:
Good afternoon, Mr. Chair and members of the committee. I thank you for the opportunity to address our submissions under the supplementary estimates and any questions you may have. Joining me today is Daniel Nadeau, our chief financial officer, and Patricia Kosseim, our senior-general counsel.
I would like to begin by explaining our submissions, and I will subsequently discuss some of our short-term priority issues.
First, let me explain the reason behind what is, in effect, a reinjection of almost $59,000 into our budget. As explained to this committee by my predecessor, our office made a mandatory move from Ottawa to a new facility in Gatineau in February 2014. The move's costs were forecasted mainly based on estimates provided by Public Works and Government Services Canada.
To cover them, the office needed to obtain a $4.1-million interest-free loan from the fiscal framework negotiated through the Treasury Board Secretariat and Department of Finance. We are repaying this loan over 15 years, ending in 2028-29.
The most recent main estimates reflected our first payment in 2014-15 of some $275,000. Since that time, however, the move's costs came in lower than expected. As a result, we returned nearly $900,000 to the fiscal framework, and our annual repayment figure decreased by some $59,000. And it is this latter figure which, in essence, would be returned to our office and be reinvested in our program activities.
[English]
I'll now move on to the other item for which we made a submission.
As you know, our office is one of three partners, along with the CRTC and the Competition Bureau, mandated to enforce Canada's anti-spam law. Our enforcement responsibilities under this law relate to the harvesting of electronic addresses in which bulk lists of email addresses are compiled for use by spammers and the collection of personal information by accessing computer systems primarily through what's known as spyware.
In order to gather reports and intelligence regarding these and other activities under the legislation, the government decided to create the Spam Reporting Centre, which is managed by the CRTC. You may remember that it was the government's initial plan to outsource the management of this centre to a private sector operator. However no compliant bids were received, so the CRTC stepped up to take on the role. The CRTC also sought the systems from partners to support the centre's analytical functions.
As a result, in 2011, it was agreed that our office would fund an analyst position at the centre and to that end we signed a two-year administrative arrangement in early 2014. The $125,000 we are transferring to the CRTC pays for an analyst to work on our behalf at the centre. This analyst was in place for CASL's coming into force in July of this year.
Now that the centre is operational, Canadians have been able to submit reports about unsolicited commercial electronic messages. The analyst's work has greatly assisted our office in identifying purveyors of address harvesting. This work has already contributed to identifying potential address harvesting cases for investigation.
Let me now turn to explaining how I plan to align the priorities of the OPC to the new realities brought forth by the emergence of today's increasingly digital economy and society. The digital revolution has truly opened up a new world, one of new technologies that have the potential of bringing benefits to us all. But this new world also comes with new risks for privacy. Take for instance the issue of big data. Rapidly increasing computer power and analytics capacity may help better identify threats and solutions to public health for emergency issues. But it can also lead to decisions about individuals based on inaccurate or incomplete information or data that people may have provided for different purposes altogether.
On top of this, while more information than ever before is being collected and processed, this raises the risk of data breaches calling for greater attention and ingenuity being devoted to cybersecurity. These are just a few of the rather complex issues confronting our office, organizations, and individuals.
Given our rapidly changing environment, we're embarking on an exercise to establish new privacy priority issues to meet the most pressing privacy challenges. In this exercise, our office will be engaging representatives from business, government, civil society, and academia. We will also be consulting focus groups to gauge the views of the general public.
The new privacy priorities resulting from the process will help hone our focus to make best use of our limited resources and further our ability to inform parliamentarians and protect and promote Canadians' privacy rights. I expect this process will be completed by spring 2015, and I look forward to sharing our outcomes with parliamentarians.
[Translation]
Mr. Chair and members, let me conclude now by underlining what lays at both the core of our work and of privacy, overall.
While the world around is rapidly changing, the value of privacy remains timeless. This is central to Canada's privacy laws and, therefore, to our priority-setting exercise.
I want to ensure that we stay ahead of the curve in a complex and quickly changing world, so we can ensure Canadians can exercise some control over their personal information. This will enable them to partake in the digital economy as informed and confident consumers, embracing new innovation with trust, rather than trepidation.
Rather than an impediment, effective privacy protection can and should be an enabler of innovation. It is my hope and ambition that the work of our office will be as effective as possible in helping organizations mitigate the risks of this new world in order to maximize its many opportunities.
Thank you.
I look forward to your questions.
:
Thank you for your question.
