Information & Ethics committee  Yes, Mr. Chairman, this is something that we suggest the committee add to the act. This has become an important problem. It's become, we think, a source for identity theft, although there hasn't been a lot of work done linking identity theft to the data spills, but it must contribute to it.

Information & Ethics committee  I would think you'd want to put in some criterion like “significant”. You can have a technical breach of personal information, but if it's not significant, then you get into a company having to notify millions of people, which is extremely costly from the company's point of view.

Information & Ethics committee  That is.... But if it's not necessarily significant--and then, as I say, it's not clear the exact links between breach notification and identity theft. In fact, I haven't seen any studies. Perhaps some of your other witnesses will know about that. So you can't say that because of this breach, we know that these numbers of people whose— I think there are some states whose models seem to us more workable.

Information & Ethics committee  As a result of the virtually global movement of personal information, that volume wasn't anticipated when the act was drafted in 1998. I don't have a clear directive in the act for dealing with my counterparts to solve potential problems. I'd like a change so that the act would give me a general scale to determine whether it's in the public interest to go and talk about even the details of a complaint brought before me with a counterpart in the European Union, for example, whether it's in the interest of Canadians' privacy.

Information & Ethics committee  Yes.

Information & Ethics committee  We're trying as much as possible to address only very general areas, so as not to give out a person's personal information, for example. However, we'd like some clarification. For example, in a complaint concerning an individual, where it's preferable that that complaint be addressed by our French counterparts, we'd like them to be able, in an entirely legal way, to have the individual's personal information as well.

Information & Ethics committee  Yes, that's it. For example, we want to be able to simply send our counterparts a copy of the complaint including all the personal information of the person in question, telling them that they can find a remedy for our complainant here in Canada. The act isn't clear on this point; it doesn't specify whether I can do that.

Information & Ethics committee  Okay. That's another of our concerns. We say that in a brief. That's a question that has been the subject of a number of discussions. You'll no doubt hear a number of views on that question. In our opinion, it's possible to include in the act general scales like those the Canadian government has included in the directives recently issued by the Treasury Board for the public sector.

Information & Ethics committee  We can already address this problem under the accountability principle.

Information & Ethics committee  No, I think it's principle no. 4.

Information & Ethics committee  Yes. These are the principles of the code. This act was designed on the basis of a standard of the code of Canadian standards. The Privacy Code is related to and forms an integral part of the act. The first principle of the act is the accountability principle. Even if I'm a Canadian organization that sends personal information on Canadians outside the country, I'm still responsible for it here in Canada.

Information & Ethics committee  I believe we've been involved in some fifty cases since the inception of the first stage of PIPEDA. We're currently at the Federal Court in twelve active cases.

Information & Ethics committee  That's hard for me to answer. I haven't really measured it.

Information & Ethics committee  Before the Federal Court, you mean?

Information & Ethics committee  The statistics over the last five years show that, on the average, we have disposed of the complaints under PIPEDA in under a year. It's around eleven months, on an average. As you know, the time to go to Federal Court or the time before the Federal Court, of course, would then depend on how quickly both parties move, where the hearing is, and various other things like that.