INDY Committee Meeting

STANDING COMMITTEE ON INDUSTRY

COMITÉ PERMANENT DE L'INDUSTRIE

EVIDENCE

[Recorded by Electronic Apparatus]

Wednesday, December 2, 1998

• 1532

[English]

The Chair (Ms. Susan Whelan (Essex, Lib.)): The chair calls the meeting to order pursuant to an order of reference of the House dated Tuesday, November 3, 1998, consideration of Bill C-54, an act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions, and by amending the Canada Evidence Act, the Statutory Instruments Act, and the Statute Revision Act.

I am very pleased to welcome the Department of Industry back again today. I apologize that we didn't get to them yesterday; however, we did have a very good discussion with the minister.

I'm going to turn it over to Michelle d'Auray for some opening comments. It was my understanding that we'll stick with the privacy issue, and we will try to separate the bill into two sections.

Ms. Michelle d'Auray (Executive Director, Electronic Commerce Task Force, Department of Industry): Thank you, Madam Chair.

With me today are Ms. Helen McDonald, the director general of the policy development group of the task force on electronic commerce, the section of the task force that is responsible for the development of the privacy legislation; Ms. Stephanie Perrin, who is the director of privacy policy for the department with the task force; and Ms. Heather Black, who is with Industry Canada via the Department of Justice, advising us on the privacy provisions of the legislation. We also have experts with us if questions on the electronic documents component of the legislation arise during the course of this discussion. We're very pleased to be here today and to be able to answer any questions the committee may have.

[Translation]

We are pleased to be here today to answer your questions. I will make a very brief introduction.

[English]

since the minister covered most of the general overview points of the bill yesterday.

Generally speaking, the goals of information privacy policies are to establish responsibility; to identify purposes at the time of collection of information; to limit collection to those purposes identified; to limit use and disclosure; to obtain consent for other purposes; to oblige data quality; to oblige data security; to allow individual access and correction; to allow individual redress; and to establish an oversight responsibility. These principles generally appear in any legislation that has been established in the world, and they are generally based on the 1980 OECD guidelines for privacy protection.

• 1535

The forces that are at work in bringing privacy issues to the agenda are implications of the patchwork system that we have in Canada. With the exception of the province of Quebec, which has legislation on privacy in the private sector, we have very spotty regulation. As the minister indicated yesterday, there is a need to establish confidence in electronic commerce on the information highway. In some instances, there is an eroding distinction between the public and private sectors in regard to the treatment and collection of information, and there are some growing implications internationally for trade and other issues with regard to privacy and data transfers.

The arguments for legislation in Canada are fairly important. We need to provide some consistent rules of the road. We need to establish an impartial “traffic cop” or oversight mechanism. We need to be able to bring under legislation those known as the free riders, or those who do not conform to self-regulatory codes. And we need to satisfy, in many respects, international data protection standards. This legislation, Bill C-54, does these things by embedding into law the Canadian Standards Association model code for privacy protection. The bill provides an oversight mechanism through the federal Privacy Commissioner, with a fairly easy recourse, and an ultimate recourse, to the federal court.

I will stop at that, and leave it open to questions from the committee.

The Chair: Thank you very much, Ms. d'Auray.

I'm going to ask members if they have questions. I'm assuming some may have some technical questions, while others may not have any at this time. We will have the opportunity to have people from the department back on this again if need be, as well as when we deal with the bill some more in February again.

That being said, Mr. Pankiw, would you prefer that I begin with Madame Lalonde?

Mr. Jim Pankiw (Saskatoon—Humboldt, Ref.): Yes.

[Translation]

The Chair: Ms. Lalonde, do you have any questions?

Ms. Francine Lalonde (Mercier, BQ): I would expect that Ms. d'Auray would give us a more extensive outline of the Act itself; her failure to do so is quite surprising, since it must be the foundation of the rights for all citizens.

The meaning of the law should be found amidst a series of conditions, which the law would unify by creating obligations. Frankly, I feel that it takes more than a law course to find out what the law and the obligations are when reading the standard and the Act itself. Thus there is a good deal of confusion, and I can quote an attorney who works for a consumer association in Quebec and who said to the newspaper Le Devoir that after a briefing with departmental officials, there were 40 people with 60 different interpretations. That will be my first question.

Ms. Michelle d'Auray: Thank you. The question of the standard is interesting. We decided to incorporate the Canadian standard in the Act in order to make it possible to use a standard already known by consumers and businesses in the private sector, and by governments. The standard is an integral part of the Act and it sets out obligations with which businesses must comply.

By attaching the standard, it can be used for audit purposes. It can also be used internationally to make an assessment and oblige companies dealing with Canadian businesses to comply. Sometimes it is quite difficult to make companies comply with laws in other countries. Thus the Act contains a standard whereby international comparisons may be made.

The Act is a unit from the first part to the appendix, but the obligations are clearly set up in the standard itself, which has the force of law.

• 1540

Ms. Francine Lalonde: Allow me, madam, to differ strongly with you. You say that the obligations—and I would add the rights—are clearly included in the standard itself; that is not so. When you look at the provisions of appendix 1, which is called Chapter 4 or Article 4, you see that there are so many verbs in the conditional that they have to be explained by subsections (1), (2) and (3) in section 7.

I repeat, it is impossible for businesses to know what their precise obligations are. I'm not concerned too much about the large companies; they have their own attorneys and all kinds of resources. However, the small and medium-sized businesses, which are in the vast majority, would not know what direction to take. I'm thinking mainly of the common people. You say that consumers are familiar with the national standard— Probably a few members of consumer associations know it, but apart from them, the national standard is not generally known. Thus I must differ with you totally in this regard.

Let me get back to the right of recourse. In the experience gained through the application of the Quebec law—

The Chair: This is your last question, please, Ms. Lalonde.

Ms. Francine Lalonde: Not in the whole procedure, I'm sure, madam. However, I will be good, as usual. I'm waiting for you to smile after the interpretation.

The Chair: This is your last question, please.

Ms. Francine Lalonde: I was saying that in Quebec, the effectiveness of the law—because it has been effective, after four years of implementation, even though the companies balked at first—is tied in with the individual's right to have recourse rapidly and free of charge.

In the federal Act, if I understand correctly concerning the right of recourse, when problems of personal information arise, section 15 refers to section 8 of the national standard, which says that the person must first try to come to terms with the company. Failing this, he or she can approach the commissioner, who can then make an investigation. A report and recommendation are made, and if the company does not comply, the person must after a certain period of time apply to the Federal Court. Would this not discourage people, on the one hand, and on the other hand, fail to give encouragement to companies to apply what might appear to them to be the spirit of this Act? We must bear in mind that there are companies whose intentions are good, and there are others. The government must be on the side of the ordinary person and the consumer.

Ms. Michelle d'Auray: I might add one more thing concerning standards. For SMEs, the requirements are quite clearly set forth. The Commissioner, through his or her public education powers, might produce very simple documents indicating the 10 steps one must follow to comply with the law. The language in the standards is quite clear and is written very simply. The obligations are set out and have force of law. The other elements, the recommendations, are there to give the companies suggestions on how to conform to the requirements.

As for the right of recourse and how to exercise it, the person may go directly to the Commissioner.

Ms. Francine Lalonde: Not in every case, if I understand the Act.

Ms. Michelle d'Auray: The person may approach the Commissioner. Normally, when a person realizes that there is a problem, it's because he or she has tried to obtain information from a given company. That's usually how you find out that a problem exists. It can then be brought before the Commissioner, who may on his own initiate audits and bring cases directly to court.

We felt that because of his public education power and his power to make certain terms and conditions public, it would be better to give the Commissioner these powers and combine them with powers to audit, rather than give him powers to decree, and leave this up to the courts.

• 1545

[English]

The Chair: Thank you.

Mr. Lastewka, please.

Mr. Walt Lastewka (St. Catharines, Lib.): Thank you, Madam Chair.

I wonder if you could explain this. We've had some discussions already about the overlap of provincial law and federal law. I realize Quebec is the only one that has a provincial law at the present time. Could you explain the procedure of how the provinces—I think it's under clause 25—if they've enacted portions of the Privacy Act, will be exempt from federal law? Also, what about where there are federal organizations or dealings in provinces that will have to fall under the federal law as they can't fall under the provincial law? Would you give us some examples?

Ms. Michelle d'Auray: The bill provides for the coverage, in the first three years, of federally regulated industries, such as banks, communications companies, cable companies, telecommunications companies, and phone companies, as well as interprovincial transportation, such as airlines. It also covers international and interprovincial trade in information.

Three years after the coming into force of the legislation, where provinces have acted, the government may exempt from coverage those provincially regulated industries. It's because the province has acted. Otherwise, the bill will apply to those provincially regulated industries in terms of their commercial activities in the trade of information.

The process really is based on whether or not a province legislates and whether the legislation is substantially similar to the federal legislation. So when there is a difference, a province can extend its scope in many instances. Provinces may choose to go beyond the coverage of provincially regulated industries to deal with municipalities or municipal issues. They would also have to deal with the employees of provincially regulated companies, because under federal jurisdiction, we cannot deal with privacy issues related to provincial employees or employees of provincial companies.

In essence, if a province like Nova Scotia decides not to legislate, then federal legislation will apply three years after the bill comes into force to those provincially regulated companies. If Nova Scotia does decide to act, then the companies under its jurisdiction will be covered by provincial law, and the federally regulated companies will covered by the federal law.

Mr. Walt Lastewka: If Nova Scotia decides to act, how is the decision made that their law covers everything that's in the federal law? What's the process?

Ms. Michelle d'Auray: The process is essentially to make sure there's an approach to harmonization. There's a group set up to work with provincial administrations to make sure that if they develop legislation, there's an understanding of how to best harmonize that.

In terms of what's defined as a provincially regulated commercial activity, it's defined in relation to the federal jurisdiction, federally regulated companies. So it's that which is not essentially covered by a federal works business or undertaking.

Mr. Walt Lastewka: What discussions did you have with the provinces and the Privacy Commissioner prior to the bill being tabled?

Ms. Michelle d'Auray: In terms of the provinces, discussions on privacy issues started in the summer of 1996. They were part of the federal-provincial information highway ministers meeting in fall 1996. I believe it was in September in Winnipeg.

The discussions then proceeded further over the next couple of years, leading up to the declaration of the information highway ministers in June 1998 that privacy protection was important and that working toward the Canadian Standards Association's model code was seen as a baseline element.

• 1550

So we have been in discussion on the intent of the federal government to legislate since about the summer of 1996.

Mr. Walt Lastewka: Were all provinces involved?

Ms. Michelle d'Auray: Yes, they were all involved in the discussions.

Mr. Walt Lastewka: What about the Privacy Commissioner?

The Chair: Mr. Lastewka, this is your last question, please.

Ms. Michelle d'Auray: The Privacy Commissioner, in a number of his reports, has been calling for legislation in the private sector for some time. We issued a discussion paper on which he commented as well. So there have been some discussions with the Privacy Commissioner at that level.

I also forgot to mention we had a public consultation paper that was issued in January 1998 on the best means by which to ensure protection, the federal government's wish to legislate, and what kind of legislation should be developed.

Mr. Walt Lastewka: Thank you, Madam Chair.

The Chair: Thank you very much, Mr. Lastewka.

Mr. Jones, please. You have no questions?

[Translation]

Ms. Lalonde, do you have another question?

Ms. Francine Lalonde: Yes. You said, madam, that there was consultation. There was the beginnings of such a process, but it was abruptly interrupted by the tabling of the Minister's bill. One week before tabling his bill, the Minister sent a previous proposal to the provinces. But there was a much more comprehensive procedure among the various provinces, one in which Quebec was pleased to participate, but it ended abruptly.

I asked the Minister the question yesterday. One of the proposals in circulation would, in light of the constitutional interpretation of its jurisdiction, give the federal government a residual role, since the provinces would have laws coordinated to protect the rights. The Minister replied that he would never have accepted such a proposal. I don't have the blues; I tried to get them, but they aren't ready yet. But my understanding was that he never would have agreed to the federal government's having residual power.

Do you realize that Quebeckers currently enjoy rights that they would lose simply by having this bill passed? I hope that before it is passed, we will be able to convince you to take another direction.

I am thinking of the Air Canada employee who asked repeatedly to see her file. When she appealed to the Quebec commission, it wished to make a ruling. The company objected. They went to the Superior Court. In a recent judgment, they said that as long as there was no federal law, Quebec law would apply. So at this time, the person in question has a right.

In your bill she does not have that right. So the company refused. There was mediation, and the company refused to give the information. With your bill, she might not have access either. Under Quebec law she can benefit from a mediation process, but not under yours.

That is one example. A number of others could be given. It is not an abstract problem, but a very concrete one.

Ms. Michelle d'Auray: In the case you refer to, I believe that the question is being appealed before the Quebec Superior Court.

Ms. Francine Lalonde: A ruling has been made, namely to the effect that as long as there's no federal statute, the Commissioner has jurisdiction.

The Chair: madam Lalonde, madam Lalonde.

Ms. Francine Lalonde: You can just say madam.

[English]

The Chair: Madam Lalonde, when the witness is answering, I would prefer if you wouldn't interject. This has happened several times already today. You've spoken; now let them reply.

[Translation]

Ms. Francine Lalonde: madam Chair, I respect your right to sit in the chair. I will try to restrain myself. Even though you find me impertinent, my attitude is not unparliamentary. Thank you. But I will try to restrain myself.

[English]

The Chair: I didn't suggest it was unparliamentary. I suggested that once you've spoken, it's time for the witness. Several times you've made comments while they were speaking, and it's inappropriate.

Madam d'Auray.

[Translation]

Ms. Francine Lalonde: Thank you.

Ms. Michelle d'Auray: As you indicated, the federal Act completes the—

Ms. Francine Lalonde: —

[Editor's Note: Inaudible]

The Chair: madam Lalonde, please.

Ms. d'Auray.

• 1555

Ms. Michelle d'Auray: The federal Act completes the Quebec Act. There are areas of federal jurisdiction in which the federal law applies because the federal government has the right of control over companies or businesses under federal jurisdiction. So we will be completing the Quebec legislation on a number of levels, in particular the interprovincial and international levels.

As the minister said yesterday, because Quebec is the only province to legislate in this matter, when the federal law is passed, the people of Quebec will have the most comprehensive protection in Canada. They will be protected at both the federal and provincial levels.

[English]

The Chair: Thank you, Madam Lalonde.

Mr. Murray, please.

Mr. Ian Murray (Lanark—Carleton, Lib.): Thank you, Madam Chair. I'd like to ask a question on clause 7 regarding the protection of personal information. It states that “an organization may collect personal information without the knowledge or consent of the individual only if”, and it gives a number of different circumstances. Paragraph 7(1)(c) says “the collection is solely for journalistic, artistic or literary purposes”. Can you tell me why a journalist should be allowed to collect personal information without somebody's consent, or am I misreading this somehow?

Ms. Michelle d'Auray: The collection is essentially deemed to be for publication of an article or a media-related activity. It is to cover activities that in Canada are recognized, let's say for investigative journalism or for the purpose of publishing a novel or a play. But it is to collect.

If the issue then is one of libel or other kinds of disclosures, there are other laws that will kick in to protect the individual. Given the practice of journalism and of media in Canada, it was deemed to be a more effective way of allowing for the publication of information in the public interest, and then leaving it to the individual for recourse under traditional other recourse if there was misuse, wrongful publication, or publication of wrongful information.

Mr. Ian Murray: Doesn't it seem rather broad? I get the impression this could be used as a defence by journalists. It includes journalistic, artistic or literary purposes. I'm not clear how it's necessary to have personal information on somebody for artistic or literary purposes, unless it's a biography of that person on the Internet and somebody is looking up information about them.

We're talking here about personal information; we're not talking about publicly known biographical information that would be out there regardless. The kind of personal information we're concerned about, by its very nature, would have to be financial or other information we don't want other people to have access to. So I really don't understand why journalists should have access to this kind of information. This seems very broad and eliminates a great deal of protection just in that one clause.

Ms. Michelle d'Auray: A journalist obviously can request information from an institution or an organization on an individual, but again, the law provides a protection for the individual that the information is not to be disclosed without that individual's consent. So how a journalist obtains information may therefore be an issue, or whether or not that information is freely given may be an issue. Then the individual can have recourse if the information was given and it should not have been given by an institution or a company. So there are checks and balances throughout the legislation.

We also have to provide for the charter right of free speech, so it is a balancing act at that level as well. If there is information that is inaccurate, the individual also has recourse through libel and other means. But we need to create a balance. It's not just on the Internet; it also applies to any form of artistic or journalistic activity—paper, Internet or otherwise.

Mr. Ian Murray: Thanks.

The Chair: Thank you very much, Mr. Murray.

I want to thank the department for being with us this afternoon. I'm sure over the course of the hearings we'll be asking you questions from time to time. I am sure you'll be monitoring them. I appreciate you coming back today.

• 1600

Our next witness, Mr. Phillips, is now here, so I'm going to ask our witnesses to trade places.

Ms. Michelle d'Auray: Thank you.

The Chair: We're pleased to welcome Mr. Bruce Phillips, the Privacy Commissioner of Canada, here today. Everyone should have in front of them a copy of the presentation by Mr. Phillips.

I understand Mr. Phillips may have some opening comments that are different from the presentation in front of us, but we want to hear whatever opening comments you have, Mr. Phillips. I'll turn it over to you, if you'd like to begin.

Mr. Bruce Phillips (Privacy Commissioner of Canada): Thank you very much, Madam Chair and members of this committee, for asking me to come along to discuss this bill.

Before I begin, I'd just like to introduce the people who are with me. Holly Harris is our general counsel and Julien Delisle is our executive director. I suspect that during the course of the questioning you may have a few things you'd like to ask them, as well as me.

The piece of paper you have in front of you constitutes our formal submission to this committee. It contains, toward the end of the outline, those things we feel need or could use substantial improvement by way of amendment.

What I'm going to say to you now is rather more informal. I would like, first of all, before I begin my remarks, to put one thing on the record. I support and my office supports this bill. It is, in my opinion, long overdue. It fills a necessary gap in the protection of data in the Canadian community. It recognizes the necessity to establish legal privacy rights for citizens of this country, no matter where they live or in what particular activity they are engaged. It puts Canada close to the same level of privacy recognition and data protection that now exists in almost all of western industrialized Europe and various other jurisdictions. It puts us ahead of the game with the United States.

It is not a perfect bill. I cannot recall in my own experience, in one capacity or another, ever seeing what could be described as a perfect bill. But it goes a long way toward doing what has to be done.

In the course of your deliberations, doubtless various suggestions will occur to you for its improvement. Some have occurred to us already, and they're in our formal submission. But I want to make it clear now that I would be very sorry to see this bill fail because of what I consider to be minor deficiencies.

It recognizes the basic principle that people have a right to some control over their personal information, no matter where it's being used in the Canadian community. That is the first and most important principle of good privacy protection. It embodies the notion of consent for usage. It embodies the notion of transparency in its usage. It embodies the notion of knowledge of things that are being done with people's personal information. It's a good bill in that respect.

• 1605

It gives an adequate oversight responsibility so that people have a place to go if they have a complaint. It allows for a court adjudication if no other solution is possible. It establishes by way of dispute resolution an ombuds-office as opposed to an order-making office. We may get around to discussing that later, but the ombuds-office is specifically what my office suggested would be appropriate in these circumstances, and I'm glad to see it reflected in this bill. We can come to that later.

Now, if you would give me just a few moments of your time, I'd like to impose upon this committee, because this is the first time I have appeared before the industry committee—normally, I make my two bits' worth before the justice committee—to talk about privacy as a concept and what has gotten us to where we are today.

In our society we all tend to take privacy a bit for granted, and we often forget it is a value that is absolutely at the foundation of so many of the things we cherish in our lives, things such as the secret ballot; doctor-patient confidentiality; solicitor-client privilege; our wiretapping laws; and the old, ancient, and honoured notion that our homes are our castles. Those things all stem from the notion that we are autonomous human beings who are entitled to fence about us enough protection to decide what it is we want the world to know about us.

So privacy is not the flavour of the month. Let's get that clear. It is a bedrock value. Supreme Court Justice La Forest described it as being the value that is at the heart of liberty in a modern state.

It's not—as is often argued, particularly in fora such as this, where you often become involved in trying to balance rights against the public good—an individual right that is enjoyed at the expense of society in a collective sense, because it goes to the notion of mutual self-respect. Respecting each other's privacy is an integral element in the mucilage of a coherent society. It helps keep us together.

Respecting the boundaries we choose to draw around us makes the difference between a life of liberty, autonomy, and dignity, and the alternative, of course, and, if you care to think about this in the modern context, the opposite, the alternative, is a pretty hollow and intimidating kind of life where we're under a cloud of constant and oppressive surveillance. We're getting more and more of it in our lives these days, and we are supinely and insensately accepting it all. It's time we started taking a hard look at this stuff.

Whether we reveal or conceal the details of our lives ought to be individual decisions for us to make, not for others, not for business, and certainly not for the state, except in limited, specific, and lawfully established circumstances.

Let's think for a second about the current climate and the computer existence into which society is moving and contemplate the power of new information management systems to mine data, to match data, to manipulate data, and to collect data. The word “exponential” is utterly inadequate to describe it. It has grown at an explosive rate almost on a daily basis since things such as the existing Privacy Act were first passed 15 years ago or thereabouts.

When the Privacy Act was passed, in my office there were, I think, three word processors. The commissioner had one, and one staff member had a typewriter. In my office, thanks to budgetary restraint and good economical management by my staff, our stuff has never been state of the art, and the computing, when it was done at all, was done on mainframes, which were then largely used simply to store static data.

• 1610

Today, just a few years later, every person in my office has a personal computer on his or her desk. The standard desktop computer has 64 megs. That's more powerful than the old mainframes were. They don't stand alone any more, and they're not used just for the retrieval and storage of static data. They're linked to each other, and they're used for all kinds of things, such as manipulating and analysing data and transmitting personal messages back and forth. There are almost an unlimited number of uses. The more these machines can do, the more we seek new and creative uses for them and for the data they store. We call this function creep.

As one of my staff said, let's paraphrase Kinsella, the man who wrote the baseball book, and say “If you build them, we'll think of some new way of using them”, and that's what's happening to our personal information. I'm not trying to argue that we can live in a society without electronic information processing. We're not Luddites, and we're not impractical people. The benefits of this in terms of improving commerce, making greater prosperity, and creating wealth are self-evident and need no argument from us.

But there is a quid pro quo here, which I think doesn't get the attention it deserves. The quid pro quo is to provide legal protection for individuals whose personal data can, thanks to the computers, be amassed, mined, manipulated, disclosed, and unhappily often without people's knowledge or consent.

You have, in a sense, my sympathy for the complexity and difficulties of the job facing you, because you're in an economic, social, and technical environment that few of your predecessors ever imagined would happen. As parliamentarians you now have to find a way through all of this and come up with answers that are going to be properly respectful of individual rights.

I'm not going to go on too much longer, and I certainly don't want to sound apocalyptic in this brief dissertation. There's going to be enough end-of-the-world stuff as we approach the millennium. But I would like you to go away from these sessions with not just a better understanding of the minutiae of a particular piece of legislation but also of the context in which it has been brought forward, to understand a little better the nature of the society into which we're moving; in other words, to consider the cumulative impact on our social values of all that is transpiring and how this particular bill fits into it. I think it would be very helpful to you.

Up to this point, in the face of the clamant necessity to recognize the need for better protection of personal information, we have in this country nothing much more than an inadequate patchwork. Most of the provinces—and if I repeat what other witnesses have said, please forgive me—have a privacy law of some sort or another. Only the Province of Quebec—God bless it, I've said it many times—up to this point has had the courage, the foresight, and the wisdom to legislate in the commercial world. Nearly all of these other statutes cover only public sector activities, including, until today, the Government of Canada.

Those early data protection statutes, including the federal Privacy Act, were very good in their time, and the federal Privacy Act has stood up very well, but to leave unattended and—I will avoid the use of the word “regulated”—unwatched, which is a better word, I think, the activities of the largest accumulators, users, manipulators, and marketers of personal information, the commercial world, has, in my opinion, been an unfortunate oversight, which we should have dealt with earlier than this. I am glad to see that this government is acting.

• 1615

It's a very simple thing. At this moment neither I nor anyone else in this room, except those who are residents of the province of Quebec, have any right to know what information business has about you, how they got it, how they use it, whether it's correct, with whom they share it, and whether and how they intend to keep it. If you're all comfortable with that, then include me out, because I am not. I think that's a distinctly uncomfortable position. The legal defences we have up to this point are inadequate, they're threadbare, they're drafty, and we want something better to keep ourselves warm at night.

I'm sure other witnesses who have preceded me have explained the circumstances that have driven the government to act—of a practical nature, the passage of the European Union draft directive on the protection of data and its possible consequences in terms of transatlantic and international trade; and the onrush of electronic commerce and the need to get some ground rules for that.

Those are all good reasons. As a privacy advocate, I think I can be grateful for the serendipity of all this, but I insist that the really basic necessity of this goes well beyond electronic commerce, well beyond the European draft directive, and has everything to do with our rights to be free, autonomous citizens entitled to mutual self-respect and some element of personal dignity. That's what's involved here. Let's try never to forget that.

When looking at a bill, we've had a number of opportunities over time to put submissions both to the Department of Industry, to the Information Highway Advisory Council, and so on, about what we thought was the solution or at least a partial answer to this problem, and I'm pleased to see that the bill reflects a number of our propositions.

We offered the following advice to Industry Canada on what a bill should look like. Keep it simple. Let's avoid the pitfalls that some European jurisdictions have followed of requiring the registration of databases, and so on. Let's not get into a costly, cumbersome, bureaucratic process. Let's keep this as clean and efficient as possible.

Let's try to get as level a playing field as possible. The last thing we need is a situation in this country in which one province or some important geographic area is free of any obligations under data protection, and as a consequence, functions as a data haven for people who prefer not to respect your rights and would prefer to put profit ahead of that.

Above all, give the bill a little teeth. Put in a proper watchdog, watchperson, with reasonable investigative powers and the right to make known to the public what his or her view may be of any particular informational practice.

Put the onus on business. Business should be obliged to deal with all complaints, in the first instance. Let's not burden the Office of the Privacy Commissioner or anybody else with the problem, initially, of explaining their conduct. That is a relationship that, if at all possible, ought to be resolved between the customer and the corporation or the institution. That's the best way, and if it can be done that way, in my opinion, it's far better than having every complaint referred automatically to a privacy commissioner.

But finally, and most importantly—and I speak from a long experience now as a privacy commissioner—we must educate both the public and the business world on this very important topic. We've done a number of surveys, which indicate pervasive uneasiness in the public at large about the state of their privacy, but at the same time a lamentable knowledge of what is really involved, what business is doing, and so on.

