ETHI Committee Meeting

     Good morning, ladies and gentlemen.

    I'll call to order our meeting of the Standing Committee on Access to Information, Privacy and Ethics.

    We're here today to deal with the main estimates for a series of officers of Parliament. I welcome them here today. It's rarer than hen's teeth, kind of like spotting a whooping crane, to see an officer of Parliament before our committee, so it's a great treat for us.

    The way we're going to conduct ourselves is this. We'll introduce the subject by saying that we are here to deal with vote 1 of the main estimates for the Office of the Commissioner of Lobbying. I believe it's vote 1 and vote 5 under the offices of the information and privacy commissioners of Canada.

    For the first hour we're going to welcome Ms. Karen Shepherd, from the Office of the Commissioner of Lobbying.

    Ms. Chantal Bernier, of course, is the Interim Privacy Commissioner from the Office of the Privacy Commissioner.

    That opens the subject. We'll give the floor to our two witnesses and then allow questioning afterwards. The way we have it in order on our agenda is the Office of the Privacy Commissioner first.

     Ms. Bernier, would you like to take five or ten minutes to speak to the main estimates of your department? Welcome.

    Thank you very much, Mr. Chair.

    Thank you very much, everyone.

    Thank you for your invitation to discuss our main estimates for fiscal year 2014-15.

    Joining me today is Daniel Nadeau, our chief financial officer and director general of corporate services, along with Maureen Munhall, our director of human resources.

    In my time today I want to outline our financial situation, then discuss some of the key challenges we face pursuing our mandate and explaining the actions we have taken to maximize the effectiveness of our resources in order to continually enhance service to Canadians.

    Let us begin with our financial situation.

    Looking at the numbers, you see a decrease in our resources of nearly $5 million. This is due to two key factors. First, our 2013-14 budget reflected a one-time injection to cover the costs of the mandatory move of our headquarters from downtown Ottawa to Gatineau. This injection came in the form of a $4.1 million interest-free loan, one which we are repaying Treasury Board Secretariat over the next 15 years, starting this year with a payment near $300,000.

    The other factor accounting for the decrease is a planned reduction under the deficit reduction action plan. While we were not mandated to make reductions under the plan, in the spirit of collegiality, our office answered the call to adhere to its intent. As a result, we have implemented savings of 5% or $1.1 million per year within our total budget as of this fiscal year. This began with $700,000 reduction per year starting in 2012-13 and an additional $400,000 takes effect this year.

    While I'm proud of our contributions to the deficit reduction action plan, it comes at a time when privacy matters continue to be of wide interest to the public. We must ensure that we maintain our level of excellence in this context of reduced resources and increased interest.

    We see this rising interest reflected in our statistics. For example, in the last completed calendar year, we saw an increase in complaints under the Personal Information Protection and Electronic Documents Act, going from 220 the previous year to 426 this year. Much of this increase owes to the fact that 168 complaints were all on the subject of changes made by Bell to its privacy policy. These are being handled under one single commissioner-initiated complaint. However, even with these subtracted, we have an increase of 17% from the year before.

    We saw the same percentage increase in complaints about federal organizations under the Privacy Act, accepting 1,675, more than 300 of which related to a breach regarding Health Canada's medical marijuana access program. The year before, we accepted 2,273 complaints, nearly one third of which related to the loss of ESDC's student loan hard drive. After subtracting complaints related to these high-profile incidents, we still see a jump of just more than 17% in the public sector.

    Added to this, we are faced with a growing number of data breach reports. From business we saw a year-over-year 81% increase of breach reports from private sector organizations. Meanwhile, breach reports from federal organizations more than doubled, to 228. That marks a record high for a third year running.

    From these numbers, we must not jump to the conclusion that breaches are increasing. More likely, we may be witnessing an increase in notification, which in fact would be an improvement in compliance.

    To continue serving Canadians with excellence, but with no additional resources, as the volume and complexity of our work increases, we have adopted the following measures. In the face of rising data breaches, we implemented a calibrated approach by which we meet each incident with a response tailored to its severity. Under this approach, we determine severity on the basis of the organization's demonstrated accountability along with the risk of harm to individuals.

    We have worked to modernize our investigation processes, enabling a proportional approach that matches the appropriate tool per issue we face.

    We have a range of tools. For example, we can group investigations as appropriate in favour of broader investigations looking at multiple complaints, as we did in the face of 168 complaints about Bell's privacy policy and the even more numerous complaints we received about ESDC. We can also assign a single investigator to handle multiple complaints from the same individual complainant and deal with these in a single report, wherever possible.

    We leverage our domestic and international partnerships to expand our enforcement capacity and achieve more expedient and effective results. We did this with the Dutch data protection authority in relation to an investigation of WhatsApp and are now doing the same with our Irish counterpart on an investigation of Facebook.

    We undertake informal activities promoting broad-based compliance, such as the international privacy sweep which we spearheaded last year, promoting 40 organizations to significantly boost their privacy transparency in response to our office's concerns.

    We are also developing guidance to share best practices and promote compliance.

    Finally, we conduct formal investigations and audits on systemic matters when necessary.

    We have made greater use of our early resolution process to resolve complaints, with an increase of 15% in relation to the private sector and 10% in relation to the public sector. This serves to resolve matters to the satisfaction of both the complainant and respondent while forgoing the need for a resource-intensive investigation.

    In 2013, we reduced the average treatment time to conclude PIPEDA complaints from 12.6 months to 6.7 months, for a 47% improvement. Under the Privacy Act, the average treatment decreased to 6.1 months, down from 6.8 months in the previous year.

    We have also made greater efforts to triage and prioritize the review of privacy impact assessments from federal organizations. These assessments are required under federal policy for any new initiative making use of personal information for decision-making.

    We are focusing on initiatives holding the highest significance for the right to privacy of Canadians, ensuring that those with the biggest possible risks receive the greatest attention. As an example, we have struck an internal task force to look specifically at initiatives under the “Beyond the Border” action plan, which involves a multitude of programs with possible privacy impacts on Canadians.

    In sum, we face challenges brought forth by the nature and volume of our work amidst a tighter fiscal context, and we are doing so determined to continue meeting the needs of Canadians.

    We have developed, and will continue to develop, new ways to make the most efficient use of our resources to do just that. The statistics I just mentioned on our increased workload as well as our recent reports to Parliament—on oversight for the Canadian intelligence community, for example, or on the loss of the student loan hard drive, or our prominent report on findings in relation to Google of online behavioural advertising—demonstrate that we are pursuing our work at a continued high level, with unwavering dedication, under resource pressures.

    I wish to take this opportunity to publicly recognize the remarkable hard work and innovativeness of the OPC staff who make this possible.

    Mr. Chair and members of the committee, thank you. I forward to your questions. Merci.

    Thank you very much, Madam Bernier, for a very comprehensive and brief report.

    We'll next hear from the Commissioner of Lobbying, Ms. Karen Shepherd, and then we'll go to questions on either or both of the presentations.

    Ms. Shepherd.

    Good morning, Mr. Chair and members of the committee.

    I am pleased to be here today to discuss the main estimates 2014-15 for the Office of the Commissioner of Lobbying. I would also like to take this opportunity to touch upon my mandate and outline a few of my priorities for this fiscal year.

    I am joined today by René Leblanc, Deputy Commissioner and Chief Financial Officer.

    My mandate is threefold. I must maintain a registry of lobbyists, develop and implement educational programs to foster awareness of the act, and ensure compliance with the act and the Lobbyists' Code of Conduct.

    The 2014-15 main estimates are $4.4 million, which is essentially the same amount as last year. However, since I became commissioner in 2008, demands for more accountability and reporting have been steadily growing. In addition, cost containment measures announced in 2010 have forced my office to absorb salary increases over the last three fiscal years.

