Proceedings of the Standing Senate Committee on
Science and Technology
Issue 1 - Evidence, November 25, 1999
OTTAWA, Thursday, November 25, 1999
The Standing Senate Committee on Social Affairs, Science and Technology, to
which was referred the subject matter of Bill C-6, to support and promote
electronic commerce by protecting personal information that is collected, used
or disclosed in certain circumstances, by providing for the use of electronic
means to communicate or record information or transactions and by amending the
Canada Evidence Act, the Statutory Instruments Act and the Statute Revision
Act, met this day at 11:00 a.m. to give consideration to the subject matter of
Senator Marjory LeBreton (Deputy Chairman) in the Chair.
The Deputy Chairman: Honourable senators, the agenda this morning is the subject
matter of Bill C-6.
Our witnesses this morning are from Industry Canada, Justice Canada and Treasury
Board. Welcome and please proceed.
Mr. Michael Binder, Assistant Deputy Minister, Spectrum, Information
Technologies and Telecommunications Sector, Industry Canada: Madam Chair, with
your permission, I should like to start by giving a short overview of the
policy and historical context for this bill.
Bill C-6 is an essential part of the government's "Connecting Canadians"
agenda and vision. The 1997 Speech from the Throne outlined that vision as
making the information and knowledge infrastructure accessible to all Canadians
by the year 2000, thereby making Canada the most connected country in the
We all know that important changes are taking place in the economy and in
society. Information communications technologies are advancing rapidly. We see
the emergence of a single, global market. We have witnessed phenomenal growth
of the Internet. There has been a dramatic growth of electronic commerce. The
pace of change itself is such that we find ourselves having to move at "Internet
The "Connecting Canadians" agenda is intended to increase
competitiveness and productivity, to ensure equal access to lifelong learning,
to improve access to government services, to develop world-leading
infrastructure and technology, and to bring Canadians closer together. It will
create a stronger Canadian economy and a stronger Canadian society.
These developments have ushered in an entirely new way of doing business --
Companies can now transact business electronically in a fraction of the time and
cost of traditional communications media. Individual consumers can buy products
directly from companies or online merchants no matter where they live.
Electronic commerce offers better services for consumers, enhanced productivity
for businesses, and lays the foundation for government on-line, which will
improve government services to Canadians at lower cost.
The promised benefits of electronic commerce are enormous, but they will not
come automatically. Consumers need confidence before they will fully embrace
electronic commerce. They have to believe that the companies they are dealing
with are reputable, and they have to believe that their personal information is
being treated fairly.
The former has always been a requirement for economic participation, but the
latter, concern with the treatment of personal information and the loss of
privacy, is a more recent and more critical issue. Many companies now recognize
that having good privacy practices for their customers will give them a
competitive advantage over competitors who do not.
The convergence of computer and high-speed communications technologies has
created new possibilities for the collection, compilation and distribution of
vast amounts of personal information about each of us. Personal information has
become a commodity of increasing economic value. Companies are buying, selling
and using this information to create individualized profiles for marketing
purposes. It is not surprising, therefore, that a recent EKOS survey found that
94 per cent of Canadians feel that it is increasingly important to have
safeguards to personal information on the Internet. These concerns are holding
many people back from participating in electronic commerce.
Government can and should be both a leader and a model user to increase the
confidence of consumers and businesses to use the new technologies in order to
facilitate the growth of electronic commerce in Canada.
Bill C-6 is designed to create a climate of trust, first, by establishing rules
for the treatment of personal information in the private sector and, second, by
putting electronic transactions governed by federal laws on the same footing as
paper ones. Giving individuals control over their personal information and
giving businesses and citizens the assurances that an electronic document and an
electronic signature has legal standing and will be recognized, enforced and
accepted by government and the courts will provide the confidence needed to
support electronic commerce.
Bill C-6 establishes a right to the protection of personal information and puts
electronic transactions on the same legal footing as paper transactions.
The protection of personal information is achieved by bringing into law the
Canadian Standards Association Model Code for the Protection of Personal
Information. The CAS Standard was developed in a consensus process that
included representatives from a broad spectrum of interests including industry,
the public sector, consumer groups and labour organizations.
The code is consistent with the OECD privacy guidelines and was recognized as a
national standard by the Standards Council of Canada.
The government conducted two public consultations, one in 1994 and the other in
The responses to the 1998 paper clearly demonstrated a preference for using the
CAS Code as the basis for privacy legislation.
In conclusion, Bill C-6 strikes a balance between the needs of organizations for
information and the right of individuals to exercise control over their
personal information. It was developed following widespread public
consultations. It addresses the real concerns of Canadians and it demonstrates
Canada's leadership in the promotion of electronic commerce and in the
protection of personal information.
We would be pleased to answer specific questions.
Senator Murray: I have quite a few questions. As I embark on them, Madam Chair,
if other honourable senators wish to ask questions, please cut me off and
proceed, because the matters I am interested in may well be covered by other
senators. If not, I may be able to come back in a second round. Therefore, I
On February 3, 1999, the Minister of Justice, Ms McLellan, appeared before the
House of Commons committee that was studying Bill C-54, the old version of this
bill. She said:
I hope I'm not revealing any confidences or secrets here, but Mr. Manley and I
actually were very interested in having the two parts of the bill moved forward
separately. I think we acknowledge the problems you have grappling with the
privacy issues that have a whole host of dimensions to them, and then with the
highly technical, highly legal parts, 2 to 5, dealing with the legal
infrastructure. But the decision was made in terms of management through the
House. It made sense. We are dealing with electronic commerce, and when it was
explained to me, I accepted it fully.
I say in parentheses here that Part 1, the privacy provisions, relates to
information that is collected by any means, electronic or otherwise. Therefore,
the relationship between that part and Parts 2 to 5 is purely coincidental.
Ms Perrin, a bit later on the same day, said:
On the issue of the two halves being together, I can echo what Minister McLellan
just said. As we indicated, these did start out as separate bills: a bill to
protect personal information and a series of legal infrastructure amendments.
The two were put together because they're both vital for electronic commerce.
Will one of the witnesses please describe the process by which the two halves
started out separately and ended up in one bill?
Mr. Binder: Let me start with some history. As someone who was pushing this
information highway way back in the Department of Communications, and later on
in Industry Canada, I can tell you that we always looked at a coherent approach
to what it takes to deal with this coming new network economy, on-line economy,
digital economy. That was the motivation. You may want to ask yourself: What is
Industry Canada doing ushering in a bill on privacy? The driver for us was
electronic commerce. It always has been that. To have Canadians and businesses
go on-line, years ago we decided that you must instil trust in the electronic
highway. This angst about putting your credit card on-line and about the data
being on-line and the worry that you do not know where it goes -- and a feeling
that it is going into a black hole -- was always the concern expressed to us
both by the consumers and by the business community, who did not know who was
on the other side and did not know whether the signature was right or if the
documents had any legal status. I am going back now almost 10 years, when we
said that we must do something about that if electronic commerce -- at the time
we called it the information highway -- was to succeed.
Senator Murray: I appreciate all that.
Mr. Binder: We then came up with our strategy for electronic commerce. I do not
know if you have seen this, but it was released by the Prime Minister in 1998.
It is a coherent approach that deals with documents, electronic signature,
encryption policies, and privacy. It was always our intention to put
legislation in place in the House to deal with these issues. We do not
differentiate. It is two parts of a whole entity. Doing half will not deal with
the electronic commerce challenge.
Senator Murray: At the risk of repeating myself, the first part of the bill
deals with information however collected, electronically or otherwise. When
Minister McLellan was before the committee, she said -- and I presume you will
confirm this -- that your minister, the Minister of Industry, has
responsibility for Part 1 of this bill and that she has responsibility for Parts
2 to 5.
Mr. Binder: In terms of drafting a piece of legislation, the Department of
Justice always has legislative drafting responsibility.
Senator Murray: No. I know that.
Mr. Binder: In terms of policy or electronic commerce, our minister has the
lead. He was given the responsibility to usher this bill through the House,
always with the help of colleagues.
Senator Murray: Yes. Ms McLellan told the committee -- and I presume she knows
what she is talking about -- that she has responsibility for Parts 2 to 5 of
this bill and that your minister has responsibility for Part 1. I will not
belabour the issue because there are other ways of dealing with it; perhaps I
am better advised to talk to the ministers if and when they come here.
I presume that a decision was made at one point in the government to approve a
policy and the preparation of legislation with regard to personal information
collected in the course of commercial activity. I presume that that decision
was made somewhere at some point, and then ultimately by the cabinet on the
initiative of the Minister of Industry.
Mr. Binder: Right.
Senator Murray: I presume that there was another decision -- and this is
implicit in what Ms McLellan told the Commons committee -- to approve a policy
and to proceed with the necessary legislation to facilitate electronic
communication with the government and electronic documentation in what we would
call the justice system. I presume that decision was taken somewhere along the
line. That is implicit in Ms McLellan's statement and Ms Perrin's confirmation
that this started out as two bills.
Mr. Binder: I would differentiate between the policy and the actual bill and
responsibility for the bill. The policy resulted from an electronic commerce
strategy, and that strategy was driven by our minister. Then, in drafting Parts
3 and 5 and making it coming into force, the Minister of Justice is implicated
because of the horizontal responsibility of all statutes, electronic documents,
et cetera. The chapeau, if I may say, or the policy that governs this bill, is
the responsibility of the Minister of Industry. That is the way I differentiate
between the two. They were always debated together in cabinet. Who actually
does the specific bills is a technicality, as far as we are concerned. It is the
policy that has driven this initiative.
Senator Murray: Once there was a draft bill, it was considered together in
cabinet. There were two bills. We were told that it started out as two bills.
Mr. Binder: I do not want to seem to be difficult, but it started out as a
policy discussion in cabinet on electronic commerce. Once a decision was
reached to move forward, the mechanics of realizing the policy becomes a
different consideration. It goes through the legislative house, et cetera.
Senator Murray: I will pursue it with the ministers, if I get the opportunity,
if and when they attend.
I draw your attention to clause 7(3)(h), which reads as follows:
For the purpose of clause 4.3 of Schedule 1, and despite the note that
accompanies that clause, an organization may disclose personal information
without the knowledge or consent of the individual only if the disclosure is
(h) made after the earlier of
(i) one hundred years after the record containing the information was created,
(ii) twenty years after the death of the individual whom the information is
Do you have that?
Industry Canada: Yes.
Senator Murray: Am I correct in my reading of this subclause that personal
information collected by an organization -- your bank, your credit card
company, your mortgage company, your insurance company, whatever -- could be
disclosed 20 years after the death of the person about whom it was collected?
Am I correct in my reading of that?
Ms Perrin: That says you need not seek the consent of the individual for that
disclosure. However, all disclosures must be justified with the purpose clause,
so there must be a legitimate purpose for the disclosure of that information.
There are still a number of tests. This merely says that you need not seek
consent to disclose.
Senator Murray: What are the purposes, Ms Perrin?
Ms Perrin: This bill is built on the CSA standard. The CSA standard has 10
provisions. They are all interrelated. You must state your purpose, if you are
an organization, for the collection, use and disclosure of personal
information. You must document that purpose so that it is available to
individuals. When that standard was incorporated into this bill, a purpose
clause was put into clause 5. That purpose clause stipulates that you must pass
a reasonableness test in order to ensure that you do not state your purposes
as, "I will collect all the information that a individual could possibly
create in their life time, and I am going to keep it forever and use it for my
Senator Murray: I wonder whether the safeguards are adequate. My eye was caught
by the following sentence in the briefing book provided by the government to
senators concerning this suggestion:
The purpose of this clause is to permit the release of personal information 20
years after the death of the individual, or where it may be reasonably presumed
that the individual is dead.
By way of background, you say:
The Privacy Act deals with this issue by defining personal information of a
person who has been deceased for twenty years as not being personal information
for the purposes of the Act. The approach in this legislation is more
restrictive, permitting disclosure but not removing it from the ambit of the
I do not know why such a provision is being put into this legislation. There may
be, and I am sure are, good reasons in the public interest why such a provision
is in the Privacy Act governing the government and its agencies. However, I
wonder about the justification for permitting disclosure, even subject to these
purposes and safeguards that you refer to, of information that is collected by
your bank or your insurance company or your mortgage company. What is the
justification for that?
Ms Perrin: We must remember that this is a broad bill of general application and
that it will cover many different kinds of enterprises. This clause is
basically for historical purposes and archives. You obviously have not heard
yet from the archivist and historian community. That community feels strongly
that if there is no clause that permits private organizations, businesses and
institutions to disclose information to historical institutions for the
preservation of historical records much valuable information will be destroyed.
There are provisions in the bill to retain the information only as long as is
necessary for the purposes for which it was gathered, so there is a strong push
on institutions to destroy information that is no longer necessary. An
insurance company, for instance, that is no longer doing business with a client
would be strongly impelled by the schedule to dispose of that information.
