INDY Committee Meeting

STANDING COMMITTEE ON INDUSTRY

COMITÉ PERMANENT DE L'INDUSTRIE

EVIDENCE

[Recorded by Electronic Apparatus]

Tuesday, February 16, 1999

• 0906

[English]

The Chair (Ms. Susan Whelan (Essex, Lib.)): I would like to call the meeting to order. Pursuant to an order of reference of the House dated Tuesday, November 3, 1998, the orders of the day are the consideration of Bill C-54, an act to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions, and by amending the Canada Evidence Act, the Statutory Instruments Act, and the Statute Revision Act.

We're very pleased to have with us today two witnesses. We have Ms. Valerie Steeves from the Human Rights Research and Education Centre of the University of Ottawa, and Mr. Ian Lawson, an independent privacy expert. Unfortunately, Mr. Pierrôt Péladeau has had to cancel at the last minute. We just got a call this morning and he will not be with us.

The clerk is in the process of circulating copies of the opening statements. With that, I would propose that Ms. Steeves begin when she is ready.

Ms. Valerie Steeves (Individual Presentation): Thank you very much, Madam Chair.

Over the past few years, it has been my privilege to take part in a number of public consultations on privacy rights and new technologies. Most notably, I was an active participant in organizing and facilitating the 1997 privacy and new technology study, which was undertaken by the Standing Committee on Human Rights and the Status of Persons with Disabilities in 1997. In addition, I created a privacy forum, which was an on-line web site, partnered by a number of public interest and consumer groups, to solicit Canadians' views on the discussion paper that preceded Bill C-54.

It's clear from these various public consultations that Canadians see privacy as a fundamental social value and that they expect their government to take a leadership role in protecting privacy in the information age. Data protection legislation is an important part of the privacy puzzle, and from that perspective Bill C-54 is to be applauded.

However, when I was preparing for my intervention this morning, one comment from all the comments we heard at these consultations stood out in my mind. A gentleman in Toronto, at the end of our town hall, stood up and said he feared that the organizations that have the most to profit from invading our privacy are the ones who are setting the legislative agenda.

Now, it's clear that C-54 is an e-commerce initiative. The bill and the discussion paper both assume that the goal of the legislation is to develop global competitiveness in the information economy by building consumer trust and market certainty. I think it's also worth noting that the discussion paper used the words “consumer, business, and industry” collectively 78 times, as opposed to a total of 10 occurrences of “citizen”.

The perspective in C-54 does not exist in isolation. In fact, I would argue that it's part of a larger shift in our notions of governance. The traditional perspective sees government as a vehicle for advancing the public good, and privacy is an essential part of what Ursula Franklin, for one, calls the indivisible benefits of government: justice, dignity, freedom, clean air, privacy, rights.

• 0910

I fear that we're sliding into a new perspective where government is becoming a vehicle to divvy up divisible benefits, things that benefit one set of private interests at the expense of another. From this perspective, good government and good legislation is efficient, cost effective, and fosters competitiveness. From this perspective, then, privacy is a barrier to efficiency and competitiveness.

When the Law Commission of Canada was reconstituted approximately a year and a half ago, they wrote a strategic agenda in which they said, and I quote:

The capacity of citizens to participate meaningfully in the democratic process poses challenges for the design of public institutions. Canadians are disengaging from these institutions, are more sceptical about their capacity to respond to legitimate expectations, and have less confidence in [them] than they once had.

The public consultations on privacy have clearly demonstrated that Canadians are calling upon their elected representative to uphold the public interest in this matter. I suppose the question I'd like to address is whether Bill C-54 meets that test.

I think there are three steps you can take as a committee of the House to bring Bill C-54 closer to this standard. The first involves what I see as the biggest flaw in the legislation. There's nothing in the bill that allows the individual or the privacy commissioner to question the legitimacy of the purpose for which the information is collected. The only time the word “purpose” is qualified to any extent is in section 4.3.3 of schedule 1, which reads:

An organization shall not, as a condition of the supply of a product or service, require an individual to consent to the collection, use, or disclosure of information beyond that required to fulfil the explicitly specified, and legitimate purposes.

But the trouble is that the history of technology tells us that it's not the intended consequences we have to worry about; it's the unintended consequences of new technologies that pose the real problems.

What are the unintended consequences of information technology? I think one example, one of many examples but just one, will highlight the kinds of issues that this bill is going to have to impact if we're going to have effective privacy protection in the information age.

In 1997 there was an American health insurance company that paid for genetic tests on a woman who was pregnant. The tests came back and indicated that the baby she was carrying was at risk of being born with Down's syndrome. Her insurer then called her and said that she would have to abort the baby. When she refused to do this, they said they would not assume the risk of her decision. If that child was born with Down's, it would be uninsured.

Cost-effective? Yes. Within their stated purposes? Yes. Appropriate? Clearly not.

When people have all these little bits of our personal lives and our persona in their hands, there's a huge potential for discrimination.

Courts interpreting Bill C-54 will have to draw the line against technologies we can't even imagine today, and they'll have to do it very soon because of the pace of change we're experiencing.

I would suggest to you that they need a statement of principles to guide them. First and foremost, I would argue that it would be appropriate to amend clause 5 of the bill to make it clear that purposes, as it's used in the bill and in the schedule, mean serious and legitimate purposes or purposes that can be demonstrably justified in a free and democratic society.

The second step I would suggest you consider is to revisit the definition of “consent” as it's used in the bill. Public consultations have made it quite clear that Canadians expect meaningful consent provisions to be included in any privacy protection legislation.

The definition of consent must ensure that privileges that flow from the giving of consent are granted by a fully informed and free individual. In particular, fully informed consent requires that the individual is aware that permission to collect, store, and use personal information is being requested; is fully cognizant of the manner in which the information will be collected; and is informed of the manner in which the information will be used.

• 0915

The legislation should therefore include a provision that ensures that individuals who do not consent to release their personal information should not be denied goods and services or penalized in any way. I think another example might be instructive here. Safeway has one of those customer identification card programs. If you agree to give them your personal information, they give you a hefty discount on your groceries. The marketing of it is fascinating, because on your bill every week it will say at the bottom, you saved $12.71 this week because you consented to give us your personal information. But they also tell that to the people who have refused to consent. At the bottom of their bill it will say, if you would give us your personal information you could save $12.71 as well. We have to make sure that our understanding of consent protects the right to draw the line on the part of the citizen.

So the legislation has to look at this issue and clarify these issues to a certain extent. For example, it should expressly prohibit the use of an opt-out mechanism. You know the little tiny box at the bottom of the fine print at the bottom that says, by the way, if you don't want us to sell all your personal information, just check here. I would suggest that that is an inappropriate mechanism and will not give us the type of protection we need, because consent must be given expressly if it is to be meaningful.

Lastly on this point, it's very clear that Canadians believe that health information, genetic information, and children's personal information should be given special protection.

I think the third step that could be taken is to place the context of the bill not in an electric commerce world but in a privacy world. I would strongly urge you to consider adding recitals that make it clear Canadians have a right to information privacy and that their right will be protected in the electronic marketplace. I would also strongly urge you to adopt the definitions of privacy and information privacy that were alluded to in the discussion paper that preceded the bill and made it quite clear that privacy is a human right and that information privacy is simply a subset of a larger group of issues.

Before I close my comments, I'd like to list four other points that I think are quite crucial if this bill is going to be effective and meet the standards that the Canadian people expect from their legislators. I am delighted, first of all, to see that the bill includes a mandate for the Privacy Commissioner's Office for public education. I've been involved for a number of years with the Media Awareness Network and the law room on Canada's SchoolNet on designing multimedia educational games to teach youth how to protect their on-line privacy in the information age. The privacy playground, the first adventure of the three little cyber pigs, is a CD game for kids in grades one to three. It takes them into an on-line marketplace, shows them the pitfalls, usually using the big bad wolf to do it, and also tells them how they can protect their privacy. This was done on a shoestring because none of these organizations is funded. The final bill for this CD was $100,000.

We're currently working on another educational initiative for kids in grades seven to nine called “Shop 'Til You Drop”. The object of the game is to go out and buy items from a shopping list in an on-line mall without dropping all your personal information. I understand Richard Rosenberger talked to you about cookies. Once the kid signs on and starts playing the game, after their first transaction they automatically lose, unless they've gone into the browser and changed the default settings to reject cookies or alert them to when cookies are being asked. It's a very practical hands-on game that focuses on the ten fair information practices in the Canadian Standards Association's privacy code. Our estimated budget for this game, which can have a lot of impact on youth who will be the consumers of tomorrow's marketplace, comes in at $350,000.

My point is that the ombudsman approach taken in Bill C-54 will not work unless the Privacy Commissioner is given a budget to provide meaningful public education to citizens about their rights.

Second, I would suggest that you revisit the clause 7 exemptions, especially paragraph 7(1)(b), which talks about the collection of information without consent if obtaining consent would compromise its accuracy or defeat the purpose for which the information is being collected. I would suggest to you that without a limitation-of-purpose clause in this bill, that clause makes many of the protections that are contained in the bill virtually meaningless.

• 0920

In addition, I would strongly urge you to look at paragraphs 7(2)(c) and 7(3)(f), which talk about the use of information for statistical or scholarly study or research purposes. Confidentiality is not the same thing as anonymity in a world where all you have to do is push a few buttons on a computer, strip off the personal identifiers, and ship the information off to another organization, which can then push a few buttons and re-personalize it.

Third, it would be my position that it is inappropriate to allow the substantive content of this bill that is contained in schedule 1 to be amended by regulation. Any changes to this fundamental concept and balance we are seeking to effect should be made in the light of full public debate and parliamentary oversight.

Fourth, I would urge you to also take care with the issue of nominative lists. We live in an era where technology makes everything part of the public domain. For example, if you search my name on the world wide web you will get my scholarly publications on the issues, but you will also get any comments I might have made in a news group discussion for adult children of alcoholics or survivors of incest or cancer support groups.

In other words, you must not let technology drive this bus and you must not let the commercial imperatives drive this bus either. I am firmly convinced, after participating in a number of public consultations, that time and again Canadians are calling upon their elected representatives to take leadership to ensure that any legislation firmly protects the social values of privacy and the relationships we enjoy because of our right to privacy.

Thank you for the opportunity to make these comments to you this morning. I look forward to your questions.

The Chair: Thank you very much, Ms. Steeves.

I'm now going to turn it over to Mr. Lawson for his opening comments, please.

Mr. Ian Lawson (Individual Presentation): Thank you, Madam Chair, honourable members.

I'm here to speak in favour of the bill. It may not be perfect—I'm sure you're hearing that so far, and I will be pointing out some imperfections in it today—but I am here to speak in favour of its being passed.

I'll make some suggestions. It doesn't contain the only final solution to privacy protection in the private sector, but in my view it is absolutely essential and it has been a long time coming. I've been interested in this for a long time, and I'll speak for a few minutes on how I've come to be at this table.

About eight years ago I started thinking about remedies for privacy invasion in the private sector. I got interested especially in the world of commerce on this issue. I approached that from the perspective of a consumer advocate for people who were interested or complaining in the early 1990s about what can be done about information about them and about their activities in the hands of private actors who weren't covered by any legislation.

Apart from finding that there was some protection under credit-reporting legislation and some other modest-in-scope pieces of legislation, I found that, apart from people in Quebec, there really was no practical way consumers had to control, to know about, to limit what business did with information about themselves or their activities.

In 1991, approximately, I recall attending a very small seminar at which a Department of Justice lawyer came to say that the official Department of Justice position at the time was that voluntarism was going to be the answer to this problem, with the entire private sector dealing with personal information. The official position back then was simply that through self-regulation the industry would look after themselves. The more I thought about voluntarism from that moment on, the more I thought about this issue of privacy protection in the private sector, the more I felt convinced something had to be done over and above what the plan was in 1991.

• 0925

So as a lawyer I started looking into what could be done in the absence of any kind of legislation to answer the problems I was seeing. My first effort at solving this problem involved looking at ways the common law could help people with regard to how to sue actors in the private sector about privacy. In 1993 I ended up writing a book on that. That was by no means an adequate solution, but it was all people really had at that time.

Later the next year, 1994, I was very fortunate to be able to return to this issue in a formal way and look at some regulatory options for privacy protection on the information highway, again with my interest primarily being in the private sector. It was in doing that work that I realized how important it was to build in privacy protection on Canada's information highway. That was the topic of the day. You all know of the Information Highway Advisory Council's work. But it struck me at another level. I started as a consumer advocate at another level as part of building an information infrastructure, and the United States was, as it always is, far ahead of us on these things. Privacy protection was an integral element of that program.

That is why I do not have any serious problem with the marriage we see in Bill C-54 between a privacy statute and electronic commerce provisions, because you have to have adequate privacy protection when you're building a regime for facilitating electronic commerce. It has to be there. So I don't have any trouble with the joining of these two apparent independent concepts, because they have to be together.

In looking at how we could come up with some options, some regulatory ideas, for protecting privacy on the information highway, I was struck by how truly difficult it is going to be to handle the entire private sector and the world of commerce as it is on the information highway. It's a huge task. In fact, my own view at the time, having applied the best thinking I could in 1994-95, was that the information highway itself was so daunting a subject for regulation and the private sector was so huge in scope that the only real hope for privacy protection in that world was to look for some way to modify human behaviour itself, rather than trying to regulate an industry or a business. I concluded that people were the only hope to really get to the bottom of it.

That is when I made a connection between the work of the CSA model code for privacy and the possibility of legislating some protections. Having concluded that human behaviour is what was going to make it possible, I felt that legislation was absolutely necessary, because I'd already looked at what could be done for people in the absence of legislative protection and there was really nothing, other than trying to sue, which is not satisfactory.

It took a long time for the CSA to come up with a model code, as you may know, because you've heard from them already, I think. It may not be perfect in itself, but what struck me about its potential was that it had some moral force in the private sector in that business could claim some ownership in its creation, as opposed to the private sector responding to a legislative regime that's imposed upon them and drafted completely by government or somebody else they may not agree with. This was something about which we can say that business itself helped to create. Some would say business dominated that process and that's why legitimate concerns could be raised about some of its content. But I am very satisfied with the results of the CSA process.

In particular, I am intrigued by the possibility of making use of what appeared to business to be a voluntary code, to use what they've come up with to draft legislation, and this is what we have before us today in Bill C-54. It is not perfect, and in the minutes remaining I'm going to outline a few suggestions to make it perfect—not to make it perfect but to improve it. I'm sorry, that was a Freudian slip.

• 0930

An hon. member: That was a wishful thought.

Some hon. members: Oh, oh.

Mr. Ian Lawson: Number one, I'm sure everyone in this room knows that at some point in the future, after this bill is enacted, there is going to be a constitutional challenge to it. There's no way anyone could prevent that from happening. Look at the private sector and the number of people out there. I say it's a given that it will happen. The first thought I had was whether there was anything we could do to maybe ensure that we survived that test. I know it's going to come sometime from somewhere. It could be Alberta, it could be Newfoundland—we don't know—but we can't stop it.

Having said that, I am very confident in saying that I have no doubts about the federal jurisdiction constitutionally being able to do this. My doubts are about whether the bill as written has enough in it to help survive that test.

I have a modest suggestion, which is the first on my list and something that has troubled me because I see that it's easily cured. I strongly suggest that some language be added, perhaps to the purpose clause, perhaps to a preamble, as Ms. Steeves suggested, that identifies a few things I'm going to set out now. The things I'm going to talk about are simply cautious suggestions to maybe help survive a constitutional test of this litigation and to put the bill in the context of the trade and commerce power, which is clearly where federal jurisdiction to do this lies.

First, I would like to see some statement on the importance of privacy protection as an integral part of the information infrastructure. Make a connection between the importance of establishing rules of the game for commerce on the information highway and the issue of privacy.

Second, I would very much like to see a statement that records the way in which commercial use of personal information sends it across provincial and national borders, a statement that says what happens when commerce makes use of personal information. Along those lines, we all should know how the Internet works. The way the system works is that in the course of sending a communication of any kind between Vancouver and Victoria, a very short distance and inside the province, that communication could go to Seattle or Tokyo on its way to Victoria and you would never know it. I'm sure there are people who can figure that out and computers that will know that, but that is what we are dealing with. Communications for commerce or for any other purpose could go anywhere. Inherently, there is that aspect of extra-provincialness to the problem this bill addresses, and that, I submit, should be recorded in some way in the legislation, just as a reminder.

Finally, I would like to see some statement that a consistent seamless set of rules is required in every part of the country for both privacy protection and electronic documents for organizations carrying on commerce, a statement to say simply that we're doing this to make sure there's an even playing field, that the rules are all the same right across the country, on two very important legislative initiatives: privacy protection and electronic commerce.

I have four more very brief suggestions and then I will conclude.

I have always been a very strong advocate of a healthy arsenal of enforcement powers in the hands of privacy protectors, whomever they might be, and I am sad to see there is not a huge arsenal at the disposal of the Privacy Commissioner in this bill. At the same time, I'm aware that the commissioner may well be happy with the way that is written.

• 0935

I am particularly heartened to see enforcement and remedial powers given to the Federal Court. As a lawyer, of course, I'm always happy to see other ways for people to go to court.

Clause 14 of the bill is the clause that sets out a complainant's right to bring a matter before the Federal Court. You'll see in subclause 14(1), in the middle of the paragraph, that there's a long recitation of various clauses in the schedule. I don't see any rationale for limiting what can be brought to the Federal Court in that way.

My suggestion to cure that problem is to simply have the bill read that a complainant may, after receiving the commissioner's report, apply to the court for a hearing in respect of any matter in respect of which the complaint was made, or that is referred to in the commissioner's report—and end it right there. Let whatever the commissioner does be fair game for the Federal Court and don't try to limit it.

I don't see huge problems in what is being limited. There's nothing terrible in there, but I don't see the need for it, and there shouldn't be, as a matter of principle, any way to limit what the Federal Court can do with what the commissioner has done.

I do, however, endorse the inclusion of subclauses 8(6) and 8(7). Subclause 8(6) is on the costs matter. That is a significant issue in some cases, and I think it is a good idea to have that go to the Federal Court if necessary, as well as clause 10 regarding sensory disabilities.

The Chair: Mr. Lawson, can I ask you to speed up a little? I'm trying to keep you both within our time limits here.

Mr. Ian Lawson: All right. I have three more small points.

I say there's no defensible rationale for a restriction on punitive damages. Make it go away. There's no need to limit it to $20,000. In fact, I throw out as a suggestion that another very effective technique for creating greater respect for legislation is to specify minimum amounts of damages. Go to the opposite extreme and say “A minimum of this much is to be awarded if there's a violation of any of the principles in the act”.

The audit power of the commissioner is a tremendously important power. In my humble view, there's no reason to restrict it to only those cases where the commissioner has reasonable grounds to think there's been some contravention. Let the commissioner audit, period. Don't tie their hands by having to first find some contravention before they're allowed to audit.

Finally, the one advantage I have today, coming from a small community in northern British Columbia, is it is important to know that the Federal Court is not the most accessible of courts. Usually in every province it is one registry in the largest community in the province. I would ask the committee to consider facilitating access to that court for these summary hearings. These are not going to be major events.

There's no reason, technologically, why we couldn't do video conferencing. We know people are going to have to make applications to the court in a summary way. If they're outside the major centres, why not facilitate that by having in the act a built-in way to make sure people have easy access to that forum?

Thank you. Those are my submissions.

The Chair: Thank you very much, Mr. Lawson.

We will now turn to questions.

Mr. Jaffer, please.

Mr. Rahim Jaffer (Edmonton—Strathcona, Ref.): Thank you, Madam Chair.

I want to thank both the presenters today. I think they've brought some really interesting suggestions to improve the legislation, and that's very useful to all of us on the committee. In some cases there were some similarities in the suggestions of both the presenters and in other cases there weren't.

My question initially is to Valerie Steeves, especially on one comment she made that we must not let technology drive this bus in the case of this legislation. On the other hand, Mr. Lawson mentioned he was satisfied with the development of this legislation as it applies to the CSA process.

One of the difficult things we all have here in dealing with this legislation is the type of balance we're trying to achieve when it comes to the importance, obviously, of privacy and protecting human rights and going down that road, but at the same time, balancing that with the agenda of various business interests. They are often very positive, because obviously there's a real desire for various people who are looking at driving electronic commerce and building the opportunity with this potential legislation to have protection built in, because it's going to provide accountability for their own businesses. They want to be able to have people trust the process and trust them to some extent with their information because they want to build the credibility with the various consumers or the citizens, as you mentioned.

• 0940

On that particular note, would you not also fear to some extent that if we go too heavy-handed on the side of regulation and not balance that with industry, in fact we might quash the opportunity to be able to really reach a proper balance with what you're trying to achieve and obviously with what industry is trying to achieve?

Ms. Valerie Steeves: I would like to reiterate that I think Canadians want some kind of data protection legislation. I don't think one of my complaints with this bill would be that it does not enable corporations to profit in the information age. I would suggest it is important to address the balance precisely because it's one-sided. I don't think that's difficult to do, by making statements in a preamble that say privacy is a right, privacy is a human right. It gives the court interpreting this legislation more to work with.

I think the reason we're around this table is because corporations realized, just as you said, that without consumer confidence they will not be able to maximize profits in the information age. I would also say corporations need to get the message that if they want to be trusted by citizens then they have to be trustworthy. When I said don't let technology drive the bus, I was alluding to the fact that technology is open by its very nature and it's taking what we consider private matters and making them public by default.

It's like nominative lists. In Yellowknife, an American company grabbed a bunch of information off the web. It included all the people who lived in Yellowknife, the names, addresses, phone numbers—well, we know we give that away—what they do for a living, approximate income level, how many kids they have, names of the kids. All this information is now in the public domain because of the technology. If you let the technology make those decisions for you, you will not be able to protect social values at all and you will not have a balance.

Let me give you a very specific example of this. One of the things I've been working on for a number of years is educating kids about on-line commerce. They go to a web site, very reputable firms—Kellogg's, Coca-Cola, these kinds of guys, big players we've seen around for a long time. On these web sites they are encouraged to give all sorts of personal information. First of all, their names, ages, addresses, their parents' names, how much money they make, the kind of car mummy and daddy drive, what kind of education mummy and daddy have—all in a public place. They might as well be shouting it from the street corner; it can be collected by anyone.

You go into Surge Cola, for example, which is a very in-your-face, keen marketing site, and the very first thing they do is tell you to drop your personal information. Hey, if you want to get our CD clips and cool graphics, you have to give something up, so just drop it.

The medium lends itself to that type of use, and companies now have an opportunity to collect all this information. My fear is that when we look at this legislation, we're thinking of a world that doesn't exist any more, where companies have records and they're discrete, and the TD's records are discrete from Safeway's. In actual fact, that's not our world at all. We have such sophisticated data-mining software that all of these little bits of information are pooled and mined. You can get a very detailed profile on my kid's life.

