Bill C-54: The Personal Information Protection and Electronic Documents Act
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Notes for an appearance before the The Standing Committee on Industry
March 18, 1999
Ottawa, Ontario
Bruce Phillips
Privacy Commissioner of Canada
(Check against delivery)
Ladies and gentlemen
Thank you for the opportunity to appear once more to discuss some of the government's proposed amendments to Bill C-54.
I do not propose to consume a great deal of time on opening remarks. However, there are a handful of clauses whose problems or ambiguities need drawing to your attention. Some of these are dealt with in a letter to the Committee which you may have already received. Nevertheless, they bear repeating.
First I should express my satisfaction with the general process and the overall amendments. I am particularly pleased to see a growing acknowledgment, support and acceptance of the role of an ombudsman in this process.
Now I will turn to the specifics.
Clause 2: Definition of "commercial activity"
My first recommendation - it is a reiteration I know - is that the bill explain what is meant by "commercial activity". I know that an attempt has been made to expand the definition but the result is a tautology. My plain questions are these: Is a medical examination a "commercial" transaction? Is a charity's purchase or exchange of donor lists a commercial transaction? Is a lawyer's service to draw up a will a "commercial" transaction? In short, does the bill cover the professions and the non-profit and not-for-profit sector? The bill should be clear; if we don't answer this now, the Privacy Commissioner will have to find an answer later - perhaps having to spend taxpayers' dollars on expensive legal advice.
Clause 2: Definition of "personal information"
In contrast, the definition of "personal information" is comprehensive and helpful. I particularly want to commend the government for building in the flexibility to include collection of information that is not necessarily recorded. This allows individuals to challenge practices such as putting video cameras in change rooms even when the surveillance is not taped.
Clause 3: Purpose clause - the "reasonable person"
I confess some bemusement over the bill's reference in Clause 3 ( the purpose clause), to what the "reasonable person" would consider appropriate in the circumstances. After some protracted discussion we concluded that this term does not override the principles in the schedule, rather the other way around. Nevertheless, only in the cooking will we know whether the soup is any good. For greater certainty, as the lawyers say, I would seize upon the recommendation of several knowledgeable witnesses who suggested limiting collection, use and disclosure to that which is "legitimate, and both justifiable and reasonably expected in the circumstances".
Clause 7(1)(d): "publicly available" information
An amendment to Clause 7 (d) permits collection of information that is "publicly available" and specified in the regulations. While seemingly obvious, what constitutes "publicly available" and whether that opens the door to any unrelated use of the information, is a minefield. It is a significant step from examining records on an organization's premises - and for a related purpose - to putting the entire municipal taxpayer database on Internet or turning over driver registration lists to direct marketers.
Individuals may have a legitimate interest in restricting disclosure of personal information - even something as basic as their name and address. The whereabouts of a battered spouse is an unfortunate example.
Clause 7(3)(f): Disclosures for research
Further on Clause 7(f) attempts to build more rigour into disclosures of information for research. I applaud it as far as it goes but urge two steps further. First, the clause should limit this type of use and disclosure to studies in which the research purpose cannot reasonably be achieved using non-nominative data. Much scientific and scholarly research does not need the individuals' names to draw reliable conclusions. The clause should also prevent any further disclosures of the information in a form that would identify the individuals. The wording of subsection 8(2)(j) of the Privacy Act may be a useful model.
Clause 8(5): Fees
I want now to turn to the matter of fees in Clause 8(5). I will state my position at the outset: individuals should not have to pay to have their privacy respected - and getting access to their information is an integral part of ensuring that respect. Having said that, I recognize that business may incur some costs in meeting their obligations but I am concerned at the apparent inability to apply any precision to these costs.
I take some comfort from the Schedule's requirement that access shall be provided "at minimum or no cost to the individual". I will keep a watching brief.
Clause 14: Hearings by the Court
Clause 14, the section dealing with hearings by the Court, gives us some pause. At best, I would describe it as cumbersome and I will explain. The bill clearly establishes the complainant's right to take such matters as inappropriate collection, uses and disclosures of information to Court. It also establishes the Commissioner's right to take a complainant's case to Court. What it does not make clear is the Commissioner's right to take a matter to Court without a complaint. Granted the Commissioner could initiate his own complaint, investigate, report to himself-and give himself permission to take the matter to Court, but this is a tortuous process.
Court appeals are not the routine stuff of our Office. We have launched but a handful of cases in our 15-year history. But in the face of egregious abuses and obstructive behaviour, the Privacy Commissioner needs the tool of last resort.
Clause 24: Commissioner's education responsibilities
I welcome the bill's answer to our number 1 privacy problem - ignorance. Clause 24 obliges the Commissioner to educate individuals and organizations about this fundamental right. The flesh is willing but the wallet is empty. Members will know first hand the cost of such items as research, writing, translation and distribution. Our office has lived with fiscal anorexia so long I worry that our collective digestions will rebel at the sight of a full meal. No matter what the words of the statute, they will be meaningless without the resources to make it so. What we must have, to paraphrase the realtor's phrase, is "resources, resources, resources".
Clause 25: Industry Minister's power to delegate
Finally-and arguably most critical-I want to deal with my reservations on Clause 25. This clause grants the Minister of Industry (with the Governor in Council's approval), the power to delegate the Privacy Commissioner's duties or powers to a provincial commissioner or similar provincial official. While there may be times when a provincial official is closer to the ground on a complaint in federal jurisdiction (for example, a B.C. trucking company also doing business in Alberta), the decision to delegate should be the Privacy Commissioner's - and the Privacy Commissioner's alone.
According a Minister of Industry that power courts the danger that powerful business interests will exert pressure on the Minister to delegate matters within the federal Commissioner's power to a province with less stringent protection. Much more dangerous is the damage this power does to the federal Commissioner's independence and thus his status as an Officer of Parliament. Having chosen the ombudsman model to oversee the law, legislators must see that nothing tarnishes the ombudsman's complete independence. Nothing will harm this bill more than any suspicion that the ombudsman operates under the watchful eye of the government and at the first perceived misstep, can be stripped of the power to investigate.
(Questions)
- Date modified: