Proceedings of the Standing Senate Committee on
Transport and Communications
Issue 7 - Evidence, June 10, 2014
OTTAWA, Tuesday, June 10, 2014
The Standing Senate Committee on Transport and Communications, to which was referred Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, met this day at 9:30 a.m. to give clause-by-clause consideration to the bill.
Senator Dennis Dawson (Chair) in the chair.
[English]
The Chair: Today, we are scheduled to conduct a clause-by-clause examination of Bill S-4, an Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act. It is also known by its short title, the "Digital Privacy Act." Bill S-4 amends the federal private sector privacy act.
Before we do this, I would like to remind the senators of a few points. If, along the way, you want clarification, if we are going too fast or too slow on the amendments or the discussion, feel free to interrupt, and "Beauchesne" and I will try to address your issues, Beauchesne being Daniel "Beauchesne" Charbonneau. When we get there, if there is opposition, we'll deal with it. I think the critic of the bill wanted to make some comments.
Senator Furey: I did, Mr. Chair. I wanted to propose a couple of amendments. I am wondering whether we can have a general discussion about that proposal because we have some people here from the department who could perhaps answer some questions. Should we just do it when we come to the appropriate clauses?
The Chair: If anybody has opening comments, we'll go clause by clause. We did request that some people from Industry Canada be here and come to the table if questions are to be asked.
Senator Furey: Perhaps we can have them at the table and I could talk about the amendments. Then, we could go clause by clause if that's okay.
Senator Plett: I certainly have no issue with the officials coming to the table and sitting here for the entire time, but I would suggest that if we want to discuss any amendments, we do so when we get to that particular clause as I also have an amendment. Perhaps Senator Furey is agreeable to that.
I think both of his amendments are around section 7. Could we wait until we get to that section before we have a general discussion on those?
Senator Furey: I'm fine; either way is good with me.
The Chair: So we won't argue about the title of the bill?
Welcome. We'll wait for the questions. Maybe you could introduce yourselves before we start.
Chris Padfield, Director General, Digital Policy Branch, Industry Canada: I'm Chris Padfield, Director General of Digital Policy at Industry Canada.
John Clare, Director, Privacy and Data Protection Policy Directorate, Industry Canada: I'm John Clare. I'm Director of Privacy and Data Protection Policy.
The Chair: Is it agreed that the committee proceed to clause-by-clause consideration of Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act?
Hon. Senators: Agreed.
The Chair: Agreed.
Shall the title stand postponed?
Hon. Senators: Agreed.
The Chair: Shall clause 1 stand postponed?
Hon. Senators: Agreed.
The Chair: Shall clause 2 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 3 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 4 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 5 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 6 carry?
Some Hon. Senators: Agreed.
Senator Furey: I propose:
That Bill S-4 be amended in clause 6,
(a) on page 5,
(i) by deleting lines 14 so 21, and
(ii) by relettering paragraphs 7(3)(d.2) and (d.3) as paragraphs 7(3)(d.1) and (d.2) respectively;
(b) on page 6 by relettering paragraph 7(3)(d.4) as paragraph 7(3)(d.3); and
(c) on page 7 by adding after line 6 the following:
"(14.1) Section 7 of the act is amended by adding the following after subsection (3):
(3.1) Except where otherwise expressly provided by law and subject to subsection (3.2), an organization shall notify the individual of any disclosure of his or her personal information made by it under subsection (3), and the purposes for which that disclosure was made, within 60 days of the disclosure.
(3.2) On the application of a government institution, the Court may grant an order that notification under subsection (3.1) be delayed if the Court is satisfied that it is in the public interest to do so.