Nevertheless, some information is of historical interest. Letters to our
minister on this very clause cite the recently donated Hudson's Bay Company
archives. Those were company records. If you put in a clause stipulating that,
if you no longer have a use for the information, the information must be
destroyed or deleted, then who will keep these records? There is still a
threshold there for the bank and the insurance company to prove that their
purpose is indeed the retention of historically interesting information.
Senator Murray: I hope senators all heard the answer to that question. I think
that deserves some further examination.
Let me ask one further question, and then I will leave the whole health care
sector until a second round or other colleagues who may wish to raise it. I
draw your attention to clause 7(1)(c), which is the exemption for journalistic,
artistic or literary purposes. I do not want to get into the journalistic
exemption today. I spoke about that in the Senate, and I understand why we must
do that. Otherwise, we would be facing a likely successful challenge under the
What I wish you to look at is the phrase "artistic or literary purposes."
Did you consider something more precise than that? Do you not think that the
category is rather large?
Mr. Binder: I will defer to my legal advisor here, but our understanding is that
it was lifted verbatim from the Charter.
Ms Perrin: Basically, the Charter is not precise in this.
Senator Murray: My point with respect to the Charter -- and the argument was
made at the House of Commons committee also -- was that, if you included
journalistic purposes in the bill, it is likely there could be a successful
challenge under the freedom of expression provision of the Charter. I want to
know why you have "artistic or literary purposes" in there and whether
you could not have been more precise; whether we need to have something quite
as general as that and whether there is potential for abuse.
Ms Perrin: The Charter does not protect only the press, so journalism is not
sufficient. You must protect the rights of the individual to free expression.
Therefore, an individual who is writing a book and wishes to collect
information for that can avail themselves of this principle.
We must remember that, in this bill, there is a balance. The Privacy
Commissioner can investigate and audit basic activities. However, we do not
want him auditing individuals in the pursuit of intellectual activities,
scholarly works, or that sort of thing.
Senator Murray: Someone suggested that, if we did not put this exemption in, a
book like Margaret Atwood's Alias Grace might be caught up because it is
supposedly based in part on events that actually happened. I do not know
whether that is a sound argument or not. However, docudramas were mentioned. As
I said in the Senate, these could be particularly dangerous to individual
reputations because what they are, essentially, is a mixture of fact and
fiction. That leads me to wonder about the breadth of the exemption.
Madam Chair, I will leave it at that. I have many questions on the health care
sector but other colleagues may wish to ask some questions on this subject.
Senator Maheu: I am relatively new to the dossier and, as such, am seeing Bill
C-6 for the first time this morning. I should like to just cover one point with
two short questions. I am wondering how the government intends to ensure
security when we are buying and selling information and data daily. Anything we
put into the Internet system can be sold and can be purchased. In your
conclusion, you talk about giving individuals control over their personal
information and you say that Canada is taking a leadership role on this issue.
Could you explain exactly what you mean by that?
Mr. Binder: I will ask Ms Perrin to elaborate. However, I will start by saying
that this bill goes a long way to doing exactly that, in the sense that it will
allow the users, the consumers of these services on-line, to know what happened
to the data that they are using in transactions. Therefore, presumably,
whenever you leave your travel information, or your credit information, at a
site, under the provisions of this bill the purpose for which the information
was taken must be adhered to and the code for this particular organization that
collects this data must be adhered to. That will give consumers the
understanding of what happened to the data. Right now, consumers have no idea of
what happens to their personal data. There is no way to know whether their data
is being used for purposes unknown to them.
Senator Maheu: What about hacking?
Mr. Binder: We are now talking about illegal activities, and those are dealt
with by the law. If someone does something illegal on-line, consumers have
recourse. The laws of general application apply on the Internet. We are talking
about someone doing something illegal on the Internet, such as spreading
hateful material, for example, or hacking into data bases. Increasingly, those
activities are being successfully prosecuted.
In addition, we hope that, again through new technologies such as public
infrastructure and encryption, we may be able to protect our data much better.
This is coming up and will be available in the near future.
Senator Maheu: What about the subject of buying and selling?
Ms Perrin: The provisions in the schedule offer some protection in many areas.
It has been asserted that you cannot control the Internet. We do not believe
that that is actually true. One way is to inform consumers so that they are
more aware and thus demand more from Internet service sites. This bill will
require companies to be transparent about the information and to seek consent
for the use of that information for other purposes. It will require companies
to list their purposes. As consumers become aware, as this bill rolls out, they
will become more discriminating before releasing information on-line, which
most consumers are doing without knowledge of how that information is being
bought and sold. It is a big secret that it is bought and sold.
That should cover some of your concerns. There is a safeguard principle in the
schedule that says that organizations must protect the information.
Senator Kinsella: Which schedule is this?
Ms Perrin: This is Schedule 1 at the back of the bill. The 10 basic principles
outlined therein have to be adhered to. Someone has to be accountable on those
Web sites for the use of personal information. There must be someone
accountable to whom consumers can complain, should the need arise. These new
rules will help to inform consumers and will assist them in being more assertive
of their rights.
The safeguard principles, I think, address your hacking question. Companies will
be obliged to protect their Web sites to the industry-standard level of
security so that more attention will be paid to preventing hackers from getting
in there. Yes, it is illegal, but not enough care is being taken in security
Senator Maheu: Taking into account your response, how will you handle American
versus Canadian law on things such as divulging information with respect to
usage of, say, credit cards? We do not control what the Americans do.
Mr. Binder: That is a good question. Whether having privacy safeguards is a
comparative advantage or not is an issue that has been raised many times. If we
can believe what consumers are telling us, the fact that a particular site
provides a clear understanding of what happens to personal information, such as
credit card information -- in other words, that they do not sell this
information without your consent -- will be a competitive advantage. Consumers
will know the difference between sites or service providers that protect their
information and those that do not. We are not the only ones who believe this. I
can tell you that the chartered accountants and the banks are very aggressively
pursuing the approach that by putting safeguards in that consumers can trust
they will get the business. Anyone who goes offshore should beware, because
there is no protection. It is no different than doing business by telephone or
through the mail. A significant amount of fraudulent activity occurs without
recourse. By enshrining this code respecting fair management of personal
information, the companies that adhere to it will have a competitive advantage.
Senator Carstairs: When this proposed legislation comes into force, which
minister will be responsible for enforcing which section?
Mr. Binder: I will defer to the two legal witnesses here. My understanding is
that our minister is responsible for Part 1 and that Parts 2 to 5 are the
responsibility of the Minister of Justice.
I am told that Parts 1 and 2 are brought into force by the recommendation of the
Minister of Industry and that Parts 3 to 5 are brought in by the Minister of
Justice through an Order in Council.
Senator Carstairs: That partly explains why, at some point, there was some
discussion of dividing this into two bills.
I have some more specific questions. I am sure that you are well aware that the
Canadian Medical Association is not happy with this piece of proposed
legislation. They do not believe that it has enough safeguards, particularly
for patients. They are concerned that, without those safeguards, they will not
be able to collect the information they require to provide better help not only
for an individual patient but also for patients with similar conditions.
Since the CMA was not involved in setting the standards, has there been any
consideration to giving them the same three-year buy-in provisions that have
been given elsewhere in the bills?
Ms Perrin: The issues in the medical arena are tricky because of the
constitutional basis and the division of powers. I shall defer to my colleague
to straighten me out, if I misspeak here.
This bill covers organizations engaged in commercial activity. That would
include such players as insurance companies, who, at this time, have not been
covered by medical privacy bills at the provincial levels. A broad spectrum of
organizations may have medical information in their files that need to be
protected. It is not possible for the federal government, either through this
bill or through any other, to reach into hospitals, into most doctors' offices
or into the patient-caregiver interface to dictate consent. The Canadian
Medical Association actually developed their code based on the CSA standard.
They did exactly what organizations are encouraged to do, namely, to take the
basic set of fair information practices and tailor them to your own needs. The
banks did it, the insurance companies did it, and the medical association did
From our perspective, we cannot get into the issue of consent being given
between a patient and a doctor. That is not our area of jurisdiction. However,
it is very important to cover that entire medical file when it arrives in the
insurance company's dossiers. That is what this bill will do.
Mr. Binder: If I may add other points here, we did not develop this code by
sitting in a dark room somewhere and plotting to force it on the world. This
code has been developed over 10 to 15 years of discussion about privacy issues
in this country, both domestically and internationally. After we finished the
discussion, we published two consultation papers.
I get a bit agitated when I hear that we did not consult extensively. First,
practically every organization that cared about privacy was at the table;
second, we are not talking about organization. We are talking about data in
commercial enterprises. Medical activities that are not involved in commercial
activity are not covered by this bill. We have spoken at length to the medical
industries and have not been convinced that this bill impedes research,
collection of data, and the health business.
We have been engaged in this dialogue now for a significant period. We are
convinced that this bill, being general in nature, does what it is supposed to
do, namely, protect Canadians when personal information in commercial
transaction is occurring.
Senator Carstairs: According to CMA, they were not one of the players at your
table. We will take that up with them.
Clearly, the best objective that could be achieved would be that provincial
legislation, which hopefully will come down the pipe, and this legislation will
mesh. However, you have specifically provided for exceptions in this
legislation. In looking at the Quebec law, there is clearly a difference in the
way they have established the means by which they will do this. For example,
they have a lower level for consent but a higher level for disclosure. Why did
you go with a different option from what they have put together?
Ms Perrin: That is a policy decision. In the Canadian standard, which is based
on consent -- and the consent is the lynch pin to that standard -- there are
different expectations for collection, use, and disclosure. We believe that
disclosure should have a higher standard, that you should document those
purposes for which you are disclosing, and that you should document all your
purposes -- separate the three out.
There is a fundamental difference between the basis of the Quebec legislation
and the basis of the federal legislation. The Quebec legislation is based on a
sound civil code that expresses property and civil rights in Quebec. We do not
have that basis under federal jurisdiction, so it changes the way you draft the
bill. The proposed legislation before us is based on commercial activity because
that is where the federal power lies.
It does not mean that the two bills are not harmonious. The Quebec legislation
was based on OECD guidelines. In fact, the Quebec privacy commissioner
participated in the drafting of the CSA guidelines code because at that time
they were drafting the bill. There was an attempt to try to harmonize as best
we could, but the fundamental basis for acting legislatively is different.
Senator Carstairs: I understand "commercial activity" also includes
barter and exchanges. I will give you a hypothetical situation. The Canadian
Cancer Society is different from the Manitoba Cancer Society. As I read this,
the Canadian Cancer Society could not share some of its information with the
Manitoba Cancer Society, let us say, about donors from the Province of Manitoba.
Is that how you read this bill?
Mr. Binder: I have a mental test that I apply to hypothetical situations like
this. I ask: Are we talking about personal information? Can individuals be
identified in this particular data? Is it commercial? It is a simple test. If
the information is personal, and if it is commercial, chances are it is covered.
If it is not, then it is not covered. However, if the information if being sold
to a third party for purposes for which it was not collected, why should it not
Senator Carstairs: Given my hypothetical about the Canadian Cancer Society and
John Doe who has given them $1 million, you are saying that the Manitoba Cancer
Society cannot learn that information. I see it as personal information from an
individual, and I see it as an exchange of information that is prohibited.
Ms Perrin: There are two aspects to this. You could assume that the transfer of
the list is covered because there is some sort of consideration in there. They
are sharing information for gain. The issue, though, is whether they get the
consent of the individual, which is the foundation of this.
The Canadian Marketing Association is strongly in support of this legislation.
They can live with it. I would suggest to you that many of these charities are
members of the Canadian Marketing Association. They have looked into it. The
issue is whether the individual, at the time of giving the gift, is informed of
the practices. Are they given the opportunity to opt out or opt in? A
fundamental principle of the ethics guidelines of the marketing association is
that you give an individual the opportunity to opt out before you trade their
name. This puts that into the legislation.
Yes, it could be covered. We do not like to make a legal determination on each
one of these hypotheticals. Does that mean that the world stops when they are
covered? No, it does not. The threshold for meeting the requirements is not
Senator Callbeck: I am trying to get this thing clear in my own mind. As I
understand it, three years after this legislation becomes effective, if the
provinces do not pass their own legislation, then it applies to the province.
What about universities? Are they exempt under this act?
Ms Heather Black, Legal Counsel, Legal Services, Department of Industry: "Exempt"
is not the term I would use. Commercial activities are covered. After the three
years, this law applies in a province if that province does not have
substantially similar legislation. The application of Bill C-6 to organizations
in the province has been exempted.
In the case of a university, to go back to Mr. Binder's test, do universities
engage in commercial activities? I think we generally must assume that they do
not, in the same way that schools and hospitals do not. However, if a
university is selling lists of its alumni, and universities do that, then I
would suggest that that is a commercial activity. That part of the information
that the university has is a commercial activity. Their student list is not
commercial activity because it is being collected in the course of providing
Mr. Binder: I keep repeating myself, but please indulge me for one more minute.
