---

APPENDIX E -
RECOMMENDATIONS

from the Report of the House of Commons Standing Committee on Human Rights and the Status of Persons with Disabilities Privacy: Where Do We Draw The Line?

April 1997

RECOMMENDATION 1

The Committee recommends that the Government of Canada recognize and act upon its responsibility to respect and protect privacy rights in Canada by enacting a declaration of privacy rights to be called the Canadian Charter of Privacy Rights. This Privacy Charter would apply within federal jurisdiction, take precedence over ordinary federal legislation and serve as a benchmark against which the reasonableness of privacy infringing practices and the adequacy of legislation and other regulatory measures would be assessed.

Furthermore, the Committee recommends that the Canadian Charter of Privacy Rights be enacted no later than the 1st of January 2000.

RECOMMENDATION 2

The Committee recommends that the Canadian Charter of Privacy Rights declare and entrench fundamental privacy rights and the responsibilities attaching to these rights. These rights and responsibilities would include, but not necessarily be limited to, the following:

1. Fundamental Privacy Rights and Guarantees

1.1. Everyone is entitled to expect and enjoy:

• physical, bodily and psychological integrity and privacy;
• privacy of personal information;
• freedom from surveillance;
• privacy of personal communications;
• privacy of personal space.

1.2 Everyone is guaranteed that:

• these privacy rights will be respected by others adopting whatever protective measures are most appropriate to do so;
• violations of these privacy rights, unless justifiable according to the exceptions principle which follows, will be subject to proper redress.

2. Justification for Exceptions

Exceptions, permitting the rights and guarantees set out above to be infringed, will only be allowed if the interference with these rights and guarantees is reasonable and can be demonstrably justified in a free and democratic society.

3. General Obligations

3.1. The basic duties owed to others to ensure their privacy rights are adequately respected include:

• the duty to secure meaningful consent;
• the duty to take all the steps necessary to adequately respect others' privacy rights or, if their rights must be infringed, to interfere with privacy as little as possible;
• the duty to be accountable;
• the duty to be transparent;
• the duty to use and provide access to privacy-enhancing technologies;
• the duty to build privacy protection features into technological designs.

4. Specific Rights Related to Personal Information

• Everyone is the rightful owner of their personal information, no matter where it is held, and this right is inalienable.
• Everyone is entitled to expect and enjoy anonymity, unless the need to identify individuals is reasonably justified.

5. Specific Obligations Related to Informational Privacy

5.1. The basic duties owed to others to ensure their informational privacy rights are adequately respected include, in addition to the general obligations set out above:

• the duty to hold sensitive personal information in trust;
• the duty to limit information collection to what is necessary and justifiable under the circumstances;
• the duty to identify the purpose for which personal information is collected;
• the duty to ensure the information collected is correct and of the highest quality;
• the duty to provide the people whose personal data is collected with access to that information and a means to review and, if they judge it necessary, to correct it;
• the duty to only use and disclose personal information for the purposes identified when meaningful consent was obtained;
• the duty to keep personal information only for as long as is necessary and justifiable;
• the duty not to disadvantage people because they elect to exercise their rights to privacy.

RECOMMENDATION 3

The Committee recommends that the Canadian Charter of Privacy Rights declare that to achieve proper respect for privacy rights in Canada the following measures are essential:

• ongoing public discussion and input on matters related to the protection of privacy rights;
• research related to privacy rights and their protection;
• public awareness and education to sensitize everyone to their rights and responsibilities with respect to privacy.

RECOMMENDATION 4

The Committee recommends that the Canadian Charter of Privacy Rights declare that, to ensure the core privacy principles are observed, the following measures must be put in place:

• proper compliance, accountability and enforcement mechanisms;
• appropriate remedies to redress violations of privacy rights.

The Committee further recommends that the Canadian Charter of Privacy Rights declare that the Privacy Commissioner of Canada shall exercise general oversight and protection of privacy rights within areas of federal jurisdiction.

RECOMMENDATION 5

The Committee recommends that the Minister of Justice, in consultation with the Privacy Commissioner of Canada, examine existing federal legislation and regulations, bills and draft regulations for consistency with the Canadian Charter of Privacy Rights and report any inconsistency to Parliament. This report shall be referred to the appropriate parliamentary committee for consideration and recommendations.

The Committee also recommends that the Canadian Charter of Privacy Rights require the Minister of Justice to notify the Privacy Commissioner of Canada of all bills tabled in Parliament and all draft regulations which may have ramifications for privacy.

RECOMMENDATION 6

The Committee recommends that the Government of Canada take a leadership role to ensure that Canadians' privacy rights are accorded equivalent dignity across the country. The Government of Canada should invite the governments of the provinces and territories to work together to develop a complementary and uniform approach to privacy protection across Canada that would accord with the Privacy Charter.

RECOMMENDATION 7

The Committee recommends that the Government of Canada, federal agencies and all Crown corporations identify privacy issues in their respective workplaces and institute appropriate measures that accord with the Privacy Charter to safeguard employees' privacy rights.