    In 2011 I conducted a strategic and operating review. This review resulted in a 5% budget reduction starting in 2013-14. I minimized the impact of this reduction by postponing the development of new features in the registration system and by limiting the use of external consultants. System maintenance, however, will continue to be a priority.

    The recent government announcement that operating budgets will be frozen for the next two fiscal years will further increase pressures on my ability to deliver my mandate. However, with the efficiencies I have put in place, I believe I can manage.

    Of the total 2014-15 main estimates, operating expenditures, including salaries, represent $4 million. The remaining $400,000 is for the employee benefits plan, which is a statutory vote. Salaries represent about 63% of my operating budget. I have a complement of 28 employees. The remaining 37% is for non-salary spending.

    The first program I would like to talk about is the registration of lobbyists. This program maintains the online, public registry of lobbyists and provides guidance and support to registrants. The registry is the primary source of information on who is lobbying federal public office holders and about which topics.

    This year, my priority for the registration unit is to improve the timeliness of monthly communication reports filed by lobbyists. I believe that transparency is hindered when communications between lobbyists and designated public office holders are reported late. I intend to monitor the situation more closely and to further educate lobbyists about the requirements of the act in this regard.

    The education of lobbyists, their clients, and public officer holders is also an important component of my mandate. This is how people are made aware of the act, the code, and their requirements. I believe compliance with the act and the code will be improved through increased awareness. My staff and I meet regularly with lobbyists, public office holders, parliamentarians, as well as academics to help them understand the act and the lobbyists' code of conduct. In 2013-14 we met with more than 1,000 stakeholders. I intend to continue these types of activities.

    This year my priority in terms of education will relate primarily to the lobbyists' code of conduct. A consultation process with stakeholders took place between September and December of 2013. I received written submissions from a range of stakeholders, and I held a number of round tables to solicit views on the code. I plan to issue a report on the results of the consultation by the end of May.

    The third component of my mandate is to ensure compliance with the act and the code. I do this through a number of compliance activities, including reviews and formal investigations.

    Since becoming commissioner, I have initiated more than 100  administrative reviews. I have tabled 10 Reports on Investigation in Parliament, finding that 12 lobbyists breached the Lobbyists' Code of Conduct. I have made 11 referrals to the RCMP when I had reasonable grounds to believe that an offence had occurred.

    In July of 2013, there was an historic first conviction for a breach under the Lobbying Act. An individual was fined $7,500 for failing to register his lobbying activities. The act provides me with the authority to prohibit an individual from lobbying for up to two years if convicted of an offence under the act. I decided in this case to prohibit the individual from lobbying for a period of four months.

    My priority for the compliance program is to develop a more strategic approach to compliance verification. I will do this by conducting activities such as compliance audits and analyzing lobbying performed in various sectors of the economy. I also plan on improving efficiency by implementing an automated case management system to help manage compliance files.

    Finally, internal services support the programs and other corporate obligations of my organization. Approximately two-thirds of the internal services expenditure is for support services secured through formal agreements with other government institutions. This strategy offers access to a broad range of expertise that I need to meet my accountabilities as deputy head.

    This year I plan to implement a segregated computer network within my office. This network will not be connected to the Internet and will enhance the security of sensitive information, particularly as it relates to compliance files. This segregated network will provide an ideal platform to implement the case management system I mentioned earlier.

    I want to close by saying that I am proud of the work my office has done over the last few years. I have assembled a dedicated team of professionals and I continually strive to allocate my resources in a manner that allows me to deliver my mandate as efficiently and as effectively as possible.

    Mr. Chair, this concludes my remarks. I look forward to answering any questions you and the committee members may have.

    Thank you very much, Ms. Shepherd, for your presentation.

    I'm sure committee members do have many questions for both of the agents of Parliament attending today.

    First, for the official opposition, the NDP, Mr. Mathieu Ravignat.

    Thank you, Mr. Chair.

    Thank you for being here. It's a pleasure to have most of you, at least, here in one meeting.

    An argument could be made that Canadians would prefer that the government not streamline your offices. You're kind of the front line for accountability; I think of all the places that we could be cutting, it could be elsewhere. I understand that you're doing what you can with the resources you have, and that is admirable, of course.

    Madam Shepherd, you mentioned that with the changes to your budget, you could “manage”. To me, and probably not to Canadians, “manage” is not a particularly encouraging word. In what respect do you think the budgetary restraints that you're under will impede your work? What is the most significantly reduced area of spending? And should Canadians be worried about you being able to fulfill your mandate?

    Well, the strategic operating review that I did in 2011 did indicate, and I've said this before at this committee, that I'm running a very lean and efficient organization.

    You are indeed; you are indeed.

    I'm lucky, as well, that I have a very dedicated team of staff who are more than willing to wear more than one hat.

    That said, in terms of the strategic operating review, it indicated that I could absorb a 5% reduction in this registration system. What that has meant is that there's no development anymore; I'm now in maintenance function.

    In the short term that's sustainable. We have, because of the money we've put in over the years, a very robust system. I have full confidence that Canadians can continue to access the data and so on, but my concern with that is probably the long term, because eventually, with technology advancing.... I no longer have developers working on the system, so that will require that at some point, with the limited discretionary budget I have, some of my priorities will have to in fact go into that system.

    Will it have an impact on your investigations at all?

    At this point I would say no, because we've been working on the investigations in terms of making them more efficient. That's one of the reasons for the case management system. I've always said that I take all allegations seriously, and I do. Since I became commissioner I've opened 118 administrative reviews, closed 126, with 11 referrals to the RCMP.

    So at this point I do not see an impeding on my investigations.

    Thank you very much.

    My next question goes to Ms. Bernier.

    In your report on plans and priorities for this year, we read:

    You say so yourself.

    I will ask you a question similar to the one I asked Ms. Shepherd. Do you have the financial resources you need to do your job? If you had more resources, what could you do better or do more of? What kind of pressure does your office currently face because of the budget cuts?

    Thank you for the question.

    Yes indeed, we have been forced to rethink our way of doing things because our budget envelope has been reduced while Canadians' interest in these matters has increased. Maintaining our level of excellence is our priority, of course.

    As I said, we have adopted a proportional approach. That is the key. For the public sector, for example, we group together all the complaints about systemic matters. I gave you the example of ESDC, where we received more than 1,000 complaints, all about the same incident. We grouped them together and filed one complaint of our own. That allowed us to conduct one single investigation for more than 1,000 Canadians and to resolve it in favour of them all. We are doing the same thing with Bell in the private sector.

    The same proportional approach also applies to evaluating privacy matters. When a department provides us with an assessment, we have to check the impact of its initiatives on privacy. There again, we determine where the biggest risk to the privacy of Canadians lies. We concentrate all our efforts on it.

    I would like to ask you a more specific question.

    The electronic world is changing rapidly. You must do a lot of research in order to understand the new issues. Is that research in jeopardy because of the budget cuts?

    At the moment, we are managing to make the necessary adjustments. The quality of our research program is really remarkable, as you have probably been able to see if you have looked at our website. At the moment, we are still able to fulfill our mandate in that area.

    You have about one minute.

    Okay.

    Will you be able to say the same next year?

    That is still an open question, but as I said earlier, Canadians have an increased interest in those matters. The vulnerability of the technology means that there are more and more incidents and they affect even extremely sophisticated and responsible organizations.

    As for next year, I think we will have to see then. It is clear, however, that the volume and complexity of our workload is trending upwards.

    Thank you.

    Thank you, Mr. Ravignat. That concludes your time.

    Next, from the Conservative Party, we have Pat Davidson.

    Thank you very much, Mr. Chair.

    Thank you both for being with us, and thanks as well as to your support staff.

