Public Safety committee  There are a number of models. I would have a hard time identifying one model as the best option. For example, the European model sets out the key privacy expectations of necessity, proportionality and transparency. It gives a prominent role to privacy organizations. In addition,

Public Safety committee  Similarly, I think it's subscriber account information, communication data, website visits, metadata, location data and financial data that may not be what is ultimately requested, but we want to make sure that the bill doesn't allow for it. What we're recommending is that noti

Public Safety committee  As it stands, Bill C-26 does not include a requirement to conduct privacy impact assessments. The Treasury Board does, however, have a policy with such a requirement. We consult with departments regularly. We have a government advisory directorate, and we provide advice to depart

Public Safety committee  It is actually permitted to share information outside the country, provided that it's done in accordance with lawful agreements and specific conditions. Under the European model, for example, laws and mechanisms have to be equivalent to what exists in Europe. In Canada, the law r

Public Safety committee  That's exactly right. If it's in the legislation, it becomes a legal requirement, and departments have no choice.

Public Safety committee  One way would be to build in the test stipulating that the activity be necessary and proportionate. The second one is missing. The necessity component is covered in the act. For example, certain provisions stipulate that, if the minister is of the view that it is necessary to do

Public Safety committee  I think all the recommendations I covered in my opening remarks help to reassure Canadians, as well as small and medium-sized businesses. The institutions are there to help them. The responsibility is not being put wholly on individuals or small and medium-sized businesses. Take

Public Safety committee  The legislation currently doesn't provide a role for my office. The role would be specified under the Privacy Act. We have jurisdiction over the government's handling of information and we have jurisdiction over the private sector's handling of information. One of our recommenda

Public Safety committee  I'm not suggesting that we would have oversight under this legislation. I'm suggesting that we be given the necessary information so that we can fulfill our mandate under privacy legislation with respect to public sector and private sector privacy information. One of the recomme

Public Safety committee  All right. What we examine are activities that impact privacy. Our mandate does not extend to security issues that do not relate to privacy. We aren't looking to broaden our mandate. According to Treasury Board policy, departments are supposed to consult our office when activit

Public Safety committee  Well, we do so at any appropriate time. Ideally, we would hope to be consulted prior to the bill being tabled, but the regular way is for my office and me to be called to committee to give a recommendation on a bill. We can also do the same for regulations and consultations with

Public Safety committee  I hope so. We're certainly prepared for that. We expect that and we would call on the government to involve us in that.

Public Safety committee  Certainly in terms of data crossing national boundaries and being shared with other institutions, my recommendation is to make sure we have specific requirements for these information-sharing agreements so that the purpose, the retention and the safeguards regarding that informat

Public Safety committee  Thank you, Mr. Chair. Members of the committee, I am pleased to be here to assist the committee in its study of Bill C-26, an act respecting cybersecurity, amending the Telecommunications Act and making consequential amendments to other acts. Cybersecurity is an area of signifi

Information & Ethics committee  Yes.