[Recorded by Electronic Apparatus]
Thursday, June 13, 1996
[English]
The Chair: Order.
I want to welcome, from the Office of the Privacy Commissioner of Canada, Mr. Bruce Phillips, privacy commissioner; Holly Harris, legal counsel; and Julien Delisle, executive director.
Our format is that we like to hear from you and then we like to ask you questions. It's pretty simple. Please go ahead.
Mr. Bruce Phillips (Privacy Commissioner of Canada): Thank you very much,Madam Chair.
Mr. Ramsay (Crowfoot): I'm sorry to interrupt, Madam Chair, but I have business here that should have been done before.
The Chair: Sure.
Mr. Ramsay: I'd like to table a letter sent to us by Mr. Michael Drapeau, dated June 10, 1996. I'd like to table that, if it's in order.
The Chair: This is the letter that was forwarded to the committee and that formed the basis of Mr. McClelland's questioning. Is there consensus for it to be tabled?
Some hon. members: Agreed.
The Chair: That's fine. It can be tabled.
Mr. Ramsay: Thank you.
The Chair: We won't do that again, Mr. Phillips.
Mr. Phillips: That's perfectly all right. Nothing surprises me, Madam Chair.
The Chair: You just wait. Give me my notes.
Mr. Phillips: First of all, thank you very much. It's a pleasure that comes all too rarely for us to appear before this committee. I note that most members of the committee have been changed since my last appearance here. I'm happy to meet those of you who are here today.
Because this is my first meeting with this particular committee, I'd like to talk a little bit in general terms about privacy, if I might, and what it is, what we do.
First of all, beginning where you left off with the previous witness, I would like to try to explain to you the differences between privacy as a concept and access to government records.
The Chair: I was going to ask you the same question I had asked him, at the end, but if you want to deal with it in your presentation, that's fine.
Mr. Phillips: The Privacy Act and privacy generally are not the flip side to access to government records. These two statutes don't - and shouldn't - mirror one another. Mr. Grace and I do share premises and support services for administrative efficiencies. Treasury Board has already examined that issue and decided that any savings to be obtained from merging these two offices would be insignificant and not worth the cost in terms of the sublimation of one or the other of these issues in the context of their public profile.
This question was examined in 1987 by the review committee. The justice department said this would not be a good idea. All the provincial privacy commissioners I know, although because they're smaller they have much smaller jurisdictions and function in both roles, oppose the notion of separating them at the federal level. Privacy itself is an issue that really touches every aspect of human life. We are dealing here with a basic, fundamental human right that permeates society at almost every level and in almost every way. Access to general government records is a simple question of whether you get it or you don't.
They are not concerned with societal issues of privacy in a swiftly changing, technologically-based world - issues such as biomedical science, genetics, for example, drug testing, or issues related to the rights of criminals to privacy, or released offenders to privacy. There are scores and scores of issues of societal value that must be examined by an organization attuned to think in those terms.
The other issue I want to make clear to you is that we often do not see eye to eye, that both the access commissioner and the privacy commissioner are ombudspersons. We do not pass binding orders. Personally, I would not want to pass binding orders. I feel that the ombudsperson approach is a much more effective one. It saves a lot of money. We don't wind up in court a lot of the time.
I do not see how any ombudsperson can stand in two pairs of shoes and wear two hats at the same time. The record is replete with quotations from my predecessor in this office saying exactly the same thing.
There are, in my opinion, very serious down sides to this notion of merger. I hope the government never proceeds with it. However, I would like to get on to some of the issues that are in front of us.
Privacy is a value that's at the heart of liberty in a modern state and fundamental to our understanding of autonomy and personal freedom. It's the right to control what other people know about us. It's the right to be left alone. It's a value that the Supreme Court itself has decided, under the search and seizure provisions of the charter, constitutes a charter right.
