Proceedings of the Standing Senate Committee on
National Finance
Issue 7 - Evidence - February 25, 2014
OTTAWA, Tuesday, February 25, 2014
The Standing Senate Committee on National Finance met this day at 10:02 a.m. to study the expenditures set out in the Main Estimates for the fiscal year ending March 31, 2014.
Senator Joseph A. Day (Chair) in the chair.
[Translation]
The Chair: Good morning and welcome to this meeting of the Standing Senate Committee on National Finance. This morning, we will continue our study on the Main Estimates for the fiscal year ending March 31, 2014.
[English]
This morning we are very pleased to welcome Chantal Bernier, Interim Privacy Commissioner of Canada. Accompanying the commissioner are Daniel Nadeau, Director General and Chief Financial Officer, and Maureen Munhall, Director, Human Resources Management.
Ms. Bernier, I understand you have a brief opening statement and then we'll get into questions and answers.
[Translation]
Chantal Bernier, Interim Privacy Commissioner, Office of the Privacy Commissioner of Canada: Thank you, Mr. Chair and honourable senators. I would like to begin by thanking you for your interest in the operations of our office.
I am pleased to share with you today our main estimates for the 2013-14 fiscal year. I will also be addressing a number of key priorities our office set during this year. As you mentioned, Mr. Chair, I have the great privilege of being assisted in this task by Daniel Nadeau and Maureen Munhall, two key advisers in our office.
I will now talk about the planned spending by program area. In 2013-2014, our office expected to spend $29.1 million to achieve the results set out for our four core program activities.
Of that amount, we earmarked just over $10.2 million for internal services. This amount includes one-time costs associated with the relocation of our headquarters to Gatineau, which includes an interest-free loan of $4.1 million to be reimbursed over the next 15 years. The relocation actually took place on February 14 and it was very successful.
In keeping with the spirit and intent of the deficit reduction action plan, our office reduced its expenditures by 5 per cent, or $1.1 million per year, from its total budget between now and 2014-15.
[English]
Let's move now to one of our greatest challenges, which is the fact that we are going through a dual transition period. This year our office is in the midst of two important transitions: my appointment as interim commissioner while awaiting the appointment of a new commissioner, and our relocation to new offices in Gatineau. I am honouring the excellent work of my predecessor by ensuring the maintenance of that level of excellence and by providing a seamless transition through both effective collaboration and clear communication.
You have already seen from our highly publicized investigation of Google in relation to online behavioural advertising released on January 15, as well as from the special report to Parliament we tabled on January 28 on oversight for the Canadian intelligence community, that we are pursuing our work for Canadians with unwavering dedication even through transition.
The results of our investigation into the loss of a hard drive at Employment and Social Development Canada will also be tabled in Parliament shortly to ensure full transparency.
Behind these highly publicized projects are our replies to over 10,000 queries from Canadians every year, our conduct of nearly 2,000 investigations in both the public and private sectors, our PIA reviews of every main federal initiative having impact on Canadians' personal information, as well as our audits, policy guidance for the public and private sectors, and research. All this comes from a group of employees who continue to provide excellent service during this time of transition.
[Translation]
In terms of serving organizations and the public, one of our office's key objectives is to raise awareness of privacy issues among all Canadians, as well as public and private organizations.
One of our biggest challenges in serving Canadians is maintaining excellence, even as our workload is growing in both volume and complexity without an increase in resources. To sustain the quality of our services in this context, we have undertaken the following concrete initiatives:
- modernizing our investigative processes so that we can implement an approach proportional to the issues at hand and, thus, gain efficiency;
- adopting a calibrated approach to data breaches, where the extent and breadth of the measures we use will depend on the severity of the incident;
- increasing the use of early resolution of complaints to ensure a timely result that is to everyone's satisfaction; and
- prioritizing reviews of privacy impact assessments to ensure the greatest risks to privacy receive the greatest attention.
Mr. Chair, I would like to close by summarizing the key points about the fiscal year that is wrapping up.
First, our expenditures increased over the last year because of the costs related to the move of our office.
Second, as this year of transition continues to unfold, my team and I are committed to ensuring that we maintain our high level of excellence and dedication to serving Canadians.
Third, we are continuing to modernize our processes to ensure the best service to Canadians despite our increasing workload in a time of limited resources.
I am now ready to answer your questions.
[English]
The Chair: Thank you Madam Commissioner. I appreciate your background information. I would like to clarify some points you've made so we can understand what you're telling us.
The budget for this year is $29.1 million. You indicate that's a little higher this year than it has been because of moves, but what was in previous years and how much are you allocating for the move?
Ms. Bernier: It is $4.1 million for the move.
The Chair: But is that all in the $29 million for this year?
Ms. Bernier: Yes, that is included, and that is why it has increased. It's because of that additional $4.1 million for the move.
The Chair: Increased from what?
Ms. Bernier: Well, deduct $4.1 million.
The Chair: Now I understand that. This is interesting. This $4.1 million is to be reimbursed over the next 15 years. It's at $4.1 million per year for 15 years that you're going to be reimbursing?
Ms. Bernier: I will let my colleague, Daniel Nadeau, explain exactly how the reimbursement will take place.
