Comments on Bill C-11, Human Pathogens and Toxins Act

This page has been archived on the Web

Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.

Archived

This page has been archived on the Web.

In a response to a request for comment, the Commissioner wrote to Ms. Joy Smith, M.P., the Chair of the Standing Committee on Health.

---

March 11, 2009

Ms. Joy Smith, M.P. 
Chair
Standing Committee on Health
Sixth Floor, 131 Queen Street
House of Commons
Ottawa ON K1A 0A6

Re: Comments on Bill C-11, Human Pathogens and Toxins Act

Dear Ms. Smith:

Thank you for seeking my Office’s comments on Bill C-11.  My Office has been very pleased to have appeared before this Committee in recent years: in April of last year concerning the Committee’s Study on Post-Market Surveillance of Pharmaceutical Products and on the Quarantine Act in 2004.  

We would be pleased to appear before you to discuss the comments we make in this letter if that would be helpful.  We understand that Bill C-11 would address a regulatory gap; we understand that several thousand laboratories in Canada which use domestically acquired human pathogens and toxins are governed by a voluntary biosafety regime.  

My responsibilities include the administration and enforcement of two federal privacy laws.  The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s private-sector privacy law. PIPEDA protects personal information collected, used and disclosed in the course of commercial activity throughout Canada and across its borders. Our public sector law, the Privacy Act, applies to federal government institutions, agencies and Crown corporations.

Our suggestions for improvements are aimed at ensuring the appropriate balance of privacy rights and regulatory powers as well as transparency, notice and accountability to those officials subject to the legislation and to the public.

Consultation with our Office

To begin, we understand that there was a stakeholder consultation process on this legislation. Public Health Agency officials provided us with some high-level information on the subject before Parliament was dissolved. 

We had hoped to see a privacy impact assessment (PIA) to understand how any privacy risks in this Bill had been mitigated, but we have not yet received one.  PIAs are a formal risk management process that helps departments consider the effects of new programs or services (or proposed policies and plans) on the privacy of individuals.  Our Office should be seeing PIAs well before the decisions have been implemented so we can provide feedback early in the process.

Without having met with the officials who developed this Bill and without having received a PIA, it is challenging for us to understand the full privacy implications of Bill C-11, such as the scope of the application of this proposed legislation to patient information.

We would appreciate participating in a consultation process with officials as they develop regulations to this Bill, as several may have privacy implications, specifically:

• Subclause 34(1) provides the Minister with authority to issue security clearances in accordance with the regulations; the criteria for issuing those clearances may well have privacy implications,
• Clause 38 provides the authority for the Minister to specify conditions around ordering an individual to provide personal information that is relevant to the administration of the Act or the regulations,
• Paragraphs 66(1)(d) and (g) concern the security screening process for individuals, and
• Paragraph 66(1)(m) concerns the collection, use and disclosure by the Minister of personal information.     

Clause 38 – Provision of information to the Minister 

This provision gives authority to the Minister to order an applicant, licence holder or a biological safety officer to provide the Minister, according to any conditions the Minister may specify, with any personal (and confidential business) information that, in the Minister’s opinion, is relevant to the administration of the Act or the regulations.  

The test of the personal information’s relevancy and “in the Minister’s opinion” in subclause 38(1) could be improved.  We would suggest that reasonableness should inform the Minister’s opinion and that the personal information should be “directly relevant” to the administration of the Act or the regulations.  We would also suggest that instead of “personal information,” Bill C-11 should provide for de-identified or anonymized information if that would accomplish the stated purpose.

Clause 39 – Disclosure by the Minister

Clause 39(1) gives authority to the Minister to disclose personal information obtained under this Act, without the consent of the person to whom the information relates, to a person from whom the Minister seeks advice, to a department or agency of government of Canada or a province, to a foreign government or to an international organization.  It can do so for any of three reasons:

1. if the disclosure is necessary for the administration or enforcement of this Act or regulations,
2. if the Minister has reasonable grounds to believe that the disclosure is necessary to address a serious and imminent danger to the health or safety of the public or
3. if the disclosure is necessary to enable Canada to fulfil its international obligations.

Again, we would suggest that instead of “personal information,” Bill C-11 should provide for disclosing de-identified or anonymized information if it would accomplish the stated purpose.

We would also prefer to see the reasonable grounds test located above paragraphs (a), (b) and (c) so that some objective measurement applies equally to all of them.  This change would be particularly important where the disclosure of personal information would be to foreign governments or to fulfil Canada’s international obligations.

And while we appreciate the inclusion of subclause 39(2), which has the Minister obtaining written assurances to the confidentiality of the information provided to administer this Act or for Canada to fulfil its international obligations, this provision should be applied to all disclosures by the Minister. We would recommend that the regulations contain some guidance on those written assurances to provide appropriate protection for personal information.

We would suggest that the Minister would need to ensure that any personal information to be disclosed under this Act should be held in confidence and that it should only be used for the purposes of the Act.

The written assurances should ensure that when personal information is disclosed, what is provided is as limited and specific as possible for the identified purposes. Recipients should be required to hold the information they receive in confidence unless there is a statutory obligation to disclose it.  As well, on the matter of retention of personal information, we would recommend that the information not be retained for longer than necessary.

We would suggest that officials maintain a clear account of all of these disclosures of personal information so that we could monitor any such disclosures and know the rationales for them.

Clause 41 – Entry by Inspectors

We noted that subclause 41(1) gives an inspector the authority to enter any place or conveyance in which the inspector believes on reasonable grounds, that an activity subject to the Act may be conducted “for the purpose of verifying compliance or preventing non-compliance with this Act or regulations.” 

Though it is not explicitly stated, subclause 41(2), that discusses the inspector’s powers to collect documents, materials and information, may well extend to the examination and collection of personal information and personal health information of individuals and patients.  Bill C-11 is short on details which would allow us to understand the scope of the application of this proposed legislation to patient information.  We are concerned about the protection of patient information and transparency around this process to the public.

Clause 67 – Interim orders

To the extent that personal information of individuals is affected, we are concerned about the level of consultation and transparency concerning clause 67 of this Bill, which exempts interim orders from pre-publication and consultation.  While there may be justifiable reasons to use this mechanism in an emergency situation, this mechanism is of concern as it could diminish controls over personal information.

Clause 68 – Externally produced documents

We are also concerned that clause 68, which refers to authority to incorporate by reference documents developed by a person or body other than the Minister, could result in a reduced level of control over personal information.

Concluding remarks

In closing, we believe that with some changes, Bill C-11 will represent an appropriate balance between a more robust biosafety regime and respect for the privacy rights of individuals.  I would be pleased to appear before the Committee if that would be desirable as a follow-up to this letter.

My staff also informs me that the Committee may be interested in examining the broader issue of patient privacy rights and hearing from my Office on this matter; we would be very pleased to discuss these matters with you.  In fact, your interest in this issue could not come at a more opportune time, given the recent funding granted to advance the adoption of electronic health records (EHRs) and the coming addition of personal health records to the Canadian healthcare environment.  We have been following developments like the Federal Healthcare Partnership toward EHRs and, again, we would be pleased to share our views with you.

Sincerely,