This is the second meeting of the Standing Committee on Access to Information, Privacy and Ethics.
Our orders of the day include two items. The first is committee business, with a report from the subcommittee on agenda and procedure. The second is to address a couple of matters on supplementary estimates (C).
Our witnesses are already here. I've had some discussions and there is an agreement that we will deal with supplementary estimates (C) first. We should be able to dispose of that within a reasonable time.
I would like to welcome Elizabeth Denham, who is the assistant privacy commissioner, and Tom Pulcine, who is director general and chief financial officer, corporate services branch.
I wonder if you would please outline for the committee the nature of the supplementary estimates (C) for privacy, and any other statements you care to make at this time. Then we'll see if the committee has some questions. So please proceed.
Good morning, Chair, and members of the committee.
Good morning, Mr. Chair and members of the committee.
It's very nice to be here again and see some familiar faces. As you've just said, I am accompanied by Tom Pulcine, our director general, corporate services, as well as Steven Johnston, our senior security and technology advisor. Steven is available in case we get into some IT technicalities that are well beyond my knowledge.
I understand that we're here to discuss supplementary estimates (C) relating to the OPC's oversight role in relation to anti-spam legislation, referred to in the last session as Bill , and more commonly as the Electronic Commerce Protection Act or ECPA.
I thought it might be worthwhile to take a couple of minutes to put our role regarding that legislation in context. Would that be helpful, Mr. Chair?
I'm afraid that with the somewhat short notice our office didn't have time to write and translate a statement, and I confess that I was much more up to speed on the content of this legislation when I appeared before the House industry committee in June. As of this morning, this legislation has not been reintroduced in either House, but I am speaking now as though the legislation will be the same as that passed by the House last November.
As many of you know, the overarching purpose of ECPA is to combat spam in order to provide for a safer Internet. Spam is a serious problem that has a significant impact on the economy. I should point out that Canada is currently the only G7 country without such legislation. Once passed, the legislation would involve a triad of federal agencies in oversight: the CRTC, the Competition Bureau, and the Office of the Privacy Commissioner.
Our role will be to investigate the unauthorized collection and use of personal information from e-mail addresses through a variety of different techniques: harvesting, dictionary attacks, and malware or spyware. I'll be happy to talk about these later if there is interest.
The legislation doesn't change our existing enforcement powers, and we don't expect a significant increase in new complaints to our office under this law. However, we need to gear up incrementally. We need to explain this new law to our stakeholders and the public, and undertake compliance education. The investigations themselves are likely to involve increased technical complexity, as well as collaboration with domestic and international enforcement bodies, and a need for legal enforcement action in some cases.
The legislation also imported some amendments to PIPEDA that are familiar to many members of this committee. Number one is to give the commissioner discretion to decline to investigate a complaint, discontinue a complaint or refer it elsewhere, and allow for collaboration with and the exchange of information with provincial and foreign counterparts who oversee and enforce laws that are similar to PIPEDA. These are general amendments to PIPEDA and would therefore apply to all of our activities, not just those activities related to spam.
In this fiscal year of 2009-10 we have estimated $100,000 in operating costs, anticipating that this bill will receive royal assent in this fiscal year. That amount relates to communication, education, and awareness activities.
Canadians need to be aware that our office will take complaints related to spam through dictionary attacks, spyware, or other methods. We need to prepare for public inquiries and inquiries from business and other government agencies. So we've been busy drafting materials and have developed internal training materials for our own staff. We've also really ramped up our technical expertise that will be needed for investigations dealing with spyware and malware under ECPA. And we've invested in software for these online investigations.
Perhaps that's enough to give you some context for our request. I'm happy to answer any questions.
The simple answer to your question is yes.
We're at a point in the fiscal year where it's very difficult. It's March 18. The fiscal year ends on March 31, and it's very difficult to spend any money at this time of year that hasn't already been initiated in terms of an activity. The simple answer to your question is no, there will not be any additional resources initiated at this point for this legislation.