I must say, the same is true of business. What I have found in discussing this thing with businessmen, which I have over the years, is that they frequently do things not out of any malign intent, but simply because they don't know better. That has certainly been true in our relations with hundreds and hundreds of federal bureaucrats in many, many departments. It's not that they are not willing to do the right thing; frequently they don't know what the right thing is.

So the educational, research, and public relations function is exceedingly important, because we're now getting into a new area.

• 1620

I think that's all I would like to say, except to make one little pitch here for my own office. This bill contemplates assigning to the Office of the Privacy Commissioner the function of being an auditor and a complaint investigator, and if necessary, on behalf of aggrieved complainants, a litigator as well. We will certainly need reasonable resources to do that job. One of the principal ways of undermining or undercutting, whether deliberately or by reason of benign neglect, the proper function of an ombudsman is simply to starve the poor guy to death. I can speak with some authority on this subject. We have been suffering severe fiscal anorexia in my office for many years, I can tell you that.

I don't want to burden this committee with my tale of grief. There's not a public servant in the land who wouldn't be able to bring you a sad story. But when I tell you that after paying our staff, we have left, for everything from the telephones, to the cleaner, to the postage stamps, to the pencils, to the stationery, for every other activity, including travel and education and public affairs, you name it, and legal work and research and everything else, $100,000. That's all we have left. There's no way anybody can do an adequate job that way.

We have carried this case repeatedly to the money people in the government, and I can't say they've turned a deaf ear, but they weren't listening all that hard for most of the way. I'm happy to say we are now getting a better reception than we had been in bygone years. Perhaps things are a little easier these days. But we certainly will not be able to do the job that Parliament is being asked now to assign to us if we don't get proper dollars.

That's the end of the crying towel exercise.

I have a final word about the bill itself. It has the essence of good data protection there. There are some things about it that we think ought to be fixed or altered. That's in our submission. It is so far ahead of where we are at the moment, though, that in my opinion this is a bill that deserves support, and we certainly support it. Thank you.

The Chair: Thank you very much, Mr. Phillips, for your opening comments.

I'm now going to begin with questions. We'll begin with Madame Lalonde, s'il vous plaît.

[Translation]

Ms. Francine Lalonde: Mr. Phillips, you deserve a good deal of respect for everything you have done and written. I have read some of your writings. However, with all due respect, please allow me to disagree with you on a certain number of things, as I said I would.

Let us begin by acknowledging that this bill is better than what currently exists. That is clear. You yourself said that there is nothing. When there is no protection, it's a cause for concern.

However, put yourself in my place. You said that there is currently protection in Quebec, which you did not qualify. But I am qualifying it: it is a measure of protection that is greater, with more effective recourse than what is in this bill—and it's free of charge. I'm not talking about the constitutional provisions, because I know that you are not the one to answer these questions. Once the Act comes into effect, and I hope it never does, because I would like to see us find another way of protecting Quebeckers and Canadians, a number of companies, in particular Quebec companies which tend to respect Quebec law, which is more stringent, will have to comply with another set of rules, and this other set of rules will be less stringent.

• 1625

For Quebec, aside from the constitutional question, this means a weakening of rights. As a person who strongly favours privacy rights and human rights, you should be on my side.

The question that I have for you is a political question, but I'm asking it anyway. Do you not feel that it would have been preferable to continue the process with the provinces, even if the Minister found that it was somewhat slower, to reach a measure of coordination, to agree on a foundation and to take Quebec law into account? Of course, we would not have made it in time for the ministerial conference on electronic trade, but neither would we be, anymore, in this type of situation that makes no sense: Quebec and I are defending rights, and we realize that we are ahead, but we find ourselves having to defend ourselves, as if we were the cause of the problem. But the real problem is that Canada has delayed too long. We cannot agree to have Canada, in catching up, take away a portion—and a growing portion—of what we have achieved.

There, I'm asking you the question.

[English]

The Chair: Mr. Phillips, do you have a response to that?

Mr. Bruce Phillips: Madame Lalonde, the very first thing I want to say is I'm very glad we agree on a very basic issue, which is the necessity for adequate privacy protection, and any differences that may arise have to do with the quality of the protection being discussed.

You've asked me a question that I'm sure the minister will have replied to earlier in the day. I was not here to listen to his testimony—

Ms. Francine Lalonde: No.

Mr. Bruce Phillips: —but I imagine that would have been a question you would put to him. I'm not going to debate whether this is better or worse than Quebec's bill, because I don't think it's all that relevant to begin with. Certainly, it is different from Quebec's bill. It is in fact in some respects better. In some respects it's not as strong.

This bill, and the federal Privacy Act, for example, give the commissioner the right to conduct audits and compliance examinations. That, in my opinion, is a very significant improvement over any bill that doesn't have it, for example. On the other hand, in the areas of collection and consent, it could be argued that the language in the Quebec bill is more precise and a little stronger. And I won't quarrel with anybody who wants to view the Quebec bill in its essence as stronger or weaker. It's certainly different.

But in their essentials and in their main objectives, they share certain things in common. All of these privacy statutes do. They reflect to a significant degree a serious commitment to the basic elements of fair information practice. This bill does and the Quebec bill does. The Ontario privacy act does. So does the Alberta bill and the British Columbia bill, although there are significant differences in many areas. For example, all of these other provincial statutes give their commissioners order powers, and they, as a consequence, function in the nature of judges.

The federal Privacy Commissioner functions as an ombudsman, and I have no power to order anybody to do anything. I can tell you I'm perfectly happy not ordering people around, because the great value of the ombudsman's office is not, first and foremost, to find blame and tell people what to do, but to find solutions to problems. I would make this argument, immodestly perhaps but confidently, that this has been an enormous success, because there have been literally hundreds if not thousands of cases that have come before my office in the eight years or so I've been there in which we have—thanks to negotiation, discussion, and careful examination of problems—identified areas in the federal public service, where our bill applies, where information management has been significantly improved to eliminate privacy problems.

• 1630

I can give you examples if you like. One leaps to mind right away where there was an embarrassing disclosure of a person's correspondence with a minister that led to some difficulties for that person. That was a very unhappy event. The disclosure was very unfortunate. In the process of investigating the disclosure, which undeniably occurred, and there was no question that the Privacy Act had been breached, the real question in my mind was, how did this happen and how could this be avoided again?

So merely writing an order saying you've broken the Privacy Act— what is that going to solve? Much more important, in my view, is to get into things by way of compliance auditing and investigation to solve problems. That has always been the end objective of any investigation that this office has undertaken since I've been the commissioner. It's not just enough to find out whether the act has been or has not been obeyed, but let's identify the problem and see if we can fix it.

The Chair: Thank you, Mr. Phillips. Merci, Madame Lalonde.

Mr. Shepherd, please.

Mr. Alex Shepherd (Durham, Lib.): Yes, thank you.

Mr. Phillips, you got into the area of cost, and that's something that's dear to my heart as well. I'm going through your 1997-98 annual report. I'm trying to understand some things, and I'm not trying to be cute at all.

It talks about 1,826 investigations you did in the last fiscal year, and I'm trying to understand these columns. It talks about well-founded resolve, not well-founded, and so forth. My interpretation is that there are 638 cases that were well-founded but never resolved. In other words, roughly 35% of all cases you thought were well-founded but nothing happened to them. Is that a fair assessment?

Mr. Bruce Phillips: That does bear some explanation. Some cases cannot be resolved because what has happened is beyond any resolution. For example, the Privacy Act requires that any request has to be fulfilled within 30 days, there must be a response within that time, or 60 days if there is some special circumstance. If the department fails to respond within 30 days, it is a well-founded complaint. It cannot be resolved because you cannot recover the 30 days, so it just becomes a well-founded complaint. And we don't call it resolved.

We use the term “resolved” usually in cases of requests for access, for example. If somebody writes in and asks for information and it's denied by the department, the complaint comes to us, we open a discussion with them, and frequently we will find that the department was wrong in refusing to give access—that makes it well-founded. If the department as a consequence of our intervention decides to give out the information, or a significant portion of it, then we consider it well-founded and resolved.

Mr. Alex Shepherd: So this is a reflection on government. Is that what you're saying, that they haven't resolved 35% of your investigations?

Mr. Bruce Phillips: No, it doesn't mean that at all. I'm sorry if you misunderstood me. Some complaints, such as a delayed complaint— you cannot resolve something that has happened for which there is no remedy is what I'm saying. If the government improperly discloses a piece of correspondence that it should not have made public and thereby breaches somebody's privacy, it cannot be resolved because the disclosure has happened and cannot be recovered. Once a piece of information has been released, it's gone. Do you see what I'm saying?

Mr. Alex Shepherd: If I take the total of the 1,826 and divide it by your cost—in spite of your only having $100,000 for overhead expenses, you have a total budget of over $6 million—that works out to $3,526 per investigation.