This bill is not about institutions; it is about personal data. An institution
can engage in several activities, many of which will not be covered because
they are not commercial activities. It is the actual data that you collect and
what you do with it that is covered by this bill. It is important that we do
not, because of one particular institution, jump to conclusions about what
happens to the actual data. We are coming to a world where information will be
in vast databases and where people can mine this data and pull out profiles of
Canadian citizens. They can do it right now, and many of them do it. You are
receiving letter solicitations based on some data, the source of which probably
will surprise you. It surprises me. This is the kind of things we are talking
about. We are not talking about organizations; we are talking about personal
Senator Callbeck: Some of the activities at the university could be covered.
Mr. Binder: Yes.
Senator Callbeck: I wish to return to the clause Senator Murray inquired about,
clause 7(3)(h). If my bank receives confidential information from me and tells
me that it will be confidential, do I understand correctly that the bank can
disclose that information 20 years after I pass away? You said that there had
to be a purpose or a legitimate reason for doing so. Tell me what that might be.
Senator Murray: The historians want to know how much you owe.
Senator Callbeck: That is not good enough for me.
Senator Murray: Nor for me.
Ms Perrin: I think they will have a difficult time justifying disclosing that
data. Just because there is a provision in this proposed legislation under the
consent clause that they do not have to get your consent, that does not mean
that they then can release that information. They must justify it. I am
hard-pressed to think of why your personal, confidential information given to
them with the duty of confidence would be disclosed. The bank, of course, is in
a particularly special situation there because of the duty of confidence. I
cannot think of an example. It might be a good question for the bankers,
actually, if they appear before you.
Senator Murray: Senator Callbeck is a former premier of Prince Edward Island.
She is a former member of the House of Commons and a present member of the
Senate. You mentioned historians and archivists. I suggest to you that there is
perhaps more than one historian or archivist or social scientist or political
scientist who would be quite interested in doing a history of Prince Edward
Island and in knowing how well or how poorly Senator Callbeck did in her long
business career before she entered politics. They would make quite a case that
it was important. I do not think it is any of the public's business. I do not
think that we should do anything to encourage that kind of thing. I assure you
there are academics and journalists and others who would make a very sincere
case that they and the public are entitled to have that information about a
public figure, even if it relates to a time long before she ever came near
I appreciate your point that the bank would have a hard time justifying the
disclosure.I have a hard time justifying the clause in the bill.
Ms Perrin:Remember, the Privacy Commissioner still exists. Once this bill
passes, organizations will take a very hard look at their liabilities and
responsibilities. I think the banks would think carefully about releasing
information to a historian. The journalistic exemption allows the organization
to gather information, but there is no obligation on any other organization to
release for that purpose. Therefore, if you say, "I am writing a book on
Senator Callbeck, and the Privacy Act does not apply to me," then the
telephone company or the bank will say, "Well, I am sorry, it applies to
me, and you are not getting that information."
If you remove this provision, then you severely constrain the ability to release
other not-so-sensitive types of information.
Senator Murray: I appreciate that, and that will be something we must bear in
mind. There may be ways of improving the clause.
Senator Kinsella: I should like to turn to the definition section. The minister
is not defined in the bill. Is there a reason for that?
Ms Black: There are so few references to the minister in this bill because
essentially it is not a government machinery bill. The minister's role is
extremely limited. There are so few references that the minister is referred to
by his title, the Minister of Industry. Towards the end of the bill, you will
find that the Minister of Industry, for example, may ask the Privacy
Commissioner to undertake research, and that the Minister of Industry is
responsible for bringing something into force. Other than that, the minister
has no ongoing oversight or administrative role, certainly as far as Part 1 is
Senator Kinsella: Turning to page 41 of the bill, in Part 3, it speaks of the
minister. Which minister is that? If you look on page 40, clause 22 mentions
the Deputy Minister of Justice. Then, over on page 43 of the bill, we see the
coming into force provision of clause 72 -- and we alluded to this in part a
few moments ago. What happens if this bill is passed by the Senate and receives
Royal Assent, in terms of the coming into force, if there is a reorganization
of the machinery of government and there is no Minister of Industry? What will
apply? Will it be the Financial Administration Act?
Ms Black: When a reorganization of government departments is done through a
statute, that statute would have transitional clauses and clauses that say that
wherever you read "Minister of Industry" you will now read "Minister
Senator Kinsella: Yes. On page 4 of the bill, subclause 7(1) mentions a note
that accompanies clause 4.3 of Schedule 1. What is the status in law of a note
that is in a bill?
Ms Black: Notes do not normally appear in bills. There are notes in the CSA
code. The notes are in the schedule, which covers the principles and commentary
of the CSA code. That code was drafted not as legislation but as a voluntary
code; it contained notes, and those notes are essentially explanatory. In
clause 4.3, for example, the note explains the circumstances under which consent
for a collection, use or disclosure would not be required. However, it is an
open-ended list; it contains examples. When we came to bring the CSA code into
legislation, we had to be more precise than that. Therefore, what we have done
is we have said: "Do not pay any attention to the note. Subclause 7(1)
gives a limited list of circumstances where you may collect without consent;
subclause 7(2) gives a limited list of circumstances where you can use without
consent; and subclause 7(3) gives a limited set of circumstances where you can
disclose without consent. Do not read the note."
Senator Kinsella: Is the note that it is on page 52 of this bill part of the
bill or not?
Ms Black: For legal and enforcement purposes, it is not.
Senator Kinsella: Subclause 7(1)(a) states that the collection must be clearly
in the interests of the individual. Can you give me an example where the state
will determine what is clearly in the interests of the individual, as it will
Ms Perrin: It would not be the state deciding in this case. Let us imagine that
I am staying in a hotel in Vancouver and I have gone out to a restaurant with
friends. Let us also say the concierge happens to know where I am and that the
hotel gets an urgent call indicating that my son has fallen and cracked his
head open, and they ask the concierge, "Where is she? We need to get her
now. What is her cell phone number?" The hotel, because they would be
caught by this bill, will be able to look at that clause and say, "Yes, it
is clearly in her interests to release this information," and they will
release it and tell them where I am or who I am with and track me down.
Senator Kinsella: That is helpful, thank you.
Further to Senator Callbeck's raising the issue of the university environment
and the data banks that are managed by universities, the most important data, I
suppose, would be the academic transcripts. How will this bill relate to that
kind of data?
Ms Black: It would not cover that kind of personal information because it is not
collected, used or disclosed in the course of a commercial activity. What the
university does is not a commercial activity; it is an educational activity. It
is beyond the scope of this bill. This bill rests on the trade and commerce
power. It is, therefore, limited in its scope to commercial activities.
Senator Kinsella: Most universities have these data on their computers now. Is
the situation of people accessing them, but who are not authorized to access
them, covered by the present legislation or not?
Ms Black: Only the provinces can pass legislation that deals with that. Some of
the provinces have public-sector legislation that may apply to that kind of
thing. Some of them do not.
Senator Beaudoin: I have two questions. The first one was raised by Senator
Callbeck. Did you address what happens if this bill is not adopted by the
provinces within three years?
Ms Black: In the first three years after coming into force, the bill will apply
to the federally regulated private sector, such as banks, telecommunications,
et cetera, as well as a rather narrow category of interprovincial and
international transactions, that is to say where the data itself is the subject
of some sort of a commercial trade for consideration. In three years after
coming into force, if a province has passed substantially similar legislation
that covers the same sorts of organizations as Bill C-6 covers, then, by order
of the Governor in Council, the application of Bill C-6 will be lifted from
those organizations with respect to intraprovincial transactions. Regardless of
whether all of the provinces enact legislation that is substantially similar --
and Bill C-6 does not apply to any intraprovincial transactions other than in
the federally regulated private sector -- Bill C-6 will always apply to
interprovincial and international transactions.
Senator Beaudoin: The jurisprudence is very clear-cut that intraprovincial
commerce is provincial and that interprovincial and international commerce is
federal. Does this mean that if the provinces do not legislate in their field
-- that is, intraprovincial commerce -- the Parliament of Canada may do it?
Ms Black: That is correct. This is based on the general branch of the trade and
commerce and it meets the five tests as enunciated by the Supreme Court in
1989, in General Motors v. City National Leasing.
Senator Beaudoin: That is fantastic. You mean that if the provinces do not
legislate in their intraprovincial trade and commerce area, the federal
authority may do so because the provinces do not legislate? The General Motors
case is very clear-cut. I agree entirely with what the Supreme Court said in
that case. We have the intra- and extra-provincial trade and commerce, and we
have the general trade. The general trade is a federal responsibility. I do not
have any problem with that. In fact, I agree entirely. However, how can you
reach the conclusion that, if a province does not legislate in the
intraprovincial domain of commerce, the federal authority may apply its own law
in that field?
Ms Black: I realize that I am debating here with a noted legal scholar.
Senator Beaudoin: I am merely raising a question.
Ms Black: Yes, but I am not a constitutional expert. The advice that we have is
that the General Motors case established the principle that, where a general
regulatory scheme is subject to an oversight that regulates trade as a whole
rather than a sector, the provinces, jointly and severally, cannot act. That is
to say, it meets that test. Furthermore, a failure to include one or more
provinces would jeopardize the operation of the scheme and you would have a
legitimate exercise of the general branch of the trade and commerce power.
Senator Beaudoin: I will wait to hear from officials from the Department of
Ms Black: I think we will all be waiting for the courts. I speak for the
Department of Justice and I am relying on the advice of the Department of
Justice. That advice was also reviewed in this bill in its earlier version, as
tabled in the other place. It was also reviewed by Professor Peter Hogg. In his
opinion, it meets the test.
Senator Beaudoin: That is an excellent opinion. I will return to this matter.
This is a very interesting bill. Obviously, the division of powers is at the
very centre of the bill, as are sections 7 and 8 of the Canadian Charter of
Rights. We cannot avoid the constitutional question because it is a masterpiece,
in a way.
This is why I hope we will hear from some very independent experts on this later
on in our hearings.
To begin with, obviously there is a division of powers. In the field of
intraprovincial trade, it is a provincial responsibility. We all agree with
that; there is no problem there. However, you said that, if the provinces do
not agree or do not legislate, after three years the federal authority may
occupy the field. That is an interesting argument. However, I should like to
think more about it.
Senator Gill: This is a nice bill for those involved. I do not wish to comment,
but in our type of society, we are overregulating. This is additional work, it
is complex and so on.
In the application section, under Part 1, I read that this does not apply to any
government institution in which the Privacy Act applies. Therefore, it does not
apply to the federal government but it applies to institutions that come under
federal jurisdiction or are regulated by the federal government?
I am specifically speaking about Native communities. Of course, they are under
federal jurisdiction. I wonder how the process would apply to some fields of
activities, education, social services and so on, which usually fall under the
jurisdiction of provincial governments. Would it apply to Native communities?
Is it the same application as in the case of the federal government?
Ms Black: As a law of general application, yes, it would apply to commercial
activities on a reserve. If I understand your question correctly, that is the
Senator Gill: In fact, what you are saying is that it would not apply. The
Privacy Act applies to the federal government. The reserve is a delegation of
power or management from the federal government. So which one applies?
Ms Black: The Privacy Act applies to government institutions and to agencies and
agents of the Crown. Those are all listed. If you are not listed in the
schedules to the Privacy Act, you are not covered. As far as I am aware, there
are no aboriginal institutions or anything listed in the schedules to the
Privacy Act; they are not covered by the Privacy Act. This is a law of general
application that would apply, as with those similar laws, to commercial
activities involving the collection, use and disclosure of personal
Senator Gill: In fact, this will have to be dealt with another time. I am not
really satisfied because it is a complex issue and there are a lot of question
marks regarding the management of communities. It is often said that they fall
under the provincial or federal jurisdiction. We might have a discussion on
some aspects of their administration elsewhere, another time.
Senator Murray: I have two points before I get to some questions on the health
care sector. First, concerning Senator Beaudoin's point, I come at this from an
entirely different perspective, unencumbered as I am by any legal training
whatsoever. I wonder why you stop where you are in terms of commercial
activity, given the impossibility, about which we have some testimony, of
disentangling "commercial" and "non-commercial". Under the
commerce power, could you not have properly gone farther than you have gone in
You may be interested to know that we will have two witnesses here at a later
time -- one of whom is Mr. Tassé -- so that we will have an opportunity
to explore those questions.
I read somewhere in my research that the government had indicated that, even
concerning those parts of the bill that applied purely within the federal
jurisdiction, it would not proclaim for a year. Is that true? The minister gave
that undertaking, did he?
Ms Black: That is true, yes. The law is brought into force by an order of the
Governor in Council on the recommendation of the minister, and the minister has
undertaken that it would be approximately one year before it would be brought
Senator Murray: Yes, and it would be three years from that date before it would
apply to those provinces that had not legislated.
Ms Black: The three-year clock starts running when it comes into force.
Essentially, it is more like four years.
Senator Murray: For the provinces.
Ms Black: Exactly.
Senator Murray: Thank you.
Respecting health care issues, the first issue is the impossibility, testified
to by virtually all of the people in the health care sector -- whether they
feel this bill is too strong or too weak or they want an exemption or they want
amendments -- that it is impracticable at best and impossible at worst. It is
illogical, senseless and ludicrous, is one of the phrases from the Heenan
Blaikie legal opinion, to try to separate out in the health care sector
commercial from non-commercial activity.
Without going into it too much, let me just refer to the illustration given by
the Canadian Health Care Association and the legal opinion they received from
Heenan Blaikie. For example, an older patient is hospitalized for hip injury.
He opts for a single room covered by his private insurance. His physician
orders X-rays from the hospital, orders blood work from a commercial laboratory,
and prescribes painkillers. The patient's wife has his prescription filled at
the hospital pharmacy on the first floor. After leaving the hospital, the
patient undergoes three months of physiotherapy at a health clinic near his
home. He is assessed by an occupational therapist sent by his private insurance
company. At his most recent visit to his family doctor's office, the doctor, a
private practitioner, recommends and arranges for the services of a home care
nurse. Eventually the patient's situation worsens and he is placed in a nursing
home. A physician specializing in geriatric care seeks access to the patient's
medical records for the purpose of a research project funded by a pharmaceutical
company to be carried out in the hospital where the patient had originally been
hospitalized. The patient's health information is transferred to the government
for the planning and management of health care delivery in the province.
The lawyers say that it is difficult to conceive how commercial and
non-commercial activities in the above hypothesis could be neatly separated in
any meaningful way and how different legal requirements respecting the
collection, use and disclosure of personal information could be imposed in each
case. They say that obtaining the appropriate consent required in each instance,
whether express or implied, whether specific at every stage or sufficiently
broad to cover multiple uses and/or disclosures, would, alone, be impracticable
to manage. From that, of course, they argue for an exemption for the whole
health care system, and I have already indicated, and I think there is a
general feeling around here, that we are opposed to that.
The CMA makes much the same point about the entanglement. I might as well put
this on the record as well and give you an opportunity to reply to the whole
thing. They talk about the difficulty of delineating what activity is
considered health care and what activity is considered commercial. Then they
ask about the movement of health information from the health care setting. This
is much of what I read from Heenan Blaikie. The CMA says that recognizing that
this is not easily distinguished from the commercial setting, for example,
health information provided to insurance companies when health information is
collected in a health care setting and transferred to a commercial setting,
which rules apply, Bill C-54 or no rules? In CMA's view, there is no clear way
of distinguishing commercial activity from health care activity in a way that
ensures that the health care record is subject to different rules than those
pertaining to other records. Moreover, the dilemma for the government is that,
even if such a distinction could occur, it would be desirable that health care
records be subject to no rules. Put in another way, will those organizations
that currently collect health care information be entitled to claim that, since
the information forms part of the health record, they are not subject to the
provisions of Bill C-54, as it was then?
Let me leave that with you and ask for your response. We will be hearing from
these people in due course, but I think we should hear what you have to say
Mr. Binder: I will turn to Ms Perrin in a moment, as she has read the material
and knows some of the arguments. However, we are happy to hear that you
subscribe to the idea that, just because it is difficult, it does not mean that
we should not be able to find a way of dealing with the most sensitive personal
information that Canadians relate in a health application.
Senator Murray: Yes, of course. That was my point.
Ms Perrin: Further to that point and the example that you mentioned -- we tend
to call them "train wreck scenarios" -- it is possible in all of the
sectors to find incredibly complex flows of data. In the health care sector,
the questions that seem to be asked are: Is it commercial? Is it not? Is it
covered by the bill? I think the better questions are: Is it personal
information? Does it deserve protection? What is protecting it right now? In
the health care area, there is surprisingly little data protection out there.
We look at Bill C-6 as a bill of broad general application. It is a floor, not a
ceiling. We do not see that inherently having a set of rules in place, a set of
fair information practices, will stop the train and cause all this chaos. It
could if you focus all of your time attempting to be a constitutional lawyer,
determining which activity is commercial and which is not. It is interesting to
ask in that example what data is being sold and what data is being transferred
outside of the health care situation.
Senator Murray: It is fairly clear, I think. There would be personal data, one
assumes, in that example. Some of it would be going to a commercial pharmacist
and some of it would be going possibly to a home care nurse, and some of it
elsewhere. You heard the example.
Ms Perrin: The data is being moved around for the purposes of giving care to
that patient. When a patient enters the system, he or she is probably entering
it in an area under provincial jurisdiction upon arrival at the hospital. There
is a consent there to get patient care and to furnish information for those
purposes. That consent is not explicit in most scenarios in Canada at the
moment, and this bill obviously would not apply in the hospital. Not only that,
the bill does not require explicit, express consent in all situations. It does
urge for more transparency.
When you get to the commercial organizations such as the laboratory or the
pharmacy, yes, there are other obligations on pharmacists that are provincially
regulated, and they have a duty of confidentiality. However, in very few
provinces are they actually subject to data protection legislation. There is a
fundamental distinction between a duty of confidentiality and being subject to
a privacy act that has the broader set of principles and the fair information
practices. That is a distinction.
We do not accept that there will be a huge kerfuffle when the patient's wife
shows up at the pharmacy to get the prescription. There is an implied consent
there. There is a consent for purposes. The pharmacy would be under an
obligation under this bill to document what they are doing with the
information. Most patients would like to know what the pharmacy is doing with
the information, and it is not at all clear what they are doing with the
However, the notion that has been advanced in many of the briefs that we have
seen is that at every step of the way you will have to get an express, signed
consent as if you were going in to give away your gallbladder. That is not the
If I may make a parallel to the banking scenario, when I agree to have a credit
card, I sign a form, the better banks have privacy statements on them, they
have a privacy code. I do not need to know where all that data is travelling.
When I use it overseas, I expect it to function. I realize the data must travel
in order for it to function. I do not need to know that my cheques are cleared
with EDS or whatever company is doing that processing. I have consented to its
use for those purposes and I do not consent at every interaction in the chain.
We think that the same sort of situation applies for routine use when you enter
the health care chain. Medical data is sensitive, but so is financial, I would
argue. There may be other junctions where an additional consent would be
required. It is certainly true that more transparency and documentation as to
where that data is going is necessary, and that would be a change.
However, if the direct marketers, the banks and the telephone companies can meet
this bill, why can the medical organizations not? Why can the pharmacies not?
Senator Murray: We will see. I think they would argue, and we will hear from
them when they come, that the scenario by the Canadian Health Care Association,
which is the organization that represents the hospitals, is not extreme, that
it is not really a train wreck situation. What it has to do with is the daily
functioning of the system. Anyway, I will let them make that point if they want
to when they come here.
