INDU Committee Meeting

The Standing Committee on Industry, Science and Technology met at 11:02 a.m. this day, in Room 362, East Block, the Chair, David Sweet, presiding.

The Committee commenced its clause-by-clause study of the Bill.

The witnesses answered questions.

Pursuant to Standing Order 75(1), consideration of Clause 1, Short Title, was postponed.

The Chair called Clause 2.

By unanimous consent, Clauses 2 to 5 inclusive carried severally.

On Clause 6,

“6. Section 7 of the Act is repealed.”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 3; NAYS: 5.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 6, be amended

(a) by deleting lines 37 to 39 on page 3.

(b) by deleting lines 11 to 13 on page 4.

(c) by deleting lines 15 to 18 on page 6.

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 3; NAYS: 5.

“(b.2) it was produced with the knowledge or consent of the individual in the course of their employment, business or profession, the information is incidental to the work product and the collection is consistent”

After debate, the question was put on the amendment of Judy Sgro and it was negatived, by a show of hands: YEAS: 3; NAYS: 5.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 6, be amended by replacing lines 40 to 44 on page 3 with the following:

“(b.2) it was produced with the knowledge of the individual in the course of an activity related to their employment, business or profession, the personal information is incidental to the product of that activity and the collection and use of that product is consistent with the purposes for which it was produced;”

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 3; NAYS: 5.

“(b.2) the information was produced with the knowledge or consent of the individual in the course of their employment, business or profession, the information is incidental to the work product and the use is”

After debate, the question was put on the amendment of Judy Sgro and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 6, be amended by replacing lines 14 to 18 on page 4 with the following:

“(b.2) it was produced with the knowledge of the individual in the course of an activity related to their employment, business or profession, the personal information is incidental to the product of that activity and the collection and use of that product is consistent with the purposes for which it was produced;”

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 3; NAYS: 5.

“(d.1) made to another organization and the organization has reasonable grounds to believe that the information is related to an investigation on a”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

“(d.1) made, on the initiative of the organization, to another organization and is”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 6, be amended by deleting lines 14 to 29 on page 5.

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

“if the organization has reasonable grounds to believe that disclosure with”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

“(d.2) made to another organization and the organization has reasonable grounds to believe that the information is related to the detection or suppression of a fraud or to the prevention of a fraud that”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

“(d.2) made to another organization, on the initiative of the organization, and is”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

“is likely to be committed, if the organization has reasonable grounds to believe that the disclosure with the knowl-”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 6, be amended by deleting line 30 on page 5 to line 4 on page 6.

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 6, be amended by adding after line 13 on page 7 the following:

“(6) Any organization that makes a disclosure to an investigative body, a government institution or a part of a government institution under any of paragraphs (3)(c.1) to (d) must

(a) within 60 days after the disclosure, notify the individual whose information was disclosed, unless the notification would jeopardize an active investigation, in which case the organization must notify the individual within a reasonable time after the conclusion of the investigation; and

(b) on a quarterly basis, publicly report the aggregate number of disclosures made in respect of each paragraph.”

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 1; NAYS: 5.

Clause 6 carried by a show of hands: YEAS: 5; NAYS: 4.

On Clause 7,

“necessary and reasonable to establish, manage or terminate”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

“7.5 An organization that, in the circumstances set out in sections 7 to 7.3, collects, uses or discloses personal information without the knowledge or consent of the individual shall, every three months, make public the number of times information was collected, used or disclosed during the previous three months and give a brief summary of that information.”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 3; NAYS: 6.

Clause 7 carried by a show of hands: YEAS: 5; NAYS: 4.

Clause 8 carried by a show of hands: YEAS: 6; NAYS: 1.

Clause 9 carried by a show of hands: YEAS: 5; NAYS: 1.

On Clause 10,

“10.1 (1) An organization shall report to the Commissioner any material breach of security safeguards involving personal information under its control.

(2) The factors that are relevant to determining whether a breach of security safeguards is material include

(a) the sensitivity of the personal information; and

(b) the number of individuals whose personal information was involved.

(3) The report must contain the prescribed information and be made in the prescribed form and manner as soon as feasible after the organization determines that a material breach of its security safeguards has occurred.

10.2 (1) Unless otherwise prohibited by law, an organization shall notify an individual of any breach of security safeguards involving the individual’s personal information under the organization’s control if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to the individual.

(2) For the purpose of subsection (1), “significant harm” includes bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on the credit record and damage to or loss of property.

(3) The factors that are relevant to determining whether a breach of security safeguards creates a real risk of significant harm to the individual include the following:

(a) the sensitivity of the personal information involved in the breach; and

(b) the probability that the personal information has been, is being or will be misused.

(4) The notification must contain sufficient information to allow the individual to understand the significance to them of the breach and to take steps, if any are possible, to reduce the risk of the harm that could result from it or to mitigate that harm, as well as any other prescribed information.