Mr. Bruce Phillips: I'll bring Mr. Delisle in here in a moment, but let me tell you that $6 million is not our budget. That is the budget for both the Office of the Information Commissioner, the Office of the Privacy Commissioner, and the Office of the Director of Corporate Management. Ours is one-third of that total.

Secondly, to apply all of our costs simply to the cost of investigation is to ignore the fact that we're engaged in a great many activities. We do public affairs work to the extent possible. The commissioner gives on average anywhere between two dozen and 50 speeches a year—that involves a travel budget. Our investigators have to travel around the country. We have to conduct, within the limits of very scant dollars, some policy research work, because one of the most important functions in the operation of an office such as mine—which is an office of Parliament; you are the people who employ me—is to be in a position to give Parliament pertinent and informed advice on a very wide range of privacy matters.

• 1635

For example, over the years, we have printed and published some of the world's leading pieces of commentary on very important issues such as DNA sampling, drug testing, and biomedical research. Those items have emerged from our office with no mandated budget to do the work, but simply because we scraped together some paper clips, rubber bands, and so on. They have become standard reference works in the privacy community around the world. We have to do all those things. And only half the staff—15 out of the 35 people—are actually complaint investigators.

Mr. Alex Shepherd: I wasn't being critical. I was just trying to understand matters, and you're helping me immensely.

I have one final question.

The Chair: Mr. Shepherd, just before you get to that, I think Mr. Delisle was going to comment as well.

Mr. Julien Delisle (Executive Director, Office of the Privacy Commissioner of Canada): No, I think the commissioner elegantly dealt with that.

The Chair: Okay, fine then.

Mr. Shepherd, this is your last question.

Mr. Alex Shepherd: The final point would be whether or not you have taken any time to consider how much it's going to cost to administer this act.

Mr. Bruce Phillips: We have, and I will invite Mr. Delisle to deal with that.

Go ahead, Julien.

Mr. Julien Delisle: We were consulted by the Department of Industry shortly before this matter went to cabinet. Of course, we hadn't had the benefit of seeing draft legislation. At that time, we weren't aware of the trade and commerce provisions.

We did provide some numbers based on an exploration of budgets of the Human Rights Commission and others with a similar mandate, such as the Commissioner of Official Languages and the Commission d'accès à l'information du Québec, which also has a private sector mandate. Based on those explorations, we looked at about a 50% increase over our existing budget. That was the number we put forward at that time. Again, however, we didn't have the knowledge of the bill. We had not seen the cabinet document, so we did the best we could.

I can't tell you with any great degree of certainty how we'll fare with what's being proposed. What we will do in the near future is conduct an in-depth feasibility study, and then we'd be glad to provide the committee with the results of that work.

The Chair: We would welcome that, Mr. Delisle.

Thank you very much, Mr. Shepherd.

Mr. Jones.

Mr. Jim Jones (Markham, PC): Mr. Phillips, what portion of this act is the Privacy Commissioner responsible for?

Mr. Bruce Phillips: Part 1 of the act, which deals with data protection.

Mr. Jim Jones: Are you assuming part 2, too?

Mr. Bruce Phillips: No. Except for the fact that we're very interested in the subject, that is not a matter that generally comes under our jurisdiction. It does only to the extent that information moved electronically will be covered by the statute, the same as any other information.

Mr. Jim Jones: You're guesstimating that the administration of this act is going to increase your budget by 50%. What's new in this versus what you do today in terms of what you're taking jurisdiction over?

Mr. Bruce Phillips: It gives the Office of the Privacy Commissioner the function of investigating complaints from citizens, Canadians, having to do with the management of their personal information by the private sector. It gives us the responsibility of conducting compliance audits in business—a complex exercise that could be quite expensive. It gives us the duty to educate and inform the Canadian public; there is a specific direction in this bill to conduct public education activities. And it gives us a duty to conduct research where necessary, in order to keep us competent.

The last two or three items I mentioned are not included in the current federal Privacy Act, although they were recommended by a previous Commons committee as recently as 1987. These are the proper activities of any well-functioning office of privacy oversight, simply because we have to come in and talk to committees such as this and we have to be in a position to be able to offer some reasonably informed observations.

By way of guidance, sir, the present complement of my office is about 38 persons tops at any time, plus or minus one or two, depending on resignations, retirements, and those kinds of things. About half that number, 15 or 16, are actually involved in the work of investigating complaints, of which we handle an average of about 2,000 a year. There are a few supervisory people associated with that investigating, and there is a director of complaints, who has a couple of assistants. The balance of the staff are myself and some research people, an executive director, a small legal office—odds and sods, if you want to put it that way. So about half of what we do is complaint investigation.

• 1640

There is no element of the operation of the Office of the Privacy Commissioner that can be easily disposed of. Investigators investigating a privacy complaint in a government department will come back and say, here are the facts. They suggest to me that the reason the person didn't get the access to this information that he or she should have had is that they don't understand the Privacy Act in the department in question. We then have to follow that up by going over to that department in order to sit down and discuss it because they all need a little education on the subject.

Alternatively, an investigator will come back with a case that may indicate a very serious systemic problem. A department may be collecting a whole lot of information that it ought not to be collecting. Or it may be extraordinarily careless in its management of documents, and those documents are not kept in a sufficiently confidential and secure manner by which improper disclosures can be avoided. The example I drew to your attention earlier was one such situation. When we got into looking at why this disclosure occurred, we found a lot of problems with what you would think would be a simple thing: the way mail was being handled. Far too many people had access to what really ought to have been documents with very limited circulation. We helped to fix that problem.

So you can't ask why we don't just investigate complaints. If you did, you would lose a great deal of the value of conducting the investigation in the first place.

I don't know that I can tell you much more than that about the way the place works.

Mr. Jim Jones: One of the things that I thought about was the idea that this bill should have been broken into two pieces. Shouldn't there just have been a bill on privacy, with another bill on e-commerce and electronic documents?

Mr. Bruce Phillips: I think that's a reasonable observation, sir. Really, though, it's a question the department should answer. As I look at it, part 2 of the bill doesn't have a whole lot to do with my function. I assume they put them together for the sake of convenience, because they felt these things were associated subjects at least in a broad contextual way and that it would be easier to move them all together.

Mr. Jim Jones: Yes, but privacy is not necessarily just the electronic use of information.

Mr. Bruce Phillips: That is so.

Mr. Jim Jones: It could be paper that—

Mr. Bruce Phillips: You're quite right, absolutely. And I'm happy to say this statute applies to a lot more than just electronic commerce. We have made no detailed analysis of this, and I'm not competent to discuss that part of the bill in any detail. I am happy to say, though, that there was no attempt either to limit my side or to exclude electronic commerce from my side.

I don't know that I can give you a better answer than that. As far as I'm concerned, I would have been perfectly happy just having this one bill before you. But if the government, in its wisdom, decided to bring it together, you'll have to explain it.

Mr. Jim Jones: Is the Quebec bill that Madame Lalonde keeps talking about just a privacy bill? It has nothing to do with e-commerce or electronic documents, right?

Mr. Bruce Phillips: It's not a bill that deals with the problem of electronic signatures and so on. This bill is specifically designed to do that. But the Quebec bill is a privacy bill, and it deals with a lot more than electronic commerce, as this or any other self-respecting privacy bill does.

Bill C-54 does not cover the entire field. This is a data protection bill. That's a more appropriate description for it. It covers personal information that's recorded about individuals. It doesn't cover every area of information usage, nor does it necessarily cover—although it may cover them in some circumstances—such things as video surveillance, biomedical testing, drug testing, and that whole field of intrusive privacy practices that are developing these days.

• 1645

In some ways the bill does touch on them, but it's not aimed specifically at that. This bill is principally aimed at information used in business. Since information used in business constitutes by far the largest, most massive usage of personal data, then it's absolutely necessary.

Even if we never get around to dealing with such things as video surveillance and so on, which in some respects are dealt with in other statutes, such as the Criminal Code, we would still need this.

So people do say, well, it doesn't do this, it doesn't do that, and it doesn't do the other thing. I readily agree. It does not do this; it does not do that. But what it does do is so absolutely essential for developing a healthy climate for the continuation of business in the computer age that it doesn't need to justify itself beyond that. That's what I'm saying.

The Chair: Thank you.

Thank you very much, Mr. Jones.

Mr. Murray, please.

Mr. Ian Murray: Thank you.

Mr. Phillips, it's good to have you with us this afternoon.

I'd like to return to the same subject I raised with the previous witnesses from the department. That's the question of the protection of personal information under clause 7, where:

an organization may collect personal information without the knowledge or consent of the individual if

—and one of those ifs is if—

the collection is solely for journalistic, artistic or literary purposes.

Now, I know you did address this in the brief you handed out to us, but I'm essentially zeroing in on the journalistic aspect. It's still not clear to me why a journalist should be allowed to collect personal information on somebody, whether or not they're allowed to use that in some way. I mean, the purpose of the privacy legislation is essentially to prevent anybody from having information about you that you don't want to have out there.