Daniel Nadeau, Director General and Chief Financial Officer, Office of the Privacy Commissioner of Canada: The interest-free loan given to us to finance the move will be reimbursed in equal payments of slightly less than $300,000 over the next 15 years, adding up to the $4.1 million.
The Chair: But you're asking for it all in this fiscal year?
Mr. Nadeau: Yes. The move occurred this year, so the expenses were incurred this year. However, because these expenses were significant and we could not absorb them as part of our regular budget, we contracted this loan over a 15-year period to finance these costs.
The Chair: Why do you need the full amount of repayment this year if you're paying it over 15 years?
Mr. Nadeau: No, the funding that came in this year was $4.1 million to finance the expenses. That explains why we normally have a budget around $24 million, $25 million. We jumped to $29 million this year. In the upcoming years, as opposed to being, to use a round number, $25 million, it will be $25 million less the $300,000 a year that we will reimburse for the next 15 years.
The Chair: I understand that. From whom did you get the loan? This seems a little different from the normal situation where I would have thought Public Works would help you move.
Mr. Nadeau: Yes, one could say that. Because what they call our ``occupancy instrument'' was ending in this fiscal year, the building we were in was being refurbished. Because we were at the end of our lease, we, the organization, had to incur expenses related to the move. We approached the Treasury Board Secretariat and the Department of Finance to discuss the financing of this move. Public Works was not in a position to fund it so we had to absorb that, and the mechanism found was this interest-free loan over a 15-year period.
The Chair: Is that from public money, from another pot?
Mr. Nadeau: Essentially from our budget coming over the next 15 years. So it's financed this year through the Department of Finance, through the fiscal framework, to be reimbursed by us over that period of time.
The Chair: That's an interesting twist on things that we normally see.
There may be other questions from honourable senators. I will go to my list of senators who have indicated an interest in participating in question and answer, discussion and comment.
Senator Buth: Thank you very much for your comments.
My first question is to follow up on this interest-free loan. Where are you going to get the $300,000 every year to pay back?
Mr. Nadeau: The interim commissioner mentioned the efficiencies we're trying to find throughout the organization, so modernizing our investigative processes is one way we will be financing this repayment over the next 15 years.
Senator Buth: That is a great segue. Can you explain that in more detail?
Ms. Bernier: With pleasure.
I'm actually very proud of this accomplishment when I consider that when I arrived at the OPC, the timelines to complete investigations were around 19 months and we've gone to 6. Truly the staff have done wonders, and I'm extremely proud of them.
So how did we do that? Essentially, to analyze the process and find where we could have efficiencies. The Privacy Act allows us to conduct investigations as we see best, within procedural fairness, so we've identified efficiencies everywhere within that.
For example, we have a proportionate approach. Some investigations are easier to do than others; the facts are more obvious. We tailor our investigation to that level of difficulty. Others are very difficult and may, for example, involve technological analysis, so we will shift our resources to those and therefore be able to leverage that way.
In relation to the private sector — and PIPEDA is the name of the legislation — we actually have the power to refuse to investigate complaints that are frivolous, vexatious or could be better addressed elsewhere. We exercise that power when indeed a complaint meets those criteria.
Of course, early resolution, which I've mentioned, has also been a great help because essentially it serves both parties towards an earlier resolution of the issue with less expense.
Senator Buth: You talk about shifting resources to the more complex cases. Does that mean staff have to be more flexible? How do you shift resources?
Ms. Bernier: It's not really staff that are shifted; it's more that efforts are shifted. For example, we will have an investigation that appears quite simple on its face, where the facts are pretty obvious. So the investigators will speak to the respondent, the organization against which the complaint is made, and say, ``Look, do you really want to go through this?'' We can then bring early resolution, so it's really the staff adopting a proportionate approach in each case.
Senator Buth: How many staff do you have?
Ms. Bernier: We have 181 FTEs at this point.
Senator Buth: You made the comment in your opening remarks that you reply to over 10,000 queries from Canadians every year. What are they asking?
Ms. Bernier: They ask a lot of things. In fact, we have it sort of in categories. They will ask about what their rights are. They will ask a lot about the SIN number: They've been asked about their SIN number in a transaction and if that is allowed. They will ask about how to file a complaint. They will ask information about their privacy rights in relation to the public or private sector. It's really anything that concerns them in a transaction or broadly.
Senator Buth: What kind of education do you do, or outreach to the public, so that you don't have to answer those inquiries?
Ms. Bernier: We have a very good website where we post tips, guidance documents and research.
To give you an example, we've had a focus on youth. We have a tip sheet for parents on how to teach their kids about privacy and how to protect themselves. We have a great piece on privacy rights at the border, either by car or by plane.
We also have education for organizations. For example, we have guidance for app developers. When they develop an app, how they should develop it in a manner that is privacy conscious?
We also have a graphic novel for youth that is very popular and teaches youth in class. We have a module to help teachers teach privacy rights.
If you go on our website you'll see it's very extensive.
The Chair: Ms. Bernier, you mentioned PIPEDA, that wonderful acronym which stands for Personal Information Protection and Electronic Documents Act. Is that correct?
Ms. Bernier: Yes.
The Chair: You're responsible for that piece of legislation?
Ms. Bernier: We are.
The Chair: There have been a number of serious problems with respect to personal information on the Internet, and honourable senators might wish to get into that question a little later on.
Senator Callbeck: Thank you, and good morning to all of you.
On the $4.5 million move, the relocation, did I understand you to say the lease was running out where you were? Was it going to cost less money to move to Gatineau than to stay where you were?
Mr. Nadeau: The building was being refurbished, so in essence we were being kicked out of the building; we were homeless.
In discussions with Public Works, we found what we felt would be best for the organization, the new home that was going to be best for the organization. In doing so, in discussions with other agents of Parliament, we moved in with the Office of the Commissioner of Official Languages, the Office of the Information Commissioner and Elections Canada. Four agents of Parliament have moved in.
We also look for opportunities to share various things that will help make our operations a bit more efficient. We saw this as an opportunity in that sense.
Senator Callbeck: Have you identified the initiatives the four of you may work on?
Mr. Nadeau: Yes. Right now we're looking at a number of areas, everything from finance, to human resources, to procurement, to administration. We physically pooled certain resources right away. For example, we have a combined library in the new space, a shared mail room and things of that sort. We will be continuing to look at various opportunities over the coming months.
Senator Callbeck: Have you projected how much you think you're going to save?
Mr. Nadeau: We're looking into that. At this time, that remains to be determined. Mostly, we're looking at improving the services while maintaining costs, but eventually we're hopeful this will bring in some financial efficiency.
Senator Callbeck: You have 181 staff right now. Have you relocated yet?
Ms. Bernier: Yes.
Senator Callbeck: Has there been an increase in staff?
Ms. Bernier: No, we did not generate an increase in staff. We relocated on February 14.
Senator Callbeck: Do you have the same square footage or more?
Mr. Nadeau: It's actually less.
Senator Callbeck: Do you have a breakdown of roughly what the $4.5 million consists of? Are they moving charges? Are you buying new office furniture and equipment? What's the breakdown?
Mr. Nadeau: As part of this initiative, Treasury Board has launched what's called the Workplace 2.0 initiative. The main objective of that initiative is to get government organizations into a new space using new approaches, sharing certain space within the office and — let's be honest — downsizing the amount of space being used by the various organizations with different setups.
In order to meet these requirements, we had to invest in new furniture. We were moving into a new building, not an existing one, so there were a number of associated costs. Essentially, Public Works paid for the shell, and as we moved in, we had to pay for everything inside. There are a number of costs, from furniture to the number of walls being put up, to the IT equipment, the audio-visual equipment, anything you can imagine on top of the moving costs as well.
Senator Callbeck: Do you have a breakdown of how much you spent on office furniture and moving?
Mr. Nadeau: We're trying to finalize that right now because the move just occurred. Most of these costs are going through Public Works right now. Public Works then bills us, invoices us for everything. We have not received all the bills yet, but we are in constant dialogue to make sure we keep a good handle on things.
Senator Callbeck: Of the $4.5 million, what did you project for moving expenses?
Mr. Nadeau: We projected a little more than that initially, so slightly under $5 million. The funding to pay for that was partly from a loan, and we managed to free up a little bit of our resources as well. Some of these costs started last year, but the bulk of them occurred this year.
The costs were funded through that loan we have. We anticipate that the costs will be a little less than what we originally thought they were going to be, which was just under $5 million. We'll be in discussions with central agencies to ensure that if we do spend less, then obviously our loan will be reduced accordingly.
Senator Callbeck: Do you have a breakdown for that $4.5 million?
Mr. Nadeau: Yes.
Senator Callbeck: Could you give us an outline of that?
Mr. Nadeau: To give you a sense of what we're looking at, the fit-up costs, what is deemed fit-up by Public Works, which include building the walls, as I mentioned earlier, is around $1.5 million.
Senator Callbeck: I thought they were paying for that.
Mr. Nadeau: No. What happens is for the building, the costs are absorbed by Public Works. I don't want to get into too much detail; let me know if it's too much. What happens is that the standards suggest that a number of offices can be built, but depending on the setup of the organizations — for example, we have a number of lawyers, and because of the information we deal with, we must have enclosed offices for these lawyers, and there are associated costs. There are also costs associated with conference rooms and various other rooms set up for people to meet, things of that nature. There are two floors in our building, so that added up to the $1.5 million of the $4.5 million.
In addition, a number of costs are billed by Public Works, such as architectural fees and design fees, so we had specialists available who helped us throughout the move.
I talked about furniture and equipment, so there is around $1 million associated with that.
We also have significant costs related to information technology and all the equipment associated with that. That is not necessarily related to the move, but we had to update our platform at about the same time we were moving, so there were significant costs put into servers, networks and the necessary security measures around that. That's IT security.
There are also significant costs associated with building security that we have to incur along with our partners in the building, so there is probably $1 million associated with that. Those are some of the major costs you will find in that $4.5 million.
Senator Callbeck: Thank you.
[Translation]
Senator Bellemare: Good morning, everyone, and thank you for joining us today.
My question is sort of general in nature. Since Snowden's revelations, we know that the NSA has spied on American citizens and citizens of other countries, including Canada. In your budget, we see that the funding earmarked for raising public awareness to those activities has dropped by almost 20 per cent. Your budget is good, but I am not able to tell whether that is a lot or not, given how considerable the challenge is. Do you have the means to meet this challenge?
Ms. Bernier: Absolutely. I actually referred to the special report we submitted on January 28. The objective of the report was precisely to contribute to a constructive discussion on this critical issue. The money for this special report did not come from the ``public education'' envelope. It came from research and policies. However, the outcome was that the public was informed.
Another example was our decision to make public our Google investigation report. This happened in January as well, and it helped educate the public without necessarily using money from an envelope set aside specifically for that purpose.
To go back to your initial question, our January 28 special report includes 10 very concrete recommendations on the increase in surveillance activities, and I think they are very easy to implement. For instance, we ask that Parliament undertake a study that focuses on this issue to find out whether we have the legislative framework needed for privacy protection, given the current risks of surveillance and cyber-surveillance.
However, there are nine other recommendations, and we hope that they will be implemented.
For our part, we continue to do our work. Following our special report, the legal status of metadata became a crucial issue. We tabled our special report on January 28; two days later, revelations came to light that data were had been captured in an airport that shall remain nameless. Officials from national security agencies appeared before the Senate and said it was not personal information, but metadata. We have started a study on the legal status of metadata in terms of personal information protection. We hope to release it in June.
Those are some examples of what we continue to do.
Senator Bellemare: I have a question about another issue, sort of at the other end of the spectrum. Is it the commissioner's duty to take the initiative in terms of federal bills that deal with privacy protection, for instance, or do you reply to requests you may receive about a bill? In other words, do you sort of review bills, identify some problems and then approach those responsible for the bill, or do you wait to be asked?
Ms. Bernier: We have a parliamentary affairs group that participates in policy-making and research, and that actually reviews all the bills. Usually, when privacy issues become quite prominent, we are invited to appear. That does not prevent us from expressing our opinion. Once we take stock of the whole legislative agenda and if we feel that some bills pose a risk to the protection of personal data, we do our study and provide our advice to Parliament.
Senator Hervieux-Payette: First through you and then the media, we should thank your predecessor, Jennifer Stoddart, who did an outstanding job. She did a fantastic job in protecting Canadians. She also set up an entire organization.
I have a quick question on recruitment and the mandate. Is there an open competition in the public service?
Ms. Bernier: To recruit the next commissioner?
Senator Hervieux-Payette: Yes.
Ms. Bernier: The Privy Council Office oversees the recruitment process. An advertisement was published in newspapers. Candidates will be interviewed. The selection committee will make a recommendation to the Prime Minister. The Prime Minister will choose a candidate and submit the nomination to you for ratification.
Senator Hervieux-Payette: He will submit the nomination to the House of Commons?
Ms. Bernier: The nomination must be ratified by both chambers, the Senate and the House of Commons.
Senator Hervieux-Payette: I think it is important for us to know the process. Has a date been set?
Ms. Bernier: I suppose that, once the selection committee finishes its work, it will propose a nomination to the Prime Minister. If the Prime Minister agrees, he will submit the name of the person to you. However, we do not have a date.
Senator Hervieux-Payette: At any rate, you are doing a great job. I even hope that you applied.
I may be getting the name of the chain wrong, but I think it was Target that had credit card data stolen. Do you oversee those activities? When this type of negligence occurs, do you have the power to sanction entities that lose such important data?
Ms. Bernier: You are correct, it was Target, and we keep a close eye on those situations.
I mentioned the initiatives we have undertaken to respond to all the requests, without an increase in resources, as well as our calibrated approach to data breaches. Target is one of them. We are warned either because the company reports the incident to us or because we read about it in the papers. We then look at the gravity of the incident. For instance, have credit card numbers been disclosed? If so, there is definite exposure. How serious is the breach on the organization's part? Did the organization fall prey to an extremely sophisticated cyber-attack, or was it negligent? If the breach and the impact are serious, our response will be more thorough.
If we realize that the company ensured all the necessary protection, but was the victim of a serious cyber-attack, we will discuss the matter together and perhaps exchange correspondence. We will make recommendations if our technology experts see that some small breaches occurred, and that might be the end of it. If, however, we find that the breaches were serious, we will conduct a proper investigation. We will even decide to make the investigation public if we feel that the public must be warned.
Senator Hervieux-Payette: My colleagues might know this, but I have known it for a long time. When RCMP officers intercept a Canadian, the incident is entered in a database, regardless of the reason. Ten years later, whether the case went to court or not, whether an offence was committed or not, the information is still in the database. This smacks of a ``police state.'' If nothing comes of it, I do not see why those data would not become obsolete after a while. We are told that, if that individual eventually does something bad again, we will have a record. I personally feel that, if the person did not commit an offence in five years, there is no reason to keep the data. We are not talking about thousands of pieces of data; we are talking about millions of pieces in the RCMP database. Perhaps it is time to do some cleaning up.