(5) The notification must be given as soon as feasible after the organization confirms that the breach has occurred and concludes that it is required to give the notification under subsection (1).

(6) The notification must be conspicuous and given directly to the individual in the prescribed form and manner, except in the prescribed circumstances where it is not feasible to do so, in which case it must be given indirectly in the prescribed form and manner.”

After debate, the question was put on the amendment of Judy Sgro and it was negatived, by a show of hands: YEAS: 3; NAYS: 6.

(a) by replacing lines 2 to 25 on page 10 with the following:

“Commissioner any incident involving the loss or disclosure of, or unauthorized access to, personal information under its control or a breach of security safeguards involving personal information under its control if a reasonable person would conclude that there exists a possible risk of significant harm to an individual as a result of the loss or disclosure or unauthorized access or as a resulf of the breach.

(2) The report shall contain the information and be made in the form prescribed in the regulations or otherwise specified by the Commissioner and shall be made as soon as feasible after the discovery of the loss or disclosure of, or unauthorized access to, personal information or of the breach.

(3) Upon the receipt of the report, the Commissioner may require the organization to notify affected individuals to whom there is an appreciable risk of significant harm as a result of the loss or disclosure of, or unauthorized access to, personal information or as a result of the breach.

(4) If the Commissioner determines that the loss or disclosure of, or unauthorized access to, personal information or the breach is likely to result in an appreciable risk of significant harm to the affected individuals, the Commissioner shall, as soon as feasible, order the organization to notify the affected individuals without unreasonable delay.

(4.1) Nothing precludes an organization from notifying affected individuals of the loss or disclosure of, or unauthorized access to, personal information or of a breach on its own initiative; in which case, the organization shall, without delay, inform the Commissioner that it has done so.

(4.2) Once the organization has complied with the notification order referred to in subsection (4), it shall notify the Commissioner of that fact.

(4.3) The notification to the affected individuals of the loss or disclosure of, or unauthorized access to, personal information or of the breach shall include

(a) a report of the risk of significant harm as it pertains to the affected individuals;

(b) instructions for reducing the risk of significant harm or mitigating that significant harm; and

(c) any other prescribed information.”

(b) by replacing line 39 on page 10 with the following:

“tunities, financial loss, identity theft, identity fraud, negative”

(c) by replacing line 9 on page 11 with the following:

“(b.1) the number of individuals whose personal information was involved; and”

(d) by replacing line 12 on page 11 with the following:

“individual of the loss or disclosure of, or unauthorized access to, personal information or of a breach of security safeguards”

(e) by replacing line 3 on page 12 with the following:

“and maintain a record of every incident involving the loss or disclosure of, or unauthorized access to, personal information under its control and of every breach of”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 3; NAYS: 5.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 10, be amended by replacing lines 2 to 6 on page 10 with the following:

“Commissioner any material breach of security safeguards involving personal information under its control.

(1.1) The factors relevant to determining whether a breach of security safeguards is material include

(a) the sensitivity of the personal information;

(b) the number of individuals whose personal information was involved; and

(c) an assessment by the organization that the cause of the breach, or pattern of breaches, indicates a systemic problem.”

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 0; NAYS: 8.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 10, be amended by replacing lines 16 to 18 on page 10 with the following:

“organization's control if the information was, or is reasonably believed to have been, acquired by an unauthorized person.”

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 0; NAYS: 7.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 10, be amended by deleting lines 25 to 44 on page 11.

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

“10.3(1) Unless otherwise prohibited by law, an organization shall, in accor-”

After debate, the question was put on the amendment of Judy Sgro and it was negatived, by a show of hands: YEAS: 1; NAYS: 6.

Clause 10 was negatived by a show of hands: YEAS: 1; NAYS: 5.

Clause 11 was negatived by a show of hands: YEAS: 4; NAYS: 5.

Clause 12 carried by a show of hands: YEAS: 5; NAYS: 0.

On new Clause 12.1,

“12.1 (1) Paragraph 13(1)(a) of the Act is replaced by the following:

(a) the Commissioner’s findings, recommendations and any order made under section 17.01;

(2) Subsection 13(1) of the Act is amended by striking out “and” at the end of paragraph (c), by adding “and” at the end of paragraph (d) and by adding the following after paragraph (d):

(e) a time limit on the implementation of any order made under section 17.01.”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 4; NAYS: 5.

Clause 13 carried by a show of hands: YEAS: 5; NAYS: 1.

Clause 14 carried by a show of hands: YEAS: 7; NAYS: 0.

On new Clause 14.1,

“14.1 The Act is amended by adding the following after section 16:

16.1 (1) If the Commissioner determines that the organization has not complied with the orders made under section 17.01 within the time limit established in section 17.02, or orders made under subsection 10.02(4) or 19(1), the Commissioner shall have a right of action against the organization.