Privacy is, for example, a value that's threatened by marketers, who sell your name and address to others without your knowledge and consent. It's the value that's at risk when some commercial enterprise such as a financial institution integrates all your account, loan, credit card, and debit card information in powerful electronic databases without your knowledge and consent. Privacy is the issue that's at stake when governments and business install covert and overt cameras in so many walks of life, or demand body samples for testing, or assemble massive registries, albeit for allegedly benign purposes, and then sometimes yield to the temptation to use the information for something else entirely.
You cannot pick up a newspaper these days without reading a story with privacy issues. There are a couple even in today's paper. Let me give you just a quick sampling.
A computer sold at a flea market recently was found to contain patients' medical records. A woman found immigration files, complete with X-rays and medical records, in a dump in Winnipeg. An apparently unauthorized disclosure of videotapes was smuggled out of prisons. We all know about that one. We have Metro Toronto's proposal to embed encrypted fingerprints in welfare claimants' identification cards; Quebec's budget announcement that it will search all government databases to identify possible tax cheats; pharmacists selling doctors' prescription records to drug companies.
That is just a very small sample of the privacy issues we have culled out of the daily run of the press in the last little while. Not all of those are necessarily bad, but they show the enormous variety and the impact of technological change on the way we're living and on our personal privacy.
In case you missed it, the firestorm in Ontario about the proposed plan, or the supposed plan, to introduce a multi-function smart card, including driver's licence and welfare and health card, which in the reported words of the responsible Ontario minister - I hope they don't get too mad at me in Ontario - will keep a timely record of citizens' use of the system ``like VISA or MasterCard, where they can tell you where you were an hour ago and how much you've spent'', and ``That would be a great step forward for the health system in Ontario''... For a privacy commissioner that's a giant leap backwards, not forwards, for autonomy and freedom.
I think you should know that privacy is rising rapidly up the profile of public agendas of interest to the Canadian people and voters. We've been a participant in a major survey on this issue. A number of other surveys have also been conducted, by people such as Equifax, the huge credit reporting company. All of them tell the same tale, that the public is deeply uneasy about what's happening in the information society, they feel the need for stronger legal protection, and they are looking to the Government of Canada as the place to provide it.
We'd be happy to provide any of the surveys we have if this committee ever wants to see them. I think we did give one to the committee in my previous appearance.
Not only that, but there is a growing sentiment in favour of action by the Government of Canada on the part of private business as well as privacy advocates such as ourselves. For example, the Canadian Direct Marketing Association has recently become quite a strong advocate of the federal government's taking the lead in legislating privacy rules in the private sector, because they feel they need a level field. The Canadian Standards Association recently cooperated with a large number of private and public sector organizations in drafting a model privacy code, which if it ever becomes law would be a pretty good law.
Some other factors make it important for the government to act now. The time has come.
In that respect, I should remind members of this committee that just a month and a half ago the government announced that it intends to proceed with drafting legislation that will bring privacy law into the private sector.
As I said at a committee appearance the other day, this is potentially the most important development in the privacy field since Quebec made a similar move a few years ago - certainly since the creation of my office and probably in the history of the country - because it would mark the first step forward in bringing privacy rights to Canadians wherever they live and whatever they do.
Another issue of concern to this committee... I bring this to your attention because this is the committee to which my office is responsible for bringing to the attention of Parliament things we think you should know about. Chief among them is the unintended, I am sure, but nevertheless very important, consequence of government downsizing and privatization.
One of the spin-offs or side-effects of privatization is the potential loss of privacy rights by many thousands of government employees, which they now enjoy under the Privacy Act. Equally, and possibly more important, there will be the removal from under the umbrella of the Privacy Act many millions of pieces of personal information currently generated on behalf of government activities, which in future will be done by private sector organizations.
One of the examples I cite, merely as an example because it's not the only one, but it's one in which I did make an effort to intervene, is the imminent transfer of the control of air traffic mechanisms in this country from the Department of Transport to a private company. Some6,000 federal employees are going to be affected by this. Currently, they enjoy all the rights of the Privacy Act. They will lose them. The company involved has given certain assurances, but they're not in any way legally binding.
Secondly, millions of pieces of traffic data, much of it highly personal information about the movements of individual Canadians, will be moved from the protection of the Privacy Act into an unprotected area.
The more this goes on by the government, the more information currently covered by the Privacy Act will no longer be covered.
If the government does bring in a comprehensive and effective piece of legislation down the road, it might well serve as an answer to that problem. But we do not yet know what kind of a bill is going to come forward. In the meantime these downsizing and privatizing activities are going forward.
There is a simple solution in each case, which is to include in the bills that authorize these downsizings a clause that simply makes the company responsible under the Privacy Act for the management of its information, in the same way as the NAVCAN bill, for example, requires them to live up to the Official Languages Act. There is no great difficulty with this. So you should know about that.
A number of other important initiatives are going on inside the government at which we are looking: the permanent voters list, the evolving law on the right of the police to gather DNA samples for forensic purposes, and the issue of community disclosure of criminal records for persons out on early release or parole. We are following all those issues and we shall be prepared to comment on them if you're interested.
I want to close this brief opening statement with one observation that is bad news. I appeal to this committee. Two years ago I brought to the attention of this committee the deplorable state of the finances of the Office of the Privacy Commissioner. I described the condition at the time as fiscal anorexia. I think I understated the case.
The Chair: Could I ask that all cellular phones be turned off in this room. It's very rude to our witnesses and to the members.
Mr. Phillips: Thank you, Madam Chair.
I think that observation was an understatement. We were asked to provide this committee with a resource document to show the picture in our particular office. We did so at the time. We've done everything, really, in terms of our recourse to the normal processes of funding through Treasury Board and so on except to stand out in front of Treasury Board with a crying towel and begging bowl. Believe me, I'll do that, too, if necessary.
Our operating budget for this office next year will be $100,000. One of the chief values of having the right to investigate complaints is for our investigators to be able to go out in the field now and again to do our work on-site. As it is, in almost every case we have to take the word of departments involving a complaint outside the city of Ottawa. We do not have adequate resources to send our investigators out to look for themselves. I think you know what that means to the credibility of any investigative process.
The reason we're so starved for funds is historical. When we started, the administration at the time made it a virtue - and I applaud them for it - of keeping the office as small, tight and lean as possible. It is still very small, very tight and very lean, but it has never kept pace, as a consequence, with the growing caseload.
Our volume of cases grows almost exponentially. It has gone up 10% per year since I came on board. In the meantime, our resource base has been shrinking. We are a complaint-driven organization. We have no control over the volume of complaints. We are obliged by law to investigate complaints that come to us. We do need adequate resources to do that work, and we don't have them. We have the smallest operating budget of any federal agency in the establishment.
So what I'm telling you is that if Parliament cares, if this committee cares - and I believe you do - you will, I hope, make an observation about the desperate need of this office for a more generous attitude, on behalf of the people who have the purse strings, toward the defence of a very important basic Canadian human right.
The Chair: Thank you. Mr. Ramsay, ten minutes.
Mr. Ramsay: Mr. Phillips, I welcome you and your staff to our committee.
I have a letter here in front of me. I guess it's a letter of complaint. It says:
- Earlier this year, a representative from the Privacy Commissioner came to our office to inquire
about who we were and why we were making so many requests. ... ...Scott Newark took
exception to their presence, as we perceived the meeting a subtle form of bullying. The Privacy
Commissioner's office maintains that it was a friendly meeting, but to be blunt, why we want
the information is none of their business.
- We were told that the decision to release what information depends on who is doing the
requesting and what it is for. This is not part of the legislation but seems to be an internal policy
that they have developed.
Mr. Phillips: I certainly can, Mr. Ramsay. I'm familiar with the issue - I think - to which you are referring. There is an organization that seeks to assist the victims of criminal acts in this country. Are we talking about the same thing?
Mr. Ramsay: I think we are.
Mr. Phillips: We're very interested. That is an important issue in the country right now, the degree to which people who have been involved in the criminal justice system should be expected to give up their privacy.
This is an important organization. We asked to see them because we're interested in their perspectives on this issue. We were in no way attempting to do anything other than get their point of view on some of these issues.
We speak to many organizations on privacy issues. This is not a subject on which anybody has any monopoly on wisdom, and the issue of privacy frequently is an issue of balancing the right of the individual against the greater social good.
We were interested in knowing what they think about some of these issues. That was the purpose of asking for that meeting, and none other.
Mr. Ramsay: Have they come to the wrong conclusions in some of the contents of this letter that I have read?
Mr. Phillips: Yes, they have.
Excuse me, I didn't mean to interrupt.
Mr. Ramsay: He states this:
- We were told that the decision to release what information depends on who is doing the
requesting and what it is for.
Mr. Phillips: I personally was not present at the meeting. It was one of my officials who was there, so I cannot testify to the exact words used at any given time. But I did ask that question.
The answer was no, that was not the purpose of our meeting.
That might have come up in some context, but I couldn't swear to that.
I know what the meeting was for. I know why we wanted to go and talk to them, which was to get from them, if they wanted to talk to us at all, what they think about the issues of privacy and the rights of victims and the rights of people who are in the judicial system. That's why we went.
We talk about this issue to all kinds of organizations. We were not there to intimidate anybody.
I am surprised, quite frankly, that given an opportunity to talk to our office, to tell us what they think about these issues, anybody would turn down the opportunity. Our man was chased out of the office.
Mr. Ramsay: So the purpose of your meeting with this individual was to accomplish what?
Mr. Phillips: To understand, if we could, the viewpoint of privacy from the point of view of people who see themselves as victims of violent crime or people who are acting on behalf of such persons. That was the purpose of that meeting.
One of the really important policy issues these days in terms of the criminal justice system is how to handle the issue of public confidence in the system with respect to the release into the community of people who have committed violent crimes. What rights should remain with such people who have been released? What is the right of the public at large to a satisfactory degree of comfort in terms of their personal safety? That's an issue on which an office such as the one we're talking about here would have, I would think, some interesting observations. We'd be interested in hearing them.
Mr. Ramsay: When a former witness was asked a similar question by Ms Torsney, he indicated that the motivation for the seeking of information isn't taken into consideration. Does your office share that same feeling?
Mr. Phillips: With respect to a complaint filed with our office, yes, we do not look behind the motive; we look at the complaint.
Mr. Ramsay: Okay. So you have no concern about the motive for seeking the information?
Mr. Phillips: We're interested in what they think about these issues. That's right.
Mr. Ramsay: But are you interested in the motive? Does the motive play any part in your decision as to whether or not you will release the information?
Mr. Phillips: Their motive has already been made public, Mr. Ramsay. They have said in one piece of paper that I read that their purpose in seeking information from the Correctional Service of Canada is to be of assistance to victims of crime. They have said that in public.
Mr. Ramsay: That's not quite the question. In a general way, is the motive of any seeker of information a consideration of yours in terms of releasing the information or not?
Mr. Phillips: I think you have to understand the process a bit better. I don't make the decision about whether that information will be released. That decision is made by the institution itself. All of the releases of information to organizations such as this one by the Correctional Service of Canada, for example, are made under paragraph 8(2)(m) of the Privacy Act, which gives the Correctional Service of Canada the right to decide when information is sufficiently in the public interest to outweigh any privacy interest. They make that decision, not me.
So if there is any consideration of motive, it would not be by me but by the Correctional Service of Canada.
Mr. Ramsay: When you receive a complaint or a concern about this, the motive isn't taken into consideration at all, then, why they they might ask one department of government, or any department of government, for information. The motive for seeking that information is not a consideration, from your point of view.
Mr. Phillips: I have nothing whatever to do with the decision to release that information, so I have no proper interest in the transaction between them and the Correctional Service of Canada. I am more interested in what they think about the general issues involved here.
Mr. Ramsay: So that was the purpose of the visit to this particular individual, was it?
Mr. Phillips: Yes.
Mr. Ramsay: That's everything, Madam Chair..
The Chair: Ms Torsney.
Ms Torsney (Burlington): Is it too easy an observation for me to make that the whole issue of privacy is greatly underestimated in Canadian society? For instance, in the recent change in government in Ontario, a lot of people were saying the MPPs' files should have been handed over to the new person, that there should have been a complete handover.