Have you ever looked into that personal information? The RCMP works at municipal, provincial and federal levels in a number of provinces. We in Quebec are less affected. I am concerned by the existence of a catch-all database that contains a lot of common little infractions, like failing to come to a complete stop at an intersection. People may well find themselves in the database for things like that.
Ms. Bernier: I share your concern. Even before I arrived in 2008, the commissioner's office had audited these ``exempt'' files, as they are called. They are RCMP files that contain a huge amount of information that is sometimes of no consequence at all, it is insignificant. But they are kept indefinitely. You mentioned cleaning them up. The good news is that, in fact, as a result of our recommendations, the RCMP has cleaned up these ``exempt'' files.
We have seen media stories about people trying to cross the border and finding out that police files contain information on them that has nothing to do with any criminal activity. For example, people have been denied entry to the United States because a police file shows that they once attempted suicide. That is why I share your concern. All I can tell you at the moment is that we are looking into the matter and you will see the fruits of our labours in the coming months.
Senator Hervieux-Payette: You have moved your offices, thanks to that amount of $4.1 million, you have all the electronic tools and you have specialized staff. To be effective, you have to use the best tools, the best computers and programs. Do you have all the tools you need, or would you like more sophisticated ones?
Ms. Bernier: Of course, we would always like to have more because we are dedicated to serving Canadians. However, I have to say that we have what we need to defend Canadians.
The proof is in the pudding. I feel that you see it regularly, in the papers and elsewhere, that Canadians are consistently getting answers to their questions. Everyone who comes to or calls our office with a complaint gets their questions answered and their complaints resolved.
Our staff is highly qualified and very dedicated. I can say so because I see them; I have been measuring their skills and their dedication for five years. We also have very sophisticated electronic equipment.
Just think about the investigation into Google Street View that was made public in 2010, when the Street View cars were capturing Wi-Fi networks. Our technology people were the ones who managed to log in, you might say, to Google's technology.
Think too about the Google issue that came to light on January 15. There again, it was our investigators, backed by our technologists, who took the lid off the mechanisms of online behavioural advertising.
In the report that we are going to submit on the incident at Employment and Social Development Canada, you will see once again that, because of the calibre of our investigators and technologists, we were able to shed light on the incident.
Really, we have the tools and our people are up to the challenges.
[English]
The Chair: Could we have a confirmation? On the moving costs, the interest-free loan, is it 4.1 or 4.5?
Mr. Nadeau: The loan that we received to fund the move is 4.1.
The Chair: I think we had rectified that, but somehow 4.5 snuck back in. That's good. We want to keep that as low as possible, right?
You also mentioned three other agents of Parliament, so there will be four of you in this building. It's very important to us as Parliamentarians to have agents of Parliament that help us keep the government to account. We have met with several of these agents of Parliament, and this interest-free loan hasn't come out. I don't want to say ``scheme,'' but we haven't heard of it before and it doesn't sound right, so I have to learn more about it.
Anecdotally, do you know if any other agents of Parliament who have come into the same building over in Gatineau are getting interest-free loans from the government to be paid back?
Mr. Nadeau: Of the four agents of Parliament, Elections Canada, which is under a different funding mechanism than we are typically, did not receive a loan for this. However, the two others, the Office of the Information Commissioner and the Office the Commissioner of Official Languages, also got an interest-free loan. We had worked in collaboration with them in negotiating with Treasury Board Secretariat and the Department of Finance on this loan.
The Chair: Depending, presumably, on the size.
Mr. Nadeau: It varies, but proportionally it's similar.
The Chair: I also have a point of clarification. PIPEDA, the Personal Information Protection and Electronic Documents Act, is under your jurisdiction. It came into force in 20004, with a mandatory five-year review. There was a review. There was proposed legislation presumably to improve the act. That legislation died on the Order Paper during one of the prorogations. What's the status? I think we're now into a second mandatory five-year review, and we haven't finished the first one yet. Can you tell us the status of this very important piece of legislation?
Ms. Bernier: You're quite right. The legislation provides for five-year reviews. A first review has occurred and led to a bill that would amend the legislation. That bill died on the Order Paper, in every one of its incarnations, so we are still waiting, for example, for mandatory breach notification. That is something we would like to see, but we would like to see more. We would like to see deeper amendments to the legislation, to PIPEDA.
In broad strokes, we would like to have greater enforcement powers, because we believe that the tech giants in particular are becoming so powerful in collecting personal information that to correct this imbalance between the consumers, the individuals and the companies, we believe the regulator, ourselves, must be stronger to defend the consumers.
Going back to the issue of national security and surveillance and law enforcement surveillance, we would like to see the private companies that receive requests for personal information to report how many requests they get from law enforcement or national security agencies. We would like to see further amendments to PIPEDA to bring it up to speed to the current privacy risks, and that, of course, could occur through a legislative review as mandated by the legislation.
The Chair: Is that second review underway as yet?
Ms. Bernier: No. We have asked for it, but it has not been undertaken yet.
The Chair: I don't have the act here, but do you know whether it specifies a House of Commons committee or a Senate committee to perform the review?