I can imagine a situation where journalists over time will have files on certain individuals. It may be the case that two or three years down the road there's a breaking story and they want to look in the files and see what they have on that person. They use some of this material, even though this bill does not specifically spell out that they're allowed to do so. Then when there's a complaint, they're saying, well, we're not going to reveal our sources—any excuse they want—and it's very difficult in the courts to take them on.

So I'm just interested in whether you and your colleagues looked at this specifically when you were looking at this bill initially. Do you have any thoughts on this? Maybe I'm just being excessively paranoid about this.

The Chair: Mr. Phillips.

Mr. Bruce Phillips: You'll understand the somewhat ambiguous position that question puts me in.

Let me be serious. The issue you raise is certainly capable of an interesting debate. But as an individual whose biases you may wish to take into account, I feel that the Charter of Rights and Freedoms, which specifically enshrines a free press in our society, is good enough for me.

I cannot visualize a circumstance in which a free press could exist if journalists were always required to seek consent for collecting personal information. That is because by its very nature—probably concerning the individual to whom it related—there would be a wish to keep secret or confidential a good deal of the information on which consent would be sought.

So if you want to put it that way, I guess an exemption for the press is an essential precondition for maintaining its ability to do its job in a free environment.

The issue of the ethics of modern journalism, and whether it does or does not go too far, is perhaps one of the things that lies at the root of questions such as the one you have raised.

I have an opinion about that. There are times when I'm happy I'm not a journalist any more—let me put it that way. I would argue that the best of Canadian journalism is better than it's ever been. The worst is certainly a lot worse than it was before. There are a number of reasons for that. The competitive pressures that exist in journalism these days are far more intense than they were, even as recently as 15 years ago when I left it. I think society as a whole has a somewhat meaner, sharper edge, which is reflected to some extent in what journalists do.

• 1650

I do not think the solution for that is to impose impossible restrictions on the ability of journalists to do their job. There has to be, in my opinion, a rebirth of the commitment of modern journalism to its ancient, honoured, ethical basis. That's missing.

There's too much pack journalism. There's too much repeating somebody else's story without verification. There's far too much usage of quotes without attribution. There is, in some people's view, excessive interest in the personal minutiae of the private lives of public people. All those are legitimate questions about contemporary journalism.

I wouldn't agree that in every circumstance journalists are at fault. I think we can all take comfort—and I'm taking a little time with this, first of all, because it's a subject that is close to my heart. I was in it for nearly 40 years. I loved it and sometimes miss it. But it is so important in our society. We ought to be arguing not for less journalistic freedom but for more freedom; for better training of journalists; for better resources for journalists, because publishers are notoriously niggardly; and above all, for better education, particularly in the ethics of good journalism and what is and what is not permissible.

It's a matter of some interest to me that the editors' committee of the Canadian Daily Newspaper Association four years ago decided to abolish altogether its code of ethics. It did so, I'm sorry to have to say, on advice from its own legal counsel that it might expose journalism to liabilities. I didn't think that spoke very well of their attachment to what I consider to be a necessary improvement in Canadian journalism. I think I've probably already said too much.

The Chair: Last question, Mr. Murray.

Mr. Ian Murray: You mentioned on page 6 of your brief that perhaps the definition of personal information could be expanded. The region now defines personal information as “information about an identifiable individual that is recorded in any form”.

Would it not be fair to suggest that you'd end up with a never-ending list of exemptions or definitions if you didn't have this kind of a broad definition, and that people could always use that as an excuse, if it wasn't defined, to get around this definition problem?

Mr. Bruce Phillips: You make a good point, Mr. Murray. I think there are arguments on both sides. I simply say that the existing federal Privacy Act does include a number of examples, 12 or 15 of them I think. It also includes a few things that it would not consider as personal information, such as the name, address, and function of a public servant. Although it's personal information, it's not protected by the act. One might argue for the same sorts of examples being put into this bill regarding executives of corporations and so on.

This is workable the way it is. I guess the virtue of putting in a list is it tends to reduce the areas of argument to some extent.

Perhaps Ms. Harris would like to say something about that.

Ms. Holly Harris (General Counsel, Office of the Privacy Commissioner of Canada): I don't have any strong feelings on the list, frankly. I think what it does is convey to the layman an idea of what was in the mind of the legislator at the time. I think it's helpful in that sense.

Mr. Ian Murray: Thanks very much.

The Chair: Thank you very much, Mr. Murray.

[Translation]

Do you have another question, Ms. Lalonde?

• 1655

Ms. Francine Lalonde: Mr. Phillips, to explain why you did not wish to have power of order or decision-making power, you invoked your lengthy experience in the public sector.

With all due respect, once again, there is a tremendous difference between the administration of the law, when you are a government-appointed commissioner and when you are dealing with publicly-owned organizations, and having the same role in a completely different world—I could call it a jungle—of publicly-owned corporations. In addition, there are organizations that do not have a commercial purpose and that are not covered by this Act. In my opinion they should be, as they are in Quebec.

There is a tremendous difference. As I said a moment ago, it's a whole different ball game. There are companies that will cooperate, especially big ones, because their reputation is at stake. However, there are others in which the ordinary person finds himself alone. As the French minister said at the conference on electronic commerce, this is where the State must be on the side of the citizen whose rights are being infringed upon. They should not have to expect to go to court. It doesn't make sense. It's costly, takes too much time and will discourage people.

When I talk about being weaker than the Quebec law, I am talking among other things about the recommending power you have, a power which in many cases is exercised after the person has had to go and plead his case before the company.

Once again, with all due respect, are you presuming that your experience will be the same? On the contrary, should you not have the power to make a decision?—and here I feel that the consumer associations will agree with me.

[English]

Mr. Bruce Phillips: I'll try to deal with the various points you've raised.

With respect to the process itself, it is essentially the same as the one that exists now. A person who wishes to obtain personal information from his or her files in the hands of the government, for example, must first apply to the department that has the information. Frequently, a dialogue will ensue between the department and the requester.

The complaint only comes to us if it cannot be resolved in the discussions between the requester and the department. I see no essential difference between that arrangement and the one that's proposed in this bill, in which a customer or a client, as the case may be, has a difference with a corporation or an enterprise, and the first place they would go with that complaint is back to the person where the problem originated. If it can't be resolved there, they come to me.

With respect to access to the courts, I am satisfied that access to the courts is adequate in this case. In any event, unless the attitude of business is far more confrontational and aggressive than it has been with the federal bureaucracy—and I would find that difficult to imagine because bureaucrats can be pretty tough—I do not see a great many occasions on which the commissioner would have to resort to the court to obtain satisfaction. Out of the thousands of cases and investigations we've had, we found it necessary to go to court I think on fewer than 10 occasions. We've had plenty of them settled at the courthouse door, though, on the steps.

Finally, I don't regard order power here— Let me deal with this again.

• 1700

When dealing with business, what matters more to a major corporation? Paying a fine of $5,000, which is money that they would spill off the end of the coffee table before they start work in the morning, or having the Privacy Commissioner issue a public statement saying this corporation is not respecting the privacy rights of Canadians? Which would matter more, which would have a more telling effect, and which person is going to be in a better position to make that statement? A person with order powers, bound by all the restraints of the legal process, or an independent ombudsman who can look at this and say this is a reasonable judgment?

I would argue for the ombudsman every time, and I think it's even more useful in the private sector than it has proved, and it has proved very useful in the public sector, than simply ordering somebody to do something. Yes, it may provide satisfaction to the individual complainant, but it might not solve the problem. That's my opinion.

[Translation]

Ms. Francine Lalonde: Mr. Phillips, when you used your—

The Vice-Chairman (Mr. Eugène Bellemare (Carleton—Gloucester, Lib.)): This is your last question, Ms. Lalonde.

Ms. Francine Lalonde: Yes, thank you.

One does not prevent the other. When you used your power with the large companies— I don't think that the problem arises there, but it could. Take for example Air Canada, which is presently in court. Air Canada refused to give a health file to an employee.

When your influence is not sufficient, why force someone to go to court? A number of cases will arise. Remember that you are getting into the field of data transactions used in marketing. People are not familiar with these transactions. You are getting into big business. It is not necessarily a world where everyone is smiling and shaking hands. Here people need some real help.

I can't help thinking about my experience in health and job safety. In this area, one would think that companies are sufficiently concerned about physical integrity to do what the inspector asks them to do. But you might be very surprised to find that this isn't the case at all.

A growing number of people are dying on the job, a trend that has not been seen for some time. In the real world, things are tough. Electronic commerce is a new world and a real jungle competitively.

Mr. Bruce Phillips: Ms. Lalonde, you're right.

[English]

I agree with everything you've said, but I am not persuaded that the problem of oversight must necessarily be solved by changing the powers that this bill proposes to put in the hands of the commissioner.

Where business is concerned, the power of the pen is mighty and ought not to be underestimated. It is, for that matter, in the field of data protection in the public sector as well. Ministers and bureaucrats do not like to have to stand up in the House of Commons or explain to the press why they have fouled up. It's far more important, and I think far more effective, than simply levying a fine or some other form of disciplinary action. That's my conviction.