As I explained before a Senate committee recently, the Supreme Court ruling in Spencer is a very important step forward in privacy law. Before the ruling, it was difficult to know whether the information that Canadians were putting on the Internet could receive strong constitutional protection of privacy. However, the Spencer ruling clearly states that personal information ultimately related to a person's activities on the Internet can in fact receive strong constitutional protection.
There are lessons to be learned from that. Although the Supreme Court did not rule on the evidence required for a government to gain access to information that constitutes a reasonable expectation of privacy, in these conditions, we can expect the government to have access to that information only if there are what we call “reasonable grounds to believe”, which is generally the standard applicable here, and not on suspicion.
I think there is a link between the sensitive nature given to information by the Supreme Court and the evidence required for the government to have access to that information.
I will stop there.
:
In my opinion, Bill has an impact on privacy, in that it directly gives CSIS an extraterritorial mandate. That implies that information is being shared between the secret services and certain foreign agencies. That sharing of information is an issue that affects privacy very directly. That is where my concerns lie.
Obviously, CSIS already receives independent oversight from an agency called SIRC. However, as I'm sure you know, recommendations have been made about this. Particularly in the Arar case, Justice O'Connor highlighted the shortcomings in Canada's independent oversight mechanisms. He recommended that all government agencies involved in national security be subject to independent oversight, much like CSIS.
I would add that Bill C-44 deals with CSIS's mandate and, indirectly, the sharing of information by CSIS. However, it is important to know that the information obtained by CSIS is then shared with some federal organizations, which may not be subject to independent oversight. That is the case with the Canada Border Services Agency, for example. It is this lack of oversight by independent agencies that is worrisome.
:
We have recommended essentially four types of amendments to Bill .
One issue is related to the question of thresholds that I mentioned earlier. The bill currently proposes that access to information under production orders would be on the basis of reasonable suspicion. We recommend that it be on the basis of reasonable grounds to believe. I think that if it stays at the level of reasonable suspicion, this threshold is vulnerable to charter challenge.
The second issue is the immunity clause I also referred to earlier. Here I recommend that the law be clarified so that only in circumstances provided for in Spencer would the state have access to information.
A third type of amendment has to do with the range of public officers who would be authorized to act under Bill . We propose that the range be narrowed significantly.
Fourth, to enhance transparency, we recommend that the use of these powers be the subject of reporting.
Thank you, Mr. Therrien, for appearing before our committee today. I certainly don't admire your job in the environment we have today; it's definitely a challenging one. I guess you don't have to wake up and wonder what you're going to do for the day.
We definitely see it on the Hill as well. We want to be accessible to the public, but we are also balanced out with the fact that we have bad people who want to do bad things. It's a balancing act; it's a tough one, to say the least. And to be the people who have to be security, or as you are, the Privacy Commissioner.... It's definitely a challenging environment, to say the least.
I see it being two groups. I just pulled up a CBC article on my laptop, and it said you have just been hacked by the Syrian army. That shows that it affects a lot of us in our daily reading. And it's really everybody. It affects not just people who read the daily news in their homes, but it also affects us as MPs.
Do you have the resources to address these new challenges that you face? I think it said in your report that it presents its challenges, but that there are also good things that can come out of those challenges.
Could you just speak to the resources that you have, seeing that we're here for the estimates? Do you have enough to address this new thing we're seeing?
:
First on the question of security and privacy, I'll just say that ultimately I think it's possible to have both, and that position informs quite a few comments that I have made, whether it's about Bill or Bill . I think security is obviously very important, and legislators should act to protect the public, but it is possible to have both security and privacy and not one at the cost of the other.
As to the question of my overall resources, if I understand correctly, and whether there are enough resources to do the job, with all the tasks, obviously there are important work pressures that we're facing. My starting point on the question of whether we have sufficient resources is, of course, that I will try very much to achieve our mandate within the budgets allocated to Parliament because, of course, these moneys come from taxpayers and I want very much to be able to achieve our goals within these budgets.
That being said, there are important work pressures, and I'll just name a few. First of all, the number of complaints that are made under the Privacy Act and PIPEDA is growing continually. The government has an ambitious policy agenda, which means that we're called upon to comment on legislation, but also we're called upon to make comments to departments on the proposed procedures and policies. The rapid evolution of technologies in the private sector also, of course, creates privacy risks that we have to react to. As I've indicated to your colleague, it's important to ensure that individuals are able to exercise control over their information, which implies that we have an important public education role that is part of our role. So these are the work pressures.