Ms. Bernier: I don't know if we remember offhand whether it is a House of Commons committee. I would assume a House of Commons committee, but I am just assuming at this point. I don't have the act before me.
The Chair: From time to time, the Senate is involved in review of legislation as specified in the legislation. We can verify that. You make a number of very important points here that we'll take into consideration. Thank you for that.
Senator Eaton: To follow up on Senator Bellemare's question about CSIS and how you don't feel you need any more people, perhaps we'd like to put more things in a legislative framework. Isn't the whole interaction with CSIS a grey area rather than a black and white one that you can legislate?
Ms. Bernier: A few comments: First of all, CSIS and CSEC, the Communications Security Establishment Canada, both have their own oversight bodies in relation to —
Senator Eaton: So you have nothing to do with it?
Ms. Bernier: Oh, yes, we do. However, there are two specific oversight bodies, which does not exclude our jurisdiction, but gives them specific oversight over these two agencies.
We are responsible for respect of the Privacy Act throughout 250 federal institutions, and that includes CSIS. However, SIRC, the Security Intelligence Review Committee, has specific responsibility to ensure that CSIS is functioning within the law more broadly than just the Privacy Act.
The way these two jurisdictions co-exist, so to speak, is that for anything broad, such as a privacy impact assessment, which is an instrument that any federal agency must do when it adopts measures that have an impact on the privacy of Canadians and must submit to our office for review, CSIS would have to submit privacy impact assessments to our office for review. However, the specific activities of CSIS are reviewed by SIRC to ensure that they are globally within Canadian law.
Senator Eaton: You said that both SIRC and CSIS had their own privacy body that oversaw them.
Ms. Bernier: They have their own oversight body, not just for privacy.
Senator Eaton: Okay. Now I understand the part that SIRC plays.
Talking about other issues of privacy, there's a great push — it hasn't been that successful, but it's becoming more successful — to put people's medical records on-line so that whether you go to a doctor in New Brunswick or a doctor in Vancouver, he can dial up your name and your medical history, in all its glory, is there, which would be great for the medical establishment and for patients. Do you have any privacy concerns about people's medical information?
Ms. Bernier: As a preface, the jurisdiction of the federal government in relation to health records is very limited. As you know, the federal government has direct jurisdiction in relation to health only in relation to specific groups, for example, prisoners or veterans.
Senator Eaton: Aboriginals.
Ms. Bernier: Aboriginals, exactly.
Health is mainly a matter of provincial jurisdiction. That being said, in answer to your question, the privacy issues inherent to the electronic health records are huge. That does not mean it should not occur. It means that if it did occur, and I believe we are going there, privacy protections must be commensurate to privacy risks. There must be huge safeguards in relation to —
Senator Eaton: Have you started to think about that?
Ms. Bernier: It's not really within our jurisdiction.
Senator Eaton: Except it's going to fly from province to province.
Ms. Bernier: We do contribute to that infrastructure. We do have a role there. And, yes, absolutely, we think about that. First, the electronic infrastructure must be absolutely solid to avoid breaches, to be impenetrable.
Second, access controls must be extremely rigid and very well documented. If you look at our work on the audit we did of the Canada Revenue Agency, there was an issue of access again and also relevance. Some medical conditions may be relevant to be accessible to anyone and some medical conditions may not be.
Our jurisdiction is minimal, as I explained; however, that would be the lens through which we would look at it.
Senator Eaton: Except we have silos in our country. It's going to be interesting to see who will pick up the ball if you don't, now that more and more people's medical records will be online and will be transferable across provincial lines.
Ms. Bernier: I should tell you that our provincial counterparts are extremely active. Some provinces actually have specific legislation on medical records, on privacy in the context of medical records.
Senator Eaton: If there's no federal oversight, if Ontario's criteria are not the same as New Brunswick's criteria or Vancouver's criteria, great.
Ms. Bernier: This is where we come in in relation to the information highway related to medical records, and indeed we do participate in these discussions.
Senator Eaton: Thank you.
The Chair: I was just looking up PIPEDA to see what the words say, and we'll have that information for you shortly.
Senator L. Smith: It's amazing listening to your proficiencies in dealing with the issues that you have to deal with. You had mentioned that you started in 2008 and have now been appointed interim commissioner. As you look at the portrait of the commission and your role, if you had to summarize your two to three biggest challenges or the challenges that whoever is in the position faces moving forward, what would they be?
Ms. Bernier: I will answer you by dividing it into categories.
First, in relation to substantive challenges, the biggest challenge is the evolution of technological surveillance capacity without the proper framework to address it. My concern is that we would reach a point where in spite of all our dedication, efforts and expertise, we could not develop the proper remedies because the technology would have become so powerful to gather information beyond what the legislative framework would allow us to do.
A second challenge is, as I mentioned in my opening remarks, the expansion of our workload, which I take as a compliment, by the way. I believe that we, all of our staff, should be honoured with the trust that Canadians place in us. That being said, it means more complaints, more complex complaints, yet no more resources. In fact, there are some hidden cuts. For example, there is the fact that we have to absorb inflation because our budget doesn't go up and yet our costs go up.
The third challenge is a legal void in the protection of privacy. Specifically I am concerned when I see the violation of privacy from individual upon individual — people posting images of others on the Internet, people violating people's privacy on the Internet, and there is no legal framework on that.
You may recall the riots after the Stanley Cup debacle in Vancouver. There were photos over the Internet, including that of a young man who as a young offender. He did set fire to a police car, so I'm not condoning that at all; however, he was 17. His identity should have been protected. His picture was everywhere, his family was destroyed, his reputation gone; yet, according to Canadian law, the identity of young offenders is protected. There again, I believe that we will need to regain control over that.
The Chair: Just to confirm, section 29 of the Privacy Act provides for a review every five years by a committee of the House of Commons or a committee of both houses, the House of Commons and the Senate, as designated. We haven't been asked yet, but we're interested in thinking about it.
Senator Mockler: I would like to follow up from Senator Smith. This is very well done. You've really highlighted the challenges. How do we compare ourselves when we look at the G20 countries?
Ms. Bernier: I would make some crucial distinctions in the group that you speak about between the United States and Europe.
How do we compare ourselves? The Economist describes us as a hybrid system between the two because, like Europeans, we have global privacy laws. We have a Privacy Act for all of the Government of Canada. Like Europe, we have an independent privacy commission, an independent data protection authority, unlike the United States which does not and which does not have an overall Privacy Act. Each department has a chief privacy officer and the Federal Trade Commission has within its mandate a wing that addresses privacy. However, like the United States, we have separate privacy laws for the private sector and the public sector. Globally, those are the discontinuations in terms of structure.
In terms of results, for example, our neighbours to the south do have enforcement powers. The Federal Trade Commission can impose hefty fines; we cannot. And a lot of our European counterparts can also impose fines; we cannot.
Senator Hervieux-Payette was speaking a moment ago about the greatness of my predecessor, and she has certainly been able to show how even without that we've been able to bring some multinationals to change their privacy policies. That being said, as I mentioned earlier, we are afraid that the power of these multinationals is getting so great that we will not be able to exert the kind of influence we have exerted so far, which is why we would like to have enforcement powers similar to our counterparts.
Senator Mockler: Do I hear correctly that if we would have the capacity to impose fines, we would have a better mechanism in place to control privacy?
Ms. Bernier: We believe so. We believe that it would certainly bring some actors in line — big actors like Google. They were very cooperative in our latest investigation. They changed their process to ensure privacy within online behavioural advertising with us being able to threaten them with a fine, because they were conscious of reputational damage. A big company like Google is sensitive to reputational damage.
However, Nexopia, a tiny little company which had a website directed at youth, and therefore a vulnerable group, resisted implementing 4 of the 24 recommendations we made, and yet 4 that were critical. We had to take them to court. Fortunately they sold the company to a new owner who was much more responsible and settled. They said, ``Don't worry; I will implement your 24 recommendations.'' Sure enough, our technologists verified, and they did. But the effort it took, having to take them to court, and insisting and so on, I would submit to you that if we had a fine power that we could have threatened them with, we would have had a shorter timeline in resolving the matter.
The Chair: We're just at the end of our time that we've contracted you for, but I do have three senators who have asked to clarify some points. Do you have five or ten minutes?
Ms. Bernier: With pleasure.
Senator Callbeck: I have a brief question. You oversee two pieces of legislation: one with the federal public service and the other with the private sector. You've said there were 2,000 investigations under both of those bills.
What about court cases or court action? How many have there been?
Ms. Bernier: Much fewer. What we've done is intervened in mostly the few court actions we've been involved in. In our annual report you will see that we have a section specifically about that. Mostly our court action has been intervention.
For example, a very important case right now before the Supreme Court of Canada on Spencer addresses the issue as to whether basic subscriber information on the Internet is personal information and should be protected. We've intervened.
Then there is the example I gave in relation to Nexopia, where we went to Federal Court, but in this case we took them to court and they settled.
Another case where we will go to court, but also quite rare, is if a federal institution refuses to give access to documents. Rather than having the complainant go to court, because complainants are entitled to go to court, we will take the case for them because it meets some public interest matters. So we've had a few of those, but they are few.
Senator Callbeck: In the last year have you taken court action against any federal government departments or agencies?
Ms. Bernier: No, we have not. We actually engaged on some, and it was settled out of court. It was resolved.
Senator Buth: I would like to go back to the interest-free loan. Is that technically what it's called?
Mr. Nadeau: I wouldn't know. I don't think so. I don't think there is a name for it specifically.
Senator Buth: How is this reported in the estimates?
Mr. Nadeau: If I take a step back, when this situation occurred and we went to meet with central agencies to secure that, the funding was added through internal mechanisms in dealing with them, something called the annual reference level update. Essentially we had Treasury Board Secretariat backing and Department of Finance to basically take that funding we're going get over the next 15 years into this year and then present it as such in the 2013-14 Main Estimates, with the description saying the increase is explained by the following reasons. It was highlighted.
In the subsequent years we will see an explanation as to why the funding is dropping by about $300,000 a year, related to the reimbursement of that interest-free loan, for lack of a better term.