I remember thinking at the time that surely those people had some assurances of confidentiality. Listening to you talk about some of the different departments, as things are privatized, I wonder if people really understand, in a general way, the issues related to confidentiality and privacy amongst the general population.
Mr. Phillips: I think public understanding of the issue certainly needs to be improved. I think there is perforce an improvement taking place, simply because of the increasing penetration of private life by technological advance.
Yes, you are right. Your own colleague, Mr. MacLellan, at a committee meeting I appeared at on Tuesday, made the observation that a great deal happens in society with respect to the handling of people's personal information that they do not know about. He's absolutely right. In fact, most of the massive traffic in personal information goes on by and large without the knowledge or consent of the people concerned. The principal exception to that rule are cases with the Government of Canada, which has a Privacy Act that does give people rights, and similar statutes in most of the provinces.
But apart from government information, there is almost no rule of the road anywhere with respect to handling personal information. That is why - to take a simple example, almost a cliché - when you buy something such as a magazine subscription, you are suddenly deluged by solicitations for a lot more. The information you provided for the original transaction has been sold off and used by somebody else, without your consent or knowledge.
Ms Torsney: Interestingly, on the subscription issue, I think people now understand that much better, but they still misunderstand that when they're filling in contest forms for draws, the information is very specifically used by most of the organizations collecting it to sell to other people. I'm amazed by how many people have no concept of this, that this is the goal. They're trying to get a mailing list based on those people who were interested in whatever was the product being drawn for.
Mr. Phillips: I wish everybody had your understanding, Ms Torsney, because that's absolutely right. There's no limit to the ingenuity of marketers to think of new ways to collect information from an unsuspecting public.
Ms Torsney: Maybe it would cut down on the number of people competing with me for whatever the prize is. I'm just kidding.
You raised the issue of transportation and the privatization of air traffic control. When you call to find out if someone is on a flight, and you can't get that information, is it for security reasons or for privacy reasons? Do you govern what an agent can tell me if I were to check if you were on the three o'clock flight this afternoon? I don't know if you've ever had the experience of trying to pick your parents up at the airport but losing the information about at what time you're supposed to do it. If you call and say that you think they're on a three o'clock flight from Tampa, they'll say that they can't give you that information.
Mr. Phillips: That's right.
Ms Torsney: Is that because of the federal Privacy Act?
Mr. Phillips: Not in the case of an airline, because at the moment they don't come within the ambit of the federal Privacy Act. But if it were a flight plan... Suppose you are a private pilot and you file a flight plan on a weekend to fly from Ottawa to some other destination for purposes that you would not like just anybody to know about. That's private information. Under the Privacy Act that would be covered because it would be a piece of information generated inside the system of federal information collection. That's the difference.
Ms Torsney: On the issue of the permanent voting records - not records, but the permanent voting lists... If only we had the records!
One of the issues that's been raised is women who have been abused who are in hiding who are fearing their former partners or whatever, that they currently are not putting their names even on temporary lists. How are we going to deal with that? There are a lot of benefits to having a permanent voters list. How do you manage that, and have we found ways to get around their specific concerns?
Mr. Phillips: You might want to take that specific question up with the chief electoral officer. I'll tell you what I know about it.
The permanent voters list as conceived by the plan already laid before the House does not force anybody to be on that list, and I'm glad to see that. In this country we don't force people to vote, and, similarly, we won't force them to be on a voters list if they don't want to be on it.
The issue arises as to the means by which they can avoid getting on it. I understand thatMr. Kingsley has in mind that he will start the creation of this voters list by one final enumeration in the conventional old style and thereafter keep it up to date by a variety of means, which I'll be happy to talk about because I have some problems with them. I presume that at that stage of the game you do not have to be enumerated if you don't wish to be.
If you subsequently find your name on a voters list and you don't wish to be on it, then he is including an opting-out provision. You would have to notify the chief electoral officer that you want your name stricken and it would be done.