It's really important as well to recognize that if the committee recommends the approval of the supplementary estimates, our understanding is if the legislation does not pass, that $100,000 will be frozen. Our office will not get any financial benefit of that $100,000. So I'm not sure if there's a--
Good morning. Thank you for being here with us.
Let me tell you first that my party and I are supporting your request for an additional $100,000.
Having said that, I've been asked by my colleague, who normally sits here, to ask a couple of other questions and to get your comments.
One of them deals with the Olympic security cameras in Vancouver. We understand that the cameras are going to be removed from the Vancouver streets. I guess the concern of my colleague from is that in fact all cameras be removed. We were wondering if you have any comments on that, from the point of view of privacy.
The other question is in regard to the UN report that states that “airport body scans breach rights”:
||Martin Scheinin, the UN special rapporteur on the protection of human rights, said while countering extremism scanners were both an ineffective means of prevention and an excessive intrusion into individual privacy.
Scheinin, who was “appointed to monitor the impact of anti-terror measures on individual freedoms five years ago, told the UN Human Rights Council better detection technology could be better for human rights.” So he's saying that “full body scanners are a disproportionate intrusion into privacy when measures are not taken to minimize the negative impact on privacy.”
My colleague would just like to see if you have any comments on that, given the fact that we've approved body scanners in Canada.
I'm the assistant privacy commissioner responsible for the private sector side of the office, so I can just answer very briefly that my colleague Chantal Bernier or the commissioner will follow up with a more complete answer. It is also my understanding that the cameras will be removed from the streets of Vancouver. Our office is continuing to follow that file. We are troubled by ongoing video surveillance, of course, so I understand your comment.
When it comes to airport body scanners, just to clarify, the commissioner did not approve the use of body scanners in our airports. We make recommendations to government departments on privacy interests and privacy rights and on how to balance the security needs with privacy and dignity interests.
When we looked at this file through a privacy impact assessment, our office felt that there was a fair balance between both of those interests. But we continue to monitor what CATSA and the government are doing in their implementation of body scanners.
I can follow up with more detail.
Thanks very much, Mr. Chair.
Thank you very much for being here with us this morning and for going through these supplementary estimates.
In your opening remarks, Ms. Denham, you said that the Privacy Commissioner is requesting $100,000 to implement and enforce legislation concerning unsolicited commercial e-mail and related online threats. In the answers you've already given here this morning, we've certainly understood what legislation we're speaking of. Certainly, it was good to hear the parties' support for that legislation. I expect when it is introduced before too long there will definitely be all-party support for it, and it will be expedited through the process. So that's encouraging to hear.
Could you tell us how you came to the $100,000 figure?
The $100,000, relatively speaking, is a very small number. To be very clear and honest, it probably would have no impact at this late stage of the fiscal year.
In essence, the authority we have right now is the $20 million or thereabouts, and that's the amount we're living within, so this late in the year, even if the legislation were reintroduced and passed, it's highly unlikely they would actually spend that amount of money.
It's very much a case, as I said already, where there's a bit of a catch-22 in terms of where the supplementary estimates process is relative to where the legislation last left off. If this legislation had been passed sometime late in the calendar year, let's say, then it's highly likely that we would have been able to effectively spend the additional resources.
Thank you very much, Mr. Chair.
I will echo my colleagues' welcome to you this morning for being here at the committee.
In the time that I've served on this committee, I have come to understand the value of the Federal Accountability Act, which was introduced in 2006. It was the Federal Accountability Act that amended the Privacy Act to extend its application to 15 institutions, including officers of Parliament and crown corporations and foundations.
Expanding the application of the Privacy Act has, I am sure, increased the workload of the Office of the Privacy Commissioner. For my understanding, could you expand on this statement and tell the committee about the increased workload that you may have and may now be experiencing as a result?
It is a very difficult question to answer in terms of the timing of the fiscal year. There are very few days left between now and the end of March, so I think it's fair to say that there is going to be very little additional activity with respect to the work to be undertaken as it relates to this legislation.
Once again, it's important to recognize that if the legislation does not pass and receive royal assent, this money will be frozen and will not be made available to the Office of the Privacy Commissioner, which I think is a very important point.