RECOMMENDATION 8

The Committee recommends that the Government of Canada introduce into Parliament comprehensive data protection legislation to be known as the Data Protection Act to replace the current Privacy Act. This Act must accord with the Privacy Charter and apply to Parliament, all federal government departments, agencies, Crown corporations, boards and commissions, and other institutions, and to all federally regulated businesses and industries. The Data Protection Act shall be enacted no later than the 1st of January 2000.

A broad and open process of public consultation shall precede the introduction of this legislation and provision shall be made in the Act for comprehensive public review of its provisions and operations within five years of the proclamation of the Act, and at regular intervals thereafter.

The Government of Canada shall give due consideration to other data protection models, such as the Canadian Standards Association's Model Code for the Protection of Personal Information and the New Zealand Privacy Act 1993, when developing the Data Protection Act. The Data Protection Act shall recognize the role of federally regulated industries in the development of their own privacy codes.

RECOMMENDATION 9

The Committee recommends that the Data Protection Act it proposes contain:

• strict protections against all unnecessary intradepartmental and interdepartmental data matching;
• standards for acceptable data matching practices;
• acceptable data matching practices that comply with the Privacy Charter, in particular the principles of informed consent and transparency.

RECOMMENDATION 10

The Committee recommends that to comply with the proposed Data Protection Act, the Treasury Board Secretariat, a central agency of the federal government must:

• create mandatory data matching guidelines;
• monitor federal government departments for compliance with the new guidelines;
• educate federal departments and employees on what constitutes unnecessary data matching practices.

RECOMMENDATION 11

The Committee recommends that the proposed Data Protection Act shall set out the circumstances under which data sharing between the federal and provincial governments is appropriate.

The Government of Canada should advise the provinces and territories that upon the enactment of the proposed Data Protection Act, all personal information shall only be shared with those provinces that have adequate data protection in place.

RECOMMENDATION 12

The Committee recommends that the proposed Data Protection Act must apply to:

• any personal information transferred from federal government institutions to the private sector;
• any contracts for providing services to federal government institutions.

RECOMMENDATION 13

The Committee recommends that:

• the Treasury Board Secretariat take responsibility for monitoring compliance by federal departments and agencies with the proposed Data Protection Act;
• the Minister of Industry take responsibility for monitoring compliance by the federally regulated private sector with the proposed Data Protection Act; and
• the federal Privacy Commissioner be made responsible for ensuring enforcement of the proposed Data Protection Act and that penalties exist in the proposed act for violations of its provisions.

RECOMMENDATION 14

The Committee recommends that the Data Protection Act regulate the development, testing (including pilot projects), implementation and application of emerging technologies that have a potential to infringe on the privacy of personal information. These technologies would include, but not be limited to, smart cards and biometric identification systems.

RECOMMENDATION 15

The Committee recommends that the Government of Canada take immediate action to deal with privacy violations and discriminatory treatment that may result from genetic testing including:

• a review of current policies and practices in the employment, health, insurance and criminal justice sectors;
• a review of existing reports and existing and proposed legal instruments (including the draft international covenant on the human genome);
• consultations with the public;
• the development of legislation that is necessary to deal specifically with the privacy and antidiscrimination issues related to genetic testing.

RECOMMENDATION 16

The Committee recommends that the Government of Canada introduce amendments to the Criminal Code that would, to the greatest extent possible, apply the prohibitions against the interception of private communications to surreptitious video surveillance.

RECOMMENDATION 17

The Committee recommends that the Government of Canada, in particular Industry Canada, encourage the development and use of privacy-enhancing technologies by:

• developing partnerships and creating incentives for research and development into privacy-enhancing technologies;
• educating the public and businesses (large and small) about the capacity of privacy-enhancing technologies to protect the personal information of Canadians.

RECOMMENDATION 18

The Committee recommends that the Government of Canada undertake ongoing public awareness and education programs about new technologies and their impact on privacy to ensure that everyone is able to make appropriate decisions regarding their personal privacy and the direction of public policy in the future.

The Committee further recommends that the Government of Canada undertake an ongoing public consultation process that examines and makes recommendations about specific legislative and non-legislative measures that are required to ensure that individuals' privacy is protected as technologies are refined or brought into use.

The Committee further recommends that the Government of Canada initiate ongoing discussions with the provinces with a view to encouraging a common approach to the treatment of these technologies (particularly genetic testing) within different jurisdictions.

RECOMMENDATION 19

The Committee recommends that the Government of Canada table in Parliament new legislation that would replace the current Privacy Act, to be called An Act Respecting the Office of the Privacy Commissioner of Canada. This act would broaden and strengthen the mandate and powers of the Privacy Commissioner in relation to all issues of privacy within the federal sector. Specifically, it should contain, but not be limited to, provisions that empower the Privacy Commissioner to:

• receive, investigate and settle complaints of alleged privacy invasions;
• initiate his own privacy investigations through the use of privacy audits and technology impact assessments;
• carry out studies relating to privacy and emerging technologies;
• review all government bills, legislation, regulations, delegated legislation, policies and practices that may have an impact on privacy rights and, whenever appropriate, table a privacy impact statement before the House of Commons;
• ensure effective enforcement of the proposed Data Protection Act.