Ms Torsney: You deal only with federal government departments, but what about federally regulated industries such as banking, which you've already mentioned?
Mr. Phillips: They are not covered by the federal Privacy Act. You raise an interesting point. I hope they will be.
The review of the Privacy Act by the justice committee in 1987 recommended two important changes in the mandate of the office. One was to include crown corporations, which are presently exempt from the act, and the other was to look at the issue of extending coverage into federally regulated private business.
Ms Torsney: The only other issue I wanted to flag to you, if we do go into crown corporations, is this. I don't know if you saw the issue that's happening in the United States where people are switching other people's mail to private post office boxes?
Mr. Phillips: I did see that item, yes.
Ms Torsney: I gather that we don't have the same kind of problem happening in Canada, although perhaps we should ask Canada Post that.
Mr. Phillips: Yes.
Ms Torsney: That would be an issue of privacy in some ways, would it not?
Mr. Phillips: Yes, in the sense that it's appropriating people's personal information for a purpose other than that for which it was originally provided to the Post Office. Yes, it would be, but it would primarily be a law enforcement issue.
Ms Torsney: In terms of fraud.
Mr. Phillips: There's a fraud issue involved there, yes.
Ms Torsney: When I was watching that program it amazed me how much information they had picked up from people's mail and how they were able to manipulate it so extensively - taking kids' college trust funds out, switching all their share purchases, everything. It was phenomenal - visas, the whole bit. It was quite extensive. The information that is flowing through our mail systems that could wreak havoc on someone's life... They had basically appropriated people's identities, from their driver's licence right through to credit cards and everything else. It's phenomenal.
Mr. Phillips: Yes, it's an enormous invasion of privacy, absolutely.
Ms Torsney: I think you've given us lots of food for thought. I don't know if the Privacy Act is up for review, but I certainly would be interested in looking at it.
Mr. Phillips: The answer to that last question is, yes, the justice department is now considering amendments to the act.
Ms Torsney: Great.
I guess you'd have to get rid of the anorexia problem, then, if we were going to include anything else.
Mr. Phillips: Yes.
Ms Torsney: Not to minimize anorexia.
The Chair: There are still a couple of minutes left on this side. Mr. Kirkby?
Mr. Ramsay.
Mr. Ramsay: Mr. Phillips, the Communications Security Establishment, which the Department of National Defence has labelled as one of Canada's most secretive agencies, apparently has the capacity to intercept all forms of communication engaged in by Canadians. Has your office conducted a fair information practices audit on that organization?
Mr. Phillips: Yes, we have, Mr. Ramsay. It is now in the final stages of preparation. We started it about two years ago. It's taken a long time to get it done, but it will soon be finished.
Mr. Ramsay: Can you tell us a little bit about what you're finding?
Mr. Phillips: I really don't think I can, Mr. Ramsay, in advance of the completion of the report. Our normal process is to provide the report. It's an audit, the same as many other audits we've done of government information management practices, that goes to the head of the institution first. We're now finalizing this.
Naturally, we are required to respect the security requirements of any particular department we audit. I therefore would want to take counsel and certainly discuss with the CSE those aspects of any of our observations that fall under some type of security restraint.
I guess I could say this much, Mr. Ramsay: don't look for any big headlines in it.
Mr. Ramsay: Of course I'm not looking for big headlines, Mr. Phillips. Will your report be made public?
Mr. Phillips: They normally are not, but I appreciate the enormous interest here, and I will certainly discuss with the other stakeholders that very issue. I want to be as open and communicative with this committee and with the general public as I possibly can.
Mr. Ramsay: Could you tell the committee to what extent this department poses a threat to the privacy of Canadians?
Mr. Phillips: I would have to answer that question by saying, no, I did not find the department in breach of the Privacy Act.
Mr. Ramsay: Have you had any individual complaints about the Communications Security Establishment?
Mr. Phillips: We have received complaints from time to time involving CSE, but the ones that come to mind - and there may be exceptions to this - were filed by employees unhappy with some aspect of the management of their personnel records. I do not recall a complaint filed by anybody who felt their privacy had been offended as a consequence of the operations of CSE in the field of signals intelligence. I may need to be corrected on that.