But in any case, that argument tends to beg the point of the great asset of the ombuds approach, which tends to be focused on understanding the culture of the business, first of all; educating the business as to its responsibilities; negotiating the problems; identifying the weaknesses; seeking solutions. All those things are part and parcel of the ombuds approach. They're much more easily achieved when you embark on these things in a spirit of—

Let us not be naive, and I'm conscious of what you've said and you are right. Businesses are tough. But we're not wimps in this office either.

[Translation]

Ms. Francine Lalonde: I hope—

[English]

Mr. Bruce Phillips: My approach to all this is that we will always go the last mile in an effort to reach a sensible resolution of a problem, but if people are going to thumb their nose at me, they're going to be sorry.

• 1705

The Chair: Thank you, Mr. Phillips.

[Translation]

Thank you, Ms. Lalonde.

[English]

Mr. Bruce Phillips: I'll take them to court; that's all.

The Chair: Thank you.

Mr. Lastewka, please.

Mr. Walt Lastewka: Thank you, Madam Chair.

Mr. Phillips, I really appreciated not only your opening remarks but your frankness in answering the questions right to the point, and I think this is what is important as we move forward on the reviewing of this total bill.

You mentioned very strongly the importance of education, and you've left me with the understanding that once this bill gets approved, your responsibilities would be very strong to educate, and when you say education—and I read your paragraphs on page 6 a number of times—you mean the importance of educating the individual and all the people involved who could be affected by this bill.

When you made your remarks concerning the questions people start to ask, such as whether this bill has enough teeth and whether this bill puts you in an awkward position, having to educate, and then trying to identify the problem and fixing it, you reassured me that what's in the bill is better to get the end result and be consistent across the country.

My concern is the level playing field, and I'd like you to give some more information on that, trying to make sure that when the provinces are doing their bills, there has to be some uniformity. I think you mentioned that what you were trying to avoid is having a weak area, which everybody would recognize as weak and that's where they'd do business. Did I understand you on that?

Mr. Bruce Phillips: Yes, that's the creation of a data haven in which there is effectively no data protection of any kind, and businesses such as unscrupulous telemarketers, people like that, look for areas like that where they can do business.

On the level playing field issue, one of the objects of this bill, as I see it—and there are other, better advocates for this subject than I am, and I only tell you how I see it—is to harmonize privacy protection around the country. It's complementary in areas such as Quebec.

I believe the minister has already committed himself, by the way, Madame Lalonde, on several aspects of that.

There are processes that are embedded in the bill that I think promote the notion of harmonization. The commissioner is specifically given authority in here to do business with other commissioners and seek their advice on how they're handling problems, and so on. There's a good deal of that, which now transpires informally, but I'm glad to see it is reflected in the statute.

It would have to be a very strange situation indeed where a provincial government responding to the clear call here to act in its own jurisdiction would come up with a piece of legislation that was materially different, which ignored some very important element of fair information practice. I can't imagine that happening.

Those provinces that intend to pass companion legislation will have the assistance of this office, their own privacy commissioners, and the Uniform Law Conference of Canada, which has been working on this very problem for several years now. This is not something that was just dreamed up yesterday, sir. There have been ongoing conversations over a number of years, so already a good deal of work has been done.

I think one way of looking at it is this. This bill, the federal Privacy Act that now exists, the provincial privacy statutes that exist, and in fact most of the privacy laws around the world, are reflections of the OECD guidelines that came out twenty years ago, which set out a code of fair information practice, and most of these statutes have reflected that.

• 1710

You're going to get differences. Yes, there may be some provinces that say we should have order powers. Madame Lalonde, I do not dispute with you the efficacy of that approach. I simply say that I'm satisfied with this one.

If experience should prove me wrong, well, that would be worth looking at, no doubt. Merely passing a half-decent privacy act almost, in a sense, guarantees some reasonable level in the field. You know what I'm saying?

Any province that passed a bill that didn't provide for some form of oversight, dispute resolution, or adequate consent provision, for example, wouldn't be worth the time of day. It wouldn't be a privacy act. It would never get passed. It would be laughed out before it ever got past a parliamentary committee.

Mr. Walt Lastewka: Some people have mentioned that this bill is a bit complicated. You've been in the privacy business for a while, and I appreciate your experience. Do you have any suggestions for possibly making this bill simpler?

Mr. Bruce Phillips: I was a reporter, not a lawyer, so I find all bills complicated.

I've heard this observation. It's certainly an unusual bill in the way it's put together. But I would defer to Ms. Harris for a more professional answer to that question.

The Chair: Ms. Harris.

Ms. Holly Harris: What can I say? One can always criticize the drafting of others.

I think there probably were a lot of constraints in terms of drafting this bill. There was a CSA code already developed. The idea was to try to incorporate it into the legislation. Aside from extracting provisions out of the CSA code and putting them into provisions directly in the bill, I don't really see any other way it could have been done. But, unhappily, I do agree it's a bit unwieldy because of that.

The Chair: Thank you.

Mr. Lastewka, do you have a last question, or are you—

Mr. Walt Lastewka: I have one more.

Commissioner, I'd like to ask you a question. What do you see as the single biggest threat to privacy going on in the world today?

Mr. Bruce Phillips: In the world?

Mr. Walt Lastewka: Let's just say at home, then.

Mr. Bruce Phillips: Ignorance is the biggest threat. That's why I put so much emphasis on the value of education. People don't understand what's happening in the system. As a consequence, they're not being sufficiently vigilant in their own dealings with business to ensure that they ask the right questions. They're not being sufficiently alert to this problem so as to bring this to the one group who can solve these things in a legal way: their legislators. So what's happening here today is, in my opinion, a very promising, welcome, and necessary attack on the very problem I've been talking about.

When I say ignorance, there's both episodic and empirical support for that. Look at my own dealings with my own associates or friends or what have you. They ask what I do. I say I'm the Privacy Commissioner of Canada. Their eyes roll back in their heads and they start talking about football scores. That's because they don't know what it is, and they're not at all certain they want to find out.

We have participated in some fairly comprehensive public opinion surveys. These make it abundantly clear that the public is insufficiently informed about these matters. They know something is going on out there, but they don't know exactly what. They're worried, but they're not exactly certain why they should be worried. They need to know more.

The privacy problem itself yields to an informed public almost easier than anything else you could think about. That's because the more people know, the less fear there is. The more people understand the system, the less likely they are to be abused by it. As a consequence, there are fewer complaints that are likely to wind up on a desk of a privacy commissioner.

• 1715

For instance, we get thousands of calls every year from people who wonder why they always have to give their SIN number to the clerk when they want to buy something, and so on and so forth. Even on that very simple issue of the SIN number, people really do not understand. Well, we can help that process.

Businesses, partly for good reasons and partly for no reason at all except for their own sense of security, ask all kinds of information from the public that they would have difficulty defending to a privacy commissioner, because they don't really need it.

This bill is, I think, going to produce much better information management processes in business. They're going to look at the stuff they're collecting and wonder whether they really need this, what good is it to them, and why they continue to ask people for their SIN numbers and so on.

Many businesses are already ahead of the curve. The banks have been struggling with this now in a fairly active way for several years, possibly in hopes of avoiding this very thing. But certainly, they're more alive to the privacy problem. They've been reviewing their collection and usage processes more thoroughly in recent years than how they did it before.

You asked me the question, and ignorance is the answer.

The Chair: Thank you very much, Mr. Lastewka.

[Translation]

Ms. Lalonde, please.

Ms. Francine Lalonde: I am going to discuss one section of Bill C-54 that Paul-André Comeau, the Quebec Information Access Commissioner, finds disturbing. He said he was especially disturbed about subsection 7(3)(f). Under this provision, an organization can communicate personal information without the consent of the person involved, if the information

—is communicated for statistical purposes or for erudite study or research; consent is practically impossible to obtain—

It's difficult to say.

—and the organization informs the Commissioner before conveying the information;

It doesn't ask for permission; it informs him.

Paul-André Comeau says:

Contrary to Quebec law, authorization does not have to be obtained from the federal Commissioner before the personal information is conveyed. Whole files of sometimes very sensitive personal information can thus be conveyed without any formalities other than notification of the Commissioner.

Do you share Mr. Comeau's fears?

[English]

The Chair: Mr. Phillips.

Mr. Bruce Phillips: To a certain extent, yes, I agree. I would like to see this more precisely drafted. I think you will see that in the paper we distributed to you.

The provisions are pretty broad. I think the bill would be improved if the terms and conditions under which this were to take place were altered. The security and third-party usages could be more carefully defined. There could be a process for a more careful definition of the project and a justification. All of those things might be considered to be improvements that could be written into the research aspect of this bill. In my opinion, yes, this is one area where it can be improved. I think your point is well taken.

The Chair: Do you have one last question, Ms. Lalonde?

Mr. Bruce Phillips: Julien just reminded me that the process of notifying the commissioner is not without its uses, of course. I mean, I can initiate a complaint if I feel like it on any issue. If, in my opinion, the project involved doesn't have the proper justification, I can't stop it, but—

[Translation]

Ms. Francine Lalonde: You cannot prevent it from happening? There's the weakness of your position. You should get angry and insist on having a greater capacity to intervene. You see things happen, and you cannot do anything except go before the court afterwards to seek damages. You should be able to act beforehand, with information, training and education.

