INDY Committee Meeting

STANDING COMMITTEE ON INDUSTRY

COMITÉ PERMANENT DE L'INDUSTRIE

EVIDENCE

[Recorded by Electronic Apparatus]

Tuesday, February 9, 1999

• 1535

[English]

The Chair (Ms. Susan Whelan (Essex, Lib.)): I'd like to call the meeting to order. Pursuant to an order of reference of the House dated Tuesday, November 3, 1998, the committee is considering Bill C-54, an act to support and promote electronic commerce by protecting personal information that is collected, used, or disclosed in certain circumstances by providing for the use of electronic means to communicate or record information or transactions, and by amending the Canada Evidence Act, the Statutory Instruments Act, and the Statute Revision Act.

I'm very pleased to welcome today our four witnesses. However, before we introduce the witnesses and go to opening statements, we have a motion before this committee that was made a few days ago by one of our members, Mr. Jones. I'll now ask Mr. Jones if he would like to move that motion.

Mr. Jim Jones (Markham, PC): Yes, thanks, Madam Chair and fellow members.

I hope I will be allowed more time to speak to this motion, as I had in my motion last week. As you have already received the motion, it is as follows:

That Mr. François Beaudoin, President of the Business Development Bank of Canada, be summoned before the committee as soon as possible to explain requirements to granting loans, compliance measures, and loan repayments, with specific reference to Mr. Yvon Duhaime.

I would like to discuss the reasons for calling Mr. Beaudoin by providing a brief history of what we know of Mr. Yvon Duhaime. In April 1993, Les Entreprises, Yvon Duhaime, purchased the inventory, furnishings, and ongoing business of the Grand-Mère Inn from numbered company 161341 Canada Inc. At the time, then opposition—

The Chair: Mr. Jones, with all due respect, you're bringing up issues of private citizens before this committee and your motion is to invite the president of the Business Development Bank of Canada to come before the committee. I really don't think we should discuss private citizens without them being here.

Mr. Jim Jones: I was trying to give you chronological events of the history we have and the reason we'd want the Business Development Bank president here.

The Chair: I'm not going to allow you to discuss private citizens, so if you can't do it...

Mr. Stan Keyes (Hamilton West, Lib.): I have a point of order. Has the chair had discussions and come to any conclusion as to whether or not this motion moved by our friend across the way is in order or not? That may just nip everything in the bud, if it's been determined that it is not in order.

The Chair: Mr. Keyes, the clerk is willing to check for absolute certainty, but our first belief would be that it has reference, again, to a private citizen, and that is beyond the scope of this committee.

Mr. Jim Jones: I'm referring to a company called Les Entreprises.

The Chair: Your motion itself has specific reference to a private citizen. Mr. Keyes' point of order is about the motion itself.

Mr. Jim Jones: I think today in the House, Minister Manley, in answer to my question, said this issue could be discussed before committee.

The Chair: Well, with all due respect to Mr. Manley's answer in the House, the fact that Mr. Beaudoin, president of the Business Development Bank of Canada, could come before the committee is not an issue. That would be proper. The reality is that we have seven weeks of hearings scheduled on Bill C-54, and then we've already said we're going to have estimates at that time. The Business Development Bank of Canada is part of the estimates that come before this committee, and we'll be meeting with them then.

• 1540

Mr. Jim Jones: Okay. In my motion, then, I'd like to withdraw the words “with specific reference to Mr. Yvon Duhaime.”

The Chair: Okay.

Mr. Keyes.

Mr. Stan Keyes: Then we go back to—you may not have heard this, Chair, because you were speaking with your assistant on dropping that reference—the chair's comment on the workload facing this committee and the opportunity you or anyone else in this committee will have when Mr. Beaudoin appears before this committee on estimates.

We understand why you want to do it; it's just mistimed.

I'll call for the question.

(Motion negatived)

Mr. Jim Jones: I have also a notice of motion here that I would like to call Mr. Howard Wilson, Ethics Counsellor, to be summoned before the industry committee to explain his mandate and responsibilities in the expenditure of his office as listed under Industry Canada.

The Chair: Fine, Mr. Jones. We'll take that as notice, but again, anything that is Industry Canada-related with regard to estimates we're going to be doing in the next couple of months.

I want to welcome our witnesses here today on Bill C-54, and I apologize for the delay in starting our meeting.

We're very pleased to have with us, from the British Columbia Civil Liberties Association, Mr. Murray Mollard, the Policy Director; from Action réseau consommateur, Madame Marie Vallée and Monsieur Jacques St-Amant; and from Electronic Frontier Canada, Professor Richard S. Rosenberg, the Vice-President, and Professor of Computer Science from the University of British Columbia.

My understanding is that the clerk has informed you that we would appreciate it if you could keep your opening statements to five minutes.

There are a number of papers that everyone should have in front of them. Unfortunately, only one was received in time to be translated. You should have that one before you. One of the others is in English and one is in French.

I will now begin with Mr. Mollard, please.

Mr. Murray Mollard (Policy Director, British Columbia Civil Liberties Association): Thank you, Madam Chair, and thank you to the committee for inviting the B.C. Civil Liberties Association to appear as a witness on the matter of Bill C-54. Obviously democracy and the laws of Canada are much stronger when you give an opportunity to citizens to participate in these types of processes, and I appreciate the opportunity to come before you.

I will give a quick introduction of the B.C. Civil Liberties Association. Since 1962 we have been working to promote and protect civil liberties of British Columbians and Canadians. Privacy is a very important issue for us, and indeed, I would suggest that in the last ten years or so it's an issue that has increasingly been one that we've had to devote resources to and work on.

We have done a lot of work on assisting complainants. We do a lot of work on law reform. For example, when British Columbia passed its law with respect to freedom of information and the protection of personal privacy, we were very much involved with the development of that act.

We've developed a handbook called The Privacy Handbook, which is a guide for citizens with respect to privacy vis-à-vis public sector and private sector. I've included as an appendix to our submission an excerpt from that privacy handbook.

As I said, more and more of our time is spent dealing with privacy issues. We have many individuals calling us with concerns and wanting our guidance and assistance. We have to say that unfortunately in the private sector there's not much we can do. Occasionally we will be able to contact an organization or employer, but it's often merely moral suasion that gives our submissions any weight to the employer or the organization.

As a personal anecdote, as I was preparing this submission back in January, I happened take a shortcut through a back alley on the way back to work. Passing a back door of a building, I came across a pile of paper documents. I took a closer look at the documents and I saw a variety of financial documents, cancelled cheques that had personal information on them. I was quite astounded. I contacted a nearby bank to let them know, and I said, listen, there's a problem here.

• 1545

This point doesn't prove the scientific necessity of this bill. What I suggest is merely that it adds to the litany of personal anecdotes and the demands for greater protection of the personal information of Canadians. It's also worth noting that in this scenario it's likely that many of the individuals who might be involved may never have known there were transgressions involved in their personal information. I think that's important to remember when considering the oversight protections necessary to make the rights and obligations effective under the bill.

Our association wants to applaud the government for the introduction of this bill. We support the bill in principle and many of the provisions, such as clause 3, the purpose. We think it is very important to provide Canadians with a right of privacy in the private sector. Whatever the economic and commerce-related incentives and motivations, we think those are merited in terms of the motivation for the bill. But we think that, ultimately, privacy is a fundamental right and an important reason for creating this bill, and we support it.

We also want to express our support for the inclusion of employees in the application and the protection of the bill. It's a very important part of the work we do. Indeed, many of the complaints with regard to privacy that we get at our office are from individuals who are either prospective employees or are employees. I note that the words “prospective employee” are not actually included in the bill, and that's one of our suggestions to your committee.