If the question is whether we are going to spend more, I suspect the answer is no. If the legislation is to be passed and receive royal assent, all that has to happen before March 31. If it is approved by Parliament, the resources are left with the office. The only financial impact it will have is the impact of how much money the organization, the Office of the Privacy Commissioner, has to carry forward from one fiscal year to another as relates to the operating budget concept.
I think the Office of the Privacy Commissioner has been very prudent in their planning for this legislation, and the expenditure we're discussing this morning was very appropriate. To have made provision for that in these estimates was very prudent.
We know that this is important legislation and it increases the role of the Privacy Commissioner in certain areas. Certainly the need to consult with other privacy commissioners in other states and organizations is one of the additions that ECPA makes to the role of the Privacy Commissioner. To do appropriate planning for that expansion of the work of the Office of the Privacy Commissioner was right on.
Unfortunately, I think we have another unfortunate consequence of the abrupt prorogation of the House. Legislation that had been worked on diligently in both the House and the Senate was abandoned by the government. It threw the whole planning process across the public service into some disarray and some question as a result. I think there are consequences to those kinds of decisions, and a further delay in this very important legislation is one.
I'll just finish with the comment that I think the Office of the Privacy Commissioner has done very prudent work in this regard.
There being no further matters, I want to thank the witnesses kindly for your appearance.
The committee will consider the request of this meeting and report to the House.
Thank you. You're excused.
Colleagues, there was one other item on the supplementary estimates (C), which had to do with the Senate Ethics Officer, a $50,000 item.
We attempted to have the Senate Ethics Officer appear before us. There is a protocol between the Houses, and certain things have to happen for that person to be able to go to the green chamber, as it were, and that wasn't possible to do. But Mr. Jean Fournier, the Senate Ethics Officer, has sent a brief statement that I could read to you. It reads:
||This is Vote 20c. It's for $50,000. The funding is to conduct an inquiry regarding compliance with the Conflict of Interest Code for Senators. The increase is needed to cover the costs of an opinion or inquiry the Senate Ethics Officer was asked to undertake by a senator on October 20, 2009, pursuant to subsection 42(1) of the Conflict of Interest Code for Senators. Inquiries are a rare occurrence and the related costs are not included in the annual estimates of the expenses of the office.
So there was no provision in their budgets for any investigations or inquiry, but there is one, in fact, and the estimated amount was some $50,000.
That is all the information I have, but I understand that is the amount included, I guess globally, in vote 45c and vote 20c.
Those are the two items.
Do we have further questions on those two items?
No, it's an investigation of a specific complaint under the conflict of interest code for senators. They have a separate conflict of interest code.
I understand that this reporting, where this matter has been referred to our committee to address, has raised some questions in that it likely will no longer be reported to us once they get this sorted out. The Senate matters will probably be handled in the procedure and House affairs committee, because it's not a House issue.
This matter has been referred to us by the Speaker of the House, so we have to in fact report back on it.
On the reason that we're dealing with the supplementary estimates (C), and I don't think I explained it to members, they have to be reported back to the House by the 23rd, which is next Tuesday. Our next meeting isn't until 11 o'clock. Routine proceedings are at the beginning of the day, at 10 o'clock. So we either do this now and have the meeting, and decide to approve or deny the request now, so that it can be reported to the House on time...
If there's no further discussion on the items, we have two motions. The committee can adopt, reduce, or negative each vote, but it cannot increase the amount of the vote.
We'll call each vote separately. Each vote forms a distinct motion that is debatable and amendable. As an example, a motion would be that vote X, Y, Z in the amount of x be reduced by y.
The circulation of the information to the members of the committee with the supplementaries included both these items.
I see there's confusion; our agenda only shows vote 45c on it.
Members can check the reference of the other vote, 20c, from the Speaker of the House to this committee. We actually discussed vote 20c about the Senate at steering committee on Tuesday, and the chair was directed to get the Senate Ethics Officer to appear and he was unable to appear. I don't think we're uninformed of the reference.