This Act shall apply to Parliament, all federal government departments, agencies, Crown corporations, boards, commissions and government institutions and to the federally regulated private sector.

This Act shall contain complaint review mechanisms such as an administrative tribunal and the provision for judicial review.

RECOMMENDATION 20

The Committee recommends that the introduction of An Act Respecting the Office of the Privacy Commissioner must:

• be preceded by a broad and open public consultation process;
• provide for a comprehensive public review of its provisions and operations within five years of the proclamation of the act and at regular intervals thereafter;
• assign a general public education mandate to the Privacy Commissioner.

RECOMMENDATION 21

The Committee recommends that Parliament provide sufficient resources to the Office of the Privacy Commissioner to adequately carry out its proposed responsibilities.

---

Dissenting Report to the Report on Privacy Issues produced by the Standing Committee on Human Rights and the Status of Persons with Disabilities

Reform considers it essential for the government to be part of the growing debate over the impact of modern technology on privacy rights and was glad to participate in the recent review performed by the Standing Committee on Human Rights and the Status of Persons with Disabilities.

The opportunity the Committee afforded for Canadians to engage in the public debate was important. Reform, however, is compelled to dissent to the final report issued by the Committee on this study because of the lack of recognition given to the scope of opinion submitted by Canadians from across the country.

Many Canadians recognize the value of some form of regulation or legislation that recognizes the competing interests involved in this complex issue. Many groups, including Industry Canada, recommended a "multi-pronged" approach where responsibility is shared between the government and other interested parties. This would likely include a measure of self-regulation by businesses in the privacy domain.

Instead the government, in standard fashion, has chosen the most narrow and heavy-handed approach by opting to recommend consolidating all power in the federal government, and in particular, under the Privacy Commissioner, greatly expanding the role and responsibilities of the Privacy Commissioner without any apparent consideration of the costs involved or the efficiency of the process.

The Canadian Human Rights Commission (CHRC) seems to mirror many of the functions of the proposed expanded Privacy Commission, but has been ignored as either a source of experience or a possible mechanism for the regulatory process.

According to the government, privacy rights are not congruent with those rights addressed by the CHRC since they do not represent historically-defined discrimination.

However, if the government adjusts this qualification on the definition of the rights addressed by the CHRC, the Commission could then focus on real and present rights' violations. This would facilitate a more equitable approach to rights violations. And if privacy is an "inalienable human right" as it maintains, it could be included in the Commission's portfolio.

Another recommendation of the Committee has potentially serious ramifications on the constitutional distinctions between federal and provincial jurisdictions. In what appears to be a very heavy-handed approach to enforcing privacy rights, the committee has recommended that federal governments cease data sharing with provinces unless the provinces implement reforms to privacy protection that meet the approval of the federal government. Thus legislation and regulation intended for application in the federal government and federally-regulated organizations will have much farther reaching implications.

The government's interest in enforcing privacy rights also rings hollow in view of its opposition to respecting property rights. With years of pressure and continuing inattention to the area of property rights, why is there now a will to exclusively pursue the related area of privacy?

Several bills illustrate "regulatory creep" and the government's disregard for property and privacy rights:

Bill C-68 significantly weakens Canadians' protection from search and seizure measures, increasing the ease of access of police officers to private property.

Bill C-71 also permits search and seizure without a warrant. While these two bills still maintain a measure of protection regarding dwelling places, Bill C-76, the Drinking Water Safety Act, of all pieces of legislation, goes even further. This bill, concerned with the regulation of bottled water, includes provisions for permitting access even to a person's home without a warrant. Little by little, the government is abandoning the historical rights and freedoms of Canadians while trying to claim the high ground by appearing concerned about new, complex issues that are more difficult to define.

Extreme proposals advanced in some circles on behalf of so-called children's rights have also found a friendly ear in some corners of the Liberal government. Such proposals, including the repeal of Section 43 or the privacy rights of children over and above the rights of parents, threaten the protection afforded to children and their families in the private sanctuary of the home. Such infringements threaten to destroy institutions and relationships Canadians have long taken for granted.

The violations of privacy made possible through more and more Liberal legislation sends a contradictory message to the recommendations proposed by the Committee on the limited scope of privacy issues addressed by the Committee. It suggests that the government lacks a comprehensive underlying philosophy that takes into account the priorities of Canadians and reflects the expected level of respect for their rights.

The Reform Party supports the involvement of the government in the public debate over privacy issues. The purpose of public debate, however, is to inform the government of the views and concerns of Canadians.

In consideration of the government report however, the Reform Party recommends greater responsibility and freedom be extended to individuals and businesses to choose and implement standards and measures that also respect the expectations of Canadians.

We recommend a re-examination of the singular proposal to use a greatly expanded Privacy Commission as the structure for the regulatory body.

Finally, we express our reservations over the rush in which the final report was produced which should have allowed more opportunity for careful examination of its proposals and their consequences. The Reform Party trusts that the public consultation proposed by the recommendations will produce results that do indeed represent the wishes and expectations of the broadest possible spectrum of Canadians.