Despite our general support, we do think there are ways in which the bill could be improved, and we've tried to outline that in our submission. I won't go through it in detail because I don't have the time, but I will entertain questions. A couple of points to highlight, though, include our point 5 on page 7, the idea of core obligations being in an appendix that can be changed merely by a cabinet decision as opposed to legislative changes. That technique really cuts both ways. It makes it easier to make changes that would augment privacy, but it would also be easier to make changes that undermine privacy interests. We think it is better to put those obligations in the bill and make them subject to legislative amendment.

We think that principle 1 in the schedule should include a principle of justification, that is, when individual organizations are stating their purpose, there should be some limitation, some ability to make an assessment of the legitimacy of those purposes and to subject it to a reasonable test.

We also think the law should cover processes as well as records. We've had trouble in British Columbia when we've made complaints, for example, about the taking of urine samples in drug testing, where the commissioner decided that the process of taking the urine sample isn't actually subject to the act. I think it's very important that the law apply to processes, so that before the sample is manipulated, there is jurisdiction and the act will apply.

We also think there's a very serious problem with paragraph 7(1)(b) of the bill in terms of the exemption. We think it punches a gaping hole in the law and in the obligations of organizations, and we suggest you re-examine that. We also suggest various measures to enhance oversight, etc.

One other addition we've made—and I think you've just been handed it today—is a suggestion for you to consider whistle-blower protection. What we mean by whistle-blower protection may not be what you've heard from other witnesses who have suggested this. We mean individuals who, in order to expose or prevent a serious civil wrong, want to disclose personal information. They're motivated to do so in the public interest, and they do it without the knowledge or consent of the data subject.

Now, we put a caveat on this whistle-blower suggestion. We're still thinking about it ourselves. It's a fairly complex issue. It requires careful consideration. We suggest that the committee and Industry Canada take time to consider it. We don't have a very specific or direct recommendation for you either one way or the other, but we think it merits significant attention.

In conclusion, we again support the bill in principle and many of its provisions. We suggest that there can be improvements, and that's what you are here to look at.

I would welcome any questions. But I would also make this note. If this bill passes, it will be ironic, it seems to me, that individuals in Canada will have better privacy protection vis-à-vis the private sector than perhaps vis-à-vis the public sector in terms of their availability for remedies through courts or tribunals.

• 1550

Thank you.

The Chair: Thank you very much, Mr. Mollard.

I'm now going to turn to Madame Vallée and Mr. St-Amant, and I'm not sure who's going to begin.

[Translation]

Go ahead, Ms. Vallée.

Ms. Marie Vallée (Analyst, Policy and Regulatory Matters, Telecommunications, Infohighway, Protection of Personal Information, Action réseau consommateur): Madam Chair, members of the committee, this brief sets out the concerns of two organizations: Action réseau consommateur, which was previously known as the FNACQ, and Option consommateurs. These two organizations have had a keen interest in privacy for several years and, among other things, have played a very active role in the work that lead to the adoption of the Quebec Act respecting the protection of personal information in the private sector.

We are here today because we strongly believe in the importance of truly protecting the personal information that companies have concerning Canadians. We congratulate the federal government for its initiative and for the ongoing efforts by the Minister of Industry, Mr. John Manley, as well as the many people who have given concrete expression to this requirement which has become, over the past few years, more and more obvious.

Unfortunately, we are not in a position to present an in-depth analysis of the bill, since for groups like ours, human and financial resources are both increasingly rare. That is one of the reasons we were not able to translate the brief in time. Having said that, the preliminary analysis that we are tabling here today should nevertheless cover the bulk of our concerns.

We are no longer in control of our lives. At least that is the impression that citizens can have when they see companies' insatiable appetite for what they're doing and who they are. Canadians are concerned about the fate of the personal information that concerns them. It is not new and it is ongoing, as all the polls show.

This problem is on the rise precisely at a time when businesses are getting more and more enthusiastic about processing personal information on their clients. At first sight, the protagonists' interests seem irreconcilable. So philosophical, political and legal choices must be made. These choices must be translated into rules of law that provide for more certainty and more precision.

In Canada, this raises a question: Are we dealing with areas under federal or provincial jurisdiction, or both? Since it is an area of joint jurisdiction, it is important to find the best ways of ensuring that the legal framework that will be put together is solid and harmonious.

This is the context in which we see Bill C-54. We fully support the bill's underlying principles. We would also like to highlight the importance and the relevance of federal government intervention at the Canada-wide and international level to ensure the privacy of Canadians.

First of all, however, we must clearly define the criteria that will make it possible to determine if the rules adopted by Canada are in accordance with these requirements. Four criteria immediately come to mind: the content of the rules must be adequate, and therefore in accordance with both the generally recognized principles, and adapted or adaptable to specific requirements; the rules must be public; the rules must have general applications; and the rules must also include an effective and accessible implementation mechanism.

Unfortunately, and this is where I'm going to lose some friends, the bill, in its current form, does not fully correspond to these four criteria. The rules, which are split between the body of the legislation and the appendix, are not easy to understand. They could be substantially amended by a simple order. This mechanism might well implement different rules based on areas of activity and the regions of Canada. Lastly, the implementation mechanisms are not solid.

• 1555

We refer you to pages 8 to 13 of our brief, where you'll find a more detailed presentation of our constitutional concerns.

Moreover, the proposed exemptions pose a problem. Paragraph 27(2)(d) and subclause 30(1) add to the complexity of determining the eventual application of the bill. If they are left as they are currently written, the outcome could be very different from that which the bill intends.

Paragraph 27(2)(d) would exempt the organization, activity or class from the application of this part in respect of the collection, use or disclosure of personal information that occurs within a province. For example, we could see a situation where the collection of information in Quebec by an insurance company like Great West would be exempt from the application of federal legislation, where the same would be true of the disclosure of personal information from Manitoba, but where all of the other activities undertaken by the company in Canada would be subject to the bill, whereas the situation could be different for another insurance company whose head office is in Ontario.

In summary, that paragraph paves the way for highly diverse legal regimes which might well distort competition and make it impossible for these companies to survive. And we are talking about companies that can afford to pay lawyers. We have not yet talked about citizens. It also invites companies to go to the Governor in Council more often to obtain exemptions that would suit them and would not necessarily be granted to their competitors. We feel that the wording of that paragraph could be improved.

As for clause 30, it gives rise to the problems for which you will find our suggestions on page 14 and 15.

Since time is of the essence, we will now move on to our solutions. Our objective is to propose solutions that could make the bill clearer, simpler and more effective. First of all, the scope of the bill must be clarified and its a constitutional basis consolidated. The purpose is to pass legislation based on jurisdiction over general trade regulations, a law that will apply without restriction not only to electronic commerce, but to all other commercial activities in Canada, without any exemptions. That would make it possible to restore citizens' confidence in business practices and by doing so, would facilitate commerce. That would establish a uniform standardized base.

The existence of this lowest common denominator should not however prevent a province from providing even better protection for personal information for its citizens. In such a case, the two pieces of legislation would apply simultaneously, with no conflict in principles. Nothing however would prevent Parliament from stipulating in the bill that in the event of a conflict between its provisions and that of another piece of legislation, whether it is federal or provincial, the authority responsible for applying the legislation must comply with the standard that is most likely to ensure the implementation of the principles to protect personal information established by the bill. This would avoid recourse to an exemption mechanism as proposed in paragraph 27(2)(d).