    First, I would like to thank you very much for the job that both of you are doing in your departments. I think you have operated well, and I think both of you have answered the call to do things in a better way, perhaps, and we've seen the results of that.

    I have a couple of questions. The first is for Madam Bernier.

    You talked about your mandatory move. I know that when you were here previously this was quite an item of discussion, because at that time it appeared to be a very costly endeavour. Has that move been totally completed, and how did it go?

    Thank you for that question, because it gives me the opportunity to publicly recognize our staff under the direction of Daniel Nadeau. It went amazingly well. There is obviously a need to adapt. For example, people's personal lives have been disrupted by moving to another location, commuting, and so on. We have moved to an open space, so that requires adaptation from closed offices. However, all in all, it has gone very well.

    The one clarification I would make on that is that the move has also shown how taxing it was for the team. We are looking at how we can make sure that indeed we absorb that extraordinary effort that they've made. The people who have made it will need to be supported through the adaptation.

    That's good.

    One of the things you said in your opening remarks was that “breach reports from federal organizations more than doubled, to 228”. Then, if I heard you correctly, you also made the statement that breaches themselves may not be increasing, but you think notification is improving and therefore that raises compliance.

    Can you comment a bit more on that, please? If in fact that is the case, why do you think it might be happening?

    Admittedly, that is speculation. I speculate that the reason we have more breach reporting is not because there are more breaches but because there is a greater awareness to report.

    The reason we speculate in that direction is this. When we look at the challenges in protecting personal information, it was always there; I mean, it is quite something. However, the awareness towards the preciousness, so to speak, of personal information has really increased, and the demands for accountability on that are clearly increasing.

     That is what makes us think that if we are seeing a greater number of notifications, it's because organizations are more and more aware of the moral obligation—not necessarily legal, because there is no legal mandatory breach notification—to notify and that notification is essential to help the individuals concerned to protect themselves should it be necessary.

    For example, when SIN numbers or credit card numbers have been exposed, then obviously the data holder who has suffered the breach must inform individuals so that they can take the measures necessary to protect themselves.

    You also talked about the tools you are using, the appropriate tools, and I commend you for the way you are using those tools.

     One of the things you talked about was leveraging domestic and international partnerships. Could you explain that a little bit further, please?

    Absolutely. I'll give you an example of how we leverage national partnerships.

    There are three provinces that have their own private sector legislation, and they are Quebec, Alberta, and British Columbia. When a big organization, for example, LinkedIn, suffered a breach, we reached out to the three provinces. Rather than the four of us going to LinkedIn independently, we went to LinkedIn together.

    LinkedIn proved to be a very responsible organization. It's an example not just of leveraging our national counterparts' expertise, but also of engaging with an organization in a less expensive way to reach compliance.

     We did not do an investigation of LinkedIn. We engaged with them in an informal investigation. In fact, we asked them what happened, what the management failings were, and what they were doing about it. So we got resolution with a much lower expenditure of effort and money.

    In relation to the international partners, let's take the investigation of WhatsApp, an American company about which we had concerns. We had concerns about lack of encryption of messages, for example. We had concerns about the transparency, because the location of an individual was almost broadcasted. The Dutch Data Protection Authority had the same concerns. So we decided to join forces.

     Doing the investigation together allowed us to divide the work. They took on mainly the technological analysis. We took on the negotiation with the American company. Together we did coordinated investigations that fed into each other and were, therefore, much more efficient. In less than a year we managed to conclude that investigation. That's another example of how we leveraged international counterparts' efforts for greater efficiency with fewer resources.

     That's great news. Thank you.

    Do I still have some time, Mr. Chair?

    You're exactly finished.

    I am? Okay.

     Nice timing, yes; thank you very much.

    We have to remember that the seven minutes is for questions and answers, and the time goes very quickly.

    Next, for the Liberal Party, is Scott Andrews.

    Thank you very much, Mr. Chair.

     Commissioners, welcome. It's a pleasure to have you back here again.

     Ms. Bernier, I'm going to start with you. Your office never knows the next thing that's going to be thrown at it. The world is changing. You may have three or four different files thrown at you at one time.

    I have a question about a recent file that's been thrown at you and about how you're managing it. It's the Heartbleed privacy breach. Obviously we're just starting to learn a little bit about this. Is this something that's going to consume a lot of the resources in your office right now? If we were to have another case similar to that, how much of your office's resources would be taken up to deal with this one particular issue?

    Your premise is quite right. I believe it characterizes our office. Because technology and society are moving so fast in relation to privacy and personal information, indeed we never know what's going to come at us.

    Turning to Heartbleed, immediately when we heard about it, our technological analysis unit examined the issue, briefed me on it, and explained to me that in fact it was an Internet-wide issue that was probably not malicious, and that it was probably an honest mistake that created a vulnerability that data holders did not know about because no one knew about it. As well, as we now know, it was unfortunately exploited by some hackers.

    What we see in front of us now is a situation in which the vulnerability of the Internet was exposed. More than the deficiencies of any data holder, it was the vulnerability of the Internet that was exposed.

    We also saw that these vulnerabilities can be exploited with malicious intent either for personal gain or perhaps just for fun. Sadly, we see a lot of hacking just for fun.

    At this point, we have no investigation related to Heartbleed, probably due to the fact that the only instance has been very quickly contained. I am speaking based only on the facts I know so far. I reserve my position on it in case I should get more information. But on the basis of what we know so far, there has been no management failing. It was a vulnerability in the Internet and what had to be done to contain it has been done.

     So it's limited to just CRA? That was my next question. How many different government organizations or businesses have contacted you about a potential breach in Heartbleed?

    It's only CRA. I was informed of all the measures they were taking, including notification of the individuals concerned, and all the measures they had taken technologically. As you know, we have posted a statement on that on our website.

    Ms. Bernier, another file that may or not consume some of your time is the accountability gap when government agencies are accessing privacy information. You just released some information in 2011, the 1.2 million requests, and you are sort of throwing your hands up, saying that we don't know what's going on; we have government organizations on one side saying, yes, we're complying and everything is okay; we have the telecoms and the social media on the other side saying, yes, we're complying. But nobody as a watchdog, Parliament or yourself, is....

    How do you see that as a major problem?

    You're referring to our January 28, 2014, special report to Parliament on checks and controls where we make a specific recommendation precisely to address the accountability gap, which would be for the private entities to annually report on how many requests they answer, with some specificity as to whether it is with a warrant or without a warrant.

    I have, in front of me, the answer that we received from the telcos, and it allows me to make a few clarifications. The 1.2 million that we received as the figure was in answer to a question that refers to government authorities in general. It could be municipal, provincial, or federal. It is very, very broad. It does not give any specificity of detail as to the circumstances, which is why in May 2013 we made first the recommendation in relation to reform of PIPEDA, the private sector legislation, to create an obligation for private entities to disclose the statistics as to how often they answer requests and under what circumstances, and we picked up that recommendation again in our January 28 report. We believe that it would give a sense of the scope of the phenomenon.

    I have one quick question on that. A lot of people will say about basic subscriber information that's being provided...that's it's okay without a warrant; we're talking address, phone number, e-mail, IP address. Does it go any further than those? There's a lot of discussion around the metadata and the envelope and communications. When you say basic, where do you see basic subscriber information?

    We have done research precisely on that. We have “What an IP address can reveal about you” posted on our website. It sought precisely to address this question. When an IP address and the customer information behind it is revealed, is it really sensitive or is it innocuous information? You will see in that technical analysis that in fact it is not innocuous, because it reveals Internet searches. Internet searches will reveal a person's interests, preoccupations, opinions, allegiances. So that in itself should be protected.

    Is it anything above those things? When people talk about the envelope, where you've sent, who you've sent to and from, is that part of basic subscriber information?

    That is precisely what we looked at. We found—it is well described in that technical analysis—that the envelope is in itself revealing.

    That's basic subscriber information?

    That is basic subscriber information linked to the Internet activity.

    Mr. Andrews, I'm afraid you're well over your time allowed. As interesting as this is, I have to cut you off, I'm afraid.

    Next, for the Conservative Party, is Mr. Zimmer.

    Thank you, Mr. Chair.

    Thank you for appearing before the committee today.

    My questions are predominantly for Ms. Bernier. We certainly appreciate what you do in your office. Many Canadians, although it goes unnoticed, definitely appreciate the results.

    I just have a couple of questions for you. First, “Reduced resources” is one of your titles here, and you say this: “Beginning with our financial situation, looking at the numbers, you see a decrease in our resources of nearly $5 million.”

    What is your overall budget, just to put that into context?

    The overall budget is $24 million.

    That's per year?

    Yes. Last year it was $29 million. The reason for the discrepancy is what I've explained.

    Can you give us a breakdown of that figure, of where the money is spent?

    Certainly.

    Or perhaps I can ask Daniel—

    If Daniel would like to do it, that would be fine.

    Daniel, do you want to take this?

    Certainly.

    Of the $24 million in budgets that we have in the main estimates for 2014-15, about two-thirds of that is for salary of our personnel. We have about 181 FTEs in our organization. The remainder is other operating funds. A small portion of that, approximately $500,000, covers contribution programs, mainly for research-associated activities.

    Out of this funding of $24 million, we have almost half dedicated to our compliance activities. These are our investigations, both on the Privacy Act side and on the PIPEDA side, as well as our PIAs, privacy impact assessments, and some of our audits, things of that sort—any activities, whether they be legal activities or technological activities, that support that function. That's almost half of our organization.

    As well, we have about 12% to 15% dedicated for our research and policy development activities, which are an integral part of the organization, as well as our public outreach activities.

    Finally, the remainder—so about a quarter of those resources—is dedicated to internal services that support all of these programs.

    Thank you.

    I have one more question for you, Ms. Bernier. Further down in your statement, again under reduced resources, you say this: “While we were not mandated to make reductions under the Plan, in the spirit of collegiality, our Office answered the call to adhere to its intent.”

    Can you explain that statement, please?

    Well, indeed we were not obligated. We felt that we should be good corporate citizens and therefore offer to participate in any way to address the fiscal pressures that the entire Government of Canada was identifying.

    What do you mean by “not obligated”?

    It's in the sense that we were not forced. We did not receive a formal request saying “You need to produce that amount of reduction”. We were not forced, we were invited to. We were not forced, but we felt that it was our moral duty to do so.

    So it was somewhat voluntary; even though you were invited, you still voluntarily went ahead and went forward with those reductions.

    Exactly.

    Thank you.

    That's all I have. Thank you, Mr. Chair.

    Thank you very much, Mr. Zimmer.

    That concludes the round of questioning for this panel of witnesses. We thank them for their presentations today and for being with us here, and ask them, please, to excuse themselves so that the next panel can join us.

    Thank you very much for being here, Madam Bernier and Madam Shepherd.

    I'll suspend the meeting briefly while we change panels.

    Good morning again, ladies and gentlemen. We'll reconvene our meeting.

    We'll welcome our next panel, two distinguished officers of Parliament.

    From the Office of the Conflict of Interest and Ethics Commissioner, we have Ethics Commissioner Mary Dawson.

    Welcome, Ms. Dawson.

    From the Office of the Information Commissioner of Canada, we don't have the commissioner herself but we welcome representatives Emily McCarthy and Layla Michaud.

    We'll do the same as we did with the first two representatives in our first panel. We'll invite five- or ten-minute opening remarks, and there will be time for one full round of questioning.

    I advise members that we're going to conclude a few minutes early so that we can do the votes on the estimates and return them to Parliament after having been voted on at the committee. As well, we'd like time to deal with a motion by Mr. Scott Andrews. I would perhaps ask people to be very concise with their questioning to keep to the prescribed limit of the questions.

    Having said that, we will go in order that appears on the agenda. We will invite Ms. Mary Dawson, the Ethics Commissioner, to please make her opening remarks.

    Welcome, Ms. Dawson.

    Mr. Chair, thank you for inviting me to appear before the committee today as it studies the main estimates for our office for the financial year 2014-2015.

    With me today is Denise Benoit, Director of Corporate Management.

    I will briefly describe the office's organization and operations and I will then talk about our financial needs for the current financial year and some related considerations.

    In support of my mandate to administer the Conflict of Interest Act for public office holders and the Conflict of Interest Code for Members of the House of Commons, I have organized my office into five divisions.

    Reflecting our primary goal of helping public office holders and members meet their obligations under the act and the code through education and guidance, advisory and compliance is the largest division, accounting for about one third of my staff. This group provides confidential advice to our stakeholders. It reviews their confidential reports, maintains internal records of this information, and administers a system of public disclosure.

    In keeping with my emphasis on education and advice as the best way to achieve compliance, the policy, research, and communications division coordinates education and outreach activities. It also contributes to policy development, compiles research, conducts public communications and media relations, and coordinates our dealings with Parliament and external organizations.

    While the major focus of my office is on prevention, we also investigate possible contraventions of the act and the code. Our reports and investigations division leads our investigations and coordinates the preparation of our annual reports.

    Legal services also plays a critical role in our investigations, and provides strategic legal advice to all facets of our work.

    Our corporate management division oversees the development and implementation of internal management policies and the delivery of services and advice on human resources, finance, information technology, information management, and the management of our office facilities. It also administers our shared services agreements with other organizations.

    Finally, my own small team in the commissioner's office provides general administrative and logistical support for the office.

    There are 49 positions in my office. Although staff turnover remains low, four positions are currently vacant as a result of employee departures. Before staffing these positions, we're assessing operational requirements.

    For the first five years after my office was created in July 2007, we maintained an operating budget that remained unchanged at $7.1 million. I considered that would be sufficient once my office was fully operational, although we have never had to spend the full amount. We have implemented measures to reduce expenditures, such as using e-mail rather than regular mail to communicate with our stakeholders; using webcasts to participate in conferences, thereby reducing travel costs; and centralizing certain purchases and functions.

    In 2013-14 we decided not to immediately fill positions that became vacant during the year, and eliminated one position in the corporate management division. We have also reduced the amount set aside as a reserve to cover unexpected situations.

    Some of those efficiencies were identified in a spending review that I initiated in 2012-13. As a result of that review, I was able to proactively offer an overall budget reduction of 1.4% for the last fiscal year.

    This year I've offered a further reduction of 1.4%, as I expect my office to be able to fund its operations with a budget of just $6.9 million in 2014-15. This amount is sufficient to discharge my mandate in its current form, although any changes resulting from the current reviews of the act and the code could have resource implications for my office.

    My office is an entity of Parliament that is not subject to most Treasury Board policies and guidelines, or to most legislation governing the administration of the public service. Nevertheless, we have worked to establish and maintain an internal management framework based on the principles of sound resource management followed in the public service.

    Over the past fiscal year, for example, we have formalized practices already adopted by the office through the development and implementation of internal directives related to expenditure management, including travel, conference, and hospitality expenses, and the use of acquisition cards.

    My office continues to rely on the expertise of other entities of Parliament, as well as Public Works and Government Services Canada, for the delivery of shared services. We have agreements with the House of Commons for technology and security, with the Library of Parliament for accounts payable and external reporting, and with PWGSC for compensation. These arrangements provide greater efficiency and one more level of scrutiny in the management of resources.

    In the past fiscal year, we have had our internal controls for expenditure management assessed by the Library of Parliament. I'm pleased to report that we've had very positive results. I'm also pleased to report that, for the third year, the annual financial statements for my office were audited independently, and we again received a positive opinion.

    We continue to follow good management practices in other areas of our operations as well. Building on our strong policy framework in the area of human resources, we implemented over the last year policies and guidelines to address occupational health and safety, disability management and the duty to accommodate, and management of specific forms of leave. We recently introduced our new directive on performance management, which is consistent with the approach being taken in the public service. We are also in the process of developing competency profiles for all positions.

    In May 2013 my office contracted with an external company to carry out an employee satisfaction survey. We achieved a response rate of 98%, and overall survey results suggest that employees are generally satisfied. We have acted to address concerns that were raised regarding opportunities for advancement within the office, employee empowerment, and the establishment of a conflict resolution mechanism. We have nearly finalized the development of a performance measurement strategy to demonstrate the effectiveness of my office in fulfilling its mandate.

    We recently reviewed and updated the strategic plan for my office, identifying priorities and projects going forward. Our strategic priorities for 2014-15 include addressing any changes arising from the reviews of the act and the code, updating the public registries, completing an internal practice manual, implementing our performance measurement strategy, continuing to identify opportunities for cost savings, and succession planning.

    My thanks once again to the committee for inviting me to discuss our main estimates. I will be pleased to answer your questions.

    Thank you very much, Ms. Dawson. We appreciate your remarks.

    Next, on behalf of the Information Commissioner, and representing the Office of the Information Commissioner, is Emily McCarthy.

    Thank you.

    Thank you, Mr. Chair, for the opportunity to discuss the operations of the Office of the Information Commissioner and to outline some of our key priorities for the year ahead.

    I am Emily McCarthy, Assistant Information Commissioner. I am accompanied by Layla Michaud, the office's Director General of Corporate Services. The Commissioner sends her regrets that she is unable to appear today.

     This year the Office of the Information Commissioner's budget to support its program activities is $11.2 million, which represents a decrease of $3.3 million from the last fiscal year. This reduction reflects a one-time $2.6-million loan received last year for the relocation of the office to Gatineau, the associated loan repayments for 2014-15, and the sunsetting of a five-year IM/IT strategy.

    The Office of the Information Commissioner employs 93 full-time equivalents, 70 in program and 23 in various corporate service functions.

    Over the last three years, the focus of the commissioner has been on the realization of the key priorities set out in her strategic plan, which comes to an end this year. One of these key priorities is to provide exemplary service to Canadians. This priority relates to our core business, which is to investigate institutions' handling of access to information requests.

    Over the last three years, our investigators have completed more than 4,700 investigations. We have improved how quickly investigators respond to complainants and have gotten additional information released whenever possible. We have also implemented a strategic approach to managing our caseload.

    Looking ahead to the current year, we will complete the remaining commitments identified in the office's strategic plan. For example, we will continue to improve our investigations of complex refusal complaints. This will involve setting clear steps and timelines for the investigative process. This will allow us to closely monitor ongoing investigations to further improve timeliness. We will also be introducing, on a pilot basis, a process which will seek to rapidly resolve or clarify complaints. These enhancements will strengthen the process and make it more efficient.

    The commissioner will also issue a comprehensive report in which she will make recommendations for the modernization of the Access to Information Act. The focus will be on suggestions for reforms that respond to factors that have had a profound effect on access to information since the act became law in 1983 such as technological developments. These suggestions will be based on the commissioner's unique perspective as the first level of independent oversight.

    Finally, we will fully implement the new integrated human resources plan. The cornerstone of this plan is excellence. This year, the commissioner will develop a new strategic plan to see the office through to the end of her term in 2017. This will be done in consultation with employees and other stakeholders.

    As you will see in the office's report on plans and priorities, everyone at the Office of the Information Commissioner is working to meet demanding performance targets: to complete 85% of administrative cases within 90 days and 75% of priority or early resolution cases within six months. However, a key element of risk to the office remains our limited financial resources. The commissioner has said in previous appearances that the office has no financial and organizational flexibility. She has raised concerns that this will impact on her ability to deliver on her mandate.

    Over the past four fiscal years, the office's budget has been impacted by nearly 9% due to cuts and other measures. In addition to this, we will need to review our planned expenditures in light of the two-year operational spending freeze announced in the 2013 Speech from the Throne, which will take effect this fiscal year.

    At the same time, our workload is growing. Last year we received 2,081 new complaints, an increase of 30% over the previous year. As of March 31, we had 2,089 complaints in our inventory, having closed 1,789 during the past year. This closure rate is 10% higher than the previous year and 20% higher than 2011-12. However, due to the increase in new complaints, our inventory grew for the first time in five years. Given this workload and the office's limited resources, there is now, on average, a six-month gap between the time a complaint is registered and the time it is assigned to an investigator.

    Under these circumstances, the commissioner is concerned about her continued ability to deliver on her mandate, which would jeopardize the rights conferred by the act. The commissioner, however, has clearly indicated that she is resolved to continue. She has an ambitious agenda for this year. And she has a dedicated group of employees who continue to make every effort to serve Canadians to their best of their ability.

    Thank you, Mr. Chair. I would be pleased to answer any questions committee members may have.

    Thank you very much, Ms. McCarthy.

    I'm sure there are many questions, so we'll begin right away with the official opposition, the New Democratic Party, Charmaine Borg.

    Thank you, Mr. Chair.

    I am going to share my time with Mr. Ravignat, given that we will not have many question periods today.

    I would like to thank the witnesses for taking the time to appear before us and provide us with their testimony, despite their very busy schedules.

    My first question goes to the people from the Office of the Information Commissioner.

    Ms. McCarthy, in your report dealing with PIN messages, you said that there is a major hole in the act that allows the government not to document those messages. Specifically, PIN messages would be saved only for three days. Clearly, that creates a gap in terms of the duty to document certain issues.

    Does that situation pose a problem for your investigations and for obtaining documents in connection with scandals or the issues that you have to resolve? What is your opinion of the change in the regulations on those PINs?

    Thank you for your question. I will first talk about the duty to document the decisions.

    The commissioner clearly requested an amendment to the Access to Information Act that would make a requirement to document decisions. She finds that important.

    In terms of PIN messages, I believe that the Treasury Board now treats them like emails. They are kept for 30 days instead of 72 hours. That has been changed. That was a draft policy that came up during the investigation. Right now, they are treated in the same way.

    Let me end by saying a few words about our capacity to investigate. We have difficulty investigating complaints when someone thinks that documents may have not been processed by the institution and that the communication that took place either by email or PIN has not been kept.

    Thank you.

    I will share the rest of my time with Mr. Ravignat.

    I don't think it would be an understatement to talk about a crisis in the access to information system today. I think there are so many Canadians who are frustrated, whether it be journalists trying to get information...and when they do get information, it seems like ministerial confidentiality or cabinet confidentiality is used in an excessive way.

    So I'm not surprised to hear that you're getting more cases of complaints, and I wouldn't be surprised if the amount of those complaints increased exponentially in the last few years, which makes it even more illogical to be cutting your office. It seems that you would need more. I also point out that you've been reduced a little bit more than some of the others, which is of concern to me, in certain areas, which seem particularly strategic.

    I have a question related to political interference in the access to information system. Recently we saw that this occurred; there are some staff who got involved, and it puts you in a particularly difficult situation. We think that it's completely unacceptable.

    Now, is the fact that you're getting less funding do you think associated to this kind of willingness to kind of pull the rug from under the access to information system—basically cut its legs at the kneecaps?

    I'll ask Madame Michaud to respond to that.

    I will just talk about the issue of funding. We are talking about a 9% cut to the budget. I will quickly provide you with the breakdown of that.

    With budget 2012, there was an impact of approximately $500,000. Prior to that, in 2010, we had to absorb increases to salaries to the tune of another $350,000. We also have to pay off the loan of $2.6 million for our relocation, which is about $200,000 a year. For us, that is the equivalent of 9%.