This was brought home to me by Lego Canada. Lego sent a little thing to my son, who loves Lego, saying please join our Lego club. All you have to do is provide this personal information—what do you want to do when you grow up, what's your favourite comic book character, blah, blah, blah, on and on. That information goes into a main database and there's a little consent thing at the bottom that says, sure, Johnny, you consent that we can use this, don't you? It goes into a main database.

One of the largest database houses in the United States is called RR Donnelly & Sons. A few years ago, an American reporter called them and said, “Hi, I'd like to buy all of the names, ages, addresses, and schools of all of the children within a certain radius in Los Angeles”, and to get it she used the name of a convicted child killer. The person giving it to her said, “That's funny, we know that name, don't we now?”—that kind of thing. For $220 that information was sold.

• 0945

If I give away my bits of personal information and the private sector treats them as a commodity and profits from that, I have no way to protect my child from those kinds of consequences. That's not a balance. I am definitely not saying we should turn back the clock. I like technology, actually. I love the Internet and I love the possibilities we see, but we are at a cusp where we could do this right. If we drop the ball on this, I think Canadians will disengage further from their political process, because that's what they're calling for; that's what they deserve from their elected representatives.

Mr. Rahim Jaffer: I have one quick last question to Mr. Lawson. Mr. Lawson, you brought up the issue of the importance of privacy protection to encompass more of a global view, obviously between provinces and to have a larger scope, and I think that's pretty much the direction of the bill. The sense I get is that it is obviously much larger than even just Canada. It's going to be global.

You brought up the issue of the provincial jurisdiction issue. I just want to ask your opinion on that issue, being a lawyer, because there have been different feelings when it comes to different justice ministers in different provinces. Obviously Quebec is concerned that they have their own privacy protection currently and how this is going to be affecting that.

How would you see a national and almost global scope when it comes to privacy protection and electronic commerce? What effect is that going to have on the provinces? Are they going to come in line, do you feel? Do you think there's going to be some cooperation, because it is much bigger than just provincial jurisdiction, obviously?

Mr. Ian Lawson: The starting point is yes, it is much bigger than provincial jurisdiction. I think that in itself, for me at least, makes me comfortable in saying this bill is completely properly within federal jurisdiction, because it's inherently something that is beyond any single province's jurisdiction.

It is true of course that the types of rules we see in this bill are going to apply to commerce that happens perhaps inside the province exclusively. I say, and the argument would be, that is incidental to the broader, more important level of control and protection, which is extra-provincial as well.

I know there has been concern expressed by provinces, Quebec especially, because they have a marvellous piece of legislation. What I would say is I think the problem of whether or not there's going to be some interference with a single province's legislation, either current or future, is solvable. Legislative concurrency is not foreign to Canada. It is possible and it's perfectly legitimate to have two pieces of legislation operating at the same time on any one activity. Where there's conflict, however, is where there is a problem.

As far as solving that problem is concerned, I see no problem with sharing that, perhaps in this legislation or preferably by way of a federal-provincial negotiation allowing provincial legislation to operate perfectly unimpeded by the federal statute, as long as it is equal or better. All power to the provinces to come up with better legislation. I sincerely hope they will come up with better legislation, but at the minimum, because of the importance of what we're doing here for privacy protection in the commercial world, in the private sector, it must be right across the country, in my view, and in every province on the same terms.

The Chair: Thank you very much.

If I could just remind everyone, we try to have short questions and short answers as well. We'd appreciate that, because we're going to run out of time.

Mr. Keyes.

Mr. Stan Keyes (Hamilton West, Lib.): Thank you, Madam Chair. Ms. Steeves, I very much enjoyed your presentation. Your bio aside, it's very evident that you know your stuff.

Because time is limited, as the chair has indicated, I would like to hear your thoughts on privacy protection vis-à-vis what I see as a negative option. Did you see anything in the legislation where if someone wants to do some e-commerce and proceeds and fills in the blanks and sends off this e-commerce, that would protect the person against anyone else seeing that e-commerce? Or does that person have to check off a box that says don't let this e-commerce go anywhere but to you or don't use this e-commerce beyond this business I'm doing with you?

• 0950

Ms. Valerie Steeves: I think the short answer is it's a public medium. You send it out, it's public unless it's encrypted, and that gets into a whole other kettle of fish. We have an annual cracker event on the net where just regular people try to crack the latest U.S. standards in encryption. I think it took 56 hours this year by a bunch of computers that networked over the Internet, just regular PCs.

In other words, the point is that when you send that over the wires, it's a public medium. So it's very difficult to actually make that information private. That's what I was saying. If you let the technology drive the bus, it will all be public. There are very few sites that have adequate encryption that are doing electronic commerce. Most savvy surfers will go out and make their purchasing choices and then fax in an order, not go through the process on-line.

Mr. Stan Keyes: The argument I'm having with myself is that some would say that, for example, freedom of speech in a democracy is a right, and we all know that there are those who will take advantage of freedom of speech, but at the same time even freedom of speech has its limitations. Just look what happens to a person who would yell “fire” in a crowded movie theatre.

When we deal with this legislation on e-commerce, shouldn't there be a box up there, for even the Windows program, or whatever, that... You have everything else up there—back, forward, print—but there's not a box up there that says don't take this information and forward it on to anybody. It's not that clear. Even with cookies, I don't know how many people in this room would understand the whole thing behind the cookie, because they don't know the ramifications of surfing.

Ms. Valerie Steeves: What you see is the tension in the marketplace, because if you look at the Intel 3 chip, for example, that's incredibly invasive.

Mr. Stan Keyes: That's right.

Ms. Valerie Steeves: So they can identify me no matter where I am.

Mr. Stan Keyes: Then you have to go to Microsoft and buy their program to knock it off the air, and they have to install it because you don't know how.

Ms. Valerie Steeves: They estimate 75% to 95% of computer users never change their default settings anyway, so it's all moot.

Mr. Stan Keyes: Right. And the people who buy that program aren't going to buy the additional program to knock themselves off it because it costs extra money and they don't want to spend it on that.

Ms. Valerie Steeves: Right. I think this is where education comes in, because there are a lot of technological tools that are privacy enhancing. If you want to ensure that the electronic marketplace thrives, then we should be supporting those initiatives as well. That comes through education.

Once you tell people what's happening with their information, lights go off. It's an interesting thing to watch.

I teach a bunch of 19- and 20-year-olds who are very media savvy and passive. Once they get it, they're looking for tools they can use to protect their privacy. Those are available.

Mr. Stan Keyes: We don't want to scare people at the same time we want to encourage e-commerce. We want to encourage, for example, someone eventually sending their income tax form from their home to Revenue Canada.

Ms. Valerie Steeves: We have some lessons to learn, though. When Revenue Canada first started to create the on-line kiosk, they did it over the Internet, which meant all that information was completely public—social insurance numbers, the money you make, all that. Now they have dedicated lines. It's easy to do. I bank on the Internet all the time through encrypted dedicated lines that go to TD.

So the marketplace is learning. What drives that is consumer demand. Consumers will not demand it unless they're educated about it.

The real truth of the matter is that all the invasions we should be worried about are invisible to the great majority of people. People don't know what's happening to their personal information. They feel powerless. They feel dissatisfied. They will disengage from their legal system because it doesn't adequately protect them.

Mr. Stan Keyes: You're right. Education is the key.

Ms. Valerie Steeves: Education is key.

Mr. Stan Keyes: If we're going to do anything with this stuff, we have to make sure there's money there to ensure that the Privacy Commissioner, who I think would be doing this stuff, has the tools to inform the public so that the public is more aware. Their demands will force the driver of the bus, if it happens to be technology, to make sure he collects the fare.

Ms. Valerie Steeves: Technology is a tool. We can use it to enhance our social relationships and our economic relationships. We can use it in a way that detracts from them, destroys them. We just have to be conscious of what we're doing.

Mr. Stan Keyes: Thanks, Ms. Steeves. Thanks, Madam Chair.

The Chair: Thank you very much, Mr. Keyes.