(3.3) An organization that discloses personal information under subsection (3) during a fiscal quarter of a fiscal year shall, as soon as feasible after the end of that fiscal quarter, submit to the Commissioner a report on the number of disclosures of personal information made by it under subsection (3) during that fiscal quarter, indicating
(a) the total number of disclosures made;
(b) the number of disclosures made in respect of each of the applicable circumstances set out in paragraphs 3(a) to (h.1); and
(c) the number of disclosures that included each of the following classes of personal information:
(i) name,
(ii) address,
(iii) electronic mail address,
(iv) telephone number,
(v) electronic message content,
(vi) computer data,
(vii) Internet protocol address,
(viii) Uniform Resource Locater, and
(ix) any other class of personal information specified by the Commissioner.
(3.4) The Commissioner shall make public the name of any organization that submits a report under subsection (3.3), together with the information referred to in paragraphs 3.3(a) to (c) that is contained in the report.
I would like to deal with those as two separate parts, chair, the first being the elimination of the disclosure of company to company. Right now, the bill permits government organizations to disclose back and forth. We're not touching that. We're saying that's fine. But we're saying that for company-to-company disclosure, we'll end up with a situation like that of our neighbours to the south where companies troll for information about downloading music and movies and basically end up attacking individuals who have no idea that this information has been supplied.
I had these discussions with the department, and they see in the present clause a four-part test. Company-to-company disclosure must be reasonable. According to this section, a breach must have occurred or is about to occur. As well, it must be reasonable to believe that obtaining the consent would compromise an investigation.
Colleagues, my fear with this is that it expands on what's already in PIPEDA from government organizations. As I said, it's not the intention of this amendment to interfere with or to change that, but when you expand it to the private sector, and I don't think those points are a really strong test, companies can gather information that they can use to end up basically suing individuals who have no idea that this information has been disclosed.
Mr. Padfield, would you like to respond?
Mr. Padfield: I would like to point out that under PIPEDA currently there is a section on investigative bodies that actually regulate the entities that do those exchanges. Under PIPEDA as it exists, there is an exchange of information between companies. There are regulating schedules at the back of PIPEDA that outline the number of entities that do such exchanges. They are like investigative services, the division of the insurance bureau, where you have insurance companies sharing information to ensure there is not fraud being committed. The Bank Crime Prevention and Investigation Office of the Canadian Bankers' Association does these kinds of exchanges.
The amendment isn't to add anything new but to change how these activities are regulated. In the past, entities making these exchanges of personal information without consent were doing so as an investigative body. The intent of the amendment is to regulate those kinds of activities.
Senator Furey: Subsection (d.2) still allows that to go on; but why do you want to have uncontrolled exchange of information from company to company? Why is that necessary? Why would you put that in there?
Mr. Padfield: I wouldn't say it's uncontrolled. As you mentioned, there is the four-part test, which we think is fairly rigorous in terms of being able to demonstrate that you're content to not require —
Senator Furey: Let's examine the four-part test. The first one is reasonableness, correct?
Mr. Padfield: Correct.
Senator Furey: Not a very stringent test.
Mr. Padfield: Or "made to another" private sector "organization and is reasonable for the purposes of investigating a breach of an agreement or a contravention of the laws. . . ."
Senator Furey: They have access to warrants. The company can do it the old way and get a warrant if they think there is a breach of their contract and get the information that way. Why are we adding to this bill an allowance for them to just go and get the information? They can ask for it and get it.
Mr. Padfield: It's a timeliness issue.
Senator Furey: It should be a timeliness issue when you're talking about the privacy of Canadians. I don't see the need for it. I can understand for government institutions and the police and exigent circumstances like 9/11. I'm saying about this amendment, let's not allow companies to request information and get it freely without warrants or anything else.
Mr. Padfield: Not all activities covered by this section would be criminal in nature. Take some of the colleges listed in the schedule, such as the College of Physicians and Surgeons —
Senator Furey: Sorry, I'm going to cut your off there. It doesn't say "criminal." It says "contravention of the laws of Canada." Contract laws are laws of Canada. It doesn't necessarily have to be criminal. If they were just criminal, it would have a different cast over it altogether. Criminal activity is still covered because the police can still get this information. We're not touching that or changing it.
With the way this is worded, I could go to a company and say, "I have a movie that has been downloaded. I have the patent right to it. It's against the laws of Canada to breach my patent. I want all that information." According to this, okay — no problem; here it is. Why would we do that?
Mr. Padfield: I go back to original intent and having the investigative bodies system in place for a number of years. Alberta and B.C. are moving toward a similar method. When we had the last parliamentary review, the recommendation was that we move to the process closer to what those two provinces have. We're streamlining to make sure the federal statute reflects what's going on in B.C. and Alberta.
Senator Furey: This broadens the scope so much. We had a witness before the committee — unfortunately I wasn't here, but I reviewed the testimony. One thing that he said is a problem in the U.S. is patent trolling. I'm sure you know what that is. To review it, a company says, "Your users are downloading my movies. I want access to all your information." So, you give them access to all the information. They contact all the people, threaten to sue them and end up settling for $5,000 — a small number but to average individuals a large number. This is becoming a multi-million dollar industry in the U.S. — attacking people. Now we're saying that companies should give out information between each other willy-nilly. Why would we do that?
Mr. Padfield: I can't speak to the differences in copyright law between Canada and the U.S.
Senator Furey: I'm not talking about copyright law. I'm talking about infringements. All I have to do is reasonably say to another company, "I think, based on the following usage tables, that your users are downloading my movies. I want their names and IP addresses." I can contact them and say, "I'm going to sue you; but if you don't want me to sue you, send me a cheque for $5,000."
Mr. Padfield: I'd only add the fourth test: You must be reasonable about obtaining consent.
Senator Furey: The reasonableness is not in the minds of you and me. Rather it's the test between the two companies trading this information. For the provider to supply my IP address to another company, they only have to say, "He's got information here and the usage definitely looks like there's been copyright infringement — a breach of the law. Here is the information." I have a real problem with that.
Anyway, thank you for your answers.
Senator Mercer: I share Senator Furey's concerns. I'm not a lawyer, but I am someone who firmly believes in the Charter of Rights and the Constitution. I'm not sure these provisions would survive a Charter or a constitutional challenge for the protection of privacy, given the reasonable expectations of Canadians to privacy, by allowing the free flow of information from one corporate entity to another corporate entity without their agreement.
We talked about reasonableness. Who determines what's reasonable? "Reasonable" is a fluid term. What's reasonable to Senator Demers and Senator Plett may not be reasonable to me. Whose reasonableness do you settle on? It's reasonable to me that your company would give me information that's going to allow me to go after a number of people who have been using my product inappropriately.
Why shouldn't there be another step in there such that I have to say why I believe that and put the evidence on the table? Then somebody can say, "Okay, that sounds reasonable." There has to be a step in there for reasonableness.
There is a reason that this bill was introduced in the Senate. I think it was introduced here because we could have the debate we're having today and hopefully make amendments today. We make good law here, and we try to fix bad law here when we get it from the other side. If we don't fix this bad law here and we think it's going to get fixed over in the other place, we're dreaming, because it's not going to be on. I think we need to pay very close attention to this and try to fix it.
I think the notification to people that their information has been shared is paramount. Senator Furey's amendment allows the court, in the public interest, to delay or stop that disclosure. We've heard on the telecommunication side that 1.2 million requests have been made for information, and I think those 750,000 or 1 million people would like to know that somebody, some government agency, has been asking about their information.
Senator Furey: To add to what Senator Mercer is saying, colleagues, it's not like we're asking to create a lawless society in Canada when it comes to copyright infringement. That's not what we're saying. This amendment is basically saying that if you want to sue somebody for copyright infringement, you follow the laws of Canada. Go get your warrant and get your information. You don't just go trolling for information, and that's what's going to happen if we put this in here.
Senator Plett: I have a couple of comments to what Senator Furey and Senator Mercer have said. Senator Mercer is not a lawyer and neither am I. I also struggle with some of the wording. The way I understand it, Senator Furey and officials, this would eliminate the ability of organizations like self-regulating professional associations to investigate and discipline their members for professional misconduct or malpractice, which I believe would put Canadians at risk. Maybe I'm wrong in that.
Further to that, Senator Mercer talks about what is reasonable, and I'm going to talk about an amendment when we get to clause 10. When I raised the issue of an amendment and changing some of the wording, we have in there "as soon as feasible" and wording that I'm going to later on talk about, and "as soon as feasible" would be similar to "as soon as reasonable." Somebody has to determine what reasonable is and what feasible is. I'm told by the Justice officials that clearly the term "as soon as feasible" is in a number of federal statutes and clearly carries with it some connotations and that there are parameters to what is feasible. I would assume "reasonable" would be the same. I don't want to argue against my own amendment.
You're suggesting, Senator Mercer, that we make good laws here, and I think we have proven that. I think our recommendations on Bill C-23, for example, were a number of good amendments that came from the Senate and were accepted by the other place — not amendments, per se, but suggestions. If Senator Furey feels strongly about this, of course it could be done with an observation as well, because this legislation can be amended in the House of Commons. It's not like it has been there first and then came here, and if we amend it we have to send it back. They have every opportunity, if they see some issues, to amend it. It wouldn't have the same negative connotations as if it had started there, was sent here and then we amended it.
Those are the general observations that I make. I don't know that I would oppose Senator Furey suggesting some observations to this if he feels strongly about his suggestions.
Senator Furey: Thank you, Senator Plett. You failed to tell us that you were be going to law school at night, did you? Is that what you're hiding from us?
With self-regulating bodies, that's never a problem. If the law society wants to investigate a lawyer and they feel there is criminality involved in their investigation, they turn it over to the police. The police are a government organization, and they can request the information. There is nothing in PIPEDA changing government organizations from getting information. This is just private company to private company, not government organization to government organization.
If anybody is doing an investigation and they require specific information, they go get a warrant. That's what police do. They go get warrants. If information on an investigation by a self-regulating body is turned over to the police, the police can, under the existing regime in PIPEDA, get information. It's not a problem. But you're right. The law society itself couldn't, if we eliminate this, and they shouldn't on their own, in my view.
Senator Eggleton: Commercial operation exchanges with other commercial operations is a huge issue that really does require an amendment. George has mentioned copyright examples, and I think we've seen an example of that. A case actually went to the Federal Court and got sorted out there. There are other cases, such as insurance companies looking for information because of a claim or agreement. They could be arguing a breach of an agreement. It's not a breach of the criminal law, but they could be arguing a breach of agreement. But going to banks or trolling for information to try to strengthen their case against somebody else on an insurance claim basis? I don't think we should be lending ourselves to that happening without there being proper third party — in this case, court — involvement. That's where the warrant comes in.
I think that's the biggest hole in this privacy legislation. It takes too much of the warrant operation out of it. It needs that kind of court involvement to ensure that Canadians are being fairly dealt with and their privacy is being protected as best it can.
I support the amendment.
The Chair: Senator Furey, on the second part.
Senator Furey: On the second part, colleagues, this amendment is asking that individuals who have their information disclosed be notified within 60 days. We all know that criminal investigations take much longer than 60 days, so a provision is made here that if it goes beyond 60 days and it's a criminal investigation, they just apply to the court and get it extended. The only test is that it is in the public interest to extend it, which in other words would be a very easy thing to do, but at least it would have a judicial eye cast over it before it goes any further.
The second part of it says that all of the information that is disclosed should be given to the commissioner and the commissioner should make that information public. People have a right to know when their private information is given to organizations other than the ones that they gave it to in the beginning, without their permission. If fraud is involved, if there is criminal activity, then the protection is still in the act to protect vulnerable people from fraud. We're not changing any of that. All we're saying is that at the end of the day you have a right to know that your private information was disclosed to somebody other than who you agreed to give it to. That's a basic, fundamental principle of democracy in Canada. That's the way we've evolved, and that's the way it should be. This idea of giving stuff to people and never telling them, never letting anybody know, is arcane. It shouldn't be allowed in Canada.
The Chair: Are there any other comments on the amendments proposed by Senator Furey?
Shall the amendments to clause 6 carry?
Some Hon. Senators: Yes.
Some Hon. Senators: No.
The Chair: We will proceed to a roll call. The clerk of the committee will call the members' names, beginning with the chair and then going in alphabetical order. Senators should indicate verbally indicate whether they vote for, against or abstain.
I'll abstain.
[Translation]
Daniel Charbonneau, Clerk of the Committee: Honourable Senator Demers.
Senator Demers: No.
[English]
Mr. Charbonneau: The Honourable Senator Eggleton, P.C.
Senator Eggleton: Yes.
Mr. Charbonneau: The Honourable Senator Furey.
Senator Furey: Yes.
Mr. Charbonneau: The Honourable Senator Greene.
Senator Greene: No.
Mr. Charbonneau: The Honourable Senator Housakos.
Senator Housakos: Against.
Mr. Charbonneau: The Honourable Senator MacDonald.
Senator MacDonald: Yes.
Mr. Charbonneau: The Honourable Senator Mercer.
Senator Mercer: Yes.
Mr. Charbonneau: The Honourable Senator Plett.
Senator Plett: No.
Mr. Charbonneau: Yeas, 4; nays, 4; abstentions, 1.
The Chair: I'll vote yes to break the tie.
Senator Plett: Again, I'm not a lawyer, but you were the first person to vote. You decided how to vote, and then the vote —
The Chair: I thought I was obliged to vote.
Senator Plett: Let me finish. You were the first person to vote, and then you decided to abstain. There is a motion on the floor. It did not receive the majority vote. I believe the motion fails.
The Chair: That is correct.
Shall clause 6 carry?
Some Hon. Senators: No.
Some Hon. Senators: Agreed.
The Chair: Shall clause 7 carry?
Some Hon. Senators: Agreed.
The Chair: Shall clause 8 carry?
Some Hon. Senators: Agreed.
The Chair: On division?
An Hon. Senator: On division?
The Chair: On division or —
Senator Eggleton: Yes, clauses 7 and 6 on division.
The Chair: Shall clause 9 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 10 carry? Senator Plett has an amendment, I think.
Senator Plett: Yes, I do, chair. As I indicated earlier, I do have a small wording change to clause 10. I would like to just read a short preamble before I suggest the amendment if that's all right.
In our last meeting, our witness, Attorney Michael Crystal, raised a concern with section 10.1(6). He stated:
The proposed provision states that notice of a breach shall be given as soon as feasible, and I'm not exactly sure what that means. It does remind me of the Brown case, with all deliberate speed, in American jurisprudence, and notice can be delayed if there is a criminal investigation of the breach. My submission to you is that the section ought to be struck on the basis that it is not justifiable to expose individuals to the risk of suffering consequences from a privacy breach of which they are left unaware, whether consequences in the form of criminal activity or any other kind of detriment, while police continue their investigation.
I thought he raised a valid concern, and I consulted with the Department of Industry as well as the Department of Justice. I originally shared the concern that Mr. Crystal had when he said "as soon as feasible," and I talked about that earlier. It sounds like it's open to interpretation and, therefore, not enforceable.
However, after discussing this matter with the Department of Justice, they have assured me that the term "as soon as feasible" appears in a number of federal statutes and is viewed by the courts to have an element of urgency and promptness. There are three standards of tiers of notifications used in Canada's statutes, the first and the most stringent being "without delay" or "immediately," which is self-explanatory. The second tier is "as soon as feasible." The French translation for this tier actually says "as quickly as possible." I certainly prefer that wording, which I believe sounds much more forceful. The third tier is "within a reasonable time," which affords the company some leeway.
In this bill, if we were to change the wording to "without delay," this would not give companies time to investigate the breach or to determine who exactly would need to be notified, and it could mean that the company notifies all customers because they have determined that there's a breach before determining that not all of the individuals notified had actually been breached.