    As a result, we have very little financial flexibility. We have no choice but to investigate all the complaints received by the office of the commissioner. Right now, there is a six-month wait before complaints can be forwarded to one of our investigators.

    How are you going to manage if you are not able to hire people to conduct the investigations?

    We are looking at our internal processes. We are trying to find the most efficient solutions possible. We have a triage and prioritization system.

    This fall, we are going to make recommendations on reforming the legislation, hoping that some of our recommendations will help make the access to information system more efficient.

    Have you felt you were more targeted than other commissioners by the office of the President of the Treasury Board?

    I think cuts were asked across the system; the agents of Parliament volunteered to participate in those cuts. The commissioner had written to the minister to explain that her budget was already under strain. I think that's the status.

    We've expressed in the past...in a past appearance of the commissioner, that she did not believe her budget was sufficient to accomplish her mandate as it stands.

    Thank you very much.

    I think my time is up.

    Yes, I'm afraid your time is up, Mr. Ravignat.

    Could I ask witnesses to allow the button keeper to press the buttons instead of you? It's a unionized job, and we'll have a grievance. We'd like to keep them here; that's right.

    Next, for the Conservatives, Mr. Jacques Gourde.

    Thank you, Mr. Chair.

    My thanks to the witnesses for being here with us today. I think you have shown that you manage your respective budgets wisely.

    My first question is for Ms. McCarthy.

    You have put in place a strategic approach to manage your workload and you have ensured that investigators have the tools they need. Could you elaborate on your approach? That might give a variety of ideas to those responsible for other offices. Managing an office well is an ongoing challenge.

    First of all, there is a process for receiving complaints. As soon as we receive a complaint, we do the sorting. We review the complaint and determine whether it is an administrative complaint or a complaint about denial of access. Then, different teams conduct the administrative investigations, either for a quick resolution or for the more complex cases. We make sure that resources are used effectively.

    We also look at the issues raised to see whether it is possible to group the complaints together in order to process them effectively. We examine our internal processes through a case management system to ensure that everything is documented in our system. That helps us a great deal with reviewing our internal processes. We are looking into our processes for more complex investigations and for the refusals in order to improve our processes.

    Overall, would you say that the complaints you receive are individual complaints or is there a certain percentage of recurring complaints? Are you always getting the same thing under different names?

    That varies considerably from one institution to another. This year, we have not seen many large groupings of topics. It really depends on the institution.

    Thank you.

    Ms. Dawson, let's talk about your work.

    Of course, we have to provide our statements. Are the files the same or are there major differences between them?

    It's always the same topic. We deal with reports. Are you talking about the investigation files or the files—

    I am talking about the files that parliamentarians must submit annually and that need to be renewed. That is a fairly repetitive process. Do you have a designated team for that?

    Yes, the largest unit in our office is the one that deals with those types of things. It also provides advice along the way.

    Do you want to add anything, Denise?

    Our advisory and compliance branch is responsible for what we call our annual revenue. We use an integrated case management system that helps us a great deal because it gives us a recall system. Priority has been given specifically to those annual reviews so that we can be up to date on the situation of our clients.

    So that represents about 60% or 70% of the overall work of the office of the commissioner.

    That is probably our organization's biggest responsibility.

    I would say that it is approximately 40%.

    You also provide advice to those who ask for it. In some circumstances, your advice must be needed. What portion of your work does that account for? Is it 15%?

    That represents about 20% of our work. It is difficult to say because that aspect of our work overlaps with other activities, but I can say that it represents a good portion of our work.

    Does processing complaints and issues account for the rest of your work?

    Investigations also take quite a bit of time. It is difficult to determine the exact percentage. There is a branch that deals with investigations only. There are also lawyers who often deal with the investigations. That probably represents 20% of the work done by our office.

    You said you never had to use your entire budget. Do you think that will still be a possibility in the coming years?

    We have reduced our budget slightly and I hope we will continue to do so. We are waiting to see whether there will be changes after the five-year reviews. If our mandate remains the same, I think we will have sufficient funding.

    All parliamentarians end up working with you and we receive very good service. Thank you.

     Thank you, Mr. Gourde.

    Next, for the Liberal Party, Mr. Scott Andrews.

    Welcome today. It's a pleasure to have you all back here.

    Ms. Dawson, I want to touch on something you said in your opening statement, that over the last three years, you've had some 47,000 complaints to deal with. You mentioned that you're implementing a strategic approach to managing your caseloads.

    Do you want to elaborate a little on that and share with the committee the strategic approach you're taking with your investigators and in your office?

    I think Denise would probably answer that a little more completely.

    Actually, if I'm not mistaken, I think the strategic approach for dealing with case management was brought up by our colleagues in the Information Commissioner's office.

    Yes. My apologies.

    It didn't ring a bell.

    I'm sorry.

    So this is for the Information Commissioner's office.

    You're looking for information about how we're managing our caseload in a strategic way?

    Yes.

    Okay.

    What we've done is to implement an intake process that does a triage of our complaints. This allows us to assess the complexity of the complaints and stream them into a certain investigation stream. We have different teams that deal with different types of investigations. We also look at the nature of the complaint, the subject of the complaint, the institution to which the complaint is addressed, as well as the complainant, to ensure that we group together complaints to the extent possible, and treat them in a holistic sense as opposed to one by one.

    We also have a specific strategy to deal with what we call special delegation complaints, which are complaints that deal with exemptions applied for international affairs, national security, and national defence. We have a specific team that works with those and a specific process that the commissioner piloted about two years ago and has now un-piloted and made permanent.

    Has that affected the timeframe in which to resolve some of this? Has that sped up the timeframe? Often we hear that the complaints take so long to resolve.

    We've had an improvement. Last year I believe we closed 57% of our complaints in less than nine months. This year we have closed 63% of our complaints in less than nine months. We are seeing an increase in the timeliness turnaround of our complaints. As we said earlier, our target is to close our administrative complaints, which deal with delays, extensions, and fees, within 90 days. We're at about 68%, and we've seen a significant increase in the number of those complaints this year. Our other complaints, they'll close within nine months.

    So yes, we have seen an increase in the timeliness over the last two to three years.

    You just mentioned that you finished one pilot project that you're going to continue on, but you also say that you'll be introducing a pilot-based process that will seek to rapidly resolve complaints and clarify.

    Are we talking about the same thing there, or is that something different?

    That's something we're looking at doing this year, along the lines of, as complaints come in, having a senior investigator sit down and review particularly complex refusal cases to see whether there's any opportunity to settle the complaint at an early stage or, potentially, to clarify or narrow the scope of the complaint. Hopefully that will assist us in treating the complaints in a more strategic and rapid way.

    Thank you.

    Ms. Dawson, I should have realized when I said 4,700 complaints...because I hope you don't get that many complaints.

    In managing the complaints that come to your office, quite often there are a lot initiated by members of Parliament. Are you seeing that these are increasingly more? Is it stable over the years? Is that of concern to you?

    I'm finding that they're relatively stable. As a matter of fact, I have the power to self-initiate investigations. I've looked at the statistics there, and I actually probably self-initiate slightly more complaints than I get just as a result of information coming to me in other ways. I would say it's fairly stable at the moment.

    Do you want to give us a snapshot in time of how many complaints you have ongoing now, self-initiated files or files that you have ongoing?

    Yes. I have those numbers somewhere.

    Basically, just to give you a sense, we've worked on 41 files this year, but in fact many of those files don't actually come to a full investigation that we consider. I think there are something in the order of six or seven investigation files—seven, I think—open at the moment. Two of them are suspended at the moment. Those are full-blown investigations.

    Last year we issued four reports on investigations. That varies. We have a number of them that probably will be ready within a couple of months this year.

