Appearance before the House of Commons Standing Committee on Health (HESA) on the Emergency Situation Facing Canadians in Light of the COVID-19 Pandemic

June 23, 2021
Ottawa, Ontario

Opening Statement by Daniel Therrien
Privacy Commissioner of Canada

(Check against delivery)

---

Introduction

Thank you to the Chair and members of the committee for your invitation to share our views on your current study on the Emergency Situation Facing Canadians in Light of the COVID-19 Pandemic.

I am accompanied today by Gregory Smolynec, the Deputy Commissioner for the Policy and Promotion Sector. Due to a prior engagement, I will be attending this meeting for an hour, but Mr. Smolynec will remain to address any questions that arise in the second hour. I am here to speak to you today about what the Privacy Act does and does not allow with respect to the production of documents under provisions of the Act related to disclosures of personal information.

Let me begin by stating that the role of the Office of the Privacy Commissioner is to oversee compliance with the duties and obligations - set out by Parliament – in both the Privacy Act (the public sector law) and the Personal Information Protection and Electronic Documents Act, or PIPEDA, (the private sector law).

Obligations under the Privacy Act

The public sector law, the Privacy Act, enacted in 1983, applies to the personal information handling practices of federal government departments and agencies.

The Privacy Act defines personal information as information about an identifiable individual that has been recorded in any form.

Furthermore, the Privacy Act creates legal obligations for departments and agencies, by stating that personal information collected by federal institutions can only be used:

• for the purpose for which it was collected,
• for a use consistent with that purpose, or,
• for a purpose specifically provided for under s. 8(2) of the Act.

Disclosures in accordance with the Act

According to the Privacy Act, personal information cannot be disclosed without consent, unless exceptions delineated in section 8(2) of the Privacy Act apply, two of which are most relevant for this discussion.

The first I would highlight is sub-paragraph 8(2)(m). This provision allows for the disclosure of personal information where, in the opinion of the head of the institution, the public interest clearly outweighs any invasion of privacy that could result from the disclosure, or if the disclosure would clearly benefit the individual to whom the information relates. Fundamental to this exercise of discretion is that there must be a clear public interest in the disclosure. The discretion to disclose or not to disclose personal information lies with the institutional head.

The second is sub-paragraph 8(2)(c) – which allows for the disclosure of personal information to a court, person or body with jurisdiction and the power to compel the production of information through the issuance of an order, subpoena or warrant.

In relation to this provision, we recognize Parliament’s authority to compel the production of documents that may contain personal information and acknowledge that the Privacy Act therefore allows for the disclosure of personal information to a Committee.

Suggestions for consideration

In previous instances where this issue has arisen, we have recommended that Committees explore a range of options to ensure the authority of committees is exercised in ways that do not unduly invade on privacy. 

For example, mechanisms that might help achieve such a balance could include:

• Having committees come to an agreement that they will limit the personal information sought to only that cases which is clearly necessary to resolve the public interest at issue;
• Holding meetings in camera where personal information is to be examined and discussed; and
• Ensuring that there are proper procedures for securing that information once it is in the possession of both the Committee as a whole, as well as individual members.

We hope that Committees will be mindful of privacy issues that could arise in the course of document production requests where personal information is involved and consider ways such as those outlined to ensure that the public interest underlying Committee requests is served while reducing risks to individuals.

Thank you. Deputy Commissioner Smolynec and I look forward to any questions you may have.