I'm reading this thing because I do wish the language could be stronger. I understand the department's wish to go ahead with the second tier of notification, "as soon as feasible," to maintain consistency with other federal statutes.
So I read that only because I do not like the term "as soon as feasible," but I'm prepared to accept it.
However, the second part of the clause reads:
However, if a government institution or part of a government institution requests that the organization delay notification for a criminal investigation relating to the breach, notification shall not be given until the institution or part concerned authorizes the organization to do so.
This, too, was part of Mr. Crystal's concern, and I share that. I believe this entire section is not necessary. With that said, I'd like to propose the following amendment, and I think it has been handed to you:
That Bill S-4, in clause 10, be amended by replacing lines 34 to 40 on page 10 with the following:
"the breach has occurred."
Senator Eggleton: Just to clarify, so that would leave in just the first sentence: "The notification shall be given as soon as feasible after the organization determines that the breach has occurred." Period?
Senator Plett: Period. Yes. That's correct.
The Chair: Any other questions or comments? Shall the amendment to clause 10 carry?
Hon. Senators: Agreed.
The Chair: Unanimously.
Shall clause 10, as amended, carry?
Hon. Senators: Agreed.
The Chair: Shall clause 11 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 12 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 13 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 14 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 15 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 16 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 17 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 18 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 19 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 20 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 21 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 22 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 23 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 24 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 25 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 26 carry?
Hon. Senators: Agreed.
The Chair: Shall clause 27 carry?
Hon. Senators: Agreed.
The Chair: Are there any new clauses?
Shall clause 1 carry?
Hon. Senators: Agreed.
The Chair: Shall the title carry?
Hon. Senators: Agreed.
The Chair: Shall the bill carry, as amended?
Some Hon. Senators: Agreed.
Some Hon. Senators: No.
The Chair: Honourable senators, we will now proceed to a roll call. The clerk shall call the members, beginning with the chair.
[Translation]
Mr. Charbonneau: Honourable Senator Dawson.
Senator Dawson: Against.
Mr. Charbonneau: Honourable Senator Demers.
Senator Demers: For.
[English]
Mr. Charbonneau: The Honourable Senator Eggleton, P.C.
Senator Eggleton: Against.
Mr. Charbonneau: The Honourable Senator Furey.
Senator Furey: No.
Mr. Charbonneau: The Honourable Senator Greene.
Senator Greene: Yes.
Mr. Charbonneau: The Honourable Senator Housakos.
Senator Housakos: For.
Mr. Charbonneau: The Honourable Senator MacDonald.
Senator MacDonald: Yes.
Mr. Charbonneau: The Honourable Senator Mercer.
Senator Mercer: No.
Mr. Charbonneau: The Honourable Senator Plett.
Senator Plett: Yes.
Mr. Charbonneau: Yeas, 5; nays, 4.
The Chair: The bill is passed, as amended.
Do you want to put forth observations, Senator Furey?
Senator Furey: Sorry?
The Chair: Do you want to append observations to the bill?
Senator Furey: No, I really don't.
The Chair: You made your point?
Senator Furey: No, I'm contemplating moving amendments at third reading.
The Chair: Shall I report the bill, as amended, to the Senate?
Hon. Senators: Agreed.
Senator Furey: Chair, I was just asked by my assistant to ask the clerk to recount the vote on the amendment. Could we just have a recount on my amendment?
Mr. Charbonneau: Okay. I have here Senator Dawson abstaining; Senator Demers, no; Senator Eggleton, yes; Senator Furey, yes; Senator Greene, no; Senator Housakos, no; Senator MacDonald, yes; Senator Mercer, yes; Senator Plett, no.
Yeas 4; nays 4; abstentions 1.
Senator Furey: Thank you.
The Chair: I will report this to the Senate as quickly as possible since we are trying to finish this session quickly as possible. Thank you very much.
We will be meeting tomorrow night at 6:45 p.m. to hear a witness on the CBC report.
(The committee adjourned.)