Senator Buth: That's how it's going to be recorded, then. How will it come through in the Public Accounts of Canada? Essentially, your expenses will just be lower?
Mr. Nadeau: Yes, essentially. Our budget is smaller than it would normally be by that amount.
Senator Buth: It's puzzling, because we approve things on an annual basis, and we're assuming that Treasury Board will keep track of this. It will be a commitment, essentially, that you will have to meet over the next 15 years.
Mr. Nadeau: Yes. Call it a mortgage, if you want. Maybe that's a better term.
Senator Buth: I'm not sure that's a better term.
The Chair: It has been pointed out to me that the Library of Parliament has found this in our estimates for 2013-14, at page II-270. The explanation is there of the Office of the Privacy Commissioner of Canada, and the $4.1 million is referred to.
Mr. Nadeau: I think it's referred to as one-time funding to be reimbursed over a period of 15 years.
The Chair: It says, ``. . . office set up and equipment as well as the new technology infrastructure. This amount is reflected under Internal Services Program.''
That is very interesting. It's good that we learned something new here today.
[Translation]
Senator Hervieux-Payette: I once sat on a committee that studied money-laundering. I wonder about the fact that we almost never target tax evaders. Does the commissioner's office have any responsibility for the fact that people who do not pay their taxes are never caught?
What is stopping Revenue Canada from acting? An employee of HSBC in France has come up with a list of hundreds of names of tax evaders, but nothing is being done about it.
Does the commissioner's office work in partnership with Revenue Canada? Are you putting a damper on what they are doing? Where does that stop? I am asking you the question and I will ask Revenue Canada as well.
I know that you were concerned about tax questions and I want to make sure that you are not the guilty party.
Ms. Bernier: I can assure you right off the bat that the right to privacy does not prevent the law from being applied. In fact, legal proceedings are a specific exception to the right to privacy.
For example, the police may obtain access to your house with a warrant. We have conducted audits on FINTRAC, the authority that receives personal information in money-laundering cases. We deplored the fact that the entities that have to disclose information to FINTRAC disclose too much of it, meaning that information on Canadians is quite readily disclosed because those entities are too careful. They are so afraid of not reporting as the law requires that they report too much.
But if there are reasonable grounds to suspect that someone is laundering money, the right to privacy in no way prevents the disclosure of those suspicious transactions to FINTRAC or to the authorities.
Senator Hervieux-Payette: Image rights. People who find themselves on the front page of magazines against their will are often angry. There is civil recourse, but do you get involved? For example, if someone wins a jackpot and sees his or her picture on the front page of the paper next morning, and everyone in the world with something to sell comes to that person's door, could one of the effective tools be to impose fines? People in that situation can see their lives being turned completely upside down.
Ms. Bernier: To do something like that would require changes to the current legislation.
Senator Hervieux-Payette: So if someone's photo is published in connection with an event that is of no public interest and if that person's life is completely turned upside down, the situation could be dealt with by amending the legislation when it is reviewed.
Ms. Bernier: Our authority extends to federal institutions and to the private sector either because it is under federal jurisdiction, like telecommunications and airlines, or because a matter occurs in a province that has no private sector legislation of its own. Only three provinces have legislation of that kind: British Columbia, Alberta and Quebec.
[English]
The Chair: I am looking at the estimates, and I see where the Office of the Privacy Commissioner and the Information Commissioner are combined. Is that for the future?
Ms. Bernier: It's the present. In fact, we were discussing this.
Daniel, do you want to answer that?
Mr. Nadeau: Maybe just to specify that I think it was more about the history than the future. Both organizations under the Financial Administration Act are reflected as one, if I'm correct in saying so. I think we've looked into amending that to be shown as separate organizations, but for whatever reason it was never implemented or supported in amending the FAA.
The Chair: As far as you know, government policy is to maintain two separate commissions at this time?
Ms. Bernier: As far as we know, yes, absolutely.
The Chair: Ms. Bernier, Ms. Munhall and Mr. Nadeau, thank you very much for being here. The role of agents of Parliament is extremely important to the role of the Senate. This committee is charged with keeping in touch with you and making sure that we're getting the information we need in order to do our job. We thank you very much. This has been a most interesting session.
Colleagues, before we adjourn, we were hoping to have the Canadian Bankers Association and certain banks here. We've circulated their letter; they cancelled at the last minute. We had two or three banks plus the bankers association lined up, but something came up in terms of year-ends and other meetings they deemed they had to go to, but they asked us to invite them back at a mutually convenient time. We'll keep that in mind, but right now, we have a lot of things on our plate leading up to the end of this fiscal year, so we'll probably have to wait until the new fiscal year beginning April 1.
Supplementary Estimates (C) should be referred to us today or tomorrow, and we start with Treasury Board tomorrow evening on that. I do not know if the Privacy Commissioner will be in Supplementary Estimates (C). I'm assuming not, based on the way Mr. Nadeau was talking here, but there are a number of different departments in Supplementary Estimates (C), so we will have to look at those and then do a report on that before the supply bill arrives. We have a lot on our plate over the next while, so stay tuned. Thank you very much.
(The committee adjourned.)