(2) The Court shall consider the following factors when determining what penalty to impose on the organization:

(a) the number of orders not complied with by the organization;

(b) whether the organization is commercial or non-commercial; and

(c) whether the organization took reasonable measures under the circumstances to comply with the orders of the Commissioner.

(3) The organization which fails to comply with an order issued under section 17.01 or subsection 19(1) may be subject to a single monetary penalty of no more than $500,000.

(4) The organization which fails to comply with an order made under subsection 10.02(4) may be subject to punitive damages imposed by the Court.

16.2 If the Commissioner has issued an order under section 17.01 and the order has become final as a result of there being no further extension of the time limit under section 17.03, any individual affected by any violation of this Act specified in the order has a right of action against the organization for damages or loss suffered as a result of the non-compliance of the organization with its obligations under this Act.”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 2; NAYS: 5.

On Clause 15,

“Compliance orders

17.01 Upon completion of an investigation of a complaint, the Commissioner may order the organization that is the object of the complaint to take the necessary actions to comply with this Act, which may include

(a) correcting its practices in order to comply with sections 5 to 10.3, including by

(i) fulfilling any obligation under the Act,

(ii) destroying data,

(iii) ceasing to collect, use or disclose personal information, and

(iv) deleting or adding a record; and

(b) publishing a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under this section.

17.02 The Commissioner shall establish a time limit for the implementation of any order made under section 17.01.

17.03 (1) Upon a request by the organization that is the object of the complaint, the Commissioner may extend the time limit for the implementation of the order at any time throughout the implementation period established by the Commissioner.

(2) The extension of the time limit may only be granted once.”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 2; NAYS: 5.

Pursuant to the order adopted by the Committee on Tuesday, October 28, 2013, the following amendment, submitted by Bruce Hyer for the consideration of the Committee, was deemed moved:

That Bill S-4, in Clause 15, be amended by replacing line 3 on page 13 to line 12 on page 14 with the following:

“Compliance Orders

17.1 If the Commissioner believes on reasonable grounds that an organization has committed, is about to commit or is likely to commit an act or omission that could constitute a contravention of a provision of Division 1 or 1.1 or a failure to follow a recommendation set out in Schedule 1, the Commissioner may order the organization to take the necessary actions to comply with this Act, which may include

(a) correcting its practices in order to comply with sections 5 to 10.3, including by

(i) fulfilling any obligation under the Act,

(ii) destroying data,

(iii) ceasing to collect, use or disclose personal information, and

(iv) deleting or adding a record; and

(b) publishing a notice of any action taken or proposed to be taken to correct its practices, whether or not ordered to correct them under paragraph (a).

17.2 The Commissioner shall establish a time limit for the implementation of any order made under section 17.1.

17.3 (1) Upon a request by the organization in respect of which an order is made, the Commissioner may extend the time limit for the implementation of the order at any time throughout the implementation period established by the Commissioner.

(2) The extension of the time limit may only be granted once.

17.4 (1) If the Commissioner determines that the organization has not complied with the orders made under section 17.1 within the time limit established in section 17.2, the Commissioner shall have a right of action against the organization.

(2) The Court shall consider the following factors when determining what penalty to impose on the organization:

(a) the number of orders not complied with by the organization;

(b) whether the organization is commercial or non-commercial; and

(c) whether the organization took reasonable measures under the circumstances to comply with the orders of the Commissioner.

(3) The organization which fails to comply with an order issued under section 17.1 may be subject to a single monetary penalty of no more than $500,000.

17.5 If the Commissioner has issued an order under section 17.1 and the order has become final as a result of there being no further extension of the time limit under section 17.2, any individual affected by any violation of this Act specified in the order has a right of action against the organization for damages or loss suffered as a result of the non-compliance of the organization with its obligations under this Act.”

After debate, the question was put on the amendment and it was negatived, by a show of hands: YEAS: 3; NAYS: 5.

Clause 15 carried on division.

Clause 16 carried on division.

On new Clause 16.1,

“16.1 Subsection 19(1) of the Act is replaced by the following:

19. (1) After an audit, the Commissioner shall provide the audited organization with a report that contains the findings of the audit and any recommendations and orders that the Commissioner considers appropriate.”

After debate, the question was put on the amendment of Charmaine Borg and it was negatived, by a show of hands: YEAS: 3; NAYS: 5.

Clause 17 carried on division.

Clause 18 carried on division.

Clause 19 carried on division.

Clause 20 carried on division.

Clause 21 carried on division.

Clause 22 carried on division.

Clause 23 carried on division.

Clause 24 carried on division.

Clause 25 carried on division.

Clause 26 carried on division.

Clause 27 carried on division.

Clause 1, Short Title, carried on division.

The Title carried on division.

The Bill carried by a show of hands: YEAS: 5; NAYS: 4.

ORDERED, — That the Chair report the Bill to the House.

At 12:24 p.m., the Committee adjourned to the call of the Chair.