[Translation]

Ms. Lalonde, if you please.

Ms. Francine Lalonde (Mercier, BQ): Good day. I would like to thank our two witnesses for their presentations. I don't want to cast aspersions on the quality of our other witnesses, but I must tell you, Madam Chair, that I'm sorry Mr. Péladeau wasn't here to fill in the rest of the picture, so to speak. I know he was an important player in the fight for the protection of privacy and for public information. Both of those questions have to be addressed at the same time.

• 0955

Since the time at my disposal is limited, I'll ask my questions right away. I have a lot of crows to pick with Mr. Lawson and perhaps a few less with Ms. Steeves, as you can guess.

Basically, on the constitutional question, there are two kinds of challenges that might be raised. They might come from Quebec, on the one hand, where there's a law they don't want to see weakened and that they want applied to all companies in Quebec. And they might also come from the other provinces that might not want a law at all and would be put off by the government saying "Take it or leave it. Three years from now, bring in your own law or we'll force one on you.

I can well understand that your assurance concerning non- challenge or the eventual victory of the federal law would be based on electronic commerce, having priority over the province's civil law or common law. However, if we put more emphasis on personal information, then the federal government's jurisdiction could be challenged, which wouldn't necessarily be reassuring for the citizenry.

[English]

Mr. Ian Lawson: I disagree only with how you've put that: e-commerce before the rights of citizens. I am quite confident in saying, as I have, that the privacy component of this bill is integral to electronic commerce, and by hoping that the constitutionality of this legislation will survive on the commercial front, I think, as you've put it, at the expense of the privacy front, I say is to needlessly split the two very important initiatives. There is going to be electronic commerce, and part 2 of this bill deals with that. But first there is privacy, and I don't think you can split them. There will be efforts to do that.

I certainly would agree that the effort to test the constitutionality would be better placed on the privacy front, on the expectation that it's a weaker front. But when you have essential privacy protection that is built into the electronic commerce initiative, I feel quite comfortable that we will survive that.

[Translation]

Ms. Francine Lalonde: You're very diplomatic.

Des voix: Ah, ah!

Ms. Francine Lalonde: It's true that you're a lawyer. You said, in your third point, that we have to have a consistent and seamless set of rules on electronic commerce all across Canada. Do you think these uniform rules could be imposed? Shouldn't we try to do it some way other than through a federal law?

[English]

Mr. Ian Lawson: There is always negotiation, and I'm a fan of negotiation; that's the way the country should run. But as we all know, negotiation doesn't always work for any number of reasons, and the more complicated the topic, the more difficult negotiations will be.

What is driving me to support this legislation is, as I said earlier, my realization that it's really important to build in privacy protection when we're facilitating a new world of commerce—and the importance of that to ensure that the new commercial world is predictable, sensible, and safe for business and consumers. In my humble view, I think that goal would override the legitimate desire of a province to differ or to do something that is not the same as what this legislation has in mind.

• 1000

[Translation]

Ms. Francine Lalonde: Even if their laws were better? Would you prevent a province from offering its citizens better protection, especially if they demanded it, if the province had already set up a procedure and already set out rules?

[English]

Mr. Ian Lawson: You're very good at pinning lawyers down, and we're trying to be diplomatic.

[Translation]

Ms. Francine Lalonde: Don't try to stall. Answer up.

[English]

Mr. Ian Lawson: All right.

Number one, I want to see stronger provincial privacy legislation. It's really a disaster there in terms of the private sector. Apart from Quebec's law, what we have here is the best around on the private sector. This has to happen. I have no doubt, however, that that there can and will be better legislative efforts provincially.

I'm probably restating what I have said, but because privacy must be integral to the doing of business on the information highway, I see Bill C-54 as the absolute minimum requirement that should be everywhere. All the power to anyone else to make it better—and I hope it will become better in each jurisdiction—but what we're seeing here, in my view, is the bare minimum protection that is necessary for this initiative.

The Chair: Thank you.

[Translation]

Thank you, Ms. Lalonde.

[English]

Mrs. Barnes, please.

Mrs. Sue Barnes (London West, Lib.): Thank you, Madam Chair.

Welcome. Both of you gave excellent presentations.

I also have a bit of a legal background, but I'm just a little confused here. I'd like somebody to explain to me how underage children give legal consent to anybody over the Internet when they can't do it in an everyday setting. If my child had an accident on the playground today, I don't think anybody in any hospital would treat him without some adult consent. How does a commercial operation manage to get information and be able to use it under this act?

Ms. Valerie Steeves: I suppose the point is that it isn't clarified in the legislation. In fact, if you examine the uses of consent with young people, I think you'd find some surprising anomalies. For example, a child in grade 6 is legally able to give consent to be immunized over parental complaints when that child is at school. That's injection of a foreign body into my kid's system without my consent. So there are already many areas in the law in which we extract consent from children even though it might not be meaningful or informed consent.

Particularly on the Internet, I think it's important to remember that we're not dealing with advertising or corporate visits. We're dealing with what we call “edutainment” environments. They have a seamless interface between play, business, and education, and I'll give you an example. When you go onto the alcohol or smoking sites, embedded in these sites' lists of links are games for kids. I believe Seagram's site—although I'm not sure it's them—has a couple of games targeted at boys eight to ten years old. They go to the site and play this game that's like Super Mario Bros, in which they jump up and collect gold coins. In this game, though, they jump up and collect bottles of rum, and then they celebrate by going to a party and drinking the booze at the end of the game.

I think we have to seriously look at the way we market to children on-line. The fascinating thing is that the nuances we see in regular media, traditional media, are much more blatant on the Internet. For example, right under those lists of games, you will find links to pictures of naked women smoking or drinking. The connections between the blacker side of marketing in the media are quite blatant when you look at the on-line environment. We're really talking about a medium that extracts consent in a seamless environment that masquerades as a safe-play environment for children. My concern is that the legislation is silent on this point, and I think it needs to be clarified.

Mrs. Sue Barnes: Would you think it's something necessary in addition to the legislation, or does it just need to be clarified?

• 1005

Ms. Valerie Steeves: It's easy to suggest all sorts of amendments, and I know this bill has gone through a long history in order to get to this place, but I think the way “consent” is not defined is one of the flaws of the bill. You have a lot of terms in this legislation that just aren't defined. Commercial activity isn't defined. Consensus isn't defined. All the stuff that really counts isn't in here, and there's a reason for that.

The CSA process, which was incredibly valuable, was a consensus-oriented negotiation. Because of the nature of the discussion, however, industry had the right to veto pretty well everything that came on the table. The consumer advocate groups were lobbying to get concessions as they went along the way. Many of the more difficult issues were purposely not defined in the CSA standard because they were too difficult for the medium. That's why I would suggest that this House is the place where leadership can be exercised and those difficult issues can be dealt with.

Mrs. Sue Barnes: Because I have such a short amount of time, I'm going to get one more quick, unrelated question in.

To your knowledge, how widespread is genetic testing in Canada for non-medical purposes such as employment purposes or insurance purposes?

Ms. Valerie Steeves: I don't have any hard information on that, but I do know we're seeing the tip of the iceberg. You're starting to see horror stories popping up, like the one I indicated with the insurance company. Whether or not we know we have the problem now, we're certainly going to have it tomorrow.

When you really consider the incredible amount of information contained in the human genome, when it is identified with an individual, there's a huge potential for discrimination.

I'll keep this short, but I found that one of the most profound events at the 1997 standing committee's consultations occurred in Calgary. A gentleman stood up and asked if people realized that medical professions established treatment for genetic diseases and selective abortion. He was a survivor of thalidomide. He said his life experience was being undervalued, that we were discriminating to the extent that we are eradicating a whole class of people from existence by claiming to treat a disease when we're really just removing those people from that possibility of having a life.