Am I right?
Mr. Julien Delisle (Executive Director, Office of the Privacy Commissioner of Canada): You're right.
Mr. Ramsay: Does the gathering of information on individuals by this organization fall within the law, based upon the security requirements of the country? If it were not for the security requirements of the country, would they be authorized, or would your audit investigation into the gathering of personal information be in violation of the Privacy Act?
Mr. Phillips: Let me just discuss that with my colleagues.
Our audits of the information practices of any government department are related to its mandate to collect information for specific purposes. It is under that authority that we conduct audits.
Does that answer your question?
Mr. Ramsay: No, it doesn't.
The Chair: Well, that's your five minutes.
Mr. Ramsay: Saved by the bell.
The Chair: We'll have a chance to come back here, Mr. Ramsay.
Ms Torsney.
Ms Torsney: Obviously you know that there are lots of petitions out there petitioning the government to do various things on behalf of various organizations or individuals. What kinds of guidelines are there for people who circulate petitions and then either sell that information or use it for other purposes?
For instance, you could start a petition tomorrow for whatever reason. I might sign it thinking that's exactly its only purpose, but you might keep that information or circulate it. Maybe it's on an issue related to drugs, for instance. I could give that information to a drug company, saying that these are the people who are worried about those issues.
Are there any guidelines for people who are praying to Parliament?
Mr. Phillips: I suppose it depends on who is circulating the petition. If it's an entirely private activity, then the degree to which it might be used for other unrelated purposes would be entirely up to the person circulating the petition and whatever assurances, guarantees, or undertakings were given to the people who signed it.
Ms Torsney: There aren't any.
Mr. Phillips: Then I suspect that there are no limitations on its possible secondary or tertiary use.
Ms Torsney: Should there be guidelines on the information?
Mr. Phillips: I think all collections of personal information ought to be subject to some common standards so that when people are required to give up personal information for transactional purposes they are protected against subsequent use without their consent, yes.
Ms Torsney: It would seem to me that if I'm signing something that seems to be fairly straightforward - it's asking Parliament to change a law or to care about an issue or something - and I'm asked to give my name and phone number and address - there are specific guidelines that we issue to make sure that the petition is valid - my intention is that Parliament, not anybody else, will see that. It's a fairly official-looking procedure that they're following, yet I have never seen anything telling people what restrictions are on the information they have by virtue of the fact that we have specific rules about how to sign petitions.
Mr. Phillips: Once it's presented to and laid before Parliament, of course it becomes a parliamentary document.
Ms Torsney: But they are circulated in stores or available... The petition industry is quite an industry now.
Mr. Phillips: That's a very interesting issue. It would be up to Parliament if it wanted to pass some rules respecting the nature of petitions it was prepared to accept. If you wanted to intervene in that process and say that you will accept only petitions that have been prepared according to certain rules -
Ms Torsney: We do that now.
Mr. Phillips: Well, okay. But I mean with respect to protecting the information on the sheet from subsequent usage.
It is a bit difficult, though. I can see all sorts of practical problems with it. If it's sitting on a sheet in a public place such as a drugstore and you can see all the names that are already there, what is to prevent the casual passer-by from looking at it and making whatever notes he or she wants to make? I can see all kinds of practical difficulties, but I do understand the problem you have.
If the drugstore itself were to take that list down, copy all the names, and use it for marketing purposes, I know of nothing at the moment, beyond whatever undertaking they're prepared to make, to stop them from doing it. I'm certainly aware of no rules that would prevent that practice.
Ms Torsney: Maybe we should have you speak to the Speaker about that. I would think that there are groups that are taking that information for other specific reasons, or maybe just by accident using it for all kinds of other reasons. That's not an appropriate use of the information and it's breaking what I think would be the goodwill of the people who are signing.
Mr. Phillips: I hope you wouldn't think it impudent of me if I suggested that maybe you'd be the right person to speak to the Speaker.
Ms Torsney: Back me up when he calls, will you?