Clause 30 would no longer be required, and at the same time there could be cohabitation of federal and provincial legislation so as to best achieve the objective of the legislation, ie protecting personal information, with a view to maintaining public confidence in commercial activity.

Moreover, the federal legislation should obviously also apply to the cross-border movement of personal information and to all activities of federally-regulated corporations. The Governor in Council could however be equipped with the power to subject these corporations to provincial legislation.

On pages 20 to 28, we point out some minor difficulties with respect to the structure and some of the solutions that we are proposing.

I will conclude with our recommendations.

While we are aware that our first recommendation does not have much of a chance of being accepted, we recommend that Bill C-54 be removed from the Order Paper and that the government table as soon as possible a bill that corresponds more closely to citizens' needs.

• 1600

Recommendation 2: If our first recommendation is not accepted, we urge the government to significantly amend the bill in accordance with the following general and specific recommendations.

Recommendation 3: We recommend that the scope of the bill be amended so that it applies without restriction to all commercial activities in Canada and to all activities of federally-regulated corporations, and that paragraph 4(1)(b) be clarified. I refer you to page 17.

Recommendation 4: We recommend that the procedure established by section 30 of the bill and the exclusive power provided under subparagraph 27(2)(d) be replaced by a rule whereby the provisions of the bill prevail over those of other parliamentary acts, without restricting the protection or access rights granted by the application of the laws of Parliament or a legislature. Please see page 17 for further details.

Recommendation 5: We recommend the insertion in section 5 of the bill of a statement of the basic principles of personal information protection, which should be interpreted and applied in accordance with the schedule.

Recommendation 6: We recommend granting to the Commissioner the power to make binding decisions and to conduct inspections even when he does not explicitly have reasonable grounds to believe that an offence has been committed (see pages 23 and 24).

Recommendation 7: We recommend that the Commissioner's decisions concerning a misunderstanding in the treatment of the personal information or access to such information be subject to an appeal to a specialized administrative tribunal.

Thank you for your attention. We would be happy to answer any questions. Thank you.

The Chair: Thank you, Ms. Vallée.

[English]

I'm now going to call on Professor Richard Rosenberg from Electronic Frontier Canada. Mr. Rosenberg.

Professor Richard S. Rosenberg (Vice-President, Electronic Frontier Canada; Professor, Computer Science, University of British Columbia): Thank you. The organization I represent today, Electronic Frontier Canada, has been in existence almost five years. On its web page the following statement of purpose appears:

Electronic Frontier Canada (EFC) was founded to ensure that the principles embodied in the Canadian Charter of Rights and Freedoms remain protected as new computing, communications, and information technologies are introduced into Canadian society.

In many of its activities, EFC has spent a lot of time arguing against government intervention into content on the Internet, perhaps issues covered by freedom of expression. With respect to privacy, however, we feel the government must be involved because of the necessity to protect Canadian citizens from misuse of personal information.

In this respect, I'd like to focus on some technological issues and try to argue for a bill...and I might add that in principle we do approve this bill. It's long overdue compared to activities in Europe, say, and of course the non-activities in the U.S. We much prefer that there be a bill to protect Canadians in their on-line activities, in fact to encourage those activities.

What concerns us is that in many instances Canadians and other users of the Internet have information about them gathered without either their awareness or their permission. So it is important that however the bill is structured, it not depend on whatever technologies we're aware of now, but be structured on principles that will survive and endure for new technologies.

In this regard we've included in our presentation discussion of something called cookies, which are quite familiar to most Internet users. The point about cookies is that a number of steps have to be taken for the average user to become aware that cookies are happening.

Of course, the very name “cookies” suggests something quite innocuous, and it's far from innocuous. It is a movement of information from an Internet user or consumer that is stored at the host web site. The argument for the use of cookies is that, once having done some activity—shopping or gathering information—a return visit will enable the site to recognize that person has been there before and presumably help them or do something for them in their further activities. Well, that's the ostensible purpose as presented from the web site, from the industry.

• 1605

Unfortunately, the information gathered is not necessarily used at that web site. It becomes used by the owner, combined with other information, marketed, transferred, and used in many other activities without that person knowing.

The first step is when you start searching on the Internet—you have a browser—you may not know that this activity in cookies is going on. The activity is quite transparent unless you set something on your browser to require that you give permission before cookies are deposited. Unless you set this, you don't know the activity is going on.

That requirement is part of the educational requirement that I think the bill refers to. But I would argue that unless sufficient funds are provided for ongoing education, changes in technology that result in information being gathered, and I would say in a surreptitious fashion, are not going to be known to people. So it's very important not just that a bill appear, but that sufficient resources be made available, not just to deal with complaints and investigations, but to deal with education. People have to know what's going on or they can't act.

I've included in this presentation something current that people may or may not be familiar with, and this is Intel's new chip, the Pentium 3, which is starting to appear now. Intel included a mechanism in this chip that aroused a lot of controversy as recently as last week. Intel felt, the industry felt, that it's important computers be linked to their users, so if they're stolen and taken away, it could be determined that someone other than the owner is using them.

Well, Intel provides an identification number in its chip, and when you purchase the computer, the chip would be activated with your name connected to the identification number. So that means if you carry on your activities, your name will be related to this, and if the name they get from you when you're doing your on-line activity doesn't match that name inside the chip, there'll be some problem and authorities will be notified.

Clearly that ostensible reason also deprives users of any kind of anonymity or privacy, because your name is automatically associated with activities, whether or not you purchase. If you visit a web site to browse and get some information, your name is already there, and they will know you've been there at a certain time.

In response to this criticism, Intel said, well, if the user doesn't want this particular feature activated, he or she can make representations and say, don't activate it. Again, this is part of a whole series of activities in which the basic default condition is that you as a user have to do something to prevent information from being taken, transferred, or used.

You'll see that the argument throughout this presentation, when you get a chance to look at it, is that the default should be exactly the opposite. The default should be that nothing about you gets used unless you say okay, you can use it. I think cookies is one of these examples where things get used, and later on you discover you can prevent further use. But it's grabbed as soon as you get on the system.

It's typical of the industry that information be taken and used, gathered, and collected as a matter of course, whether or not it's directly related to the transaction at hand.

I would argue that if it's a default position where unless a positive step is taken by you as the user or consumer, no information is gathered, then no matter what technology appears along the way, that principle will be in effect.

Let me finish with final comments in my presentation.

The Intel case is not unique. It is an important example, however, of an endless stream of technological innovations that have societal implications—in this instance privacy. Only a vigilant community can recognize these threats and take actions to combat them.

The burden on the individual is too great to act alone, to say nothing of being positioned to identify the assaults on privacy.

Legislation such as Bill C-54 is desperately needed to safeguard all Canadian Internet users, but only if that legislation incorporates effective and workable privacy defaults that place the burden on companies to provide the facilities outlined above.

A strengthened Bill C-54 would provide continuing protection against the threats of an ongoing stream of new and powerful devices and methods. Canadians deserve no less.

Thank you.

The Chair: Thank you very much, Professor Rosenberg.

I am now going to begin with questions.

[Translation]

Mr. Dubé, please.

Mr. Antoine Dubé (Lévis-et-Chutes-de-la-Chaudière, BQ): I welcome those of you who are here to defend the rights of citizens in relation to this bill.

My first question is for Ms. Vallée, and my second, for the two other groups.

• 1610

You prepared quite a long brief. You touched on the constitutional part, which is found on page 9 and following. On page 9, you talk about five criteria for judging whether a federal law is constitutional. I would like to give you an opportunity to explain this, Ms. Vallée or Mr. St-Amant.

My second question is for the two other groups but relates to you also. We have a law in Quebec. Quebec is the only province with a law that has similar objectives right now. I would like to get your opinion on the value of the Quebec law.

Ms. Marie Vallée: Mr. St-Amant will answer any constitutional questions.

Mr. Jacques St-Amant (Attorney, Option consommateurs, Action réseau consommateur): In the decision handed down in 1989, the Supreme Court tried to set out guidelines for cases in which Parliament could use its general regulatory power in trade, and set five criteria.

There must be a system, and there must be a regulatory body, but there must also be a problem that can be settled by the court but not separately by the provinces. There absolutely must be federal intervention to resolve the difficulty that is the subject of the law. Failure to include some parts of Canada would also compromise fulfilment of the objectives.

Our concern is that because of the mechanism in the bill, Parliament is saying, essentially: We are establishing a law based on general trade regulations, but if in one, two, eight or ten provinces there is a similar law, we can make a decree whereby the federal law will no longer be effective.

From a strictly legal viewpoint, I have difficulty with the fact that on the one hand they are using powers related to trade, which theoretically should apply everywhere, and on the other hand, they are prepared to make orders whereby the federal law will only apply in one or two provinces. This seems somewhat paradoxical, if not illogical. This is our basic concern as to the constitutional validity of the proposal as presented.

The Quebec law has been in force for a some years. It has the benefit of being much simpler in form, and under it, the agencies implementing it, in particular the Access to Information Commission, can make binding decisions. It is a law which works well in practice and is easier for individuals and companies to understand than the bill in its present form.

[English]

The Chair: Thank you, Maître St-Amant.

Mr. Mollard or Professor Rosenberg, do you have anything to add to the second question?

Mr. Murray Mollard: Yes, I have a couple of things to say.

The constitutional questions are very complex. I'm sure if you invited five lawyers in here, you'd get ten opinions. Ultimately, of course, the constitutional issues will be sorted out in court at the end of litigation and whatnot. That doesn't mean the government shouldn't think very carefully about the constitutional implications.

I do want to give members a sense of some of the impact of the introduction of this bill on British Columbia, though. We know the Province of British Columbia has taken a serious interest in protecting privacy in the private sector all of a sudden. We didn't see that interest expressed prior to this bill being introduced. I think the government should commend itself for showing the fortitude to take those privacy interests seriously; for stepping forward and forcing the issues; and indeed for asserting its authority where it has it, in order to force governments to take this seriously.

Remember we're talking about nine other provinces and almost three territories that won't have the same type of legislation. If the bill is passed in the end and provides a significant impetus for those provinces to seriously consider these issues, that's great. We need for them to do that in British Columbia because this bill would not extend its application to protecting employee privacy. I do, however, just want to perhaps commend the government for forging ahead.

• 1615

The Chair: Thank you very much, Mr. Mollard.

I'm now going to turn to Mr. Murray.

Mr. Ian Murray (Lanark—Carleton, Lib.): Thanks, Madam Chair.

First of all, I want to thank all of the witnesses for putting a great deal of effort into your presentations and your submissions. They're very helpful.

I've been preoccupied with one section of this bill, so I perhaps should address my question to the B.C. Civil Liberties Association. On page 12 of the association's submission, I believe there's a recommendation that clause 7, as it's currently worded, be deleted. I think that's what you're suggesting, Mr. Mollard.

My concern has been the exemption that's currently in the bill for journalistic, artistic or literary purposes. I don't believe you spelled out specifically in your submission that you were at all concerned about, for example, journalistic purposes. I need to be convinced that there's not a problem there. I understand that a number of news groups have suggested that there would be immediate charter challenges if the exemption is not there for journalists. I'm personally more concerned with the rights of individuals to their own privacy than I am with journalists being able to collect whatever information they feel they should have. Also, I see journalism today very much as a business. I don't think Conrad Black would disagree with me.

As the Privacy Commissioner also pointed out to us, there's also a problem with the statement of principles, as I believe it's called. There had been a code of ethics, but it no longer exists now. I can't remember the exact name of the news association that its members ascribe to, but not all so-called journalists or journalistic publications belong to those groups.

I'd just like to know your feelings on that specific exclusion for, in particular, journalistic reasons.

Mr. Murray Mollard: Thank you for the question. It's an interesting one.

To quote Alan Borovoy, this is one of those situations in which freedoms collide. What you have on one hand is an interest in freedom of expression, the exposure to public debate of issues that may involve particular individuals in identifying particular personal information, and on the other hand, the interest in having those individuals' privacy protected.

The association is not opposed to the journalistic exemption or the literary or artistic exemption. What the act does do, though—and I'm sure some in the media may not be happy with this, although we support it subject to our suggestion about your considering carefully a whistle-blower protection—is something with respect to sources for journalists. Individuals who are tempted to disclose personal information are going to be subject to the act. We therefore think the act creates a balance in the sense of allowing the exemption for journalists generally, but then placing an onus on all organizations to respect the obligations within the act.

Mr. Ian Murray: If I could just interrupt there, the problem I have with the sources is that journalists are often loathe to admit who their sources are. What recourse is there in that case, if a journalist refuses to say where he or she obtained the information?

Mr. Murray Mollard: I think that's one of the reasons why we've suggested that there should be, in the oversight provisions, for example—and I agree with Marie Vallée on this—a proactive ability to audit individual organizations. I'm not sure that addresses your question particularly, but I think there should be an opportunity for the commissioner to audit perhaps in a way that encourages compliance, as opposed to using a hammer approach.

In British Columbia, the commissioner there uses what he terms “site visits”. He's visiting organizations to make sure they're complying with the act. If there is a disagreement at the end of a controversy, though, there should still be the power to expose problems on the commissioner's behalf.

• 1620

As far as journalistic sources go, I don't have a complete answer for that. The fact is that the obligations are there if they come to light or if there are concerns from an individual. Certainly, if an individual is named, he or she can raise the question. How effective it will be to have that concern noted is unclear to me, though.

With respect to this, the act is not going to be perfect. I don't know how it would be able to strike a perfect balance. Indeed, if I follow your question, you would not want the journalistic exemption, but that begs the question about freedom of expression. In this case, we see that there is somewhat of a balance between the two.

The Chair: Thank you, Mr. Murray.

If anyone has any comments on a question that's not directed to them, just signal to me and I'll allow you to participate in the discussion.

[Translation]

Ms. Lalonde, please.

Ms. Francine Lalonde (Mercier, BQ): Thank you for the work you have done. Unfortunately I was unable to attend your presentation because I had to meet with a group, but I did go over your text. I think that Option consommateurs has put forth quite an effort toward squaring the circle.

This bill might create a number of problems, and I would like to stress two major ones. On the one hand, Quebec which was the first to adopt this kind of law, took a chance and developed some expertise. The Liberal government of the day and the Opposition passed the bill unanimously. One might have expected to see this new bill based on the Quebec law. The least one can say is that it will hinder the application of the Quebec law. This is the essence of the first problem: How can we avoid having companies throughout Quebec subject to two sets of rules, and citizens having to deal with two different types of protection, and having to knock on two different doors?

The other problem is the lack of privacy protection measures in the rest of Canada. One would think that almost any kind of protection is better than none.

Thus there are at least two major problems. I thought you were maintaining that for optimal privacy protection, there would have to be coordination, agreement and basic rules applicable everywhere, and we should be able to apply the best rules, those that more closely resemble Quebec's. Did I understand your intervention clearly? Was that the result of your research? It is quite unique.

Mr. Jacques St-Amant: Yes, it is a matter of squaring a circle. We feel that it is useful for Canadians, and inevitable in some areas, to have Parliament intervene. There are some questions in which it is difficult to intervene.

I think that we generally agree that the Quebec law provides protection equivalent or superior to that of Bill C-54. We are proposing a system where Canadian law would apply to all commercial activities, federal business activities and transboundary activities. As soon as it took effect, it would apply everywhere.

Wherever, in the opinion of the Commissioner, a legislative provision by a tribunal or an organization more effectively fulfilled the objectives of privacy protection than the basic law, the former provision would take effect. Thus we would have a system where everyone from coast to coast would at least know what to expect. And if a province decided to give more rights to its citizens, which it can do, there would be a slightly more beneficial regime.

• 1625

Undoubtedly in some cases we would find two overlapping regimes, but that is probably inevitable in Canada. We see this kind of situation in many areas.

In the matter of consumer protection, for example, the Competition Act contains provisions on advertising, as do a number of provincial laws. Business is quite comfortable with this, and so generally are consumers. Thus there is a way of reconciling these laws and making sure that everyone is protected, some as well, if not better.

I would like to add a detail which coincides with some comments that have already been made. We must not forget that several other provinces currently have existing legislation or case law that provides some protection of personal information. For example, there are some controls put on journalists. Journalists cannot do anything they want. Regardless of whether or not there is federal legislation, Quebec has libel and privacy provisions that will continue to apply. This is also the case in other provinces.

We must not lose sight of the fact that we currently have an extremely complicated mosaic in Canada. We have just added another element to this mosaic which may be important. We must make sure that it works.

The Chair: Thank you, Mr. St-Amant and Ms. Lalonde.

[English]

Ms. Barnes.

Mrs. Sue Barnes (London West, Lib.): Thank you, Madam Chair.

Thank you for your presentations.

When we look at our world, which we're used to, we see medical circles doing informed consent. In legal circles, you read before you sign. Here, we're into the default provisions in that it's nearly the reverse. Although I can understand your criticisms about taking it off the table, law is the art of the possible. No one piece of legislation fixes everything. I take the input from B.C. to be saying it's a good start, and I believe that's true.

What can we do to fix it? To my mind, I think the input about punitive damages being limited fiscally to $20,000 is very good. I would agree with that, but we'll hear from others in order to try to unearth the justification for why that number is there. It's small potatoes to many corporations, I'm sure. It's more like lunch money as opposed to anything with a real impact.

Also, Professor, in one of the footnotes in your paper, you've outlined the points on fundamental principles of fair information practices. Those are extremely relevant. If it's possible, what I would like for you to do is to point out where you find this piece of legislation deficient in standing up to those fair principles.

Prof. Richard Rosenberg: I should point out that these fair principles are about 25 years old. They were first proposed by a U.S. congressional committee investigating privacy legislation or privacy proposals. Of course, there is no universal privacy protection in the U.S.

In the proposal, I used those principles at various places, in various statements, with respect to the use of the word “should” as opposed to the use of the word “shall”. The term “should”, of course, is conditioned by the statement in subclause 5(2) of the bill:

(2) The word “should”, when used in Schedule 1, indicates a recommendation and does not impose an obligation.

At a couple of places, I went through and said that if you have “should” here, it will not give the protection of a particular one of these fair information principles. For example, paragraph 4.3.7(b) reads:

(b) a checkoff box may be used to allow individuals to request that their names and addresses not be given to other organizations. Individuals who do not check the box are assumed to consent to the transfer of this information to third parties;

In my brief, I wrote:

I would argue that such an option must be made available to individuals. It cannot be the case that one should assume that permitting an organization to collect and use personal information applies to the right of that organization to sell or transfer such information to third parties, unless explicit permission has been obtained.

And I also note:

To do otherwise would be a clear violation of the third principle of Fair Information Practices, namely “There must be a way for an individual to prevent information about him that was obtained for one purpose from being used or made available for another purpose without his consent.”

I think there are two or three other examples in this document.

Given that these principles arose in the States and are referred to very widely in other countries as justification for legislation, I think it's interesting that in the U.S. they are seen as principles and are never referred to as justification for legislation.

• 1630

Mrs. Sue Barnes: One of the areas that interests me is the whole concept of data mining. Here we have a system that talks about individual complainants coming forward and special circumstances where the commissioner can enter the fray. When there's a whole class of people affected, do you have any civil liberties input on that? What are your thoughts in that area?

Mr. Murray Mollard: I'm sorry. I don't quite understand the question.

Mrs. Sue Barnes: Do you want input on that?

Prof. Richard Rosenberg: Let me understand your use of data mining. This is where vast amounts of information are collected, say, supermarket shopping records.

Mrs. Sue Barnes: That's it, yes.

Prof. Richard Rosenberg: Something where there's lots of information, and the idea of data mining is to take this vast amount of information and process it with some very large computers or lots of small computers acting in concert, to extract detailed shopping behaviour, detailed microscopic economic behaviour of individuals—that is, by the hour, by the day, by the store, by the product, on and on.

Clearly, stores that encourage the use of air miles cards or special cards attach a name, a real live name of a shopper, to this data. So now you have very particular, very fine-meshed information about a whole bunch of individuals and their regular shopping activities. I understand the question to be that if all of them are somehow affected, what resource do all these people have, or what will they do to express their concern? Will thousands of people in some shopping area discover all of a sudden that information is being used? Will some individual do it, and how will that affect the other individuals?

Mrs. Sue Barnes: Specifically because the individual piece of information is so minute that nobody is really going to get upset about that one piece. It's only when you see the whole picture.

Prof. Richard Rosenberg: I think that's one of the concerns about this in the large, that at the micro-level a piece of information seems harmless. It seems, what does that matter? But the point is in data mining, and many other areas, what the computer facilitates, which was not possible previously, is the gathering of vast amounts of information from quite different places and attaching them to given individuals, to very tightly define people. Now you have little pieces that independently have no particular threat, but put together provide quite detailed information about behaviour of individuals. I think that's a real concern.

As you know, this bill is complaint-driven. Unless you discover something has happened, and it's very difficult to discover this, then you could say, well, it's all operating in the background; if it doesn't affect my life, what do I care if they have all this stuff and are using it?

Well, it may not affect your life now, but it could easily affect your life down the road, in which case you will never be able to figure out where the information came from and how it is that all this stuff is known about you when you never gave permission for any piece of it, or you may have for some piece and not for others. It makes it extremely difficult for people to determine how they're going to get redress after the fact, when all this has been gathered.

Mr. Murray Mollard: My comments are, first, that it perhaps goes back to that audit point I made, that it's important that the commissioner have some proactive ability to encourage compliance and take a cooperative approach with organizations, rather than the hammer approach in the first instance. It's just to step back for a moment and realize that in terms of freedom, if some individuals want to give their personal information for a particular gain, economic gain or benefits from various marketing schemes that occur, I think they should be free to do so. But what is critical is that the purposes be very specific and that people understand those purposes and indeed that public education occurs so people can understand the implications of what they're doing.

I think perhaps in the last 10 years or so, we're only awakening to some of the implications of what it means when you're asked for your name and all your personal information from a particular corporation that wants to sell you something. People are starting to ask, “What do you want that information for?”

One of the things we've said is that the public education mandate of the commissioner is critical. The commissioner needs to have proper funding for that. But I think that public education mandate falls on all of us, not just one particular government organization.

The Chair: Mr. St-Amant, do you subscribe to that?

[Translation]

Mr. Jacques St-Amant: I fully agree with Mr. Mollard. Obviously, we need resources if we are to play the role of an educator.

[English]

The Chair: Thank you.

Thank you, Mrs. Barnes.

[Translation]

Ms. Marie Vallée: And, obviously, the Commissioner needs to be given resources.

• 1635

[English]

The Chair: Thank you.

[Translation]

Mr. Dubé, please.

Mr. Antoine Dubé: I will let Ms. Lalonde speak before I do, so that I can continue reading.

[English]

The Chair: Monsieur Dubé, you went first, she went, and now it's your turn. You don't want another turn?

[Translation]

Ms. Francine Lalonde: Go ahead.

[English]

The Chair: I'm sorry. Did I mention Madame Lalonde's name. I apologize.

[Translation]

Mr. Antoine Dubé: I was in the process of reading, on page 13, your example of the Great West Life. You have no doubt thought of other similar cases. These are various exemptions that may be allowed under the current legislation for a business like that. You have no doubt thought about other examples. I would like you to provide us with other cases.

Mr. Jacques St-Amant: We have not come up with a complete list. Nevertheless, the bill, as it is drafted, definitely poses two basic problems. First of all, it is very difficult to treat strictly federal businesses and other businesses that may be competing with the federal government in the same fashion. The best example would be the one where you have the banks on one side and the credit unions on the other. If both are not treated equally, somebody, somewhere, will complain and say that

[English]

this is not a level playing field

[Translation]

and that it is unfair. Consequently, we have to find a way to harmonize these two cases.

Then, paragraph 27(2)(d) of the bill, as it is drafted, enables the Governor in Council to exempt, by decree, the organization, activity or class from the application of the Act. This could possibly lead to an absolutely phenomenal carve-out. We could find ourselves, in certain provinces, with a law that may or may not be basically the same and even, in the case of such a carve-out arrangement between organizations and between activities, with federal businesses being subject to another system. The citizen will be totally confused and the business itself may be somewhat perplexed.

On top of that, the proposed system will change with the times. Let's say, for instance, that this bill, as it is currently drafted, comes into force on July 1, 1999. Basically, the legislation will not apply to strictly provincial business activities for three years, and therefore not until 2002. In Quebec, we will therefore continue under the current system and, in the other provinces, there will, basically, be a vacuum.

Starting on July 1, 2002, in Quebec, we will have overlapping legislation. We now have C-54 in the other provinces. Who is to say that, in 2004, for example, Alberta will not decide to pass different legislation? We would again be changing the system in this province if the Act were deemed to be essentially similar to the federal Act. This is not a simple system; this is not a system that enables businesses to foresee how they are going to manage.

Last week, I discussed the issue of personal information with a lawyer who works for a parapublic agency in the field of public protection and discipline. Her spontaneous reaction was to say: "My God, personal information is a sensitive and complicated field. Now that five years have gone by in Quebec, we are still not sure whether or not we are comfortable with the issue." And this was a lawyer speaking.

If we wind up with a system such as this one, the provincial bar associations are going to have to put a lot of work into on- going training, to say the very least.

The Chair: Mr. Dubé.

Mr. Antoine Dubé: On another issue...

[English]

The Chair: I'm sorry, Mr. Mollard.

Mr. Murray Mollard: I would like to add something. There's no doubt that this law is complex, and indeed in some sense, even with the experience in Quebec, we're launching a little bit of new territory in terms of legislation. So there's definitely going to be a learning process, and that's why it's so important to have the five-year review.

In terms of complexity, I would like to talk to Jacques a bit more about this. There's no doubt that our constitutional set-up is one that is always going to engender complexities. Indeed, corporations that operate across provincial boundaries have this problem on all sorts of matters, environmental for example and other matters, where there is shared jurisdiction in some ways, and they have to learn to adjust to the particular provisions with any particular jurisdiction. Perhaps that's the bargain we bought when we created this country. I think it's a great country.

• 1640

The Chair: Thank you, Mr. Mollard.

I will go to Mr. Dubé. Last question, Mr. Dubé.

[Translation]

Mr. Antoine Dubé: I have a question on another matter. I believe you said, Mr. St-Amant, that individuals and private businesses will be treated more harshly under this Act than the federal government, under the system it gave itself. Recently, the Department of Revenue was nonsuited by the court for, I believe, pairing customs and employment insurance data, something which the Department allowed.

I would like you to explain why the federal government is not a good model of this system which it is absent to impose on private business.

Mr. Jacques St-Amant: As Mr. Mollard was saying, our constitutional system is by nature complex. We do feel, however, that we could do something to simplify the situation where we have both provincial and federal legislation pertaining to personal information protection.

I think that the principles suggested in the federal act, Bill C-54, make, on the whole, a lot of sense. The bill is based on an OECD proposal of a few years ago and on what is done just about everywhere else. There are, of course, some linkage problems between the bill and the schedule and we have made a few recommendations pertaining to this matter. However, as far as the principles are concerned, I don't think that there are any major obstacles.

Of course, you were talking about the situation as it pertains to the public sector. In our opinion, a major difference lies in the fact that, in the federal public sector, the Commissioner's decisions are not binding. Perhaps this is understandable given that problems can be drawn to the attention of the House of Commons. At one point the minister in charge may have to be accountable.

However, this is not the case in the private sector and this is why we feel it is important that the Commissioner be authorized to make binding decisions. Indeed, if we ask consumers and citizens experiencing difficulties to complain to the Commissioner who in turn can only make recommendations, these people will then have to go to Federal Court, where they will have to deal with the delays, costs and complexities that such proceedings entail.

This is a complicated process for resolving small problems which often, as Professor Rosenberg pointed out earlier, do not appear to be crucial, at least not crucial enough to warrant going to Federal Court. However, they may be real problems all the same, and we are recommending that a more effective and simpler process be implemented.

I'm not sure that that answers your question, but there you have it.

The Chair: Thank you, Mr. St-Amant. Mr. Bellemare.

Mr. Eugène Bellemare (Carleton—Gloucester, Lib.): Thank you, Madam Chair.

[English]

My question is to Professor Rosenberg and it is in regard to the section on protection of personal information. Knowing full well that this bill is specifically about electronic commerce, and the commerce we do within the province, outside the province, interprovincially and internationally, and of course, the ballgame we must play with Europe and the rest of the world... But in terms of access to information, it appears that journalists, artists, comedians, and literary people have free access to your personal information. I'm surprised you did not point out that perhaps—and even this I would not accept as being restrictive enough—the word “commercial” or “business” should be added between the words “an organization may collect personal information without the knowledge or consent of the individual only if”; and if they're newspaper people, for example, “personal information”. If someone wants to do electronic business, why should they need to know the personal affairs of any individual in Canada as opposed to knowing the personal business or commercial affairs of an individual? Let's stick to that fine point first.

Prof. Richard Rosenberg: They shouldn't, of course.

Mr. Eugène Bellemare: Shouldn't what?

Prof. Richard Rosenberg: They shouldn't know. They shouldn't have access to or gather or use information beyond that needed for the immediate purposes of the transaction. Again, I think that is a long-standing principle in the privacy area.

• 1645

However, it's usually phrased in a way that allows lots of manoeuvrability for organizations. That is, some organizations will say in their privacy statement, we only gather the information we need to do our business, which leaves a lot of leeway open for interpretation about what exactly do they need to do their business.

So even if you try to make it explicit, as has been attempted here, and say that only the information necessary for the transaction should be gathered, it's not clear to me that you would put a severe limitation on the information gathered in the end.

Mr. Eugène Bellemare: Don't you believe, then, that subclause 7(1)—

The Chair: Mr. Bellemare, Mr. Mollard wants to add something.