The issues that are raised by genetic information are incredibly far-reaching. I believe they will require a mechanism that allows the courts to balance these things. The technologies we have today are probably a tenth as invasive as the stuff we're going to see in five years, especially with genetic information. That's why I think this is our kick at the can. We have to give the courts enough to work with, and we have to make it clear that those rights will be part of the balance.

Mrs. Sue Barnes: I'd love to see your CD for kids.

Ms. Valerie Steeves: I'll show it to you after the meeting.

The Chair: Thank you very much, Mrs. Barnes.

[Translation]

Ms. Lalonde, do you have any other questions?

Ms. Francine Lalonde: Thank you, Mr. Lawson, you say you're happy that the commissioner has a healthy arsenal of powers at his disposal, as I noted in French. In conclusion, you said you're happy that the Federal Court is that recourse. Do you really think that the Federal Court is the right instrument for dealing with many citizens' problems, such as knowing what's in their files, correcting information in their files or being removed from name lists? Do you think it's enough to provide that citizens first try to come to an agreement with the company, then go to mediation, then to a privacy commissioner's examination and finally to a recommendation and then, bingo, they can go to Federal Court? Is that not dissuasion enough? Is the act not outrageously slanted toward self-regulation, without saying so, while citizens are abandoned by the State, which should be giving them some real recourse?

[English]

Mr. Ian Lawson: I hang around courts all the time. On the privacy issue, I much prefer privacy commissioners. I have some anxiety about judges. No disrespect intended to the Federal Court or any judge in particular, but I have no trouble saying that. Privacy commissioners have a wealth of knowledge. They have tremendous advantages over a single judge in a summary hearing who is trying to get into this stuff. The Federal Court doesn't do this, and it has never done this prior to this bill, at least not in the way this bill contemplates.

• 1010

As I said, I've always been a strong advocate of formidable power at the hands of the expert who is reviewing any particular legislation to protect privacy. However, I have a lot of respect for the commissioners as well. There is a very strong school of thought that there is a conflict of interest when the same commissioner who is trying to negotiate or persuade compliance is also the commissioner who is going to hit a person with a penalty of some kind for non-compliance.

I respect that view, and I surmise that it's why we see the legislation in this way, that the Privacy Commissioner of Canada perhaps feels he can be more effective with the power of persuasion and negotiation. The downside is that these issues are going to go someplace else and there will be decisions that are binding. That is the reason I have some anxiety about bringing a court in.

Having said that, I was and still am a fan of litigation to protect privacy when there's no other choice. It has to be done. There has to be some remedy given to individuals who are faced with privacy invasion.

Now, I'm trying to be as diplomatic as I can.

[Translation]

Ms. Francine Lalonde: Yes, I see that. You don't have to tell me that. It's obvious.

[English]

Mr. Ian Lawson: I'm happy with this legislation, although it could be better. I would have done it differently, but I am happy with it and it's going to work. Frankly, I'd prefer that the Privacy Commissioner do his utmost to solve problems quickly without the need to go to court, and I'm hopeful and confident that the commissioner will be able to do that.

The Chair: Did you have another question, Madame Lalonde?

[Translation]

Ms. Francine Lalonde: Yes. You talked about your desire for effectiveness and the need to convince business. You saw manoeuvring room that showed up when the code was being negotiated. On the other hand, Ms. Steeves pointed out that companies would voluntarily go as far as some point x, that public pressure might push them to point x 1, but there is a point they won't pass. That's true for everything. I worked in the field of health and workplace safety. Some large corporations with lots of money hire public relations officers and I don't know what else, and they have what it take to do so, but what percentage of companies could you find like that? How many do you know of? The people, for their part, are up against all these corporations. The ones they have the most problems with are those that may not have taken part at all in this process.

That's why I am asking my question again - the one you answered so diplomatically. Maybe Ms. Steeves could help me. When citizens asks to have their file corrected, they don't necessarily want the company to be fined something like $200,000, which is another thing altogether. But, basically, if things go into my file that aren't true, that are put in the public domain and that I want corrected, it isn't obvious to me that involvement by the commissioner will change anything. As you know, the commissioner has often made a fool of himself, to put it less diplomatically, in the public sector.

[English]

The Chair: Ms. Steeves.

Ms. Valerie Steeves: I think that's incredibly crucial to address, because we do live in a world of data mining, one in which most of these invasions are invisible. If all these little pieces of me are brought together from all these different organizations, if they are stuck in a database, are linked together, and are then mined, I might not even know which piece of information I gave and whether I consented to it or not. Because of that, I think it's very important to make sure the audit powers on the part of the Privacy Commissioner are strong.

I do have some concern that they're limited by the way the legislation is currently drafted, precisely because of the kinds of concerns you raised. I'm not even going to know. When I do know, how am I going to track that one little piece? It's a very sophisticated networked world, so it's very difficult to deal with.

Realistically, I think we also have to recognize that we're talking about international linking of databases, not national linking of databases.

• 1015

Again, if you strengthen the audit provision, it's perhaps not the way we're used to regulating these kinds of things because we're used to using law in a passive sense. We make the rules and you follow them. I think to a large extent we're doing pass interference here, and an audit provision would increase the effectiveness of the Privacy Commissioner.

On the constitutional issue—and I'm really stupid; I shouldn't raise it because no one's asking me about it—the ombudsman approach is perhaps the right approach to take, because we are looking for federal leadership and it provides the Privacy Commissioner with greater leeway to continue the dance of negotiation that is already going on between the federal and provincial levels among the privacy commissioners.

My concern is that if we turn the federal Privacy Commissioner into a bureaucrat, the office might be less effective at helping facilitate that consensus.

The Chair: Mr. Lawson, do you have any comments?

Mr. Ian Lawson: Yes. The question put to Madame Lalonde is an illustration of why, when I first looked at this problem, I concluded we have to change human behaviour. We have to change the way people think as opposed to trying to order them or regulate them. That's education.

I want to point out, however, to come back to the CSA code, that section 4.9.5 affords to an individual in that situation the right, enforceable by the commissioner and even by the court, upon a complaint, to have that cured if inaccuracy is demonstrated.

I have faith in the CSA code, as a first and very important step, to educate and change behaviour in the private sector, because it is bought into by those players. It is a matter of education of those players to make sure this will work, but I do agree that it is a daunting thing for an individual to approach that problem.

I will say again that this is the best we've had, especially on a national scale. Apart from Quebec, there is nowhere else where an individual is able to have this type of recourse and make it work.

The Chair: Thank you, Mr. Lawson.

Mr. Lastewka.

Mr. Walt Lastewka (St. Catharines, Lib.): Thank you, Madam Chair.

Ms. Steeves, you've mentioned a lot of changes and so forth in the bill, but I'd like you to prioritize. If you had the opportunity to make changes in the bill, what would priority one and priority two be?

Ms. Valerie Steeves: Number one by far would be the limitation of purpose clause, so it makes it clear that corporations can collect information for legitimate purposes, reasonable purposes, and purposes that can be demonstrably justified in a free and democratic society—whatever the language you chose. There has to be some mechanism to say you don't really need to ask my eight-year-old the colour of my car in order to sell him Lego. I should be able to have some control over that, particularly when we live in a marketplace where people are penalized if they protect their privacy. That, by far, would be my first priority.

Second, we have to deal with the whole issue of consent, though that's a pretty major overhaul, to a large extent. I don't know if that's practical as the third thing. I'd love to see some recitals in this bill. Then make it clear that privacy is a right, Canadians have the right to privacy, and their privacy will be protected in electronic commerce.

Again, it's effecting a balance. It's just placing that explicitly in the bill. My fear is that without putting those recitals in, a court could interpret this bill to be enabling legislation for corporations to collect, commodify, and use our personal lives for profit. We need a balancing statement in there and I think the recitals would do it.

Those are my two priorities. First, limit purposes; have a simple definition and throw it into clause 5. Second, this thing needs some recitals.