The members will be asked to dispose of both of these requests for votes under supplementary estimates (C). Of course the members will also know that if a committee does not report back on supplementary or main estimates, they're deemed to have been reported back without amendment. So this is our opportunity.
Mr. Siksay, you have a question?
Well, certainly there is the relevance of it coming to our committee. But it always has been there. That vote has always been there for us; we've just never dealt with it. We're learning.
The question you raised has already been discussed, and we will get a resolution and any other information that would be helpful for the committee to understand the logistics of properly addressing appropriations, whether it be for this House or the other place. We will do that.
Shall vote 45c under Justice with regard to the privacy matter carry?
||Offices of the Information and Privacy Commissioners of Canada
||Vote 45c--Office of the Privacy Commissioner of Canada–Program expenditures..........$100,000
(Vote 45c agreed to)
||Vote 20c--Program expenditures..........$50,000
(Vote 20c agreed to)
The Chair: Shall I report the supplementary estimates to House?
Some hon. members: Agreed.
The Chair: Thank you, colleagues.
All right, we have a bit of time. We're definitely going to complete this meeting before 1 o'clock, but we'll carry on.
Do you have a question, Mr. Rickford?
Let me see if I can help the committee move forward and tell them where we are. In our first meeting the committee instructed the chair to retable the 10th and 11th reports from the last session to the House and indicate that we were not requesting a response from government since we have already received one. We are having ongoing discussions with the Minister of Justice about getting the responses to every recommendation, as well as making arrangements for him to come before us.
I want to confirm that this morning I did table the first and second reports of this session, the privacy quick fixes and the access to information quick fixes. That has been done.
I don't have a written report on the steering committee meeting because we had so many items and points that we thought it would be important to engage the full committee in making decisions. We also had the problem of trying to schedule things, because our commissioners are not available in the next couple of weeks.
What we do may require some stickhandling, but next Tuesday will be another steering committee meeting. It won't be a full meeting; it will be a steering committee meeting that will consider the input members give now. We will try by that time to lock in the four commissioners to appear before us to deal with the issues. To the extent that we don't need the commissioners, other business would be slotted in to make sure we make good use of our time.
The committee did agree that in addition to doing the supplementary estimates (C) today--which we either dealt with or they were deemed to be reported, and thank you for that--we are going to be dealing with the main estimates from Access, Privacy, and Justice. We will also have the Ethics Commissioner and the Commissioner of Lobbying. The access and privacy offices are under the Justice umbrella, and the Ethics Commissioner and Commissioner of Lobbying are stand-alone.
Now, the committee wanted to address the work we did on Google and Canpages. At the last meeting Mr. Poilievre asked whether the committee felt it might construct a report on the issue and whether we had any recommendations. I asked Mr. Poilievre if he could give more thought to that, and at this meeting we would have an opportunity to get the views of the committee as to whether there was something we could constructively contribute to a report to the House.
Is this what you would like to discuss, Mr. Rickford?
This might be a good segue. I had a great meeting with the senior legal counsel for Google, and he wrote a very thoughtful memo here on a couple of different subject matters that he thought the committee might benefit from discussing or looking at. I have that memo here. It is only in English. I would be happy to share it with the members of the committee, subject to any sort of technical requirements for its translation or what have you.
If I may, by way of introduction, the subject matters were “Privacy by Design”, so the committee might study how the private sector can develop and does develop pro-privacy products as a competitive edge in winning and keeping customers; open data, government, looking at the possibility of opening vast added resources of the Government of Canada to the public. A study of successes and challenges in other jurisdictions would provide the committee, in my view, with a solid base of knowledge to make a recommendation to the government on how best to implement a potential strategy.
Data portability was another subject—again, I'm just briefly going over some of the areas of potential study—whether data portability has a pro-privacy impact, and explore other market-driven pro-privacy solutions.
Then, of course, there is privacy in data security, which is further divided into two major subject areas. HTTPS, which of course is the hypertext transfer protocol secure, is used to encrypt data. The suggestion would be that we might explore the barriers to the greater adoption of HTTPS across a variety of websites, including the Government of Canada websites. As a second subsection of that, privacy and data security, would be anti-malware, which is actually quite an interesting area for us to perhaps look at. We would examine the integration of privacy and security, and the committee might consider how the government could further foster anti-malware collaboration through the creation of a registry or phishing or malware site.