Mr. Murray Mollard: I wanted to emphasize Professor Rosenberg's point and underline the limitation of the bill in that respect. One way to solve that is to think about adding some principle of justification mirroring the words in Quebec's act, or the European Commission's directive about serious and legitimate purposes.

In other words, I think it's impossible to think ahead of time of all the purposes that might be legitimate. It's impossible in law to specify those. However, if you use limiting terminology that provides some assessment after the fact and recourse to complainants—

Mr. Eugène Bellemare: Why aren't you suggesting that since we're talking about electronic commerce the leeway would be for that specific activity and not permit a fishing net to any journalist who wants to really do defamatory work on anyone he or she feels like?

Prof. Richard Rosenberg: It's difficult to separate. I haven't actually thought about the journalism part. I did make a note when I was reading the bill; I underlined the word “collect” exactly in that place and I was thinking about it in general. But I'm not experienced enough to know what kind of justification there is for arbitrary collection of information by journalists, because, seemingly, any limitation in advance could be seen as a restriction on some general notion of freedom of the press.

I don't know how you could say in advance that there are certain things they couldn't get, or shouldn't get, without permission. I would like them not to get a lot in general, but I don't know how you would say it, how you would frame that and say... Then the journalists would come back and say, I began the story investigating this and this seemed interesting.

I suppose President Clinton would have liked it if Kenneth Starr had stopped the investigation when he found nothing out about Whitewater. That would have been a limitation thing. You were called to do Whitewater, you finished Whitewater, it's over; but then this other thing appears.

Mr. Eugène Bellemare: You're not giving me an answer to my question.

Prof. Richard Rosenberg: I'm saying it's a difficult problem. I'm not sure how you would frame that. My answer is I don't know.

Mr. Eugène Bellemare: Should the press be let loose on every individual in this country under the guise of writing up something on electronic commerce?

Prof. Richard Rosenberg: Probably not, but as I said, I don't know how you would frame it to say you can only get this but not that. I don't know how that would work when you don't know what the press is trying to do at any given time.

Given the benefits to a free and open society of a free press, that is, given certain latitude, I think the press has to be responsible in the end for what they produce. If they defame, or if they commit libel or so on, they should be subject to those things if the information they gather has that effect. But in advance, I personally don't know how you would be able to frame a restriction on what the press could collect, or how much, or in what directions, in advance.

Mr. Eugène Bellemare: Time could be of the essence in a case of a press write-up, and the person being attacked, or who feels he or she is being attacked, might have no recourse because of the time element. In an election, for example, of a school trustee in some city, a person could be defamed, and then the election is over.

Mr. Murray Mollard: You can seek an injunction, presumably, to prevent the publication of particular information.

Mr. Eugène Bellemare: Once it's out, how do you stop the trustees from having their election?

The Chair: Mr. Bellemare, Mr. St-Amant wishes to respond.

[Translation]

Mr. Jacques St-Amant: As the law currently stands, every Canadian province has rules governing the press, governing journalists, that prevent them from committing libel and spreading false information. This exists right now. Regardless of whether or not Bill C-54 is adopted, this already exists in law. The only thing that the provisions of the bill do—there could be some minor refinements, but these are details—is to say that this Act does not prevent the press from doing its job. It does not provide the media with any new rights or powers, this is far from the case. These provisions simply avoid the situation where we would be faced with a multitude of court challenges based on the Canadian Charter of Rights and Freedoms and its provisions pertaining to freedom of expression.

• 1650

[English]

The Chair: Thank you very much, Mr. Bellemare.

Madame Lalonde, s'il vous plaît.

[Translation]

Ms. Francine Lalonde: Thank you. I would like to go back to the confusion arising from the bill. I feel that legislation of this type takes it for granted that there will be some consumer training or education and that, for businesses with obligations, clarity is also essential.

Do you think that it would be possible to leave the text as it is, namely, to apply the provisions of a bill that provides for an obligation that refers to the CSA Code, which is full of conditions, to state within the bill that the conditions do not apply, but then to have clause 7 which provides some type of framework in order to compensate for what would be missing in the CSA Code.

Mr. Jacques St-Amant: I would respectfully submit to those who are of the opposite opinion, that I feel that the solution put forward in the bill is not the easiest one. That being said, this approach was adopted for all kinds of reasons. We do feel, however, that we could still make things easier to apply and more readily understood for the parties concerned, for the businesses and possibly also for the Commissioner, at the very least, by including certain essential principles in the bill. At any rate, most of these principles are already included in the schedule. But let's take these principles out and say: This is what any business or organization must do.

Next, and this would greatly simplify any interpretation problems with respect to the schedule, we should say that these general principles must be interpreted and applied according to the instructions provided in the schedule. By doing this, we would avoid these quasi-legislative "shoulds" and the notes and we would no longer have to say that the "shoulds" and the notes do not really apply and do not have force of law. The schedule would therefore play a role that is more in keeping with its form and nature and we would have a system that is easier to understand without having to rewrite the entire bill. Indeed, we would not have to do much at all. In an ideal world, we would have perhaps taken another approach, but we have to live with what is now on the table.

Ms. Francine Lalonde: We are not living with what we now have on the table if we do what you want. We would be amending the bill significantly.

The Vice-Chairman (Mr. Eugène Bellemare): Ms. Vallée.

Ms. Marie Vallée: Ms. Lalonde, I would like to refer you to page 22 of our brief. We put a lot of work into this brief because we know that we may have only one shot at it. We're going to have to live with the bill, after making some amendments to it.

Ms. Francine Lalonde: That's not what we think.

Ms. Marie Vallée: This is what we are suggesting on page 22 in order to interpret the schedule. If we were to amend clause 5 as we have suggested on page 22, we would be adding principles that are essentially the same as those given in the schedule, but which would have legal weight. If you were to read it, you would see that we talk about "must"...

Ms. Francine Lalonde: Like the body of the bill.

Ms. Marie Vallée: ... "must" rather than "could" and "should". If these principles were included in the Act, we could avoid many problems which we fear may occur and, at the same time, the Act could coexist with the schedule. Of course, this is not an ideal situation, but it's better than what is there, and it's better than nothing as well.

[English]

The Chair: Mr. Mollard, do you wish to say something?

• 1655

Mr. Murray Mollard: Yes, I just wanted to say that Marie, Jacques, and I can probably sit down and talk about this. Indeed we suggest as well that the basic obligations be a part of the body of the act, or if the act is going to put them in a schedule, that they not be subject to change simply by cabinet fiat. It's quite obvious the schedule is not as neat and tidy as probably most legal drafters would like it to be. Nevertheless, we as an association were prepared to accept it partly on the basis that there was wide consensus from various quarters—business interests, consumer interests—when the Canadian Standards Association put this together. It was a consensus document. It may not suit everybody's purposes, but it was a consensus document, and to some extent that's quite significant in terms of the various parties that this law would apply to in terms of their cooperating with it, buying in, etc.

The Chair: Thank you.

Thank you, Madame Lalonde.

Mrs. Barnes.

Mrs. Sue Barnes: Thank you. I have a couple of questions. Mr. Mollard, this one is for you.

On page 13 of your brief you were giving a criticism of paragraph 7(1)(b), and the association's position is to remove that area. Would it make a difference to you if instead of thinking of the need for it as being a lawful purpose... For instance, I'll give you an example of a banking or an insurance company trying to detect fraud. You're not going to signal that you're checking out transactional records. So to me there is some justification, maybe in some improper personnel activity within a corporation, where there are some overriding security issues involved. And I see some need for some type of exemption here. I'm wondering when you wrote your criticism whether you had those situations in mind or just the normal commercial activity.