Mr. Walt Lastewka: You're obviously involved a lot in this field. What do you think are the biggest threats we have today in privacy?

• 1020

Ms. Valerie Steeves: I would say—from years of teaching 20-year-olds in law school, and I'm in the law department at Carleton—it's passivity among our future citizens. They need to be educated about their rights and their obligations and responsibilities in the marketplace. They don't just need to be educated as consumers; they also need to be educated as corporate citizens. To be honest with you, that is key.

The technology can be invasive or protective of privacy, depending on what we choose to do with it. There are many dissidents out there who are actively putting together freeware programs to protect my privacy, because I use them. I have what I hope is a justifiable belief in the freedom of information we see in a networked world and the ability to share solutions from a citizen-to-citizen point of view. But that will only work if we have an active, engaged citizenry. We need to pass these messages on to youth, particularly on privacy.

I just completed a year-long study based on the 1997 consultations, under the able leadership of Mrs. Finestone. We took the case studies we had used in the consultations for small group discussion and put them on-line with a bunch of educational materials for high schools. Across the country, 350 kids participated in mock public hearings—they basically re-enacted what we did in the real world in 1997.

The discussion forum is fascinating because their comments are less about privacy and more “Wow, this political system works. I never knew I could do this.” That was really encouraging. We need to take that initiative and develop it, because I don't think we're going to get the right balance unless we bring citizens to the table.

Mr. Walt Lastewka: When we had the commissioner here a number of weeks ago, he also mentioned that people are ignorant of all the details on privacy; the number one priority item should be public education and so forth; and from education will come additional pressures to make privacy happen. Obviously you agree with that.

Ms. Valerie Steeves: I agree completely. Outside of fooling around with the bill, I see education as the bottom line. If we have education, this will work; if we don't, it won't.

Mr. Walt Lastewka: Thank you.

The Chair: Thank you, Mr. Lastewka.

Mrs. Finestone.

Mrs. Sheila Finestone (Mount Royal, Lib.): Thank you very much, Madam Chair.

May I say I enjoy hearing both of you again. Valerie, you're something else—fantastic.

I heard what you said about your three or four priorities. You didn't mention an audit power as one of your four priorities, so I wonder if you think the enunciation of a list on privacy and the definition of privacy in a clearer fashion would take the place of the audit power. I didn't see it that way.

Ms. Valerie Steeves: I think the audit powers could be broader, and that would be the next priority I would kick in. Especially at this late date, we're really looking at what we can do with Bill C-54 to make it stronger.

I think Ian pointed out that we would all like to sit down and redraft it, just as a legislative drafting exercise. The first time I saw it I said I would give any student who handed this to me a C, and that would only be out of pity because they were new to it. It's too late; it's not a practical thing to do.

The audit provisions in it could definitely benefit from being expanded, but I'm concerned about what the courts are going to do about this later on, especially because we know there will be challenges to this left, right, and centre. That's why I think we need those recitals and definitions that make it clear privacy is a human right. Give them more to work with.

Some pretty interesting stuff has been happening, both at the Supreme Court level of Canada and within the British Columbia Supreme Court, that has tied free speech and privacy in such a way that there has been a very honest evaluation of the social value of these rights and freedoms. So if we put the recitals in, we might be able to link the two.

Mrs. Sheila Finestone: With respect to privacy, I don't think a constitutional change is in the wind, and privacy is not in the Constitution of Canada. However, there is a revision coming up to the Canadian Human Rights Act. Do you feel that if we put privacy under nondiscrimination, or put it into the Canadian Human Rights Act in some aspect, it might be the next step we would need? I don't disagree that we need a commerce bill. But this is a commerce bill; this is not a privacy bill.

• 1025

Ms. Valerie Steeves: Yes. It's not a privacy bill.

Mrs. Sheila Finestone: And I think it has to be underscored that it is not a privacy bill, but all aspects of privacy where possible need to be protected. Would you agree with that?

Ms. Valerie Steeves: Yes.

Mrs. Sheila Finestone: Okay. So as it isn't going to be in the Constitution in the foreseeable future, although it is in the act in the United Nations, what about ensuring that when the human rights amendments come in under the Canadian Human Rights Act it should fall under nondiscrimination? Where would you see it?

Ms. Valerie Steeves: Well, we've already seen some attempts to test the water, I think, with section 13 of the Canadian Human Rights Act, the telephony provision, which deals with the ability to use communications media in socially destructive ways—the on-line hate messages, where you can call a line and get a hateful message. We're looking at effecting that balance between free speech and our human rights through the human rights code. I think it is appropriate to consider placing privacy in a similar type of provision. It's also an interesting idea because the codes, both provincially and federally, focus on the provision of services. So it ties right in to the electronic marketplace.

Mrs. Sheila Finestone: If the amendment were made in the Canadian Human Rights Act, would there be any use to having a separate privacy bill, privacy act, that would define the role of the Privacy Commissioner in a much broader perspective, and add those areas that are absolutely vital to protecting the ordinary citizen?

Ms. Valerie Steeves: I don't think we're going to have effective privacy legislation in this country until we have the umbrella legislation that does exactly that. That's just a fact. We have the political will to go ahead with data protection legislation. That's a first step. There will be a lot of pressure to continue down this road. I firmly believe that in the future we will be looking at broader legislation. I also think you can't discount what the Supreme Court has done with section 8 of the charter, interpreting unreasonable search and seizure to protect our reasonable expectations of privacy.

So what you see is a convergence, though I hate to use such a technological word. But you'll see a convergence of case law, provincial law, and federal law. And the federal government does have to take leadership in this role. I perhaps would not have chosen to use the big stick—Stephanie, forgive me—of the three-year limit. You know, do what we tell you to or else. But at the same time I think the Privacy Commissioner and the federal government are showing leadership in the marketplace just by putting data protection legislation in place. The constitutional vagaries of it will fall out in court, but it is a first step. We're not going to solve these problems until everybody sits down and says yes, we need to agree on these issues and we need to do it within our federal context.

The Chair: This is the last question.

Mrs. Sheila Finestone: I'm not even going to ask a question because I think Valerie has outlined all the areas for consideration and review. I can only tell you that with Nancy Holmes, Valerie, and Stephanie, I've been in the process of working on a privacy bill. So I sincerely hope I'm going to consult with the three of you and be able... And I remember you too, Mr. Lawson, with much pleasure, thank you.

So thank you very much. I'm pleased to have been here to listen to it restated once again that privacy is a human right and we should respect it as such.

The Chair: Thank you very much, Mrs. Finestone.

[Translation]

Ms. Lalonde, do you have any other questions?

Ms. Francine Lalonde: Yes, I have, thank you.

Mr. Lawson, Mr. Raymond Doray, who you no doubt know, is a lawyer who works mostly for corporations in the field of personal information. Here's what he said at a symposium held by the Canadian Life and Health Insurance Association Inc.:

The federal law might also be hard to interpret and apply to the extent that it turns the Canadian Standards Association Code (CSA Code), which was not designed to develop enforceable rules, into statutory obligations. Among other things, in the CSA code appended to the federal act, there are a number of rules written in the conditional. Sub-section 5(2) of the federal act states that the use of the conditional in Appendix 1 means it's a recommendation and not mandatory. It is, to say the least, strange to find recommendations in a law.

• 1030

He says that that's not true in the Quebec law. A little further on, he has this to say about section 7:

However, it's extremely difficult to judge the import of that exception and it's very likely that it'll give rise to numerous disputes.

How would you respond to what he says, given that the goal is effectiveness and that there are no clear indications in the act itself, which companies need?

[English]

Mr. Ian Lawson: That is precisely why I have faith in the CSA code, because business has gone through that already. I don't have any trouble at all with making binding the very document that business has worked on and accepted in a fairly thorough consultative process of consensus-making. As Ms. Steeves pointed out, it is a product of consensus. Yes, you see weaker things in there than you see internationally. I agree “shoulds” don't make much sense. “Recommendation” doesn't make much sense. But we have the complaint power that can still take an allegation that a recommendation was not followed to the commissioner, to the Federal Court.

