STANDING COMMITTEE ON INDUSTRY
COMITÉ PERMANENT DE L'INDUSTRIE
[Recorded by Electronic Apparatus]
Tuesday, February 9, 1999
The Chair (Ms. Susan Whelan (Essex, Lib.)): I'd
like to call the meeting to order. Pursuant to an order
of reference of the House dated Tuesday, November 3,
1998, the committee is considering Bill C-54,
an act to support and
promote electronic commerce by protecting personal
information that is collected, used, or disclosed in
certain circumstances by providing for the use of
electronic means to communicate or record information
or transactions, and by amending the Canada Evidence
Act, the Statutory Instruments Act, and the Statute
I'm very pleased to welcome today our four witnesses.
However, before we introduce the witnesses and go to
opening statements, we have a motion before this
committee that was made a few days ago by one of our
members, Mr. Jones. I'll now ask Mr. Jones if he would
like to move that motion.
Mr. Jim Jones (Markham, PC): Yes, thanks, Madam
Chair and fellow members.
I hope I will be allowed more time to speak to this
motion, as I had in my motion last week. As you have
already received the motion, it is as follows:
That Mr. François Beaudoin, President of the
Business Development Bank of Canada, be summoned before
the committee as soon as possible to explain
requirements to granting loans, compliance measures, and
loan repayments, with specific reference to Mr. Yvon
I would like to discuss the reasons for calling Mr.
Beaudoin by providing a brief history of what we know
of Mr. Yvon Duhaime. In April 1993, Les Entreprises,
Yvon Duhaime, purchased the inventory,
furnishings, and ongoing business of the Grand-Mère Inn
from numbered company 161341 Canada Inc. At the
time, then opposition—
The Chair: Mr. Jones, with all due respect, you're
bringing up issues of private citizens before this
committee and your motion is to invite the president
of the Business Development Bank of Canada to come
before the committee. I really don't think we should
discuss private citizens without them being here.
Mr. Jim Jones: I was trying to
give you chronological events of the history we have
and the reason we'd want the Business Development
Bank president here.
The Chair: I'm not going to allow you to discuss
private citizens, so if you can't do it...
Mr. Stan Keyes (Hamilton West, Lib.): I have a point of
order. Has the
chair had discussions and come to any conclusion as to
whether or not this motion moved by our friend across
the way is in order or not? That may just nip
everything in the bud, if it's been determined that it
is not in order.
The Chair: Mr. Keyes, the clerk is willing to
check for absolute certainty, but our first belief would
be that it has reference, again, to a private citizen,
and that is beyond the scope of this committee.
Mr. Jim Jones: I'm referring to a company
called Les Entreprises.
The Chair: Your motion itself has specific
reference to a private citizen. Mr. Keyes' point of
order is about the motion itself.
Mr. Jim Jones: I think today in the House,
Minister Manley, in answer to my question, said this
issue could be discussed before committee.
The Chair: Well, with all due respect to Mr.
Manley's answer in the House, the fact that Mr.
Beaudoin, president of the Business Development Bank of
Canada, could come before the committee is not an
issue. That would be proper. The reality is that we
have seven weeks of hearings scheduled on Bill C-54,
and then we've already said we're going to have
estimates at that time. The Business Development Bank
of Canada is part of the estimates that come before
this committee, and we'll be meeting with them then.
Mr. Jim Jones: Okay. In my motion, then, I'd like
to withdraw the words “with specific reference to Mr.
The Chair: Okay.
Mr. Stan Keyes: Then we go back to—you may
not have heard this, Chair, because you were speaking with your
assistant on dropping that reference—the chair's
comment on the workload facing this committee
and the opportunity you or anyone else in this
committee will have when Mr. Beaudoin appears before
this committee on estimates.
We understand why you
want to do it; it's just mistimed.
I'll call for the question.
Mr. Jim Jones: I have also a notice of motion here
that I would like to call Mr. Howard Wilson,
Ethics Counsellor, to be summoned before the industry
committee to explain his mandate and responsibilities
in the expenditure of his office as listed under
The Chair: Fine, Mr. Jones. We'll take that as
notice, but again, anything that is Industry
Canada-related with regard to estimates we're going to
be doing in the next couple of months.
I want to welcome our witnesses here today on Bill
C-54, and I apologize for the delay in starting our
We're very pleased to have with us, from the
British Columbia Civil Liberties Association, Mr.
Murray Mollard, the Policy Director; from Action réseau
consommateur, Madame Marie Vallée and Monsieur Jacques
St-Amant; and from Electronic Frontier Canada,
Professor Richard S. Rosenberg, the Vice-President, and
Professor of Computer Science from the University of
My understanding is that the clerk has informed you that we
would appreciate it if you could keep your opening
statements to five minutes.
There are a number of papers
that everyone should have in front of them.
Unfortunately, only one was received in time to be
translated. You should have that one before you.
One of the others is in English and one is in French.
I will now begin with Mr. Mollard, please.
Mr. Murray Mollard (Policy Director, British
Columbia Civil Liberties Association): Thank you,
Madam Chair, and thank you to the committee for
inviting the B.C. Civil Liberties Association to appear
as a witness on the matter of Bill C-54. Obviously
democracy and the laws of Canada are much
stronger when you give an opportunity to citizens to
participate in these types of processes, and I
appreciate the opportunity to come before you.
I will give a quick introduction of the B.C. Civil
Liberties Association. Since 1962 we have been working
to promote and protect civil liberties of British
Columbians and Canadians. Privacy is a very important
issue for us, and indeed, I would suggest that in the
last ten years or so it's an issue that has
increasingly been one that we've had to devote
resources to and work on.
We have done a lot of work on assisting complainants.
We do a lot of work on law reform. For example, when
British Columbia passed its law with respect to freedom
of information and the protection of personal privacy,
we were very much involved with the development of that
We've developed a handbook called The Privacy
Handbook, which is a guide for citizens with
respect to privacy vis-à-vis public sector and private
sector. I've included as an appendix to our
submission an excerpt from that privacy handbook.
As I said, more and more of our time is spent
dealing with privacy issues. We have many individuals
calling us with concerns and wanting our guidance and
assistance. We have to say that unfortunately in the
private sector there's not much we can do. Occasionally
we will be able to contact an organization or employer,
but it's often merely moral suasion that gives our
submissions any weight to the employer or the
As a personal anecdote, as I was preparing this
submission back in January, I happened take a shortcut
through a back alley on the way back to work. Passing
a back door of a building, I came across a pile of
paper documents. I took a closer look at the
documents and I saw a variety of financial documents,
cancelled cheques that had personal information on
them. I was quite astounded. I contacted a nearby bank
to let them know, and I said, listen, there's a problem
This point doesn't prove the scientific
necessity of this bill. What I suggest is merely that
it adds to the litany of personal anecdotes and the
demands for greater protection of the personal
information of Canadians. It's also worth noting that
in this scenario it's likely that many of the
individuals who might be involved may never have known
there were transgressions involved in their
personal information. I think that's important to
remember when considering the oversight protections
necessary to make the rights and obligations effective
under the bill.
Our association wants to applaud the government for
the introduction of this bill. We support the bill in
principle and many of the provisions, such as clause 3,
the purpose. We think it is very important to provide
Canadians with a right of privacy in the private sector.
Whatever the economic and commerce-related incentives
and motivations, we think those are merited in terms of
the motivation for the bill. But we think that,
ultimately, privacy is a fundamental right and an
important reason for creating this bill, and we support
We also want to express our support for the inclusion
of employees in the application and the protection of
the bill. It's a very important part of the work we do.