At this point, I would say that I'm still assessing, frankly, whether we have enough to achieve all of these objectives, but I will try as much as possible to do that. In part, what is at play, given the work pressures, is that we have to be constantly looking for new and efficient methods to do our work. This is something that the OPC has done over the years, and we're still very much in that mode. For instance, investigations, which constitute roughly 50% of our work, are the subject of more efficient processes, for instance, that use early resolution as opposed to a full-fledged investigation into complaints. We're trying to have more efficient methods, and this is working. Productivity is up, there are more files being closed in the office than ever before, but unfortunately, the growth in complaints exceeds the growth in our productivity. That's an issue we have to tackle.
In particular, the number of complaints made under the Privacy Act is growing. Our response times to these complaints is also growing because of the phenomenon I was describing: the growth in complaints exceeds the growth in productivity. In early 2015, we will launch an audit into the activities of that branch to see whether it could be possible to be even more efficient than we are currently.
Essentially, there are important work pressures. My objective is to work within the budget that was given to me. At this point I'm not asking for additional moneys. If I come to a different view, I will let you know.
:
Thank you very much, Mr. Chair.
Thank you, Commissioner and officials, for being here with us this afternoon.
Congratulations on the great job you're doing with a very difficult situation. I can't imagine how you can even try to keep up with the way the digital world is changing so rapidly, so I commend you on the job you are doing. I think it's reassuring to Canadians to know that it's ultimately possible to have security and privacy, and I think you made that very clear.
You talked quite a bit about the increased complaints, the number of new pieces of legislation you've had to comment on, department policies, and of course the new technology. One thing I'm extremely interested in is public education and how that is going.
You also talked about establishing the new privacy priority issues, and the exercise you're going through and hoping to have completed by spring 2015. I wonder if you could give us an update on what steps you've taken so far and who may be involved with this, if it's possible to talk about that. Give us a bit more of an idea about what direction you may be going in.
The OPC under Madame Stoddart had four such priorities, and they served the organization very well during her tenure. With my arrival, I think it's timely to modernize these priorities, and it was foreseen that this would be done even before I arrived. I intend to look at these priorities in light of the current environment and the current issues. I want to consult with various sectors in society on what the priorities of the office should be over the next however many years, say five years.
We will consult in five cities across Canada, from January to February or March, with various sectors of the population: certainly the private sector, which would be affected by PIPEDA; civil society; academia; consumer groups; and focus groups of the general population, because I think they too have something to say about what is of concern to them in terms of privacy. We would like to hear from certain representatives of the general population regarding their concerns so that they can be taken into consideration as we develop our priorities. I want to do that in a consultative and inclusive way.
After these sessions, we will sit down in the office and determine how to reflect these comments in new strategic priorities, which goes directly to the subject matter of the meeting today. We want to ensure we are the most effective in how we use our resources, and having modernized priorities will help us focus our activity so that we are as effective as possible.
:
Thank you, Mr. Chair. I understand your role and that you have to limit speaking time.
Mr. Therrien, thank you for being here, and congratulations on your appointment. I had the opportunity to meet with your predecessor, Ms. Stoddart, a few times. She did a very good job. I am sure you will also meet this challenge. I have a few questions for you about your budget.
Your budget for last year was $29.1 million. This year, the main estimates (B) are $24.3 million, a decrease of $4.8 million. I was quite surprised by these figures.
A little earlier, it was mentioned that the budget had not increased, but had actually decreased. If I understand the numbers correctly, the expectation is that the budget will be reduced.
In 2013, there was a 17% increase in PIPEDA-related complaints compared to 2012. Do you think you have the resources you need to fulfill your mandate, given the reduction of close to $5 million compared to last year?
:
Most of the reduction was related to the moving costs last year and will not come back, except in the form of repayment of the loan, which is about $200,000 a year for 15 years.
However, approximately $4 million that was spent last year will not be spent again. The difference between $29 million and $24 million is about $5 million. In other words, $4 million for the move and another $1 million related to 2012-13 budget cuts and the spending reduction program that affected all federal departments and agencies to the tune of about 5%.
The commissioner's office was not specifically targeted by this measure, but before my arrival, it was felt that the same effort should be made out of fairness. The contribution of the commissioner's office in this exercise is $1.1 million, and that is a recurring cut.
Will it be more difficult to achieve our objectives? Obviously, we will need to increase our efforts to be efficient. In the end, despite the cuts and as a result of the efficiency measures we have adopted, we have been able to increase the productivity of our investigations. So there are more completed investigations than before.
Again this year, we think that the number of completed files will increase, despite these cuts. We think we will be able to meet the demand, despite the cuts in question.