When it comes to fighting about what it means, it is purely a recommendation. And it doesn't keep me up at night to imagine the puzzle that a court or whoever might have with the word “recommendation” or “should” because it is soft and it is not a binding obligation. That is acknowledging a weakness in the code itself.

[Translation]

Ms. Francine Lalonde: You don't seem to understand what he said in the same way I do. He says that the meaning isn't clear and that companies, particularly large corporations, when they're reorganizing their data collection and transmission procedures, need to know what to expect. However, if you take the code as a whole, with its conditionals and sections 5 and 7, you'd have trouble finding anything specific in there. I know you're a smart guy, but you can't be sure it'll always be interpreted the same way. There's always the risk that companies will do whatever they want, and I'm sure you'll agree that's not what the law wants.

[English]

Mr. Ian Lawson: I am, fortunately, on record—a long time ago, several years ago—as saying the CSA code should be in what we call plain language. It should be simpler. I'm not saying it's an impossible thing to understand, but I do agree it is rather mammoth when a lay person or a small business sits down to look at it. That, of course, is one of the things I would have done differently if I had been in the position of doing this. But on the other hand, even though there is some oppressiveness to the size of the obligation and how it actually works as it fits into this act, what is contained in the code is hardly new. These are principles that have been around for 20 years now, and they are refined reworkings of the principles that have been accepted internationally for a long time. They're all known and they are simple.

The accountability principles that were started in the OECD guidelines... I do say if they are not known at a simple level at this very point in time, which is probably true, that should be one of the first goals of the commissioner's work under this legislation, to ensure, to develop that privacy, human dignity-sensitive behaviour on the part of businesses engaging in commerce.

The Chair: Madame Lalonde, Ms. Steeves also wishes to reply.

Ms. Steeves.

Ms. Valerie Steeves: I was just going to say that I think that's a point well taken, because it's not just educating the citizens, it's also educating the private sector. Again, I think if it's going to work, that's what's going to make it happen. But I think it's a very, very important point to realize that the CSA code means different things to different people. One of the people who participated in the privacy forum public consultation told a story about walking into a bank in Saskatchewan. He wanted to open up a savings account—he wanted to put money in and take it out. They sat him down and said, what do you do for living? How many kids do you have? What schools do your kids go to? What are your life goals? What are your spouse's life goals? He said, why do you want this information, it's none of your business? And they said, we want to have a relationship with you; we want to better serve you.

• 1035

Ms. Marlene Jennings (Notre-Dame-de-Grâce—Lachine, Lib.): Call up the dating service.

Ms. Valerie Steeves: Exactly. But that's the reality of it. The CSA code, as it is drafted, will be interpreted differently by the private sector than it will be by a privacy advocate, and that's just a fact of life. Unless you put in something that says purposes have to be legitimate, I think you're right, this is a hotbed of potential litigation.

[Translation]

The Chair: Ms. Lalonde, this will be your last question, if you don't mind.

Ms. Francine Lalonde: I would like to quote Mr. Doray again:

Although they follow the same principles and share the same philosophy, the federal and Quebec acts are significantly different. You can imagine how difficult it would be for a company to comply with both of them at the same time. You can also see that, in many cases, it would be impossible to know in advance which act would govern what private information. Finally, given the scope of the federal act, we would be in for lots of constitutional type disputes.

That's all I have to say.

[English]

Mrs. Sheila Finestone: I have a point of order, Madam Chair. Could that document be tabled, so we could all enjoy the...

[Translation]

Ms. Francine Lalonde: Yes, with pleasure.

The Hon. Sheila Finestone: Thank you very much.

[English]

The Chair: Certainly.

Mr. Lawson.

Mr. Ian Lawson: I agree that predictability, consistency, and certainty are essential to any business trying to carry on in Quebec, and anywhere else in the country. The good news is that this problem exists only in Quebec, this overlap. We have nine other provinces and territories in which businesses will not have this problem. As far as how to solve it is concerned, it will be good work for lawyers, and people in Quebec—

[Translation]

Ms. Francine Lalonde: Quebec's problems...

[English]

Mr. Ian Lawson: Why do lawyers in Quebec get all that work? Yes, business will have the difficulty of trying to figure out where they stand. I do acknowledge it will be difficult, and I say that's solvable. It is not an impossible situation. We shouldn't let that continue. But there are ways to get around it, and although there are differences, I do suggest... In fact, if you look at the history of the CSA code, they started with the Quebec bill. I don't know if it's known or not, but they started there, and they threw in the OECD guidelines and came up with something a bit different. It is not, I suggest, that different that it will pose insurmountable problems for business. But I do agree it would be nice if everything were under the same rules, which is why I'm still endorsing this bill.

The Chair: Thank you. Thank you very much, Madam Lalonde, Mr. Lawson.

Mrs. Barnes, your final question.

Mrs. Sue Barnes: When Ms. Steeves gave to Mr. Lastewka her two top priorities, it somewhat surprised me, and I'm sure there's good reasoning behind it, that you asked for recitals, as opposed to amendments to sections, or inclusion in sections. I know we're getting into the areas of privacy law per se, but given that there's a lot of difference procedurally down the road in our justice system between the enforceability of a recital in law, which is pretty well zero, versus a section, which is the enforceable part... It doesn't matter. It's sort of like giving your wish list, but it's not the law, so you don't have to worry about it.

We have used this—our own government. I can think back to sections in criminal areas where we've used it recently, in sentencing, for instance, where we've prefaced it with violence-against-women issues and put in different sanctions. But it's telling me that you very consciously have said this is not something you want as the basic thrust; it's something you'd like the courts to take into account. Again, on the enforceability between the statute and the whereas recitals, they're really the second best, and I need to hear you acknowledge that this is the case, that you are understanding of this and that they would have a limitation on their enforceability.

• 1040

Ms. Valerie Steeves: I agree with you that they are second best. I was working with what I see as the political realities of what is possible when it comes to pushing Bill C-54 into a better place than it is now.

The other place you could consider is clause 3, the purpose clause. That easily could be redrafted to make it more explicit, because it does talk about the right to privacy in that clause.

At the same time, though, I think if you look at the way courts deal with recitals, they are contextual. They are not meaningless. They might not be binding, but they certainly spin this thing in a different direction. I am not overwhelmingly convinced we can significantly redraft what we have before us, so to a large extent it's just an attempt to do that spinning.

Mrs. Sue Barnes: Mr. Lawson—if I could, Madame Chair—on the same point.

The Chair: Sure.

Mr. Ian Lawson: The reason I was advocating a preamble was for a very specific ulterior motive, which is to help some poor judge at the provincial level somewhere in Canada...or help see what the purpose was behind this and not just leave it to the skill of whatever lawyer may be there to try to save the bill. Make it clear. That's why Parliament does articulate why things are happening. There is strength behind it.

The purpose I had in advocating changes to the purpose clause or the preamble is more to help in interpretation.

Yes, it's true. They are enforceable, but what you say in a preamble or the purpose clause is only helpful in interpreting it.

Mrs. Sue Barnes: And therefore essential in your mind...or is that too leading?

Mr. Ian Lawson: I would very much like to see an improvement in the purpose clause, and I've already said I would like to see a preamble, from my perspective, focusing on the constitutional side, but equally establishing the right to privacy. It's high time we started talking in those words.

The Chair: Thank you very much, Mrs. Barnes.

I want to thank both of our witnesses for being with us today. Mr. Lawson, Ms. Steeves, we appreciate you taking time to review the bill and to come and discuss it with us. We look forward to any other comments you may have on other suggestions or the witnesses we have before us over the next few weeks.

The meeting is adjourned.