Information & Ethics committee  We will assist the committee in any way during your study.

Information & Ethics committee  The office has approximately 180 employees responsible for administering the Privacy Act with respect to the public sector and PIPEDA with respect to the private sector. We have approximately 50% of our employees working on enforcement or investigation of one kind or another, in relation to either the Privacy Act or PIPEDA, and that includes a group that does audit and review.

Information & Ethics committee  That is an excellent question. Since the beginning of my term, the questions I have been asked about information sharing have often had to do with police forces or national security. However, you are quite right to look at the situation more broadly. The government has initiatives to increase information sharing among departments, in part to improve program effectiveness.

Information & Ethics committee  We co-operate with government, for example, on advice to citizens on how to protect themselves against cybersecurity threats or other risks of a privacy nature. We do that with Public Safety on different issues. We do that with the innovation department, which is responsible for PIPEDA.

Information & Ethics committee  I'll start with the second question. Yes, it is still one of our recommendations. Currently we can inform the public and parliamentarians only in the context of reports to Parliament, which are either annual reports or special reports. Otherwise we're bound by a confidentiality provision under the Privacy Act not to reveal our investigative activities.

Information & Ethics committee  I don't have a precise answer to give you. As you say, several parties were in government. The act was adopted in the 80s. I honestly don't know. In part, policies were adopted short of legislation to address some of the privacy risks, but in my view, this is no longer sufficient.

Information & Ethics committee  With respect to seniors and youth, we already have a public education mandate under PIPEDA. It's a question of how we would do this, and we have various means. We attend conferences and outreach activities. We want to improve our website, for instance, and give tips to populations, vulnerable populations in particular.

Information & Ethics committee  I've answered in large part. In relation to the government, let me give you a specific example of how it would be useful to have a public education mandate under the Privacy Act vis-à-vis government. On the question of encryption that Mr. Blaikie raised, currently we have a public education mandate under PIPEDA, which means that our research, for instance, and our public education efforts are focused on how consumers relate to private companies.

Information & Ethics committee  I'll give a partial answer due to time considerations because that's a huge issue. Here we're talking about regulation of personal information in relation to the private sector, not the government. This is not the Privacy Act; this is PIPEDA. Regarding the agreement in question, its value is having a template that can be used by any country, any member of the international conference of privacy commissioners, who wants to use it as opposed to the previous scenario where agreements were bilateral.

Information & Ethics committee  Yes. Again, this is mostly a PIPEDA issue, as opposed to the Privacy Act, but I didn't mention these risks in my remarks a few weeks ago. The risks may not be exactly the same for youth and seniors. Youth are, of course, very adept at using technology. There are many privacy considerations, but one of them is to make sure that young people are prudent in their use of technology so that information they put out there cannot be used by others against their interests.

Information & Ethics committee  We would have to look at the specific statute. We can get back to you. Of course, there would be ways to mitigate that risk. What happens if there is a recourse before the court? Is the recommendation applied in the meantime or not? Is there a mechanism whereby the court would be seized with this issue quickly?

Information & Ethics committee  Consent is a different matter. Consent under the Privacy Act is also grounds for permissible disclosure. What we are dealing with here are the other provisions of section 8, which authorize disclosure other than consent, including consistent use. The elements that we have in mind, at a minimum, would be these: What is the personal information, exactly, that is being shared between the two institutions?

Information & Ethics committee  Are you referring to things like cabinet confidences, for instance? I'm not sure I get—

Information & Ethics committee  I think we're talking essentially—maybe not completely but essentially—about cabinet confidences. Under both statutes, the fact that information is protected by cabinet confidence is grounds to actually exclude the information from the application of one or the other statute. I understand that this would in practice be more of a problem for my colleague, given the nature of the information.

Information & Ethics committee  It would be not “rather than” but “in addition to”.