You are aware, I am sure, that on the question of consent, the hospital people,
if I may call them that, complain that potentially this bill puts too onerous a
requirement on them in terms of multiple consent all the way down the line.
The Canadian Medical Association takes the position that there is not enough
provision in the bill for explicit consent. This is something that the
committee must grapple with.
Senator Fairbairn: I just want to add that I am from Alberta and we are now
looking with interest at certain propositions involving a proposal by the
premier and his government to insert another step of medical participation in
the current system, that is, contracting out to private institutions. The
question that arises in my mind is this: Where would privacy of information sit
if it were subject to a contracting-out process?
Ms Black: Alberta has just tabled a bill to protect health information. That
bill covers a long list of what are called custodians, that is, custodians of
health information. It lists all of the current actors in the provincial health
care sort of scene, if you will, including pharmacists, nursing homes, the
Alberta Cancer Board. It is a fairly extensive list.
I do believe that any privatization of current, publicly delivered health care
in any of the provinces will be covered by provincial health legislation. If it
is not captured, if it escapes that sort of legislation, then in most cases it
would fall under the provisions of this bill as a part of the private system.
As it is, the health care system is essentially 70 per cent public and 30 per
cent private. This bill affects the private sector part of the health system.
Mr. Binder: I would like to remind everyone that what we are trying to do is
create a digital, unified national market. The doomsday scenario is that every
province does its own thing and that data is being treated differently in every
province. This will not create an electronic market that will allow us to
address jobs, growth, and the economic dimension of all of this. Our aim is
harmonization across the whole country. This bill allows every province to
determine how they wish to manage health. If Alberta decides to privatize
health care and institute some form of database management, then that is fine
with us. The whole idea here is that Canadians must trust in the personal
Senator Murray: You will end up with a patchwork, Mr. Binder. If three or four
provinces decide to legislate and to apply fairly tough standards in this field
and four, five or six do not, then they will be governed by this bill.
Mr. Binder: Which is a floor of a minimum standard.
Senator Murray: Which touches only commercial, whatever that is, aspects of
health care, right?
Mr. Binder: Right. That is the point. That is exactly our focus, commercial
Senator Murray: Why do you not persuade Ms Black that the thing to do is have a
federal law in this matter?
Senator Fairbairn: Just to enlighten me, my friend Senator Murray has slipped me
an article that appeared a couple of days ago in the Calgary Herald in which
this very issue is being raised. According to this particular piece, which
would seem to be almost an editorial, there are no laws stopping such health
agencies as private hospitals from broadly sharing patient medical files.
There is nothing more closely held in an individual's life than privacy in
medical files. If in fact there will be differences in the way that various
parts of this country deal with something like this, then that should be
uppermost in the minds of those who are concerned with this legislation and
Mr. Binder: We are hoping that, by passing this bill and the code, there would
be consumer pressure on all governments to adhere to something very similar.
It took a long time, but the same thing happened with respect to privacy. The
federal government was the first to pass privacy legislation; the provinces
As I said before, this proposed legislation is only a base; it is a minimally
acceptable standard, as far as we are concerned. Each province is free to apply
higher standards, and hopefully they will. We believe that provinces will apply
higher standards because as consumers become more aware of the digital on-line
commerce they will demand such protection of personal information.
Senator Fairbairn: I hope you are right.
Senator Murray: I hope we will have the officials, perhaps even the Minister of
Health, here before we have finished with this bill. In the meantime, may I ask
whether you are familiar with the Advisory Council on Health Infostructure?
Mr. Binder: Yes, we are.
Senator Murray: In their final report, chapter 5, they make two points that I
would simply like to place before you. First they say that, within the
legislation, there should be a transparent definition for "custodians"
or "trustees" of personal health information -- the persons
responsible for ensuring the protection, confidentiality and security of
personal health information -- and that their obligations should be precisely
defined. They also say that they should apply equally to public- and
private-sector organizations as well as to organizations acting as an agent or
contractor for the custodian, and that the definition of "guardians"
and their obligations should be clearly set down in the legislation. This
legislation does not do that, does it?
Ms Perrin: No, actually, it does not. I think it is fair to say that those
remarks are addressed to provinces, whose responsibility primarily it is to
legislate in this field. It is a sad thing that most of them have not. That
guidance is targeted at the provincial seat of power.
Senator Murray: They call on the federal minister to take the lead in
encouraging an accord among provincial, territorial and federal governments to
harmonize the approaches in their respective jurisdictions. I cannot ask you,
but I will ask them when they get here, whether that has been done. Instead of
that, we have the bill.
Ms Perrin: I do not wish to speak for them, but they are actively working with
the provinces on a federal-provincial accord as to what those standards are. In
fact, I believe they have accepted the CSA standard as the basis for fair
information practices. How you actually implement a specific sectoral bill on
health information is quite different from our goal in setting a broad set of
fair information practices. The fair information practices can be the same but
the scope and the definitions necessarily are different.
Senator Murray: That is an important point, even for us, and for our future
consideration of this bill. Let me give you another comment they make, and then
I will close. They say that the legislation should also contain a clear
prohibition against all secondary commercial use of personal health
information. This bill does not do that, does it?
Ms Perrin: I think it does achieve that, yes.
Senator Murray: A prohibition?
Ms Perrin: Yes. You must get the consent of the individual. We do not prohibit,
if the individual consents to those further purposes. However, the bill forces
an organization to obtain the consent of the individual, to document their
purposes and their information flows. It allows the individual to get access so
that they can then complain and can take a complaint to the Privacy Commissioner
and then to the Federal Court. Therefore, I think we have actually looked after
If I might respond to your further comments on consent and the debate on both
sides of whether we have strong enough consent provisions in here. At the risk
of sounding like Goldilocks, when one side is saying that we are too onerous
and will stop health care and the other side is saying that it is nowhere near
strong enough and does not do the job, that tells us that we are right in the
Senator Murray: Yes, that is what we always say.
Senator Callbeck: I wish to return to the question I asked before about
universities. You indicated that certain data would be under the federal
legislation provided the province does not legislate. Would student records be
under this legislation?
Ms Black: No, they would not.
Senator Callbeck: So the fact that a student pays for education does not make it
a commercial activity?
Ms Black: That is not a commercial activity. If the university undertook, for
example, to sell all their student records to Visa, that would be a commercial
activity. The fundamental assumption is that universities are not engaged in a
Senator Callbeck: What about private business? We see private businesses setting
up everywhere, such as, for example, computer colleges.
Ms Black: That is commercial.
Senator Callbeck: So there is a double standard here.
Ms Black: In a sense.
The Deputy Chairman: I thank the witnesses for appearing. It was a very lively
and informative discussion.
The committee adjourned.