Indeed, many of the complaints with regard to privacy
that we get at our office are from individuals who are
either prospective employees or are employees. I note that
the words “prospective employee” are not actually
included in the bill, and that's one of our suggestions to
Despite our general support, we do think there are
ways in which the bill could be improved, and we've
tried to outline that in our submission. I won't go
through it in detail because I don't have the time, but
I will entertain questions. A couple of points to
highlight, though, include our point 5 on page 7, the
idea of core obligations being in an appendix that can
be changed merely by a cabinet decision as opposed to
legislative changes. That technique really cuts both
ways. It makes it easier to make changes that would
augment privacy, but it would also be easier to
make changes that undermine privacy interests.
We think it is better to put
those obligations in the bill and make them subject to
We think that principle 1 in the schedule should
include a principle of justification, that is, when
individual organizations are stating their purpose,
there should be some limitation, some ability to make
an assessment of the legitimacy of those purposes
and to subject it to a reasonable test.
We also think the law should cover processes as
well as records. We've had trouble in British Columbia
when we've made complaints, for example, about the
taking of urine samples in drug testing, where the
commissioner decided that the process of taking the
urine sample isn't actually subject to the act. I
think it's very important that the law apply to
that before the sample is manipulated, there is
jurisdiction and the act will apply.
We also think there's a very serious problem with
paragraph 7(1)(b) of the bill in terms of the
exemption. We think it punches a gaping hole in the
law and in the obligations of organizations, and we
suggest you re-examine that. We also suggest various
measures to enhance oversight, etc.
One other addition we've made—and I think you've just
been handed it today—is a suggestion for you to
consider whistle-blower protection. What we mean by
whistle-blower protection may not be what you've heard
from other witnesses who have suggested this. We mean
individuals who, in order to expose or prevent a
serious civil wrong, want to disclose personal
information. They're motivated to do so in the public
interest, and they do it without the knowledge or
consent of the data subject.
Now, we put a caveat on this whistle-blower
suggestion. We're still thinking about it ourselves.
It's a fairly complex issue. It requires careful
consideration. We suggest that the committee and
Industry Canada take time to consider it. We don't
have a very specific or direct recommendation for you
either one way or the other, but we think it merits
In conclusion, we again support the bill in principle
and many of its provisions. We suggest that there can
be improvements, and that's what you are here to look
I would welcome any questions. But I would also
make this note. If this bill passes, it will be
ironic, it seems to me, that
individuals in Canada will have better privacy
protection vis-à-vis the private sector than perhaps
vis-à-vis the public sector in terms
availability for remedies through courts or tribunals.
The Chair: Thank you very much, Mr. Mollard.
I'm now going to turn to Madame Vallée and Mr. St-Amant,
and I'm not sure who's going to begin.
Go ahead, Ms. Vallée.
Ms. Marie Vallée (Analyst, Policy and Regulatory Matters,
Telecommunications, Infohighway, Protection of Personal
Information, Action réseau consommateur): Madam Chair, members of
the committee, this brief sets out the concerns of two
organizations: Action réseau consommateur, which was previously
known as the FNACQ, and Option consommateurs. These two
organizations have had a keen interest in privacy for several years
and, among other things, have played a very active role in the work
that lead to the adoption of the Quebec Act respecting the
protection of personal information in the private sector.
We are here today because we strongly believe in the
importance of truly protecting the personal information that
companies have concerning Canadians. We congratulate the federal
government for its initiative and for the ongoing efforts by the
Minister of Industry, Mr. John Manley, as well as the many people
who have given concrete expression to this requirement which has
become, over the past few years, more and more obvious.
Unfortunately, we are not in a position to present an in-depth
analysis of the bill, since for groups like ours, human and
financial resources are both increasingly rare. That is one of the
reasons we were not able to translate the brief in time. Having
said that, the preliminary analysis that we are tabling here today
should nevertheless cover the bulk of our concerns.
We are no longer in control of our lives. At least that is the
impression that citizens can have when they see companies'
insatiable appetite for what they're doing and who they are.
Canadians are concerned about the fate of the personal information
that concerns them. It is not new and it is ongoing, as all the
This problem is on the rise precisely at a time when
businesses are getting more and more enthusiastic about processing
personal information on their clients. At first sight, the
protagonists' interests seem irreconcilable. So philosophical,
political and legal choices must be made. These choices must be
translated into rules of law that provide for more certainty and
In Canada, this raises a question: Are we dealing with areas
under federal or provincial jurisdiction, or both? Since it is an
area of joint jurisdiction, it is important to find the best ways
of ensuring that the legal framework that will be put together is
solid and harmonious.
This is the context in which we see Bill C-54. We fully
support the bill's underlying principles. We would also like to
highlight the importance and the relevance of federal government
intervention at the Canada-wide and international level to ensure
the privacy of Canadians.
First of all, however, we must clearly define the criteria
that will make it possible to determine if the rules adopted by
Canada are in accordance with these requirements. Four criteria
immediately come to mind: the content of the rules must be
adequate, and therefore in accordance with both the generally
recognized principles, and adapted or adaptable to specific
requirements; the rules must be public; the rules must have general
applications; and the rules must also include an effective and
accessible implementation mechanism.
Unfortunately, and this is where I'm going to lose some
friends, the bill, in its current form, does not fully correspond
to these four criteria. The rules, which are split between the body
of the legislation and the appendix, are not easy to understand.
They could be substantially amended by a simple order. This
mechanism might well implement different rules based on areas of
activity and the regions of Canada. Lastly, the implementation
mechanisms are not solid.
We refer you to pages 8 to 13 of our brief, where you'll find
a more detailed presentation of our constitutional concerns.
Moreover, the proposed exemptions pose a problem. Paragraph
27(2)(d) and subclause 30(1) add to the complexity of determining
the eventual application of the bill. If they are left as they are
currently written, the outcome could be very different from that
which the bill intends.
Paragraph 27(2)(d) would exempt the organization, activity or
class from the application of this part in respect of the
collection, use or disclosure of personal information that occurs
within a province. For example, we could see a situation where the
collection of information in Quebec by an insurance company like
Great West would be exempt from the application of federal
legislation, where the same would be true of the disclosure of
personal information from Manitoba, but where all of the other
activities undertaken by the company in Canada would be subject to
the bill, whereas the situation could be different for another
insurance company whose head office is in Ontario.
In summary, that paragraph paves the way for highly diverse
legal regimes which might well distort competition and make it
impossible for these companies to survive. And we are talking about
companies that can afford to pay lawyers. We have not yet talked
about citizens. It also invites companies to go to the Governor in
Council more often to obtain exemptions that would suit them and
would not necessarily be granted to their competitors. We feel that
the wording of that paragraph could be improved.
As for clause 30, it gives rise to the problems for which you
will find our suggestions on page 14 and 15.
Since time is of the essence, we will now move on to our
solutions. Our objective is to propose solutions that could make
the bill clearer, simpler and more effective. First of all, the
scope of the bill must be clarified and its a constitutional basis
consolidated. The purpose is to pass legislation based on
jurisdiction over general trade regulations, a law that will apply
without restriction not only to electronic commerce, but to all
other commercial activities in Canada, without any exemptions. That
would make it possible to restore citizens' confidence in business
practices and by doing so, would facilitate commerce. That would
establish a uniform standardized base.
The existence of this lowest common denominator should not
however prevent a province from providing even better protection
for personal information for its citizens. In such a case, the two
pieces of legislation would apply simultaneously, with no conflict
in principles. Nothing however would prevent Parliament from
stipulating in the bill that in the event of a conflict between its
provisions and that of another piece of legislation, whether it is
federal or provincial, the authority responsible for applying the
legislation must comply with the standard that is most likely to
ensure the implementation of the principles to protect personal
information established by the bill. This would avoid recourse to
an exemption mechanism as proposed in paragraph 27(2)(d).