    I guess all I could say is that it's fairly stable. Those are the numbers we have. Many files, of course, lapse into the next year, but we average about 40 files that we're working on.

    Thank you.

    We will now go to Mr. Hawn for seven minutes, please.

    Thank you, Chair.

    Thank you all for being here.

    I'm going to ask you both a motherhood question—I recognize it's motherhood—and anybody can define the word “reasonable” the way they like. Do you think it is logical that all departments, big or small, DND or smaller offices like yours, should operate in as lean and efficient a manner as reasonably possible?

    Yes.

    I know it's motherhood, but thank you for the motherhood answer.

    Madam McCarthy, we heard from the Office of the Commissioner of Lobbying some points about how they have managed their workload. It sounds like you're doing a lot of the same thing in terms of grouping investigations, assigning investigators to specific types, and so on.

    Do you have any sense of how much that has saved you in terms of people or money? I'm not looking for a finite answer, but has it made all the difference?

    It certainly has assisted us. I think in the last annual report we were looking at about 50% of our inventory being related to three specific streams of institutions or subject matters. Now those three streams are down to about 38%, so we have seen, I think, an impact in those strategies.

    The other thing we've seen is that there's a lot better communication with complainants, which has made the process more efficient generally. I do think we have seen a significant improvement.

    We also heard about integration of support services, which of course is going on across the government. Both of your departments are doing that, I'm assuming.

    I'll start with Ms. McCarthy.

    Yes. We have actually sent our human resources function to Shared Services Canada. We also have explored opportunities to share services now that we're co-located with a number of other agents of Parliament.

    Madam Dawson, would that be the same for you?

    No, our office is a little bit different because we are part of Parliament as opposed to part of the public service. But we do outsource some of our basic things like staff payments and stuff.

    Madam Dawson, this is for you. We heard from the Office of the Privacy Commissioner about being a voluntary participant in SOR. I was on that committee, and I forget the number of departments we targeted but it was substantial. There were a lot of smaller departments. I think we just said “if you wish” and we encouraged them to. It sounds like you were one of the voluntary participants. Is that correct?

    That's right. Yes.

    How about yours, Madam McCarthy? It sounds like you might not have been a voluntary participant in the strategic operating review process.

    I'll let Madam Michaud answer that, perhaps.

    We sent a submission to the Minister of Justice to tell the minister what we were able to do and so on. It has been four years, and I have to tell you that our lapse is less than around 3%. This year it will be only $35,000, which is 0.2%.

    Pretty close to the line.

    Yes, pretty close to the line.

    Okay.

    Madam Dawson, we do annual reviews, as we all know, and it sounds like you spend a fair bit of time doing that. How much would it save you if we did biennial reviews instead of annual reviews? You know, change is by exception. I can't speak for anybody else, but my stuff doesn't change from year to year. What would it save if we did biennial reviews or reviews by exception?

    I don't think it would save much. Those annual reviews are fairly routine, and someone like you, who doesn't change very often, is very easy to deal with. It's important to see the ones who have changed. So personally I think an annual review is the appropriate length of time.

    I would debate that a little bit, but that's okay.

    Yes. Okay.

    This committee published a report this past February, “Statutory Review of the Conflict of Interest Act”, which contained a number of recommendations. I'm not sure what you've done with that. Do you have any comments regarding that report, or the impact or doability of the recommendations?

     I made a large number of recommendations in that report. I was happy to see that this committee studied it and supported a couple of those recommendations. But there could have been more, from my point of view. I guess we have to wait and see what the government does with it. But I stand behind my recommendations.

    Okay.

    Madam McCarthy, you talk about this strategic plan ending this year and a new strategic plan coming out. When does that plan get unveiled? Is there an approval process for that? Who vets that plan above your office?

    That strategic plan is established by the commissioner. It is being done in consultation with employees and stakeholders. The consultations are starting in June. I think we hope to have it....

    By the fall.

    By the fall; and it will be published on our Internet.

    Is there an approval process for that? Does somebody approve the commissioner's plan, or is it totally within her purview to say this is what we're doing?

    She is an independent agent of Parliament, so she establishes her office's priorities based on her legislative mandate.

    Madam Dawson, you talked about some employee empowerment measures; I think that was you, in your office. Can you describe those a little bit?

    What we've done is we've established a system. Instead of the executive committee always getting together to decide issues, we determined there are some that we can delegate to a subcommittee, basically. So that's our main measure that we have taken so far.

    Okay.

    We also have suggestion-box sorts of things as well.

    Without going into names or pack drill, obviously, you talked about self-initiating investigations. Is it possible to give an example of the kind of thing that would compel you to self-initiate an investigation?

    It's usually exactly the same kind of issues as I get complaints about. Just off the top of my head, many of the reports that I've put out have been as a result of self-initiated investigations.

    I would say that it's always the same kind of subject matter, whether it's by complaint or whether it's self-initiated. Sometimes it's from media reports; sometimes it's from citizens; sometimes it's from other members; and sometimes it's not an official complaint.

    But it's under the various parts of the act. I don't think there's a preponderance in how they come to me, which kind.

    Ms. Dawson, thank you very much.

    Mr. Hawn, that concludes the time set aside for questioning.

    I'd like to thank the representatives from the Office of the Information Commissioner and Ethics Commissioner Mary Dawson for their presentation.

    Without bothering to suspend the meeting, I think we'll go right into the votes for the consideration of estimates. We'll thank our witnesses for their presentations, and proceed right away to the meat and potatoes of our meeting, as it were.

    (Vote 1 agreed to on division)

    (Vote 1 agreed to on division)

    (Votes 1 and 5 agreed to on division)

    (Vote 1 agreed to on division)

    The Chair: Shall the chair report vote 1 under the Office of the Commissioner of Lobbying, vote 1 under the Office of the Conflict of Interest and Ethics Commissioner, votes 1 and 5 under the Offices of the Information and Privacy Commissioners of Canada, and vote 1 under the Senate Ethics Officer, less the amount voted in interim supply, to the House?

    Some hon. members: Agreed.

    The Chair: Thank you very much, committee members. That concludes our examination of the 2014-15 estimates for the agents of Parliament who report to our committee.

     We now have time, I'm glad to say, to deal with a notice of motion put forward by our colleague Scott Andrews.

     Scott, are you prepared to move your motion today?

    If we have time, yes, sure.

    We seem to have a luxury of time, actually.

    We don't normally have that.

    No.

    If it is your wish, then, you have the floor to move the motion that you gave notice about.

    Thank you, Mr. Chair.

    I will move the notice of motion that this committee undertake a study, of at least four meetings, on the transfer of personal consumer and subscriber information from Canadian telecom providers to the Canadian government, as disclosed by the Office of the Privacy Commissioner of Canada, and this committee report its findings and recommendations to the House.

    I think it is somewhat timely that we discuss it. We had the Information Commissioner here today.

    Let me state that this is not a gotcha motion. This is not trying to embarrass the government in any form, because one of the things the Information Commissioner told us this morning is that this information is being transferred to municipal agencies and other agencies as well; we really don't know. There's often good reason for information to be provided to our law enforcers and Canada Border Services.

    The intent is to make sure that this information is being transferred in a proper format. What concerns us is that the Information Commissioner states that there's no way of knowing if these government agencies and telecommunications and social media companies are following the rules. We should take a look at that, and see if they are following the rules or if the rules need to be tightened up a little. It's of some genuine interest.

    We know about warrant lists and warrant disclosures of information. Often there are important reasons for government agencies to work quickly and not get a warrant to request this information. We understand that. But when you see the sheer volume of these requests, I think some bells and whistles should go off that maybe we have a problem here. Is there a better way? How do these requests happen?

    From my understanding, a telecommunications company puts certain information to the side, and law enforcement agencies can have free rein to look at that information. Is that something we need to tighten up on? We really don't know.

