Letter to the Standing Senate Committee on Transport and Communications on Bill C-49, the Transportation Modernization Act

On February 16, 2018, the Privacy Commissioner of Canada, Daniel Therrien, sent the following letter to the Standing Senate Committee on Transport and Communications to provide his views for the Committee's study of Bill C-49, the Transportation Modernization Act. It is a follow-up to his January 31, 2018 appearance before the Committee on Bill C-49. On March 22, the Commissioner sent the committee a second letter on this issue to further clarify his views.

February 16, 2018

The Honourable David Tkachuk, Chair
Standing Senate Committee on Transport and Communications
The Senate of Canada
Ottawa, Ontario K1A 0A4

Dear Mr. Chair:

I would like to thank you and the Members of the Committee for the invitation to provide our views for your study on Bill C-49, the Transportation Modernization Act. I trust the input we provided to the Committee was of some assistance with your study.

The purpose of my letter is to clarify a few points which arose during the discussion that were perhaps not fully covered in my testimony on January 31, 2018, particularly regarding the interplay between C-49 and the Personal Information Protection and Electronic Documents Act (PIPEDA).

Impact of audio/video recordings on employee privacy

Recordings made in the workplace certainly can be considered invasive and affect the privacy of employees. My Office has received many complaints on this issue over the years. The assertion that employees have no reasonable expectation of privacy, simply by virtue of being in a workplace, is problematic. At the same time, however, privacy rights are not absolute and so must often be weighed against other compelling interests.

On this point, we understand the proposed amendments emerged largely from the work of the Transportation Safety Board (TSB) in its study of the potential safety benefits of installing recorders in locomotives, and the appropriate use of locomotive voice and video recorders (LVVRs). We also understand that further to this study, the TSB reached the conclusion that LVVRs are necessary to its investigations. It is encouraging that the TSB’s report on the issue appropriately acknowledged employee privacy rights and workplace surveillance questions. Successful implementation of LVVRs will depend on ensuring an appropriate balance of rights.

Based on what I have heard so far, I am satisfied that safety considerations in this context justify the use of video/audio recording. We have examined this question before and it is consistent with findings of my office. For example, individuals have complained specifically about concerns regarding new security systems being installed in their workplace and, specifically, the digital video cameras that were part of these systems. In one instance (PIPEDA Case Summary #2004-264) it was alleged that a company used cameras without consent, to collect information about employees and to use that information to impose discipline. We found ultimately that it was it was not necessary that the company obtain employee’s explicit consent for the collection of personal information as recorded by the cameras.

Purpose limitation

Beyond that initial question of justification, however, there follow other important conditions under PIPEDA. The provisions of that law – which govern federally regulated organizations, including much of the transportation sector – set out the basic framework of data protection requirements organizations need to observe. For example, under the PIPEDA provisions for purpose and use limitation, if information is collected for safety reasons, it should only be used for those purposes. This is why it is important to assess whether the requirements in Bill C-49 are consistent with a specific purpose and why many parties raised concerns about potential reuse of video-audio footage for other reasons, such as employee discipline.

Section 17.91(1) of the Railway Safety Act, as amended by clause 62, is consistent with the goal of limiting usage under PIPEDA in that it establishes specific purposes for which the data may be used by companies. The pre-existing privilege prohibiting use and disclosure of such recordings, as set out in section 28 of the Canadian Transportation Accident Investigation and Safety Board Act (“CTAISBA”) is also consistent with this principle. However, the regulation-making authority prescribed in the bill, specifically the language of paragraph 17.95(1)(d), as amended by clause 62, raises concern because it allows the making of regulations relating to, among other things, the collection, preservation, use and communication of information from the recordings. While we are supportive of regulations that would add data protection measures, such as specific retention limits or safeguards such as encryption, our concern is that the language of this paragraph is such that it could also be possible to create regulations that add or expand the statutory purposes for collection, use, or disclosure of LVVR data.

It is important to remember that subsection 17.31(2), as amended by clause 62 of the bill, requires that use or communication must be in accordance with the law, which also includes regulations. We are also not convinced that the pre-existing privilege would necessarily limit the possibility that collection, use, or disclosure could be expanded through the regulations in future. If we consider clauses 67, which adds section 28(5.2) to the CTASBIA, and 63, which amends s.28(1.1) of the Railway Safety Act, and when read in conjunction with subsection 17.31(2) of the Railway Safety Act, this might allow for regulations under the Railway Safety Act (i.e., under s.17.95(1)(d)) to authorize the use and disclosure of LVVRs in ways that would be otherwise prohibited under the privilege outlined in s.28 of the CTASBIA.

Put another way, if the overall intent of the bill is to strictly define the parameters for collection, use and disclosure of LVVR data, then I question why paragraph 17.95(1)(d) is drafted in such a way as to allow for the possibility of expanding purposes for collection, use, or disclosure. That authority should be limited to the making of regulations that would prescribe privacy or other safeguards in relation to the collection, use or communication of information.

The impact of carve-outs from PIPEDA and respect for privacy

While section 4(3) of PIPEDA allows for other Acts of Parliament to create exceptions to certain of its provisions such exceptions are rare. Exceptions to consent are generally contained in section 7 of PIPEDA itself. Prior to the introduction of the legislation now before you, there were only two exceptions – section 4.83 of the Aeronautics Act and sections 15 & 50 of the Public Servants Disclosure Protection Act. In each instance, the aforementioned exceptions only placed limitations on disclosures.

By contrast, Bill C-49 would create exceptions to four key elements of PIPEDA through the Railway Safety Act: collection, use, disclosure, and retention. On this point, I feel two separate questions arise. First, is there proper justification – under each of those PIPEDA elements - for the exceptions being created? And secondly, on a case-by-case basis, who should examine whether these exceptions are being properly applied? Regarding the question as to whether the exceptions are in fact individually justified, I would make the following points:

• On the exception from consent (for collection, use and disclosure), I believe there is a reasonable justification and I would refer to past findings of my Office on the specific question of consent in the workplace and how it can be established. This is simply to reiterate the point made in my testimony that, in the context of workplace safety measures, PIPEDA does not give individual employees some manner of ‘final say’ or right of refusal in relation to the installation of audio or video recorders.
• Conversely, on the exception from the requirement to limit retention, I view this to be unjustified for the reasons noted in my testimony. This element of PIPEDA simply states as a general principle that personal information should not be retained longer than necessary. It is relevant in this context. The regulation-making authority in paragraph 17.95(1)(d) of the Railway Safety Act, as amended by clause 62 of Bill C-49, could be used to add details, for instance to prescribe an actual period of retention, but it is not a valid substitute for the general principle set out in PIPEDA.
• On the aspect of ensuring compliance in practice and allowing for effective oversight, it is my view that adding exceptions within PIPEDA itself, as opposed to external pieces of legislation, creates more certainty as to where and when PIPEDA applies. That would minimize uncertainly about my Office’s jurisdiction to investigate specific privacy complaints. Bill C-49 as currently drafted creates unnecessary ambiguity about my Office’s jurisdiction.

If certain activities occur “despite” the general application of PIPEDA, as per subsection 17.91(4) of the Railway Safety Act, as amended by clause 62 of Bill C-49, does the OPC have jurisdiction to investigate whether these exceptions were properly applied? We believe that we would, but drafted in this manner, Bill C-49 certainly creates ambiguity. This is why we have recommended confirmation of my Office’s jurisdiction to investigate complaints relating to alleged violations of PIPEDA provisions and principles, including whether the exceptions found in the Railway Safety Act were properly applied.

Access

Another principle found in PIPEDA is that individuals have the right to access personal information held about them by organizations. It is not clear whether that principle would apply to LVVR recordings. Clause 62 of Bill C-49 does not list access as one of the PIPEDA principles which would not apply to LVVRs. Accordingly, the right of access of employees would seem intact. However, section 28 of the CTAISBA significantly limits disclosure of on-board recordings and would seem to prevent individuals from accessing their own personal information under PIPEDA.

So while an aspect of section 28 of the CTAISBA can be viewed as positive - in the sense it may safeguard against the risk of recordings being used for disciplinary purposes - it remains potentially problematic if it is interpreted as an exception to PIPEDA's right to access one's own personal information. Allowing a right of access is the key to exercising other PIPEDA rights such as ensuring accuracy.

Section 28 of the CTAISBA could also further complicate our oversight, in that it renders LVVRs ‘privileged’ and prohibits their use and disclosure unless a specific exception applies. Bill C-49 and the current version of the CTAISBA lack any OPC-specific exceptions to this privilege. While PIPEDA gives my Office the authority to compel evidence, section 28 of CTAISBA could bring organizations to oppose production orders, thereby hindering the conduct of OPC investigations into alleged violations of PIPEDA. This is why I have proposed the amendments to section 28 as set out in my testimony and restated in the text below.

Proactive role of the OPC

As noted in my testimony, the OPC takes an active role in commenting on the development of regulations at the federal level (through the Canada Gazette consultation process) and departmental programs across government (through the Privacy Impact Assessment process). We will therefore play a role in commenting on further rules to be proposed by government on the implementation of Bill C-49.

I should note, however, that my Office is rarely consulted during the legislative drafting phase of bills, and Bill C-49 was no exception. In recommendations to Parliament made in March 2016, we have asked that discussions with our Office become a legal requirement under the Privacy Act when departments bring forth amendments that will have privacy implications.^{Footnote 1} While we largely agree with the government’s effort to balance privacy and transportation safety, the precise wording in this instance matters significantly, especially when it directly impacts a law which I oversee. The concerns we raise now could have been avoided had we been consulted on the specific provisions earlier.

Conclusion

As noted in my testimony, I believe for the most part the legislation before your Members achieves an appropriate balance, but there are matters where deviations from that balance seem possible. To address the concerns noted above, I would recommend the following amendments to the bill:

First, Bill C-49's exception to PIPEDA should not include the retention principle. That principle simply provides that information should not be retained longer than necessary. It is relevant in context.

Second, the bill should confirm the jurisdiction of my Office to investigate complaints relating to alleged violations of PIPEDA principles, including whether the exceptions found in the Railway Safety Act were properly applied.

Third, concerning the privilege surrounding LVVRs, the bill should clarify for greater certainty that section 28 of the Canadian Transportation Accident Investigation and Safety Board Act does not impede the right of individuals to access their own personal information and the OPC’s authority to access and use it if such persons submit a complaint to our office under either the Privacy Act or PIPEDA.

Fourth, paragraph 17.95(1)(d) should be amended to reflect the government's stated intention to use regulations to add privacy protections as opposed to adding other purposes for the collection, use and disclosure of information.

Fifth, I would recommend that in the future, exceptions to PIPEDA principles be defined in PIPEDA or at least be referred to therein. Otherwise, if the drafting method in this bill became the norm, transparency would be adversely affected in that we would need to refer to statutes other than PIPEDA to determine whether PIPEDA would apply, and if so, to what extent.

Thank you again for the opportunity to present my views and I hope these comments are helpful.

Sincerely,

c.c.:
Victor Senna
Clerk of the Committee