Mr. Murray Mollard: Well, yes. To be very clear here, we're not suggesting that paragraph 7(1)(b) simply be erased without being replaced by anything. What we are saying, though, if you look at what it says... Let's look at the wording in particular here: It says:

it is reasonable to expect that the collection from the individual would compromise the accuracy of the information or defeat the purpose or prejudice the use for which the information is collected;

Well, for the individual, taking this from the perspective of the data subject, the reason this is there and the accuracy might be compromised is that the individual would object to the collection of that personal information. In other words, it's in the significant time where privacy means most to the data subject that there's this wide open, gaping hole.

You're quite right, there may very well be compelling public interests, or legal duties, obligations, or rights on behalf of an organization that would merit an exemption for collection, but we say specify those, be specific, think it out, think it through.

Mrs. Sue Barnes: Define the problem.

Mr. Murray Mollard: Define them. Define them as you've done—

Mrs. Sue Barnes: In the legislation?

Mr. Murray Mollard: Yes, as you've done in subclauses (2) and (3). That's the approach you took in subclauses (2) and (3). Instead, in subclause (1) you create this absolute gaping hole when privacy means most to an individual, the data subjects who would be subject to the collection without their knowledge or consent. It just seems quite a large, gaping hole, and a mistake in our view.

The Chair: Mr. St-Amant, do you wish to reply as well?

Mr. Jacques St-Amant: I'd like to quote from another statute that addresses that problem. The act addresses it in the following way. It is possible to collect a person's information without consent if you have a serious and legitimate reason and either of the following conditions is fulfilled: the first is being in the interest of the person concerned; and second, collection from a third party is necessary to ensure the accuracy of the information.

With that kind of drafting you narrow the gaping hole that exists, without trying to go into making a list of cases where it would apply, which may not be easy.

Mr. Murray Mollard: I'd like to follow up. I suppose I'm open to Jacques' suggestion that there is some limitation on that. But again, because the individual who's going to be subject to it may never know, there may be some problem—and this is complaint-driven, remember—with the complainant ever coming forward to challenge what is legitimate and what is serious.

• 1700

So it's hard to be exhaustive. I know subclauses 7(2) and (3) have been, and I'm curious as to why that approach wasn't taken in subclause 7(1).

Ms. Sue Barnes: This seems to be a recurring theme sometimes, and it's a difficult thing to do, that is, decide what you put in the text of your legislation and deal with the possibility of regulation outside the purview of a parliamentary committee and Parliament itself. I've heard your complaint.

I'm wondering, Professor, if you feel the same way. Is this one of the situations where we should have this in the text of the legislation?

Prof. Richard Rosenberg: I actually don't feel as strongly as the expressed opinion. I'm not sure who that's directed towards. I don't expect the average person to read the text of the legislation. I can't think of any other legislation I've ever read, except the things that—

Mrs. Sue Barnes: My issue is, do you want something of this importance where parliamentarians would not have to review it and where it can be done by order in council?

Prof. Richard Rosenberg: No, I would like it reviewed by Parliament.

Mrs. Sue Barnes: Can I have input from the others?

[Translation]

The Chair: Mr. St-Amant.

Mr. Jacques St-Amant: At any rate, it would be good to have some consultation before we have rules such as those contained in the schedule so that we can amend them. That much is clear.

[English]

Mrs. Sue Barnes: On a point of information, my colleague from the Bloc gave a Revenue Canada example and brought it up as a contrast. I would just put out the other recent example about the income tax form where we actually asked for informed consent to add information to the electoral records, and I think we've had a great response on that.

The Chair: Thank you, Ms. Barnes.

I have no one else on my list. Are there any other questions?

Madame Vallée, do you have a comment?

[Translation]

Ms. Marie Vallée: I'd like to raise an issue which I haven't had time to deal with yet. There are some minor drafting problems between the French and English versions and, in some places, there are some very major shifts in meaning. I'd like to draw your attention to page 28 of our brief. One of the problems that we have noted pertain to the way that certain clauses of the bill are numbered. The clauses are not numbered the same way in both French and English. Certain words are included in the French version but not in the English version, and sometimes these words completely change the meaning of a clause or subsection. We have already discussed these issues with some people. We cannot stress enough how important it is that the wording be similar in both languages and that it mean the same thing.

Moreover, I'd like to state, if we did not make this point very clearly during our presentation, that we believe that the federal bill should apply to all business activity, and not only to electronic commerce.

[English]

The Chair: Madame Vallée, you should know that there have been a number of reviews, and they're continuing to review the legislation. They have identified a couple of errors in matching, and we appreciate your bringing that to our attention as well.

I want to thank you all for being here today. The committee appreciates your input. It's a very difficult subject for us to understand completely. Some have been involved in this area longer than we have. We do appreciate your being here and travelling the distances you did in order to join us here.

If you have any other comments as our hearings continue, we would appreciate your input. Our hearings are posted on the Internet as soon as they're available. You should also know that your briefs will be translated and circulated to the members of the committee.

Mr. Mollard, do you have a final comment?

Mr. Murray Mollard: I just want to take up one final detail, and that was the point about the enforcement mechanism. Jacques made some comments about a tribunal versus a court and whether this court system that has been set up in the bill is actually very good. The association originally recommended to Industry Canada that a tribunal be used in terms of its special powers and special knowledge and the whole reasons one has an administrative tribunal.

That said, we're not opposed to the bill's use of Federal Court. However, it's absolutely important that the ability to go to court is both accessible and affordable. It's quite a unique and novel scheme that's set up here in terms of a sort of ombudsman and yet the opportunity to go to a judicial review in some way.

• 1705

Where the Privacy Commissioner decides that the complaint is justified and recommends that the organization amend its practices or whatnot and the organization just ignores those recommendations, as it can do, it seems to me that it should really fall to the Privacy Commissioner on behalf of the complainant to pursue that in court. If there are no recommendations or the commissioner finds the complaint isn't justified, it really should be up to the complainant to pursue it. But even in that case, it still should be an affordable and accessible process, which is one of the reasons one uses administrative tribunals and not the court.

The Chair: Thank you, Mr. Mollard.

Madame Vallée, Mr. St-Amant, and Professor Rosenberg, do you have a final comment?

Prof. Richard Rosenberg: I'd just like to add one thing about the difficulty of finding out what happens to information, and I'll try to do this quickly. Currently, on the application for a credit card, let's say, you agree to certain things. That's rightly so, because you're getting the use of someone else's money for some period of time while you purchase things. What you agree to, specifically, is that the bank or financial institution run a credit check on you to make sure you're a good risk for the card they're giving to you, and that seems reasonable.

The part I want to raise for your consideration is that you also give them into—they don't quite say perpetuity—the future the right to do credit checks on you that are totally unrelated to your getting the original credit. Furthermore, the information they gather is automatically shared with whoever requests it. This comes about because of their membership in credit bureaus. The credit bureau system operates by members not only using information but also being required to supply information they get to the credit bureau so that other agencies can use it. As a consumer, I would like to know that when I agree to the conditions, in fact I'm agreeing to this indefinite intrusion and this indefinite sharing of information beyond any fixed date. That's generally not known by people. That's just one example of gathering information without limitations.

The Chair: Thank you very much, Professor Rosenberg. In fact, we had a discussion with some of the provinces in early December about how information is used and gathered. We appreciate that input as well, when it comes to consumer information.

Again, I want to thank you all for being here with us.

The meeting is now adjourned.