    I commend the government; there are a few bills before the Senate and before Parliament right now that will look at some of this information as it comes forward. That's a side issue; that's something we'll look forward to seeing make its way through the Senate, and into the House...to disclose some of that information.

    It's about oversight. Right now there doesn't seem to be a lot of oversight on this, and no court oversight. Yes, the judicial system does apply for warrants for this, but not 1.2 million times, not 800 times. How many times are warrants being asked for and given? Is that taking up a lot of the time of our judicial system? We don't know because we don't know how many of these are warrants and how much is warrant-less information.

    I think we should take a short study of this, four meetings, to see if there's more to this. As I said, it's not trying to “get” the government, because I think we all have an opportunity to look at things in this House, and if our Information Commissioner and our Privacy Commissioner are feeling their hands are tied, it's our duty to look into this.

    One of the things that has come up for much debate is basic subscriber information from Internet service providers. Well, what is basic subscriber information? As we dive into this, we know it's your name, address, e-mail, and IP address. We had a little discussion this morning about the IP address as a very, very detailed piece of personal information—maybe, maybe not, but we should look into it.

    From what experts are telling us, it goes beyond that basic subscriber information. It goes into transmission data or metadata. The analogy that's being used is that's the information on the outside of the envelope from Canada Post: to, from, and when, as in when something was sent, whether it's e-mail or a phone call; it's that information. That's getting into grounds where we need to see if that should require a warrant or not, and it's of some concern.

    You know, it's a genuine motion. I think we as parliamentarians should have a look at this. The committee is probably the best spot to look at this to see if there's more to this than meets the eye. I do take the government for their word that most of this is being done on a warranted basis, and I hope it would be. We should just peel back the onion a little bit here and see if there is more to this than really meets the eye.

    That gives you an overview of the situation. I think we're all familiar with the information around it. It's our duty to ask some questions and get some more answers on this, especially when it comes to, as the motion says, subscriber information. Let's see how broad or narrow that definition is and whether that is causing the Canadian telecommunications companies some leeway.

    One of the things is that the Information Commissioner wrote 13 companies and social media companies as well. They're not telecom companies. Only nine responded and four didn't even bother to respond to the information commissioner.

    So she's given us an opportunity to look into this as an area of concern. I think it's something that we should take at least four meetings to dive into to see if there's something to this or not and give it the due diligence that it needs.

    Thank you, Mr. Andrews.

    That's a comprehensive argument in favour of your motion.

    Madam Borg would now like to contribute.

    Thank you, Mr. Chair.

    Let me just say that I am happy to see this motion introduced before this committee. I think our committee is the appropriate forum to review the situation since we have learned from the news that 1.2 million pieces of personal data were forwarded to the government.

    We have learned today that this involves several government agencies. The situation is extremely worrisome. I think Canadians are expecting some answers about that. As Mr. Andrews said, we must see whether there have been abuses, whether the requests were made with a warrant, why the data were sent and under what circumstances.

    I think more transparency is needed on the issue and we need to look into it together, as members of the committee, to find potential solutions to this. There is clearly a gap. The commissioner explicitly stated it today. We have to see what the committee can do to address this shortcoming we see in the legislation.

    The NDP plans to support the motion and I trust that all the members of the committee will do the same.

    Is there further debate?

    Mr. Calandra.

    I thank the member for bringing the motion forward.

    I know that as part of our identity theft study that we're undertaking right now we'll be having representatives from telecom before us, or I'm hoping that we'd put them on an approved list, at some point.

    Obviously, we've discussed it. We won't be supporting the motion right now. We think that as part of our identity theft study this might be an opportunity for us to engage a bit further, perhaps with telecoms and other service providers. In the context of our identity theft study, we had spoken separately with committee members about potentially bringing in the commissioner as we approached the conclusion of our identity theft study.

    So if the member would consider putting it on hold for now, let's see what we can get through as part of our study on identity theft, and perhaps we could consider.... I know that all committee members would probably agree with me that we've made some really good progress on identity theft. We had wanted to perhaps consider extending that study a little bit further to tackle some of these other issues that have come up as part of the study.

    In summation, I guess what we're saying is not at this time, but as part of our identity theft, perhaps we want to expand our witness list to include not only the telecom but other service providers, so that we can have them before us. As we said, perhaps towards the end of our identity theft study we could consider not only bringing in the commissioner but other individuals who have opened certain doors to us, and calling them back as well. Perhaps the member would be amenable to that. At the same time, I think we should probably look at other committees, I guess public safety, to see if this is before them or not.

    In conclusion, I know that the commissioner was in front of the Senate recently, I'm told...?

    The Privacy Commissioner or the Information Commissioner?

    I think it was the Privacy Commissioner who might have been in front of the Senate on Bill S-4.

    I had a chance to look at her testimony, so I'm wondering if the analysts could maybe just forward a copy or a link to her testimony so we could review that.

    If it's amenable to the committee, then, not right now, but we'll expand our witness list on identity theft and perhaps increase the study; I would even suggest more than four meetings.

    So perhaps that is acceptable.

    Mr. Calandra, just for the record, the telecoms are not currently on the witness list, but we can always add them.

    I thought they were on an approved list. Sorry, sir.

    I thought so too, but apparently not.

    Scott.

    Yes, I thought they were too, Telus and a few of them. Maybe we need to expand it a little.

    You know, I'm open to just putting this on the table for now, to give us some time, just as long as when the telecom companies come before committee, we do the identity piece and we give them a little bit of time for this, don't just jam in the witnesses. Maybe we'll see where the other committees are on this, because I guess it would overlap.

    As long as it doesn't get tidied up in the bill that's coming before the Senate now, because I think that's a separate piece, I'm willing, if it's the right protocol, Mr. Chair, to table this for the time being, to see where we go and revisit it in June. We are running out of time, and this may all get pushed into the fall.

    Just as a point of information, I'm informed now that Telus, Bell, and Rogers were in fact on the approved list; it's not a full range of telecoms or service providers.

    I wonder, then, if it would be appropriate, maybe at another meeting, if we could suggest some committee business, to maybe consider then adding additional providers outside of the big three. If members want to consider adding more, we can maybe discuss that at a future date on committee business so that we could add to the study a little bit.

    I think that's wise.

    Okay, then, we won't call for a vote on this motion today, Mr. Andrews. We'll consider it and we will see how much of it we can fold into the study on identity theft.

    Just for the information of committee members—I don't think we need to go in camera for this information—we won't have a meeting on Thursday. We're unable to get the witnesses from the banks that we anticipated, and we want to have a full panel of the banks when the time comes to speak to them.

    Charmaine.

    Just as a little point of information, is it due to their unwillingness to come or is it because of a scheduling issue?

    I guess it's the clerk who has been speaking to them, but it's been difficult to get them to agree to come. We have one that's tentatively offered to come, but they're saying they have to fly him in from California, etc.

    We've been clear that it's not the Canadian Bankers Association we want to speak to, it's the banks themselves, as private businesses, that we want to speak to.

    Yes, I agree.

    I think we do need to give the clerk some more time. Nobody said they won't attend, but it's been difficult to schedule them in a panel the way we want them to appear. All five at a time would be ideal as long as we could limit their remarks so they don't use up our entire time with five separate sets of remarks.

    Having said that, our next meeting, then, will be next Tuesday, and we'll be dealing with the clause-by-clause analysis of Bill C-520. The independent members of Parliament have been served notice that they have one week to get their amendments, if they choose, to the clerk, within 48 hours before the meeting. So I think we're all in compliance there.

    Members of the committee, of course, should amendments be coming forward from the various parties, must have them in 48 hours before that meeting.

    Seeing no other business, I have a motion to adjourn. It's non-debatable.

    We're adjourned.