Bill C-6, the Personal Information Protection and Electronic Documents Act
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Speaking notes prepared for the Senate Standing Committee on Social Affairs, Science & Technology
December 1, 1999
Ottawa, Ontario
Bruce Phillips
Privacy Commissioner of Canada
(Check Against Delivery)
I thank the members of this committee for inviting me to appear today. Bill C-6 represents a fundamental and necessary sea change in the way we deal with privacy issues in Canada. I am particularly pleased, after years of calling for an extension of data protection laws to the private sector, to see the bill that you now have before you.
Some members of this committee may not be completely familiar with my role and that of my office. I am the Officer of Parliament responsible for supervising the application of the Privacy Act, which regulates the collection, use and disclosure of personal information by federal government institutions. The Act also provides individuals with a right of access to personal information held about them by government, and a right to seek the correction of that information where it is erroneous. The Privacy Act is Canada's initial response to the international movement to secure a set of rights known as "fair information practices." The Act is one of a series of measures designed to promote respect for the broader right of privacy, which includes the right to be free from unreasonable search or seizure, the right to freedom from unwarranted surveillance, and the right to privacy of one's surroundings.
My office also investigates complaints by individuals about the handling of their personal information by government institutions, and conducts audits of government institutions to promote their compliance with the Act. And, although it has no formal research and education role, my office has been at the fore in exploring the panoply of privacy issues raised by advances in technology and shifts in public policy.
As I stated, the federal Privacy Act - and its provincial counterparts - is Canada's initial response to the international consensus about the need to promote fairness in the handling of personal information. The Privacy Act fulfils in large part our commitment to establish fair information practices for personal information handled by the federal government. However, until the introduction of the Personal Information Protection and Electronic Documents Act last year, Canada's response to the call for fair information practices in the private sector has been woefully inadequate. To date, only Quebec has enacted comprehensive private sector data protection legislation. I am happy to say that Bill C-6 is about to remedy this deficiency.
We could of course look at the bill in very cold, clinical terms. If we did, we would describe it simply as legislation regulating the processing of personal data by Canada's private sector. Or we could see it, as I urge you to see it, as legislation that seeks to preserve and, indeed, enhance one of the underpinnings of a democratic society - the right to control what others can learn about us. Let us not forget what is at the core of the discussion about this bill. We are speaking about human dignity, about human autonomy.
Three years ago, Professor Ursula Franklin delivered a powerful closing address at the international data protection commissioners conference being held in Ottawa. Professor Franklin spoke of the tension between two opposing views of privacy:
All the notions of privacy can trace back their origin and validity primarily to considerations of human rights. When human rights informs the language in which the discussion amongst you, the general public, and Parliament takes place, then you speak, rightfully, about citizens and all that comes with that.
On the other hand, if the emphasis is primarily on the protection of data, one looks at a market model, one looks at an economic model, and all the things you have heard about the new economy. Then, it is the language of the market that informs your discourse. You and everybody who speaks with you, speak about consumers, about providers, about service.
It will come as no surprise to the members of this committee that I view privacy from the perspective of human rights. Privacy is a fundamental human right. In this tug of war between privacy and commercial interests that you are witnessing in the debate over this bill, I implore you to remember what is at the foundation of the debate. It is a right that is elemental to life in a democratic society. It is a right that is at the core of the international instruments protecting human rights - rights that we are so willing to champion when violated in other countries, but that we sometimes overlook in our own.
So I ask you not to yield too readily to the opinions of those who might wish to open the book on individuals through access to their personal information. Commercial interests are important, but so are human rights. I also remind you that the very heart of this bill is the Canadian Standards Association's Model Privacy Code, which the private sector helped create and over which it can claim some ownership. This bill therefore does not constitute the heavy-handed imposition on an unwilling business community of principles foreign to their thinking. Rather, perhaps more so than almost any other piece of federal legislation in recent years, it reflects the consensus of significant sectors of Canada's business community.
It is not the objective of the bill to impede business. The objective is to help create a state of mind in which business routinely considers client, customer and employee privacy rights in developing products and administrative practices. This will not happen overnight. But I am supremely confident that the end result will be positive. Business depends on satisfied clients and customers. Its reputation is any company's most important asset, and no one will want to risk being singled out for willfully flouting the rights of individuals.
Presuming it becomes law, the bill will be the most important legislative tool defending privacy since the enactment of the Privacy Act in 1982.
Although not perfect - what piece of legislation ever is? - this bill represents a great leap forward. It will require business to respect a code of fair information practices requiring individual consent for the collection, use and disclosure of personal information. Equally important, it provides a mechanism for independent oversight. The Privacy Commissioner of Canada is given statutory authority to investigate complaints, issue reports and conduct audits. As a last resort, the bill provides recourse to the Federal Court and empowers the court to award damages.
THE OMBUDS ROLE
The bill grants the Privacy Commissioner the power to conduct audits and investigations, and to report findings. Just as it is not the bill's intention to impede business, it is not my intention as Privacy Commissioner to impede business. I pledge to work closely with the private sector. It is not my goal to be heavy-handed.
The 15 years of experience that my office has had with an ombuds role for complaint investigation has shown that heavy-fisted enforcement is not necessary to secure the privacy rights of Canadians. Rather than emphasizing confrontation, the ombuds role emphasizes resolving complaints and, perhaps ultimately more important, it emphasizes correcting the underlying problems that lead to those complaints.