Clause 30 would no longer be required, and at the same time
there could be cohabitation of federal and provincial legislation
so as to best achieve the objective of the legislation, ie
protecting personal information, with a view to maintaining public
confidence in commercial activity.
Moreover, the federal legislation should obviously also apply
to the cross-border movement of personal information and to all
activities of federally-regulated corporations. The Governor in
Council could however be equipped with the power to subject these
corporations to provincial legislation.
On pages 20 to 28, we point out some minor difficulties with
respect to the structure and some of the solutions that we are
I will conclude with our recommendations.
While we are aware that our first recommendation does not have
much of a chance of being accepted, we recommend that Bill C-54 be
removed from the Order Paper and that the government table as soon
as possible a bill that corresponds more closely to citizens'
Recommendation 2: If our first recommendation is not accepted,
we urge the government to significantly amend the bill in
accordance with the following general and specific recommendations.
Recommendation 3: We recommend that the scope of the bill be
amended so that it applies without restriction to all commercial
activities in Canada and to all activities of federally-regulated
corporations, and that paragraph 4(1)(b) be clarified. I refer you
to page 17.
Recommendation 4: We recommend that the procedure established
by section 30 of the bill and the exclusive power provided under
subparagraph 27(2)(d) be replaced by a rule whereby the provisions
of the bill prevail over those of other parliamentary acts, without
restricting the protection or access rights granted by the
application of the laws of Parliament or a legislature. Please see
page 17 for further details.
Recommendation 5: We recommend the insertion in section 5 of
the bill of a statement of the basic principles of personal
information protection, which should be interpreted and applied in
accordance with the schedule.
Recommendation 6: We recommend granting to the Commissioner
the power to make binding decisions and to conduct inspections even
when he does not explicitly have reasonable grounds to believe that
an offence has been committed (see pages 23 and 24).
Recommendation 7: We recommend that the Commissioner's
decisions concerning a misunderstanding in the treatment of the
personal information or access to such information be subject to an
appeal to a specialized administrative tribunal.
Thank you for your attention. We would be happy to answer any
questions. Thank you.
The Chair: Thank you, Ms. Vallée.
I'm now going to call on Professor Richard
Rosenberg from Electronic Frontier Canada. Mr.
Professor Richard S. Rosenberg (Vice-President,
Electronic Frontier Canada;
Professor, Computer Science, University of British
Columbia): Thank you.
The organization I represent today, Electronic
Frontier Canada, has been in existence almost five
years. On its web page the following statement of
Electronic Frontier Canada (EFC) was founded to ensure that
the principles embodied in the Canadian Charter of
Rights and Freedoms remain protected as new computing,
communications, and information technologies are
introduced into Canadian society.
In many of its
activities, EFC has spent a lot of time arguing against
government intervention into content on the Internet,
perhaps issues covered by freedom of expression. With
respect to privacy, however, we feel the
government must be involved because of the necessity to
protect Canadian citizens from misuse of personal
In this respect, I'd like to focus on some
technological issues and try to argue for a bill...and
I might add that in principle we do approve this
bill. It's long overdue compared to activities in
Europe, say, and of course the non-activities in the U.S.
We much prefer that there be a bill to protect
Canadians in their on-line activities, in fact to
encourage those activities.
What concerns us is that in many instances
Canadians and other users of the Internet have
information about them gathered without either their
awareness or their permission. So it is important
that however the bill is structured, it not depend on
whatever technologies we're aware of now, but be
structured on principles that will survive and endure
for new technologies.
In this regard we've included in our presentation
discussion of something called cookies, which are quite
familiar to most Internet users. The point about
cookies is that a number of steps have to be taken for
the average user to become aware that cookies are
Of course, the very name “cookies” suggests
something quite innocuous, and it's far from innocuous.
It is a movement of information from an Internet user
or consumer that is stored at the host web site. The
done some activity—shopping or gathering information—a
return visit will enable the site to recognize that
person has been there before and presumably help them
or do something for them in their further activities.
Well, that's the ostensible purpose as presented from
the web site, from the industry.
the information gathered is not necessarily used at
that web site. It becomes used by the owner, combined
with other information, marketed, transferred, and used
in many other activities without that person knowing.
The first step is when you start searching on the
Internet—you have a browser—you may not know that
this activity in cookies is going on. The activity is
quite transparent unless you set something on your
browser to require that you give permission before
cookies are deposited. Unless you set this, you
don't know the activity is going on.
That requirement is part of the educational
requirement that I think the bill refers to. But I
would argue that unless sufficient funds are provided
for ongoing education, changes in technology that
result in information being gathered, and I would say
in a surreptitious fashion, are not going to be known
to people. So it's very important not just that a bill
appear, but that sufficient resources be made
available, not just to deal with complaints and
investigations, but to deal with education. People have
to know what's going on or they can't act.
I've included in this presentation something
current that people may or may not be familiar with,
and this is Intel's new chip, the Pentium 3, which
is starting to appear now. Intel included a mechanism
in this chip that aroused a lot of controversy as
recently as last week. Intel felt, the industry
felt, that it's important computers be linked to their
users, so if they're stolen and taken away, it could be
determined that someone other than the owner is using
Well, Intel provides an identification number in its
chip, and when you purchase the computer, the chip
would be activated with your name connected to the
identification number. So that means if you carry on
your activities, your name will be related to this, and
if the name they get from you when you're doing your
on-line activity doesn't match that name inside the
chip, there'll be some problem and authorities will be
Clearly that ostensible reason also deprives users of
any kind of anonymity or privacy, because your name is
automatically associated with activities, whether or
not you purchase. If you visit a web site to browse
and get some information, your name is already there,
and they will know you've been there at a certain time.
In response to this criticism, Intel said, well, if the
user doesn't want this particular feature activated, he
or she can make representations and say, don't activate
Again, this is part of a whole series of
activities in which the basic default condition is that
you as a user have to do something to prevent
information from being taken, transferred, or used.
You'll see that the argument throughout this presentation,
when you get a chance to look at it, is that the
default should be exactly the opposite. The default
should be that nothing about you gets used unless you
say okay, you can use it. I think cookies is one of
these examples where things get used, and later on you
discover you can prevent further use. But it's grabbed
as soon as you get on the system.
It's typical of the industry that information be taken
and used, gathered, and collected as a matter of
course, whether or not it's directly related to the
transaction at hand.
I would argue that if it's a default position where
unless a positive step is taken by you as the user or
consumer, no information is gathered, then no matter
what technology appears along the way, that principle
will be in effect.
Let me finish with final comments in my presentation.
The Intel case is not unique. It is an important
example, however, of an endless stream of technological
innovations that have societal implications—in this
instance privacy. Only a vigilant community can
recognize these threats and take actions to combat
The burden on the individual is too great to act
alone, to say nothing of being positioned to identify
the assaults on privacy.
Legislation such as Bill C-54 is desperately needed to
safeguard all Canadian Internet users, but only if that
legislation incorporates effective and workable privacy
defaults that place the burden on companies to provide
the facilities outlined above.
A strengthened Bill C-54 would provide continuing
protection against the threats of an ongoing stream of
new and powerful devices and methods. Canadians
deserve no less.
The Chair: Thank you very much, Professor
I am now going to begin with questions.
Mr. Dubé, please.
Mr. Antoine Dubé (Lévis-et-Chutes-de-la-Chaudière, BQ): I
welcome those of you who are here to defend the rights of citizens
in relation to this bill.
My first question is for Ms. Vallée, and my second, for the
two other groups.
You prepared quite a long brief. You touched on the
constitutional part, which is found on page 9 and following. On
page 9, you talk about five criteria for judging whether a federal
law is constitutional. I would like to give you an opportunity to
explain this, Ms. Vallée or Mr. St-Amant.
My second question is for the two other groups but relates to
you also. We have a law in Quebec. Quebec is the only province with
a law that has similar objectives right now. I would like to get
your opinion on the value of the Quebec law.
Ms. Marie Vallée: Mr. St-Amant will answer any constitutional
Mr. Jacques St-Amant (Attorney, Option consommateurs, Action
réseau consommateur): In the decision handed down in 1989, the
Supreme Court tried to set out guidelines for cases in which
Parliament could use its general regulatory power in trade, and set
There must be a system, and there must be a regulatory body,
but there must also be a problem that can be settled by the court
but not separately by the provinces. There absolutely must be
federal intervention to resolve the difficulty that is the subject
of the law. Failure to include some parts of Canada would also
compromise fulfilment of the objectives.
Our concern is that because of the mechanism in the bill,
Parliament is saying, essentially: We are establishing a law based
on general trade regulations, but if in one, two, eight or ten
provinces there is a similar law, we can make a decree whereby the
federal law will no longer be effective.
From a strictly legal viewpoint, I have difficulty with the
fact that on the one hand they are using powers related to trade,
which theoretically should apply everywhere, and on the other hand,
they are prepared to make orders whereby the federal law will only
apply in one or two provinces. This seems somewhat paradoxical, if
not illogical. This is our basic concern as to the constitutional
validity of the proposal as presented.
The Quebec law has been in force for a some years. It has the
benefit of being much simpler in form, and under it, the agencies
implementing it, in particular the Access to Information
Commission, can make binding decisions. It is a law which works
well in practice and is easier for individuals and companies to
understand than the bill in its present form.
The Chair: Thank you, Maître St-Amant.
Mr. Mollard or Professor Rosenberg, do you have
anything to add to the second question?
Mr. Murray Mollard: Yes, I have a
couple of things to say.
The constitutional questions are very complex. I'm
sure if you invited five lawyers in here, you'd get ten
opinions. Ultimately, of course, the constitutional
issues will be sorted out in court at the end of
litigation and whatnot. That doesn't mean the
government shouldn't think very carefully about the
I do want to give members a sense of some of the
impact of the introduction of this bill on British
Columbia, though. We know the Province of British
Columbia has taken a serious interest in protecting
privacy in the private sector all of a sudden. We
didn't see that interest expressed prior to this bill
being introduced. I think the government should
commend itself for showing the fortitude to take those
privacy interests seriously; for stepping forward and
forcing the issues; and indeed for asserting its
authority where it has it, in order to force
governments to take this seriously.
Remember we're talking about nine other provinces
and almost three territories that won't have the
same type of legislation. If the bill is passed in the
end and provides a significant
impetus for those provinces to seriously consider these
issues, that's great.
We need for them to do that in British
Columbia because this bill would not extend its
application to protecting employee privacy. I do,
however, just want to perhaps commend the government
for forging ahead.
The Chair: Thank you very much, Mr. Mollard.
I'm now going to turn to Mr. Murray.
Mr. Ian Murray (Lanark—Carleton, Lib.): Thanks,
First of all, I want to thank all of the witnesses for
putting a great deal of effort into your presentations
and your submissions. They're very helpful.
I've been preoccupied with one section of this bill,
so I perhaps should address my question to the B.C.
Civil Liberties Association. On page 12
of the association's submission, I believe there's a
recommendation that clause 7, as it's currently worded,
be deleted. I think that's what you're suggesting, Mr.
My concern has been the exemption that's currently in
the bill for journalistic, artistic or literary
purposes. I don't believe you spelled out specifically
in your submission that you were at all concerned
about, for example, journalistic purposes. I need to
be convinced that there's not a problem there. I
understand that a number of news groups have suggested
that there would be immediate charter challenges if the
exemption is not there for journalists. I'm personally
more concerned with the rights of individuals to their
own privacy than I am with journalists being able to
collect whatever information they feel they should
have. Also, I see journalism today very much as a
business. I don't think Conrad Black would disagree
As the Privacy Commissioner also pointed out to us,
there's also a problem with the statement of
principles, as I believe it's called. There had been a
code of ethics, but it no longer exists now. I can't
remember the exact name of the news association that
its members ascribe to, but not all so-called
journalists or journalistic publications belong to
I'd just like to know your feelings
on that specific exclusion for, in particular,
Mr. Murray Mollard: Thank you for the question.
It's an interesting one.
To quote Alan Borovoy, this is one of those
situations in which freedoms collide. What you have on
one hand is an interest in freedom of expression, the
exposure to public debate of issues that may involve
particular individuals in identifying particular
personal information, and on the other hand, the
interest in having those individuals' privacy
The association is not opposed to the journalistic
exemption or the literary or artistic exemption. What
the act does do, though—and I'm sure some in the media
may not be happy with this, although we support it
subject to our suggestion about your considering
carefully a whistle-blower protection—is something
with respect to sources for journalists. Individuals
who are tempted to disclose personal information are
going to be subject to the act. We therefore think the
act creates a balance in the sense of allowing the
exemption for journalists generally, but then placing
an onus on all organizations to respect the obligations
within the act.
Mr. Ian Murray: If I could just interrupt there,
the problem I have with the sources is that journalists
are often loathe to admit who their sources are. What
recourse is there in that case, if a journalist refuses
to say where he or she obtained the information?
Mr. Murray Mollard: I think that's one of the
reasons why we've suggested that there should be, in
the oversight provisions, for example—and I agree with
Marie Vallée on this—a proactive ability to audit
individual organizations. I'm not sure that addresses
your question particularly, but I think there should
be an opportunity for the commissioner to audit perhaps
in a way that encourages compliance, as opposed to
using a hammer approach.
In British Columbia, the commissioner there uses what
he terms “site visits”. He's visiting organizations
to make sure they're complying with the act.
If there is a disagreement at
the end of a controversy, though, there should still be
the power to expose problems on the commissioner's
As far as journalistic sources go, I don't have a
complete answer for that. The fact is that the
obligations are there if they come to light or if there
are concerns from an individual. Certainly, if an
individual is named, he or she can raise the question.
How effective it will be to have that concern noted is
unclear to me, though.
With respect to this, the act is not going to be
perfect. I don't know how it would be able to strike a
perfect balance. Indeed, if I follow your question,
you would not want the journalistic exemption, but that
begs the question about freedom of expression. In this
case, we see that there is somewhat of a balance
between the two.
The Chair: Thank you, Mr. Murray.
If anyone has any comments on a question that's not
directed to them, just signal to me and I'll allow you
to participate in the discussion.
Ms. Lalonde, please.
Ms. Francine Lalonde (Mercier, BQ): Thank you for the work you
have done. Unfortunately I was unable to attend your presentation
because I had to meet with a group, but I did go over your text. I
think that Option consommateurs has put forth quite an effort
toward squaring the circle.
This bill might create a number of problems, and I would like
to stress two major ones. On the one hand, Quebec which was the
first to adopt this kind of law, took a chance and developed some
expertise. The Liberal government of the day and the Opposition
passed the bill unanimously. One might have expected to see this
new bill based on the Quebec law. The least one can say is that it
will hinder the application of the Quebec law. This is the essence
of the first problem: How can we avoid having companies throughout
Quebec subject to two sets of rules, and citizens having to deal
with two different types of protection, and having to knock on two
The other problem is the lack of privacy protection measures
in the rest of Canada. One would think that almost any kind of
protection is better than none.
Thus there are at least two major problems. I thought you were
maintaining that for optimal privacy protection, there would have
to be coordination, agreement and basic rules applicable
everywhere, and we should be able to apply the best rules, those
that more closely resemble Quebec's. Did I understand your
intervention clearly? Was that the result of your research? It is
Mr. Jacques St-Amant: Yes, it is a matter of squaring a
circle. We feel that it is useful for Canadians, and inevitable in
some areas, to have Parliament intervene. There are some questions
in which it is difficult to intervene.
I think that we generally agree that the Quebec law provides
protection equivalent or superior to that of Bill C-54. We are
proposing a system where Canadian law would apply to all commercial
activities, federal business activities and transboundary
activities. As soon as it took effect, it would apply everywhere.
Wherever, in the opinion of the Commissioner, a legislative
provision by a tribunal or an organization more effectively
fulfilled the objectives of privacy protection than the basic law,
the former provision would take effect. Thus we would have a system
where everyone from coast to coast would at least know what to
expect. And if a province decided to give more rights to its
citizens, which it can do, there would be a slightly more
Undoubtedly in some cases we would find two overlapping
regimes, but that is probably inevitable in Canada. We see this
kind of situation in many areas.
In the matter of consumer protection, for example, the
Competition Act contains provisions on advertising, as do a number
of provincial laws. Business is quite comfortable with this, and so
generally are consumers. Thus there is a way of reconciling these
laws and making sure that everyone is protected, some as well, if
I would like to add a detail which coincides with some
comments that have already been made. We must not forget that
several other provinces currently have existing legislation or case
law that provides some protection of personal information. For
example, there are some controls put on journalists. Journalists
cannot do anything they want. Regardless of whether or not there is
federal legislation, Quebec has libel and privacy provisions that
will continue to apply. This is also the case in other provinces.
We must not lose sight of the fact that we currently have an
extremely complicated mosaic in Canada. We have just added another
element to this mosaic which may be important. We must make sure
that it works.
The Chair: Thank you, Mr. St-Amant and Ms. Lalonde.
Mrs. Sue Barnes (London West, Lib.): Thank you,
Thank you for your presentations.
When we look at our world, which we're used to, we see
medical circles doing informed consent. In legal
circles, you read before you sign. Here, we're into
the default provisions in that it's nearly the reverse.
Although I can understand your criticisms about taking
it off the table, law is the art of the possible. No
one piece of legislation fixes everything. I take the
input from B.C. to be saying it's a good start, and I
believe that's true.
What can we do to fix it? To my mind, I think the
input about punitive damages being limited fiscally to
$20,000 is very good. I would agree with that, but
we'll hear from others in order to try to unearth the
justification for why that number is there. It's small
potatoes to many corporations, I'm sure. It's more
like lunch money as opposed to anything with a real
Also, Professor, in one of the footnotes in your
paper, you've outlined the points on fundamental
principles of fair information practices. Those are
extremely relevant. If it's possible, what I would
like for you to do is to point out where you find this
piece of legislation deficient in standing up to those
Prof. Richard Rosenberg: I should
point out that these fair principles are about 25 years
old. They were first proposed by a U.S. congressional
committee investigating privacy legislation or privacy
proposals. Of course, there is no universal privacy
protection in the U.S.
In the proposal, I used those principles at various
places, in various statements, with respect to the use
of the word “should” as opposed to the use of the
word “shall”. The term “should”, of course, is
conditioned by the statement in subclause 5(2) of the
(2) The word “should”, when used in Schedule 1, indicates
a recommendation and does not impose an obligation.
At a couple of places, I went through and said that if
you have “should” here, it will not give the
protection of a particular one of these fair
information principles. For example, paragraph
(b) a checkoff box may be used to allow individuals to
request that their names and addresses not be given to
other organizations. Individuals who do not check the
box are assumed to consent to the transfer of this
information to third parties;
In my brief, I wrote:
I would argue that such an option must be made
available to individuals. It cannot be the case that
one should assume that permitting an organization to
collect and use personal information applies to the
right of that organization to sell or transfer such
information to third parties, unless explicit
permission has been obtained.
And I also note:
To do otherwise would be a clear violation of the third
principle of Fair Information Practices, namely “There
must be a way for an individual to prevent information
about him that was obtained for one purpose from being
used or made available for another purpose without his
I think there are two or three other examples in
Given that these principles arose in the States and
are referred to very widely in other countries as
justification for legislation, I think it's interesting
that in the U.S. they are seen as principles
and are never referred to as justification for
Mrs. Sue Barnes: One of the areas that
interests me is the whole concept of data mining.
Here we have a system that talks about individual
complainants coming forward and special circumstances
where the commissioner can enter the fray. When
there's a whole class of people affected, do you have
any civil liberties input on that? What are your thoughts
in that area?
Mr. Murray Mollard: I'm sorry. I don't quite
understand the question.
Mrs. Sue Barnes: Do you want input on that?
Prof. Richard Rosenberg: Let me understand your
use of data mining. This is where vast amounts of
information are collected, say, supermarket shopping
Mrs. Sue Barnes: That's it, yes.
Prof. Richard Rosenberg: Something where
there's lots of information, and the idea of data mining
is to take this vast amount of information and process
it with some very large computers or lots of small
computers acting in concert, to extract detailed
shopping behaviour, detailed microscopic economic
behaviour of individuals—that is, by the hour, by the
day, by the store, by the product, on and on.
Clearly, stores that encourage the use of air
miles cards or special cards attach a name, a real live
name of a shopper, to this data. So now you have very
particular, very fine-meshed information about a whole
bunch of individuals and their regular shopping
activities. I understand the question to be that if
all of them are somehow affected, what resource do
all these people have, or what will they do to express
their concern? Will thousands of people in some
shopping area discover all of a sudden that information is
being used? Will some individual do it, and how will
that affect the other individuals?
Mrs. Sue Barnes: Specifically because the
individual piece of information is so minute that
nobody is really going to get upset about that one
piece. It's only when you see the whole picture.
Prof. Richard Rosenberg: I think that's one of
the concerns about this in the large, that at the
micro-level a piece of information seems harmless. It
seems, what does that matter? But the point is in
data mining, and many other areas, what the computer
facilitates, which was not possible previously, is the
gathering of vast amounts of information from quite
different places and attaching them to given
individuals, to very tightly define people. Now
you have little pieces that independently have no
particular threat, but put together provide quite
detailed information about behaviour of individuals.
I think that's a real concern.
As you know, this bill is complaint-driven. Unless
you discover something has happened, and it's very
difficult to discover this, then you could say, well,
it's all operating in the background; if it doesn't
affect my life, what do I care if they have all this
stuff and are using it?
Well, it may not affect your life now, but it could
easily affect your life down the road, in which case
you will never be able to figure out where the
information came from and how it is that all this stuff
is known about you when you never gave permission for
any piece of it, or you may have for some piece and not
for others. It makes it extremely difficult for people
to determine how they're going to get redress after the
fact, when all this has been gathered.
Mr. Murray Mollard: My comments are, first,
that it perhaps goes back to that audit point I made,
that it's important that the commissioner have some
proactive ability to encourage compliance and take a
cooperative approach with organizations, rather than
the hammer approach in the first instance. It's just to
step back for a moment and realize that in terms of freedom,
if some individuals want to give their personal
information for a particular gain, economic gain or
benefits from various marketing
schemes that occur, I think they should be free to do
so. But what is critical is that the purposes be very
specific and that people understand those purposes and
indeed that public education occurs so people can
understand the implications of what they're doing.
I think perhaps in the last 10 years or so,
we're only awakening to some of the implications of
what it means when you're asked for your name and all
your personal information from a particular corporation
that wants to sell you something. People are
starting to ask, “What do you want that information
One of the things we've said is that the public
education mandate of the
commissioner is critical. The commissioner needs
to have proper funding for that. But I think that
public education mandate falls on all of us, not just
one particular government organization.
The Chair: Mr. St-Amant, do you subscribe to that?
Mr. Jacques St-Amant: I fully agree with Mr. Mollard.
Obviously, we need resources if we are to play the role of an
The Chair: Thank you.
Thank you, Mrs. Barnes.
Ms. Marie Vallée: And, obviously, the Commissioner needs to be
The Chair: Thank you.
Mr. Dubé, please.
Mr. Antoine Dubé: I will let Ms. Lalonde speak before I do, so
that I can continue reading.
The Chair: Monsieur Dubé, you went first, she
went, and now it's your turn. You don't want another
Ms. Francine Lalonde: Go ahead.
The Chair: I'm sorry. Did I mention Madame
Lalonde's name. I apologize.
Mr. Antoine Dubé: I was in the process of reading, on page 13,
your example of the Great West Life. You have no doubt thought of
other similar cases. These are various exemptions that may be
allowed under the current legislation for a business like that. You
have no doubt thought about other examples. I would like you to
provide us with other cases.
Mr. Jacques St-Amant: We have not come up with a complete
list. Nevertheless, the bill, as it is drafted, definitely poses
two basic problems. First of all, it is very difficult to treat
strictly federal businesses and other businesses that may be
competing with the federal government in the same fashion. The best
example would be the one where you have the banks on one side and
the credit unions on the other. If both are not treated equally,
somebody, somewhere, will complain and say that
this is not a level playing field
and that it is unfair. Consequently, we have to find a way to
harmonize these two cases.
Then, paragraph 27(2)(d) of the bill, as it is drafted,
enables the Governor in Council to exempt, by decree, the
organization, activity or class from the application of the Act.
This could possibly lead to an absolutely phenomenal carve-out. We
could find ourselves, in certain provinces, with a law that may or
may not be basically the same and even, in the case of such a
carve-out arrangement between organizations and between activities,
with federal businesses being subject to another system. The
citizen will be totally confused and the business itself may be
On top of that, the proposed system will change with the
times. Let's say, for instance, that this bill, as it is currently
drafted, comes into force on July 1, 1999. Basically, the
legislation will not apply to strictly provincial business
activities for three years, and therefore not until 2002. In
Quebec, we will therefore continue under the current system and, in
the other provinces, there will, basically, be a vacuum.
Starting on July 1, 2002, in Quebec, we will have overlapping
legislation. We now have C-54 in the other provinces. Who is to say
that, in 2004, for example, Alberta will not decide to pass
different legislation? We would again be changing the system in
this province if the Act were deemed to be essentially similar to
the federal Act. This is not a simple system; this is not a system
that enables businesses to foresee how they are going to manage.
Last week, I discussed the issue of personal information with
a lawyer who works for a parapublic agency in the field of public
protection and discipline. Her spontaneous reaction was to say: "My
God, personal information is a sensitive and complicated field. Now
that five years have gone by in Quebec, we are still not sure
whether or not we are comfortable with the issue." And this was a
If we wind up with a system such as this one, the provincial
bar associations are going to have to put a lot of work into on-
going training, to say the very least.
The Chair: Mr. Dubé.
Mr. Antoine Dubé: On another issue...
The Chair: I'm sorry, Mr. Mollard.
Mr. Murray Mollard: I would like to add something.
There's no doubt that this law is complex, and indeed in
some sense, even with the experience in Quebec, we're
launching a little bit of new territory in terms of
legislation. So there's definitely going to be a
learning process, and that's why it's so important to
have the five-year review.
In terms of complexity, I would like to talk to
Jacques a bit more about this. There's no doubt that
our constitutional set-up is one that is always going
to engender complexities. Indeed, corporations that
operate across provincial boundaries have this problem
on all sorts of matters, environmental for example and
other matters, where there is shared jurisdiction in
some ways, and they have to learn to adjust to the
particular provisions with any particular
jurisdiction. Perhaps that's the bargain we bought
when we created this country. I think it's a great
The Chair: Thank you, Mr. Mollard.
I will go to Mr. Dubé. Last question, Mr. Dubé.
Mr. Antoine Dubé: I have a question on another matter. I
believe you said, Mr. St-Amant, that individuals and private
businesses will be treated more harshly under this Act than the
federal government, under the system it gave itself. Recently, the
Department of Revenue was nonsuited by the court for, I believe,
pairing customs and employment insurance data, something which the
I would like you to explain why the federal government is not
a good model of this system which it is absent to impose on private
Mr. Jacques St-Amant: As Mr. Mollard was saying, our
constitutional system is by nature complex. We do feel, however,
that we could do something to simplify the situation where we have
both provincial and federal legislation pertaining to personal
I think that the principles suggested in the federal act, Bill
C-54, make, on the whole, a lot of sense. The bill is based on an
OECD proposal of a few years ago and on what is done just about
everywhere else. There are, of course, some linkage problems
between the bill and the schedule and we have made a few
recommendations pertaining to this matter. However, as far as the
principles are concerned, I don't think that there are any major
Of course, you were talking about the situation as it pertains
to the public sector. In our opinion, a major difference lies in
the fact that, in the federal public sector, the Commissioner's
decisions are not binding. Perhaps this is understandable given
that problems can be drawn to the attention of the House of
Commons. At one point the minister in charge may have to be
However, this is not the case in the private sector and this
is why we feel it is important that the Commissioner be authorized
to make binding decisions. Indeed, if we ask consumers and citizens
experiencing difficulties to complain to the Commissioner who in
turn can only make recommendations, these people will then have to
go to Federal Court, where they will have to deal with the delays,
costs and complexities that such proceedings entail.
This is a complicated process for resolving small problems
which often, as Professor Rosenberg pointed out earlier, do not
appear to be crucial, at least not crucial enough to warrant going
to Federal Court. However, they may be real problems all the same,
and we are recommending that a more effective and simpler process
I'm not sure that that answers your question, but there you
The Chair: Thank you, Mr. St-Amant. Mr. Bellemare.
Mr. Eugène Bellemare (Carleton—Gloucester, Lib.): Thank you,
My question is to Professor Rosenberg and it is in regard
to the section on protection of personal information.
Knowing full well that this bill is specifically about
electronic commerce, and the commerce we do within the
province, outside the province, interprovincially and
internationally, and of course, the ballgame we must
play with Europe and the rest of the world... But in
terms of access to information, it appears that journalists,
artists, comedians, and literary people have free access
to your personal information. I'm surprised you
did not point out that perhaps—and even this I would
not accept as being restrictive enough—the word
“commercial” or “business” should be added between
the words “an organization may collect
personal information without the knowledge or consent
of the individual only if”; and if they're newspaper
people, for example, “personal information”.
If someone wants to do electronic business, why
should they need to know the personal affairs of any
individual in Canada as opposed to knowing the personal
business or commercial affairs of an individual? Let's
stick to that fine point first.
Prof. Richard Rosenberg: They shouldn't,
Mr. Eugène Bellemare: Shouldn't what?
Prof. Richard Rosenberg: They shouldn't know.
They shouldn't have access to or gather or use
information beyond that needed for the immediate
purposes of the transaction. Again, I think that is a
long-standing principle in the privacy area.
However, it's usually phrased in a way that allows
lots of manoeuvrability for organizations. That is,
some organizations will say in their privacy statement,
we only gather the information we need to do our
business, which leaves a lot of leeway open for
interpretation about what exactly do they need to do
So even if you try to make it explicit, as has been
attempted here, and say that only the information
necessary for the transaction should be gathered, it's
not clear to me that you would put a severe limitation
on the information gathered in the end.
Mr. Eugène Bellemare: Don't you believe, then,
that subclause 7(1)—
The Chair: Mr. Bellemare, Mr. Mollard wants to add
Mr. Murray Mollard: I wanted to emphasize
Professor Rosenberg's point and underline the
limitation of the bill in that respect. One way to
solve that is to think about adding some principle of
justification mirroring the words in Quebec's act, or
the European Commission's directive about serious and
In other words, I think it's impossible to think
ahead of time of all the purposes that might be
legitimate. It's impossible in law to specify those.
However, if you use limiting terminology that provides
some assessment after the fact and recourse to
Mr. Eugène Bellemare: Why aren't you suggesting
that since we're talking about electronic commerce
the leeway would be for that specific
activity and not permit a fishing net to any journalist
who wants to really do defamatory work on anyone he or
she feels like?
Prof. Richard Rosenberg: It's difficult to
separate. I haven't actually thought about the
journalism part. I did make a note when I was reading
the bill; I underlined the word “collect” exactly in
that place and I was thinking about it in general. But
I'm not experienced enough to know what kind of
justification there is for arbitrary collection of
information by journalists, because, seemingly, any
limitation in advance could be seen as a restriction on
some general notion of freedom of the press.
I don't know how you could say in advance that there
are certain things they couldn't get, or shouldn't get,
without permission. I would like them not to get a lot
in general, but I don't know how you would say it, how
you would frame that and say... Then the journalists
would come back and say, I began the story
investigating this and this seemed interesting.
I suppose President Clinton would have liked it
if Kenneth Starr had stopped the investigation when he
found nothing out about Whitewater. That would have
been a limitation thing. You were called to do
Whitewater, you finished Whitewater, it's over;
but then this other thing appears.
Mr. Eugène Bellemare: You're not giving me an
answer to my question.
Prof. Richard Rosenberg: I'm saying it's a
difficult problem. I'm not sure how you would frame
that. My answer is I don't know.
Mr. Eugène Bellemare: Should the press be let
loose on every individual in this country under the
guise of writing up something on electronic commerce?
Prof. Richard Rosenberg: Probably not, but as I
said, I don't know how you would frame it to say you
can only get this but not that. I don't know how that
would work when you don't know what the press is trying
to do at any given time.
Given the benefits to a free and open society of a
free press, that is, given certain latitude, I think
the press has to be responsible in the end for what
they produce. If they defame, or if they commit libel
or so on, they should be subject to those things if the
information they gather has that effect. But in
advance, I personally don't know how you would be able
to frame a restriction on what the press could collect,
or how much, or in what directions, in advance.
Mr. Eugène Bellemare: Time could be of the essence in
a case of a press write-up, and the person being
attacked, or who feels he or she is being attacked,
might have no recourse because of the time element. In
an election, for example, of a school trustee in some
city, a person could be defamed, and then the election
Mr. Murray Mollard: You can seek an injunction,
presumably, to prevent the publication of particular
Mr. Eugène Bellemare: Once it's out, how do you
stop the trustees from having their election?
The Chair: Mr. Bellemare, Mr. St-Amant wishes to
Mr. Jacques St-Amant: As the law currently stands, every
Canadian province has rules governing the press, governing
journalists, that prevent them from committing libel and spreading
false information. This exists right now. Regardless of whether or
not Bill C-54 is adopted, this already exists in law. The only
thing that the provisions of the bill do—there could be some minor
refinements, but these are details—is to say that this Act does
not prevent the press from doing its job. It does not provide the
media with any new rights or powers, this is far from the case.
These provisions simply avoid the situation where we would be faced
with a multitude of court challenges based on the Canadian Charter
of Rights and Freedoms and its provisions pertaining to freedom of
The Chair: Thank you very much, Mr. Bellemare.
Madame Lalonde, s'il vous plaît.
Ms. Francine Lalonde: Thank you. I would like to go back to
the confusion arising from the bill. I feel that legislation of
this type takes it for granted that there will be some consumer
training or education and that, for businesses with obligations,
clarity is also essential.
Do you think that it would be possible to leave the text as it
is, namely, to apply the provisions of a bill that provides for an
obligation that refers to the CSA Code, which is full of
conditions, to state within the bill that the conditions do not
apply, but then to have clause 7 which provides some type of
framework in order to compensate for what would be missing in the
Mr. Jacques St-Amant: I would respectfully submit to those who
are of the opposite opinion, that I feel that the solution put
forward in the bill is not the easiest one. That being said, this
approach was adopted for all kinds of reasons. We do feel, however,
that we could still make things easier to apply and more readily
understood for the parties concerned, for the businesses and
possibly also for the Commissioner, at the very least, by including
certain essential principles in the bill. At any rate, most of
these principles are already included in the schedule. But let's
take these principles out and say: This is what any business or
organization must do.
Next, and this would greatly simplify any interpretation
problems with respect to the schedule, we should say that these
general principles must be interpreted and applied according to the
instructions provided in the schedule. By doing this, we would
avoid these quasi-legislative "shoulds" and the notes and we would
no longer have to say that the "shoulds" and the notes do not
really apply and do not have force of law. The schedule would
therefore play a role that is more in keeping with its form and
nature and we would have a system that is easier to understand
without having to rewrite the entire bill. Indeed, we would not
have to do much at all. In an ideal world, we would have perhaps
taken another approach, but we have to live with what is now on the
Ms. Francine Lalonde: We are not living with what we now have
on the table if we do what you want. We would be amending the bill
The Vice-Chairman (Mr. Eugène Bellemare): Ms. Vallée.
Ms. Marie Vallée: Ms. Lalonde, I would like to refer you to
page 22 of our brief. We put a lot of work into this brief because
we know that we may have only one shot at it. We're going to have
to live with the bill, after making some amendments to it.
Ms. Francine Lalonde: That's not what we think.
Ms. Marie Vallée: This is what we are suggesting on page 22 in
order to interpret the schedule. If we were to amend clause 5 as we
have suggested on page 22, we would be adding principles that are
essentially the same as those given in the schedule, but which
would have legal weight. If you were to read it, you would see that
we talk about "must"...
Ms. Francine Lalonde: Like the body of the bill.
Ms. Marie Vallée: ... "must" rather than "could" and "should".
If these principles were included in the Act, we could avoid many
problems which we fear may occur and, at the same time, the Act
could coexist with the schedule. Of course, this is not an ideal
situation, but it's better than what is there, and it's better than
nothing as well.
The Chair: Mr. Mollard, do you wish to say
Mr. Murray Mollard: Yes, I just wanted to say that
Marie, Jacques, and I can probably sit down and talk
about this. Indeed we suggest as well that the basic
obligations be a part of the body of the act, or if the
act is going to put them in a schedule, that they not be
subject to change simply by cabinet fiat. It's quite
obvious the schedule is not as neat and tidy as
probably most legal drafters would like it to be.
Nevertheless, we as an association were prepared to
accept it partly on the basis that there was wide
consensus from various quarters—business interests,
consumer interests—when the Canadian Standards
Association put this together. It was a consensus
document. It may not suit everybody's purposes, but
it was a consensus document, and to some extent that's
quite significant in terms of the various parties that
this law would apply to in terms of their cooperating
with it, buying in, etc.
The Chair: Thank you.
Thank you, Madame Lalonde.
Mrs. Sue Barnes: Thank you. I have a couple of
questions. Mr. Mollard, this one is for you.
On page 13 of your brief you were giving a criticism
of paragraph 7(1)(b), and the association's position is
to remove that area. Would it make a difference to you
if instead of thinking of the need for it as being a
lawful purpose... For instance, I'll give you an
example of a banking or an insurance company trying
to detect fraud. You're not going to signal that you're
checking out transactional records. So to me there is
some justification, maybe in some improper personnel
activity within a corporation, where there are some
overriding security issues involved. And I see some
need for some type of exemption here. I'm wondering
when you wrote your criticism whether you had those
situations in mind or just the normal commercial
Mr. Murray Mollard: Well, yes. To be very clear
here, we're not suggesting that paragraph 7(1)(b)
simply be erased without being replaced by anything.