So I have that document, Mr. Chair, and do I have to...?
Sorry, go ahead.
When we hit one, please indicate to the clerk if you'd like to comment.
Other than the mains, etc., the report cards are coming from the various commissioners. I think we just received one, did we not, from privacy...? It's the plans and priorities and the report cards. They're not coming until the 26th. We won't be in a position to deal with the mains until after we get that, which is at the end of the month. Our challenge is going to be to schedule business for us until we get those and have an opportunity to review it. We talked about the report cards.
Madam Freeman had raised an interest with regard to the process followed by the government in terms of order in council appointments. You will have received in your office from the clerk an e-mail that has the links to all of that information. I did print off most of it. It's quite comprehensive, but it's quite helpful because it goes through, step by step, all of the different checkpoints in terms of considering someone for an appointment, including security checks, etc. Unless Madam Freeman brings forward any further matters, I think that's already been take care of.
She also asked for a list of appointees for our committee. We're working on that.
When the issue with the two reports that I tabled today... I have spoken with the minister, and he was under the impression from his staff that they had already responded and there was no further work to do. I gave him copies of all of the correspondence, including his letter to us saying he will respond to the recommendations, but he wanted an extension until February 15. The prorogation stopped all of that. He is going to come back to me to indicate when they would be able to get the comprehensive response to each of the recommendations and a date.
He also wanted to remind me that he has not agreed to appear before the committee. I assume the committee would like to see the minister after we have received the response to those two reports and had a chance to review them.
We will plan at some point to try to get dates. Certainly, that is going to happen before the summer. The minister is a busy person, but we will extend an invitation to him to come before us so we can discuss his comprehensive response to both our reports.
We are expecting an order in council appointment of the new Information Commissioner. As you all know, we have an acting commissioner right now. We don't know when that's coming. I'm hopeful that we have a full-time appointee. We will have a special, separate meeting dedicated to having the nominee of the government come before us, which is the traditional practice. We would then do a report to the House with the committee's recommendation, and propose a motion of an appointment, which the House will vote on.
In addition to the things Mr. Rickford raised in terms of the broader privacy issues related to emerging...there are lots of things. We have two matters before us, and this is where we want to get a little bit of input from the committee.
The first one has to do with the whole question of camera surveillance. There have been court cases in the past. We've had balloons carrying cameras around the border. Mr. Siksay put together a fairly extensive package on this matter, the whole emerging risks or problems related to camera surveillance in our society. It would take a little time to study. We have no idea right now as to the dimension, but we do hope to discuss it at our steering meeting next Tuesday.
The other item is something that was considered in the last session of Parliament, and in fact the researchers were asked to prepare for the committee a document related to proactive disclosure and access to information.
You may know, for instance, that in the United States, President Obama has his whole economic plan on the web--every project, how many jobs, and other things. They have partial proactive disclosure in terms of access to information. But there are other countries that have, in fact, full proactive disclosure. Virtually everything the government does that's accessible to the public is accessible on the web, other than those matters that are, for instance, cabinet confidences, national security and public interest concerns, and so on, which the government, in their opinion, would not release under access to information because of their nature.
It goes to the question of the possibility of eliminating a tremendous volume of work in terms of processing and delays. This is one the committee expressed an interest in. We will have a copy of a document in a week. For next Thursday's meeting you will have the research information they have available to date on the jurisdictions in which this is occurring.
I wanted to inform you of the two areas the steering committee considered.
Now we also have the matter Mr. Rickford has brought up on the Google sphere of things, which is not exactly camera surveillance. There may be some overlap in terms of the privacy issues, but we'll have to see. We're going to have to get a little bit more information, okay?
We'll consider any other item the members would like to recommend the steering committee consider.
We'll go to Mr. Easter, and then we're going to Madam Freeman and Mr. Rickford.
Twice. I worry about that as well.
