Appearance before the Standing Committee on Access to Information, Privacy and Ethics (ETHI) on Bill C-58, An Act to amend the Access to Information Act and the Privacy Act and to make consequential amendments to other Acts

October 25, 2017
Ottawa, Ontario

Opening Statement by Daniel Therrien
Privacy Commissioner of Canada

(Check against delivery)

---

Thank you for inviting me to provide my views on Bill C-58.

We support Government’s commitment to Open Government and we see this review of the Access to Information Act (ATIA) as welcome and long overdue. Making more government information available to the public is crucial to fostering transparency, accountability and trust.

The OPC has frequently championed transparency. For example, as part of Privacy Act reform, we recommended strengthening transparency requirements for lawful access requests made by law enforcement agencies. In our submission to Treasury Board Secretariat on revitalizing access to information, we expressed support for Open Government, particularly in enabling informed citizens to participate fully in democratic debate.

However, it is recognized internationally that Open Government can and should only be achieved in conjunction with appropriate privacy protections, for societal acceptance is predicated on trust that privacy will not be unduly infringed. The online environment requires rigorous de-identification techniques to be applied and validated by experts prior to disclosure. The OPC and Statistics Canada can play key roles in minimizing inadvertent release of personal information by government in the course of implementing open data initiatives.

We are confident that access and privacy are parallel goals that can be reconciled. The ATIA and the Privacy Act have long been considered by the Supreme Court to be a “seamless code” of informational rights, the combined purpose of which is to carefully balance both privacy and access. The Court has further held that the personal information exception to access is mandatory and “should not be given a ‘cramped interpretation’ by giving access pre-eminence over privacy”.

Our previous comments on ATIA reform focussed on the importance of maintaining this balance. We spoke in favour of maintaining ATIA’s public interest exception that permits the disclosure of personal information only where the public interest clearly outweighs a claim of privacy. We had also recommended that the definition of personal information not be amended. We are pleased that Bill C-58 leaves these concepts unchanged.

We further recommended that Parliament defer changing the Information Commissioner’s power to order the disclosure of personal information until a legislative review has been done of the Privacy Act and its interplay with the ATIA.

Nonetheless, Bill C-58 proceeds to confer upon the Information Commissioner order-making powers, including in respect of personal information disclosures. This would significantly and clearly disrupt the balance struck in the current legislation. We acknowledge that Bill C-58 takes limited steps to restore balance, primarily through notification requirements and legal recourse against formal OIC orders. But this falls far short of maintaining the required balance, as privacy would be impacted outside formal orders, through OIC recommendations or institutions’ decisions to disclose personal information to avoid OIC orders. I would not be notified or given opportunity to intervene in such cases, even though the OIC and OPC may diverge on key legal issues relating to the balance of both rights.

For example, the offices may disagree on the degree of risk of reidentifying anonymized information or meta-data, which could be determinative in assessing whether it constitutes personal information that should not be disclosed. The Commissioners may also diverge on whether personal information is publicly available and whether the public interest clearly outweighs a privacy invasion, particularly in light of the new purpose clause in Bill C-58, which the Information Commissioner finds concerning, but which I find helpful.

Recently, in response to the Bill before you, the Information Commissioner has taken issue with the proposed obligation to consult the Privacy Commissioner. She says consultation is unnecessary as the OIC has years of experience in interpreting the relevant provisions. This is very unfortunate, and clearly inappropriate as the Supreme Court has recognized the "central role" of my Office in protecting privacy. It is true that the OIC has significant experience in interpreting the personal information exception to access, but that experience has been developed as a champion for access rights. To ignore the views of other actors, who have a legal role in ensuring the balance between access to information and other rights, plainly makes the case that, as legislators, you must recognize in Bill C-58 the role of the OPC as privacy champion. Furthermore, this should be extended to all situations where privacy is in need of protection. The quasi-constitutional nature of the right to privacy is another reason to enshrine this role in the bill before you.

To restore the balance between access and privacy in Bill C-58, I propose two legislative solutions. One, the bill should require mandatory notification of and consultation with the OPC in all cases where personal information is at real risk of being disclosed without the individual’s consent, and not just when there is a formal order about to be issued. The point would not be to consult in every case in practice. Although the obligation to notify and consult with the OPC would be the rule, this obligation, in the interests of resource efficiency, would not apply to lower-risk situations where the OIC and OPC have agreed that consultation would not be necessary. This type of agreement would support collaboration with the OIC to ensure the best balance between these two fundamental rights.

Second, I recommend that Bill C-58 give the OPC the opportunity to seek judicial redress in all cases where personal information is at material risk, not only those where an order has been made. Again, this right of redress would not be exercised in every case in practice but only where necessary to protect privacy and to develop jurisprudence that would guide both commissioners, departments and citizens on the applicable law.

To bring further clarity to my proposals, I have attempted to put them in statutory language. I believe that you have these texts before you now.

Mr. Chair and members of the Committee, with your indulgence, I would now like to spend a few more minutes to explain why this bill disrupts the balance between access and privacy.

The current balance, upheld by the Supreme Court of Canada in several judgments, is based on a number of factors, including, first, the substantive provisions of the ATIA and the Privacy Act, including the definition of personal information; the fact that the personal information exception in the ATIA is mandatory rather than discretionary; and the wording of the public interest exception, which requires that the public interest in disclosure "clearly outweigh" privacy invasions in order to prevail.

As a result, the Supreme Court held that, as the law now stands, the combined purpose of the two Acts is to protect both privacy and access rights and strike a careful balance between the two. The Court even added that, as things stand privacy is "paramount" over access.

The second consideration is the roles of the two commissioners currently, one being the access champion and the other having a "central role" in protecting privacy; both being ombudspersons who can only make recommendations and not orders; and the role of departmental heads, who ultimately have the discretion to decide on exceptions in general to the personal information exemption and specifically when the public interest in disclosure "clearly outweighs" privacy.

It is important to understand that Bill C-58 maintains some of these factors but changes others, notably the roles of the Information and Privacy Commissioners and their authority to make binding orders. Changing the balance between the roles of the two commissioners and departmental heads may well have an impact on the interpretation of the substantive provisions. Giving the OIC the authority to make these orders could mean the OIC's interpretation will prevail as between disclosure in the public interest and privacy.

The problem is not that the OIC is inherently unfair or unknowledgeable, but rather that it is a champion of one side of the balance. Someone needs to speak for the other side, particularly when the Information Commissioner is on record, in her recent special report to Parliament, to say it is unnecessary and inappropriate to consider the  other side.

Under Bill C-58, the OPC will rarely be involved, despite having a "central role" according to the Supreme Court. The Bill provides that the OPC will be notified only in the case of formal orders and, only in these cases, will be afforded judicial redress.

Yet, privacy may be at risk not only where OIC formal orders are made but in other situations. Departments are much more likely to comply with the OIC's interpretation knowing that the OIC ultimately has the authority to make binding orders. As government officials acknowledged, it is only in very rare cases that departments will use their resources to challenge OIC orders.

Similarly, when the OIC makes a recommendation under the new regime, or even when discussions take place between the OIC and departments during the investigation of a complaint, departments are much more likely to comply with the OIC's view, knowing that the OIC can ultimately order the department to accede to its interpretation of the law.

Bill C-58 ultimately creates an incentive to give access pre-eminence over privacy, contrary to the Supreme Court jurisprudence. I am deeply concerned about this, and have suggested a few simple solutions to restore balance.

Thank you for your attention and I look forward to answering your questions.