The Chair: That is an interesting point. I was just commenting to the researcher that if I get a petition on an issue I'll use it to form a database of people in my riding who are interested in that issue. If I'm doing that, then who else has access to those when they're in the hands of the House?
Ms Torsney: It's before they even get to you that I'm concerned about.
The Chair: I understand. It's interesting. Ms Meredith says that she gets too many to do that.
Mr. Ramsay.
Mr. Ramsay: I'd just like to finish something. Have you had any difficulty in obtaining the necessary information to do your audit on the Communications Security Establishment? Why is it taking you two years?
Mr. Phillips: There are several reasons.
The answer to the first question is no. You will understand that the audit is done by officials in my office; I usually don't go to these places personally, although I have been briefed by CSE on the nature of its operations. No, we didn't have any difficulty in obtaining information; in fact, they were extremely cooperative.
The reason why it's taken us a long time is several-fold. For one thing, there were security requirements for the storage of documents in our office that we were not able to meet at the outset of this audit. It took several months before we could get a proper, safe storage facility in our office.
Mr. Ramsay: Is this your first audit?
Mr. Phillips: No. It's our first audit of CSE, which involved the movement of highly classified documents into our office from CSE, to be stored there while they were examined by our audit team. So it took a while for us to get a proper storage facility built in a safe room.
Mr. Ramsay: What is the purpose of the audit?
Mr. Phillips: The purpose of the audit is to see whether the collection of their information is in conformity with the Privacy Act. The collection of information by governments is usually authorized by some statute that gives them the authority to collect information and store it and use it, and the purpose of our audit is to make sure that the method by which they're collecting information complies with the authority they have to do so.
Mr. Ramsay: Recently the Minister of Justice conducted a consultation on the establishment of a DNA bank. Did your office participate in that consultation?
Mr. Phillips: Yes. We have been involved in two consultations with the justice department on the issue of DNA. The first was associated with the introduction and passage by Parliament a year and a half or so ago of laws that authorize the police to collect DNA samples for the purpose of identification. The second is a consultation document on the next phase of the government's evolving DNA legislative approach, which is whether the samples themselves, as opposed to the results derived from the samples, should be retained and kept in some sort of data bank. They asked us for our opinion on that subject and we have responded, yes.
Mr. Ramsay: Do you support the establishment of the DNA bank?
Mr. Phillips: No.
Mr. Ramsay: Do you have any concerns about it?
Mr. Phillips: Yes, we have a very serious concern about that.
We recognize the value of DNA fingerprinting for law enforcement purposes. It's a very valuable tool, in the same sense that in an earlier era the Bertillon fingerprint system was a very valuable tool for the identification of people suspected of crime, and also to establish innocence, as it has already done in more than one case. But the retention of the actual sample itself, from which the fingerprinting is derived, is in our opinion unwarranted.
The natural temptation, when you have an actual databank sample, is what we call ``function creep'', to say, well, these samples can produce all kinds of other information unrelated to the identification of people. Inevitably, people start finding ways and justifications for using it for that purpose.
Mr. Ramsay: Can you give us an example of that?
Mr. Phillips: Yes, I can. I saw just the other day an actual, living example of what goes on. The United States Marine Corps, I noticed, requires all its members to give a DNA sample for the purpose of getting material that can help them identify fatal battle casualties. Frequently the corpse itself is not identifiable because of the nature of the wounds. That seems, on the face of it, a reasonable use of it, but now the Marine Corps has decided it will make these DNA samples available to police and to research people for other purposes.
Those are not the terms under which the young marines have been asked to give that sample. Two of them refused, as a consequence, and were court-martialled. I think they've been dismissed from the service. The case is now under appeal.
That's an ideal example of what we call function creep, finding other unrelated uses for this information. So we have a serious problem with that, yes.
The Chair: Thank you very much for your questions, Mr. Ramsay.
I want to thank you for appearing before the committee and for giving us an opportunity to hear about your department. It's also nice to have had the juxtaposition with the previous group of witnesses. We do appreciate that. Thank you very much.
[Proceedings continue in camera]