When an acting commissioner is acting commissioner, her independence and the ability to do her job without fear of losing her job are in fact compromised. That's why she either needs to be appointed permanently for a five-year term, so that she can do her job and challenge the government as necessary without thinking she'll be fired for having done her job because she's only an acting commissioner... And we've seen this. Even government members know we've seen lots of people lose their jobs around here.
So what I'm saying to you, Paul, as our chair, is that we don't want to dilly-dally on this. Members and the general public are trying to use the Access to Information Act, and it's being compromised, so we can't dilly-dally until June.
I'm sure that members share the concerns.
Members should also know that the acting commissioner is also the deputy commissioner, and if she should not be appointed to be the new information commissioner, she still has her job. So I'm not concerned about firing, as I'm sure she's going to do the job well. I have full confidence in her.
But the full committee will be making a decision as to the work we do. The steering committee is going to have to really bring to this committee our recommendations only. We cannot bind the full committee as to what we're going to do and when. All we can do is recommend. So that certainly is one of the items there.
I have Madam Freeman, Mr. Rickford, Madam Block, and Mr. Siksay.
Mr. Chair, I have just two comments.
First of all, I'd like, certainly from my part, to encourage the committee to wait for the report before we proceed with anything. I respect and understand where the member is coming from. I'm not sure his party has been in power since the Internet was created. But if we could wait for the report, I think it would be the right thing to do.
The other part, and I appreciate your raising this, is with respect to the access for proactive disclosure study or anything along those lines. I would be interested in understanding the committee's enthusiasm around a trip to Washington to look at some of the research and work that's being done in this area. I'm throwing that out there. We are in a period of fiscal restraint, as other members have raised here and certainly in the House in looking at our resources, but I think this would be a particularly useful trip. If managed properly, it would benefit us all and inform us in some very important ways as to what, as you pointed out in your earlier discussion, the United States of America is doing in this regard.
I'm interested in this. Of course, in the great Kenora riding I have a spreadsheet called the “get-'er-done spreadsheet”. It keeps track of all the projects we're doing since Canada's economic action plan has been implemented. Of course, it's quite a long list of all the things we're taking care of, now that we have an opportunity to do that.
There is important information on there that I've often felt my constituents should have access to. There is a process there, and there are certainly things we should think about that have to do with that information: How should it be accessible? Why should it be accessible? I think anything we can do to understand better would benefit this committee.
We all share an affection for the Obama administration, and if he is doing something that we can just build on, by golly, I think that might be a useful exercise.
So I put that out there for us to think about.
I have to say that you did a very eloquent job this morning of tabling those reports and pointing out the circumstances under which they were being retabled. I'd recommend to colleagues that they take a look at Hansard for that.
Mr. Chair, I want to say that I share Mr. Easter's concerns about the whole question of the slowness of access to information and the apparent interference by ministers or by the PMO in the process of the appropriate release of documents. I was one of the people who made a complaint to the Information Commissioner, and the Information Commissioner has acknowledged that she is indeed investigating that issue.
I just want to say that I have full confidence in the Information Commissioner. I see her as a person of integrity, and I believe we should allow her to do her job as someone appointed to follow up on those kinds of issues.
While I'm not prepared to wait forever for that, I also believe that the commissioner has shown that she is prepared to do the work expeditiously and appropriately. With that caveat, I believe we should wait to see what her report is and then follow it up as necessary.
The only other thing I would have mentioned, Chair, is that the agenda subcommittee looked at the issue of the review of the Lobbying Act that will be—
There were only two other things. We had “urgent, must do”; the second column was those items we want to get dealt with before the summer break; and then for after we get back after the summer, there were two items. One was a legislative review of the Lobbying Act. We have to do it; it's a five-year review. The other would be, if necessary, a review of the Oliphant report on the Mulroney-Schreiber matter, which is coming, I understand, in late May. So we could have time over the summer, and maybe some work could be done. But we don't anticipate that this would happen until after the summer. Those are all of the matters.
So thank you, Bill. I probably should have thrown it all on the table.
Is there anything more there?
Mr. Rickford again.