• 1720

[English]

Mr. Bruce Phillips: I'm not certain I should have that kind of authority. I would be happier with a bill that more precisely defined the justifications necessary. I would like a little more guidance in the bill. I do not wish to be the sole arbiter and judge of every research project that comes along. I don't think there's any individual in the world who's competent to make that decision.

Let the legislators consider this and see whether they wish to define this more narrowly. If, in my opinion, it's not a good idea, I'll say so publicly. That would, in those circumstances, compel the person who's proposing it to make a public justification. We would join in a debate in public. Then let's see who would win that.

I think, Madame Lalonde, that I would invite you anyway to reflect on the great value of the commissioner's ability to speak. It has certainly been the most powerful weapon I've had in eight years. I don't feel the need for any more than this. I feel quite confident that when I really feel I'm right about something, I wouldn't feel that way if I couldn't develop the facts of the argument to support it and the case for privacy anywhere and at any time. I'm quite happy to submit my case to the general judgment of the public, legislators, and other people.

I do not feel I need the authority to order people to do things. We've got enough people in this country pushing other people around and telling them what to do. That's includes business. I'd like to see less of that, not more. I would like to see people saying that I was right about this being a good privacy issue such that they're going to get on board with me because it's good for business.

I'm not going to get to that point with a businessman if I have to tell him to do it my way, otherwise it's into the pokey with him. I don't believe in that. I don't believe it's necessary.

Admittedly, it might occasionally be necessary. I might not stop the thing from happening, but I can certainly deal with it afterward. I'm willing to wager, Madame Lalonde, that experience will prove that in 99% of the cases, we're going to settle the problems without having to order somebody to do something.

The Chair: Thank you, Mr. Phillips.

Mr. Bruce Phillips: If I'm wrong, I'll be the first person to admit that I was wrong. I'll certainly be happy to buy you the best dinner in Ottawa. But that's not saying a whole lot.

The Chair: Thank you, Mr. Phillips.

Mr. Bellemare, please.

[Translation]

Mr. Eugène Bellemare: Thank you, Madam Chair.

[English]

Mr. Phillips, I finally get to see you in person. I've been watching you. The national news in the Ottawa area is really local news. I'm a local boy. I heard a great deal about you, read about you, and saw you on TV.

Since I've got this optic about you in the media, I'd like to revisit a media event. Take freedom of the press. You banged that drum heavily today. I think it's a motherhood issue. In Canada, we pride ourselves on freedom of the press. You seem to say one should not touch the media because they should keep on having that freedom.

I think you admitted—this is my interpretation, at least—that there's abuse. Is it illegal? Is it immoral? Is it whatever? You didn't get into that domain. But you did admit that the worst of journalism is worse than ever before, and the best of it is better than at any time before.

Journalists can build up a case against a public figure. A public figure is either a politician, clergyman, or business person. It's someone in public life, let's say, anywhere in any municipality or province.

• 1725

A media person can really build up a public figure. He or she can also destroy a public figure by association. Someone could draw a parallel between the President of Iraq and a public figure just by associating ideas, never saying this person is actually the President of Iraq. But the way the article is written, you want to go and string up the person, because the media has created a mindset.

They'll talk of a variety of things. It could be the person's habits, or his or her age. I say age also because we have a Charter of Rights and Freedoms. I thought, for example, you could not discriminate against the age of a person for hiring purposes. In the case of, let's say, a public figure, suppose a 90-year-old gentleman wanted to run for public office. Isn't it illegal to start harping on his age?

If this person happens not to be a man, but is a woman, for example, and if this person is not just a woman, but someone from the Middle East or the Far East, and if the people in the community dislike the person, and everything that is said is true, the case could be built in such an abusive way that they destroy this person's chance of becoming either a politician or let's say, a chair of a caisse populaire—it's the only place in the banking system where you could get elected to office. I don't know how you could get elected—

The Chair: Mr. Bellemare, your question, please.

Mr. Eugène Bellemare: My question is simple; it'll get a yes or no.

As an authority in privacy and in media, why don't you come up with an amendment—and you said you had a pocket full of them—so that the most abusive kind of journalist, the one who collects data in order to be malicious, could not do this? Why haven't you come up with some kind of recommendation or amendment? I'm talking about the extreme abuse, because you said let what is good alone because we want to protect our Canadian liberties.

The Chair: Mr. Phillips, do you have a reply to that?

Mr. Bruce Phillips: I certainly don't have a yes or no reply. I hate to do this, Monsieur Bellemare, by turning the question around, but if you have such an amendment, I would like to see it—one that would curb the practice you have without doing irreparable damage to the general freedoms of the press, one that would also stand up to the charter. This is a very difficult—

Mr. Eugène Bellemare: But you're the authority. I'm just a person representing the general public, the people who get abused by certain sectors of the media on occasion. You're the one with the experience, the authority, and the knowledge, not me.

Mr. Bruce Phillips: Well, the first thing I would say is the press does not operate in a legal vacuum. There are some fairly decent libel and slander laws around that—

Mr. Eugène Bellemare: You're hiding behind that.

Mr. Bruce Phillips: No, I'm not. I would say this about libel and slander laws. They're far too expensive for the ordinary person to have recourse to them. I think a solution to that problem is available. I think the ordinary person, having been blackened by a resource-rich newspaper chain, or a magazine with deep pockets, or what have you, can rarely get satisfaction because they can't afford to accept the legal costs necessary to undertake the litigation.

In my view, the judicial system and the legal profession can solve that. Can't they? There are certainly plenty of cases that, with my lay eye, just looking at things that I see in the papers, and one thing or another, seem to me to constitute a pretty good case for somebody taking some action. But it seldom happens, and public figures generally are reluctant to do that anyway, because it merely perpetuates a public discussion about whether the libel is or is not true. It makes things worse.

• 1730

So, yes, the press does have— Somebody once said—what was the expression—never attempt to win an argument with a fellow who's carrying around a 10-tonne pencil and 6 tonnes of ink. He's likely going to out-gun you. All of which argues, in my opinion sir, for a recommitment to basic standards of good journalism. It's not rocket science.

There are two things involved in news. One is public interest and one is public importance. When I say public interest, what I mean is what interests the public. And that's a great many things, some of which are not important at all. Let us face it, we're all fallible human beings and most of us do at least look at the stuff, even if we think it's terrible when it's printed and published. It's in human nature. Journalists know that. It is part of the way of the world. Newspapers, television stations, and magazines would be pretty dull places if the only thing they carried were verbatim reports of the debates of the House of Commons, the Senate, the local school board, or what have you—undeniably important though they may be.

So the aberrant, the unusual, the bizarre—those are all part of the warp and woof of life, and are of interest to the journalist.

What I cannot support, and you can't either obviously, is material that is without any reasonable need to be transmitted—the publication of material that is hurtful to people, when it does not serve any useful purpose. It is difficult enough in journalism. You frequently must write and publish things that you know when you do it are going to hurt. To do so without being persuaded in your mind, as a matter of conscience, that the public really does have to know this because it bears directly, for example, on the qualifications of a person to do an important public task, to publish it simply because it's interesting and attractive, knowing it's going to hurt somebody, I can't support that as an individual. Some journalists can.

But to me, those are not the major sins of journalism. To me, journalism would be— Its major sin is accuracy. There's far too much copycat journalism going on. Look, I've been on both sides of this fence. I have worked as an official in government, and I have to say I was dismayed when I crossed over the bridge to see the number of times that material I knew was wildly incorrect was being published, and how deeply it was resented when any effort was made to correct it.

The press has to have a more vigorous sense of its accountability. It's got to have more of an attachment to getting it right. We had a saying when I was a young reporter that I would like to see printed in big type in every newsroom in the country: Get it first. Get it right. But first get it right.

Do you see what I'm saying? Those are the real sins of journalism and not— Yes, you'll get the occasional scatological magazine; we have one in this town that delves into the private lives of people. But that's not the major problem of journalism. The major problem of journalism is prioritizing in its mind what is genuinely useful, important, and interesting for people in managing their lives, and making sure the stuff is right. Now it's not easy.

Mr. Eugène Bellemare: Do you want to work on an amendment?

• 1735

Mr. Bruce Phillips: I don't think I can put all that in a one-paragraph amendment. I'm sympathetic to what's been said here, but I don't think you can cure that by restricting a free press.

The Chair: Thank you very much, Mr. Bellemare.

Thank you very much, Mr. Phillips.

Mr. Phillips, I have some questions I may put to you in writing about your brief. That may be the better way to get some detailed answers in particular on the issue of being done by regulation, and what you mean by formal consultation with the Privacy Commissioner. However, as we're running out of time and members have other commitments, I want to thank you very much for being with us today. Who knows, we may have you back again before this is done, because we'll be continuing into the month of February. We appreciate your comments and we look forward to further discussion.

Mr. Bruce Phillips: Thank you, Ms. Whelan. Thank you members.

The Chair: Thank you.

The meeting is adjourned.