is allowed and legal—unless a business follows its own code of ethics.

The bill before us would not necessarily make this practice illegal, and this is the purpose of my question to the hon. member. Clause 4.3.7 of the schedule deals with the consent principle and provides the following: b ) a checkoff box may be used to allow individuals to request that their names and addresses not be given to other organizations. Individuals who do not check the box are assumed to consent to the transfer of this information to third parties;

So, we go to a store, buy something and get a receipt. The clerk says “Look at the receipt. There is a small box”. We think “fine”, but the act has just been circumvented.

This is what will happen with this bill, which provides just the opposite of what we have in Quebec, where a person must check off the box to allow the transfer of information to third parties. Here, it is exactly the opposite. In Quebec, there is no consent unless otherwise specified, whereas in the legislation before us, consent is implicit, unless otherwise stated.

I wonder if the hon. member for Kamouraska—Rivière-du-Loup—Témiscouata—Les Basques could comment on this.

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Mr. Speaker, I appreciated the comments made by the member across the way. I must say his concerns are well-founded. He considered the protection of personal information to be important. Of course, he said that none of us would want our medical records read or seen by just anyone, or our personal correspondence intercepted.

This bill does not ensure the protection of non-commercial information; in other words, medical data, income tax information or information included in personal correspondence are not protected by this bill.

As the hon. member mentioned, the situation is different in Quebec. Quebeckers are protected by provincial legislation that prohibits the use and disclosure of personal information.

The member also added and I quote “This bill will put Canada at the forefront”. Right? Wrong. Quebec is at the forefront. This bill will not put Canada at the forefront; it will bring up the rear, behind countries which already have more effective legislation.

We have to wonder why the minister did not go to Quebec to study the legislation that has already in force there for four years. It is working well and could no doubt be improved. This would have been an excellent opportunity to improve on it. But no. They ignored it and brought forward a second class bill. That is what we have before us, a second class bill, which aims to promote electronic commerce, not to protect personal information.

However, by protecting personal information in general, we would not only be promoting electronic commerce, we would also be making full use of the tools that the information highway puts at our disposal. I have a question for the member opposite. Earlier, he said that the federal legislation would not apply to Quebec because Quebec already has its own legislation.

Clause 27 provides that:

1. (1) The Governor in Council may make regulations— d ) if satisfied that legislation of a province that is substantially similar to this Part applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of this Part in respect of the collection, use or disclosure of personal information—

Does the member opposite think that a political decision instead of a legal decision can be enough to exempt Quebec from the application of this legislation? As for me, it does not make any sense.

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Mr. Speaker, Bill C-54 obviously deals with electronic commerce. Its primary purpose is not the protection of privacy, but electronic commerce and in that context, the bill supports electronic commerce while protecting privacy.

As I said a few minutes ago during the speech of one of my colleagues, this bill is incomplete and this fact was stressed by the government member a few moments ago. He mentioned, for instance, medical information, to which I would add legal as well as tax information.

The Internet involves much more than the communication of mere business information. It contains information of all kinds which can and do indeed travel 24 hours a day and concern individual citizens of Canada and Quebec. This information which is not of a commercial nature is not covered by this bill, and there is the rub.

Does the government member not recognize that the bill is incomplete and what changes does he suggest so that it provides the same protection Quebeckers already enjoy?

[Personal Information Protection And Electronic Documents Act, October 19th, 1998]

Mr. Speaker, the Liberal member for Markham is very knowledgeable on information technologies issues, judging from the comments he just made.

I would also like to mention that I started to work in this field in 1972. I worked in education and I have been a consultant for many years in Quebec, in Canada and internationally.

As a matter of fact, before being elected to this place, I was working on an MBA with a major in information technology. I was also the president of the Association de sécurité informatique du Québec. Accordingly, I am very familiar with security of information issues and I am especially interested in a bill like the one we are now debating.

I am especially interested in this debate since I had the privilege, in 1992, to present a brief, on behalf of the Association de sécurité en informatique du Québec, to the National Assembly, which was examining a bill to protect personal information in the private sector. That bill has now been enacted. It was passed four years ago, but it goes much further than what the government is now proposing.

Unfortunately, the government has only gone halfway and protected only in part personal information held by the private sector, i.e. information that is given in a commercial context. This is not the only type of information transmitted by computer. Thanks to the Internet, it is now much easier to provide information to recipients scattered around the globe.

I would like my colleague from Markham to tell us whether he believes that this bill should be much broader in scope, that it should in fact go as far as what has been done in Quebec instead of stopping halfway, because it has to be closely scrutinized. What does my colleague from Markham think about the fact that, if Bill C-54 is adopted without amendment, Quebeckers will lose rights that they have gained through the legislative process over the last four years?

It would be very difficult for Quebeckers to go back to the way things were four years ago before the Quebec government passed legislation in the leading-edge area of electronic commerce.

Would my colleague from Markam agree to see to it that the industry committee amends the bill so it goes as far as the four-year-old Quebec legislation? I await his answer.