What we are saying, though, if you look at what it
says... Let's look at the wording in particular here:
it is reasonable to expect that the collection from the
individual would compromise the accuracy of the
information or defeat the purpose or prejudice the use
for which the information is collected;
Well, for the individual, taking this from the
perspective of the data subject, the reason this is
there and the accuracy might be compromised is
that the individual would object to the collection
of that personal information. In other words, it's in
the significant time where privacy means most to the
data subject that there's this wide open, gaping hole.
You're quite right, there may very well be
compelling public interests, or legal duties,
obligations, or rights on behalf of an organization that
would merit an exemption for collection, but we say
specify those, be specific, think it out, think it
Mrs. Sue Barnes: Define the problem.
Mr. Murray Mollard: Define them. Define them as
Mrs. Sue Barnes: In the legislation?
Mr. Murray Mollard: Yes, as you've done in
subclauses (2) and (3). That's the approach you took
in subclauses (2)
and (3). Instead, in subclause (1) you create this absolute
gaping hole when privacy means most to an individual,
the data subjects who would be subject to the
collection without their knowledge or consent. It just
seems quite a large, gaping hole, and a mistake in our
The Chair: Mr. St-Amant, do you wish to reply as
Mr. Jacques St-Amant: I'd like to quote from
another statute that addresses that problem. The
act addresses it in the following way.
It is possible to collect a person's information without
consent if you have a serious and legitimate reason and
either of the following conditions is fulfilled:
the first is being in the interest of the person
concerned; and second, collection from a third party is
necessary to ensure the accuracy of the information.
With that kind of drafting you narrow the gaping hole
that exists, without trying to go into making a list of
cases where it would apply, which may not be easy.
Mr. Murray Mollard: I'd like to follow up. I
suppose I'm open to Jacques' suggestion that there is
some limitation on that. But again, because the
individual who's going to be subject to it may never
know, there may be some problem—and this is
complaint-driven, remember—with the complainant ever coming
forward to challenge what is legitimate and what is
So it's hard to be exhaustive. I know
subclauses 7(2) and (3) have been, and
I'm curious as to why that approach wasn't taken in
Ms. Sue Barnes: This seems to be a recurring theme
sometimes, and it's a difficult thing to do, that is,
decide what you put in the text of your legislation and
deal with the possibility of regulation outside the
purview of a parliamentary committee and Parliament
itself. I've heard your complaint.
Professor, if you feel the same way. Is this one of
the situations where we should have this in the text of the
Prof. Richard Rosenberg: I actually don't
feel as strongly as the expressed opinion. I'm not
sure who that's directed towards. I don't expect the
average person to read the text of the legislation. I
can't think of any other legislation I've ever read, except
the things that—
Mrs. Sue Barnes: My issue is, do you want
something of this importance where parliamentarians
would not have to review it and where it can be done by
order in council?
Prof. Richard Rosenberg: No, I would like it
reviewed by Parliament.
Mrs. Sue Barnes: Can I have input from the others?
The Chair: Mr. St-Amant.
Mr. Jacques St-Amant: At any rate, it would be good to have
some consultation before we have rules such as those contained in
the schedule so that we can amend them. That much is clear.
Mrs. Sue Barnes: On a point of information, my
colleague from the Bloc gave a Revenue Canada example
and brought it up as a contrast. I would just put out
the other recent example about the income tax form
where we actually asked for informed consent to add
information to the electoral records, and I think we've
had a great response on that.
The Chair: Thank you, Ms. Barnes.
I have no one else on my list. Are there any other
Madame Vallée, do you have a comment?
Ms. Marie Vallée: I'd like to raise an issue which I haven't
had time to deal with yet. There are some minor drafting problems
between the French and English versions and, in some places, there
are some very major shifts in meaning. I'd like to draw your
attention to page 28 of our brief. One of the problems that we have
noted pertain to the way that certain clauses of the bill are
numbered. The clauses are not numbered the same way in both French
and English. Certain words are included in the French version but
not in the English version, and sometimes these words completely
change the meaning of a clause or subsection. We have already
discussed these issues with some people. We cannot stress enough
how important it is that the wording be similar in both languages
and that it mean the same thing.
Moreover, I'd like to state, if we did not make this point
very clearly during our presentation, that we believe that the
federal bill should apply to all business activity, and not only to
The Chair: Madame Vallée, you should know that
there have been a number of reviews, and they're
continuing to review the legislation. They have
identified a couple of errors in matching, and we
appreciate your bringing that to our attention as well.
I want to thank you all for being here today. The
committee appreciates your input. It's a very
difficult subject for us to understand completely.
Some have been involved in this area
longer than we have. We do appreciate your being here
and travelling the distances you did in order to join us here.
If you have any other comments as our hearings
continue, we would appreciate your input. Our hearings
are posted on the Internet as soon as they're
available. You should also know that your briefs will
be translated and circulated to the
members of the committee.
Mr. Mollard, do you have a final comment?
Mr. Murray Mollard: I just want to take up
one final detail, and that was the point about the
enforcement mechanism. Jacques made some comments
about a tribunal versus a court and whether this court
system that has been set up in the bill is actually
very good. The association originally recommended to
Industry Canada that a tribunal be used in terms of its
special powers and special knowledge and the whole
reasons one has an administrative tribunal.
That said, we're not opposed to the bill's use of
Federal Court. However, it's absolutely important that
the ability to go to court is both accessible and
affordable. It's quite a unique and novel scheme
that's set up here in terms of a sort of ombudsman and
yet the opportunity to go to a judicial review in some
Where the Privacy Commissioner decides that the
complaint is justified and recommends that the
organization amend its practices or whatnot and the
organization just ignores those recommendations, as it
can do, it seems to me that it should really fall to
the Privacy Commissioner on behalf of the complainant
to pursue that in court. If there are no
recommendations or the commissioner finds the complaint
isn't justified, it really should be up to the
complainant to pursue it. But even in that case, it
still should be an affordable and accessible process,
which is one of the reasons one uses administrative
tribunals and not the court.
The Chair: Thank you, Mr. Mollard.
Madame Vallée, Mr. St-Amant, and Professor Rosenberg,
do you have a final comment?
Prof. Richard Rosenberg: I'd just like to add one
thing about the difficulty of finding out what happens
to information, and I'll try to do this quickly.
Currently, on the application for a credit card, let's
say, you agree to certain things. That's rightly so,
because you're getting the use of someone else's money
for some period of time while you purchase things.
What you agree to, specifically, is that the bank or
financial institution run a credit check on you to make
sure you're a good risk for the card they're giving to
you, and that seems reasonable.
The part I want to raise for your consideration is
that you also give them into—they don't quite say
perpetuity—the future the right to do credit
checks on you that are totally unrelated to your
getting the original credit. Furthermore, the
information they gather is automatically shared with
whoever requests it. This comes about because of their
membership in credit bureaus. The credit bureau system
operates by members not only using information but also
being required to supply information they get to the
credit bureau so that other agencies can use it.
As a consumer, I would like to know that when I agree
to the conditions, in fact I'm agreeing to this indefinite
intrusion and this indefinite sharing of information
beyond any fixed date. That's generally not known by
people. That's just one example of
gathering information without limitations.
The Chair: Thank you very much, Professor
Rosenberg. In fact, we had a discussion with some
of the provinces in early December about
how information is used and gathered.
We appreciate that input as well, when it
comes to consumer information.
Again, I want to thank you all for being here with us.
The meeting is now adjourned.