Of the 20,000 complaints my office has handled since 1983, fewer than a dozen have prompted our recourse to the courts. The office is less a police department than a problem solver. Our approach has always been non-confrontational and non-adversarial - an approach that will be even more necessary in dealings with the private sector. I have no intention of arbitrarily crashing through the doors of businesses. To do so would only doom the cause of promoting respect for privacy from the start. Recourse to the courts remains, but as a last resort.
Some might liken the ombuds role to a watchdog without teeth. I can assure you that my response to privacy abuses will be more dramatic than simply gumming the offender to death. But I firmly believe that effective privacy protection can be secured without strict powers of enforcement.
EDUCATION
One vital element of the bill is that it provides the office the tools to fight the single greatest privacy problem in Canada - ignorance. The office will be given a formal mandate to undertake public education. Business is already welcoming our assistance. Individuals who deal with those businesses will want to know their rights and their responsibilities. The more people know, the less they fear and the more informed choices and decisions they can make.
CONSTITUTIONAL ISSUES
The bill walks through a constitutional minefield, and it appears to do so with some skill. The objective is clearly noble - to provide a level playing field for privacy protection across Canada. Privacy is simply too important a right for anything other than consistency in its treatment across this country. Indeed, through measures such as the European Union Data Protection Directive, we see strong efforts to harmonize aspects of privacy protection - in this case, data protection - across national borders. It would be a pity if, in this era of increasing international connectedness and attempts to harmonize legislation, our own domestic privacy protection would remain fractured and fractious.
LAW ENFORCEMENT
The law enforcement lobby in Ottawa has managed to persuade the government to give it unnecessarily broad exclusions from privacy law. Note that "law enforcement" includes not just police forces but those who administer such laws as the Income Tax Act or the Employment Insurance Act. The exemptions encompass all such investigations. As a result, businesses are not permitted to tell someone that they have responded to police or bureaucrats' demands for personal information, unless the agency agrees. This is a sensible requirement during the period where disclosure would impede or injure an investigation. But once the investigation is finished, there is seldom good reason for not telling the individual what has been done with the information, particularly with administrative investigations.
However, Bill C-6 gives law enforcement agencies absolute discretion. They need not demonstrate an injury to their investigation in order to deny the individual access to the information. And, unlike the federal Privacy Act, there is no requirement in Bill C-6 to keep a record for the Privacy Commissioner. This obligation to keep records has proven to have salutary effects on federal agencies; it provides an audit trail for investigations.
On the positive side in these otherwise overly zealous law enforcement exemptions, businesses are not required to give up information merely on the say-so of a police officer. They are entitled in the absence of a warrant to decline to give information. And since warrants are not required for many administrative requests (although the form of request is usually prescribed), there is all the more reason to make the process accountable.
The most that can be said about unfettered police discretion to deny access to investigative files is that it is also to be found in the existing Privacy Act. We have objected to this discretionary power, and will continue doing so with greater vigour than ever. This issue sits high on the list of amendments needed to bring the existing Privacy Act up to date.
PRIMACY
Clause 4(3) states that privacy protections contained in the bill apply despite any provision of any other federal act unless the other act expressly declares that its provisions operate despite these privacy protection provisions. This in itself is good.
However, the granting of primacy of the data protection provisions in the bill is not retroactive. I would ask Senators and all Parliamentarians to help our office in keeping a careful eye on legislation that comes before them in the meantime. I hope that all legislation now before Parliament will, in anticipation of the enactment of the primacy provision, be designed so as to comply with the privacy protections in Bill C-6. This would constitute a manifest show of good faith on the part of the government.
RECONCILING BILL C-6 AND THE PRIVACY ACT
Bill C-6 and the existing Privacy Act contain some important differences that need to be reconciled. For example, the existing Privacy Act permits recourse to the Federal Court only in cases of denial of access to records. Not included are complaints about collection, use or disclosure of personal information - the heart of any privacy code. Bill C-6, on the other hand, allows an appeal to the court for all such complaints. If this discrepancy stands, Parliament will have acquiesced in a lower standard of privacy protection in dealings with the federal government than in dealings with the private sector. That is hardly defensible.
CONCLUSION
Bill C-6 is not perfect. However, it signals a profound and necessary shift in the direction of securing effective privacy protection. I anticipate that, after it is enacted, the legislation will require further amendments as we gain experience with it. This is part of the evolution of the protection of privacy in this country. It should not be unexpected, particularly in light of the constantly shifting nature of the threats to privacy.
As pleased as I am with this legislation, I cannot leave this hearing without reminding the members of this committee and other parliamentarians that data protection is only one element, though an important one, in the search for respect for the fundamental human right of privacy. The privacy of Canadians is increasingly under siege, due in part to ever-more-powerful technologies of surveillance, and in part to an apparent willingness of governments and others in positions of control to exploit their positions of power for noble and, often, ignoble reasons.
Protecting Canadians' privacy in the face of these forces will be one of the great challenges of the coming years. Of course, even with this legislation in place, the battle to protect privacy in our society will not end. But at least we are moving, however, cautiously, in the right direction.
- Date modified: