Proceedings of the Standing Senate Committee on
Social Affairs,
Science and Technology
Issue 1 - Evidence, November 25, 1999
OTTAWA, Thursday, November 25, 1999
The Standing Senate Committee on Social Affairs, Science and Technology, to which was referred the subject matter of Bill C-6, to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act, met this day at 11:00 a.m. to give consideration to the subject matter of Bill C-6.
Senator Marjory LeBreton (Deputy Chairman) in the Chair.
[English]
The Deputy Chairman: Honourable senators, the agenda this morning is the subject matter of Bill C-6.
Our witnesses this morning are from Industry Canada, Justice Canada and Treasury Board. Welcome and please proceed.
Mr. Michael Binder, Assistant Deputy Minister, Spectrum, Information Technologies and Telecommunications Sector, Industry Canada: Madam Chair, with your permission, I should like to start by giving a short overview of the policy and historical context for this bill.
Bill C-6 is an essential part of the government's "Connecting Canadians" agenda and vision. The 1997 Speech from the Throne outlined that vision as making the information and knowledge infrastructure accessible to all Canadians by the year 2000, thereby making Canada the most connected country in the world.
We all know that important changes are taking place in the economy and in society. Information communications technologies are advancing rapidly. We see the emergence of a single, global market. We have witnessed phenomenal growth of the Internet. There has been a dramatic growth of electronic commerce. The pace of change itself is such that we find ourselves having to move at "Internet time."
The "Connecting Canadians" agenda is intended to increase competitiveness and productivity, to ensure equal access to lifelong learning, to improve access to government services, to develop world-leading infrastructure and technology, and to bring Canadians closer together. It will create a stronger Canadian economy and a stronger Canadian society.
These developments have ushered in an entirely new way of doing business -- electronic commerce.
[Translation]
Companies can now transact business electronically in a fraction of the time and cost of traditional communications media. Individual consumers can buy products directly from companies or online merchants no matter where they live.
[English]
Electronic commerce offers better services for consumers, enhanced productivity for businesses, and lays the foundation for government on-line, which will improve government services to Canadians at lower cost.
The promised benefits of electronic commerce are enormous, but they will not come automatically. Consumers need confidence before they will fully embrace electronic commerce. They have to believe that the companies they are dealing with are reputable, and they have to believe that their personal information is being treated fairly.
The former has always been a requirement for economic participation, but the latter, concern with the treatment of personal information and the loss of privacy, is a more recent and more critical issue. Many companies now recognize that having good privacy practices for their customers will give them a competitive advantage over competitors who do not.
The convergence of computer and high-speed communications technologies has created new possibilities for the collection, compilation and distribution of vast amounts of personal information about each of us. Personal information has become a commodity of increasing economic value. Companies are buying, selling and using this information to create individualized profiles for marketing purposes. It is not surprising, therefore, that a recent EKOS survey found that 94 per cent of Canadians feel that it is increasingly important to have safeguards to personal information on the Internet. These concerns are holding many people back from participating in electronic commerce.
Government can and should be both a leader and a model user to increase the confidence of consumers and businesses to use the new technologies in order to facilitate the growth of electronic commerce in Canada.
Bill C-6 is designed to create a climate of trust, first, by establishing rules for the treatment of personal information in the private sector and, second, by putting electronic transactions governed by federal laws on the same footing as paper ones. Giving individuals control over their personal information and giving businesses and citizens the assurances that an electronic document and an electronic signature has legal standing and will be recognized, enforced and accepted by government and the courts will provide the confidence needed to support electronic commerce.
Bill C-6 establishes a right to the protection of personal information and puts electronic transactions on the same legal footing as paper transactions.
[Translation]
The protection of personal information is achieved by bringing into law the Canadian Standards Association Model Code for the Protection of Personal Information. The CAS Standard was developed in a consensus process that included representatives from a broad spectrum of interests including industry, the public sector, consumer groups and labour organizations.
[English]
The code is consistent with the OECD privacy guidelines and was recognized as a national standard by the Standards Council of Canada.
The government conducted two public consultations, one in 1994 and the other in 1998.
[Translation]
The responses to the 1998 paper clearly demonstrated a preference for using the CAS Code as the basis for privacy legislation.
[English]
In conclusion, Bill C-6 strikes a balance between the needs of organizations for information and the right of individuals to exercise control over their personal information. It was developed following widespread public consultations. It addresses the real concerns of Canadians and it demonstrates Canada's leadership in the promotion of electronic commerce and in the protection of personal information.
We would be pleased to answer specific questions.
Senator Murray: I have quite a few questions. As I embark on them, Madam Chair, if other honourable senators wish to ask questions, please cut me off and proceed, because the matters I am interested in may well be covered by other senators. If not, I may be able to come back in a second round. Therefore, I will start.
On February 3, 1999, the Minister of Justice, Ms McLellan, appeared before the House of Commons committee that was studying Bill C-54, the old version of this bill. She said:
I hope I'm not revealing any confidences or secrets here, but Mr. Manley and I actually were very interested in having the two parts of the bill moved forward separately. I think we acknowledge the problems you have grappling with the privacy issues that have a whole host of dimensions to them, and then with the highly technical, highly legal parts, 2 to 5, dealing with the legal infrastructure. But the decision was made in terms of management through the House. It made sense. We are dealing with electronic commerce, and when it was explained to me, I accepted it fully.
I say in parentheses here that Part 1, the privacy provisions, relates to information that is collected by any means, electronic or otherwise. Therefore, the relationship between that part and Parts 2 to 5 is purely coincidental.
Ms Perrin, a bit later on the same day, said:
On the issue of the two halves being together, I can echo what Minister McLellan just said. As we indicated, these did start out as separate bills: a bill to protect personal information and a series of legal infrastructure amendments. The two were put together because they're both vital for electronic commerce.
Will one of the witnesses please describe the process by which the two halves started out separately and ended up in one bill?
Mr. Binder: Let me start with some history. As someone who was pushing this information highway way back in the Department of Communications, and later on in Industry Canada, I can tell you that we always looked at a coherent approach to what it takes to deal with this coming new network economy, on-line economy, digital economy. That was the motivation. You may want to ask yourself: What is Industry Canada doing ushering in a bill on privacy? The driver for us was electronic commerce. It always has been that. To have Canadians and businesses go on-line, years ago we decided that you must instil trust in the electronic highway. This angst about putting your credit card on-line and about the data being on-line and the worry that you do not know where it goes -- and a feeling that it is going into a black hole -- was always the concern expressed to us both by the consumers and by the business community, who did not know who was on the other side and did not know whether the signature was right or if the documents had any legal status. I am going back now almost 10 years, when we said that we must do something about that if electronic commerce -- at the time we called it the information highway -- was to succeed.
Senator Murray: I appreciate all that.
Mr. Binder: We then came up with our strategy for electronic commerce. I do not know if you have seen this, but it was released by the Prime Minister in 1998. It is a coherent approach that deals with documents, electronic signature, encryption policies, and privacy. It was always our intention to put legislation in place in the House to deal with these issues. We do not differentiate. It is two parts of a whole entity. Doing half will not deal with the electronic commerce challenge.
Senator Murray: At the risk of repeating myself, the first part of the bill deals with information however collected, electronically or otherwise. When Minister McLellan was before the committee, she said -- and I presume you will confirm this -- that your minister, the Minister of Industry, has responsibility for Part 1 of this bill and that she has responsibility for Parts 2 to 5.
Mr. Binder: In terms of drafting a piece of legislation, the Department of Justice always has legislative drafting responsibility.
Senator Murray: No. I know that.
Mr. Binder: In terms of policy or electronic commerce, our minister has the lead. He was given the responsibility to usher this bill through the House, always with the help of colleagues.
Senator Murray: Yes. Ms McLellan told the committee -- and I presume she knows what she is talking about -- that she has responsibility for Parts 2 to 5 of this bill and that your minister has responsibility for Part 1. I will not belabour the issue because there are other ways of dealing with it; perhaps I am better advised to talk to the ministers if and when they come here.
I presume that a decision was made at one point in the government to approve a policy and the preparation of legislation with regard to personal information collected in the course of commercial activity. I presume that that decision was made somewhere at some point, and then ultimately by the cabinet on the initiative of the Minister of Industry.
Mr. Binder: Right.
Senator Murray: I presume that there was another decision -- and this is implicit in what Ms McLellan told the Commons committee -- to approve a policy and to proceed with the necessary legislation to facilitate electronic communication with the government and electronic documentation in what we would call the justice system. I presume that decision was taken somewhere along the line. That is implicit in Ms McLellan's statement and Ms Perrin's confirmation that this started out as two bills.
Mr. Binder: I would differentiate between the policy and the actual bill and responsibility for the bill. The policy resulted from an electronic commerce strategy, and that strategy was driven by our minister. Then, in drafting Parts 3 and 5 and making it coming into force, the Minister of Justice is implicated because of the horizontal responsibility of all statutes, electronic documents, et cetera. The chapeau, if I may say, or the policy that governs this bill, is the responsibility of the Minister of Industry. That is the way I differentiate between the two. They were always debated together in cabinet. Who actually does the specific bills is a technicality, as far as we are concerned. It is the policy that has driven this initiative.
Senator Murray: Once there was a draft bill, it was considered together in cabinet. There were two bills. We were told that it started out as two bills.
Mr. Binder: I do not want to seem to be difficult, but it started out as a policy discussion in cabinet on electronic commerce. Once a decision was reached to move forward, the mechanics of realizing the policy becomes a different consideration. It goes through the legislative house, et cetera.
Senator Murray: I will pursue it with the ministers, if I get the opportunity, if and when they attend.
I draw your attention to clause 7(3)(h), which reads as follows:
For the purpose of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may disclose personal information without the knowledge or consent of the individual only if the disclosure is
(h) made after the earlier of
(i) one hundred years after the record containing the information was created, and
(ii) twenty years after the death of the individual whom the information is about;
Do you have that?
Ms Stephanie Perrin, Director, Privacy Policy, Electronic Commerce Task Force, Industry Canada: Yes.
Senator Murray: Am I correct in my reading of this subclause that personal information collected by an organization -- your bank, your credit card company, your mortgage company, your insurance company, whatever -- could be disclosed 20 years after the death of the person about whom it was collected? Am I correct in my reading of that?
Ms Perrin: That says you need not seek the consent of the individual for that disclosure. However, all disclosures must be justified with the purpose clause, so there must be a legitimate purpose for the disclosure of that information. There are still a number of tests. This merely says that you need not seek consent to disclose.
Senator Murray: What are the purposes, Ms Perrin?
Ms Perrin: This bill is built on the CSA standard. The CSA standard has 10 provisions. They are all interrelated. You must state your purpose, if you are an organization, for the collection, use and disclosure of personal information. You must document that purpose so that it is available to individuals. When that standard was incorporated into this bill, a purpose clause was put into clause 5. That purpose clause stipulates that you must pass a reasonableness test in order to ensure that you do not state your purposes as, "I will collect all the information that a individual could possibly create in their life time, and I am going to keep it forever and use it for my own aims."
Senator Murray: I wonder whether the safeguards are adequate. My eye was caught by the following sentence in the briefing book provided by the government to senators concerning this suggestion:
The purpose of this clause is to permit the release of personal information 20 years after the death of the individual, or where it may be reasonably presumed that the individual is dead.
By way of background, you say:
The Privacy Act deals with this issue by defining personal information of a person who has been deceased for twenty years as not being personal information for the purposes of the Act. The approach in this legislation is more restrictive, permitting disclosure but not removing it from the ambit of the legislation.
I do not know why such a provision is being put into this legislation. There may be, and I am sure are, good reasons in the public interest why such a provision is in the Privacy Act governing the government and its agencies. However, I wonder about the justification for permitting disclosure, even subject to these purposes and safeguards that you refer to, of information that is collected by your bank or your insurance company or your mortgage company. What is the justification for that?
Ms Perrin: We must remember that this is a broad bill of general application and that it will cover many different kinds of enterprises. This clause is basically for historical purposes and archives. You obviously have not heard yet from the archivist and historian community. That community feels strongly that if there is no clause that permits private organizations, businesses and institutions to disclose information to historical institutions for the preservation of historical records much valuable information will be destroyed. There are provisions in the bill to retain the information only as long as is necessary for the purposes for which it was gathered, so there is a strong push on institutions to destroy information that is no longer necessary. An insurance company, for instance, that is no longer doing business with a client would be strongly impelled by the schedule to dispose of that information. Nevertheless, some information is of historical interest. Letters to our minister on this very clause cite the recently donated Hudson's Bay Company archives. Those were company records. If you put in a clause stipulating that, if you no longer have a use for the information, the information must be destroyed or deleted, then who will keep these records? There is still a threshold there for the bank and the insurance company to prove that their purpose is indeed the retention of historically interesting information.
Senator Murray: I hope senators all heard the answer to that question. I think that deserves some further examination.
Let me ask one further question, and then I will leave the whole health care sector until a second round or other colleagues who may wish to raise it. I draw your attention to clause 7(1)(c), which is the exemption for journalistic, artistic or literary purposes. I do not want to get into the journalistic exemption today. I spoke about that in the Senate, and I understand why we must do that. Otherwise, we would be facing a likely successful challenge under the Charter.
What I wish you to look at is the phrase "artistic or literary purposes." Did you consider something more precise than that? Do you not think that the category is rather large?
Mr. Binder: I will defer to my legal advisor here, but our understanding is that it was lifted verbatim from the Charter.
Ms Perrin: Basically, the Charter is not precise in this.
Senator Murray: My point with respect to the Charter -- and the argument was made at the House of Commons committee also -- was that, if you included journalistic purposes in the bill, it is likely there could be a successful challenge under the freedom of expression provision of the Charter. I want to know why you have "artistic or literary purposes" in there and whether you could not have been more precise; whether we need to have something quite as general as that and whether there is potential for abuse.
Ms Perrin: The Charter does not protect only the press, so journalism is not sufficient. You must protect the rights of the individual to free expression. Therefore, an individual who is writing a book and wishes to collect information for that can avail themselves of this principle.
We must remember that, in this bill, there is a balance. The Privacy Commissioner can investigate and audit basic activities. However, we do not want him auditing individuals in the pursuit of intellectual activities, scholarly works, or that sort of thing.
Senator Murray: Someone suggested that, if we did not put this exemption in, a book like Margaret Atwood's Alias Grace might be caught up because it is supposedly based in part on events that actually happened. I do not know whether that is a sound argument or not. However, docudramas were mentioned. As I said in the Senate, these could be particularly dangerous to individual reputations because what they are, essentially, is a mixture of fact and fiction. That leads me to wonder about the breadth of the exemption.
Madam Chair, I will leave it at that. I have many questions on the health care sector but other colleagues may wish to ask some questions on this subject.
Senator Maheu: I am relatively new to the dossier and, as such, am seeing Bill C-6 for the first time this morning. I should like to just cover one point with two short questions. I am wondering how the government intends to ensure security when we are buying and selling information and data daily. Anything we put into the Internet system can be sold and can be purchased. In your conclusion, you talk about giving individuals control over their personal information and you say that Canada is taking a leadership role on this issue. Could you explain exactly what you mean by that?
Mr. Binder: I will ask Ms Perrin to elaborate. However, I will start by saying that this bill goes a long way to doing exactly that, in the sense that it will allow the users, the consumers of these services on-line, to know what happened to the data that they are using in transactions. Therefore, presumably, whenever you leave your travel information, or your credit information, at a site, under the provisions of this bill the purpose for which the information was taken must be adhered to and the code for this particular organization that collects this data must be adhered to. That will give consumers the understanding of what happened to the data. Right now, consumers have no idea of what happens to their personal data. There is no way to know whether their data is being used for purposes unknown to them.
Senator Maheu: What about hacking?
Mr. Binder: We are now talking about illegal activities, and those are dealt with by the law. If someone does something illegal on-line, consumers have recourse. The laws of general application apply on the Internet. We are talking about someone doing something illegal on the Internet, such as spreading hateful material, for example, or hacking into data bases. Increasingly, those activities are being successfully prosecuted.
In addition, we hope that, again through new technologies such as public infrastructure and encryption, we may be able to protect our data much better. This is coming up and will be available in the near future.
Senator Maheu: What about the subject of buying and selling?
Ms Perrin: The provisions in the schedule offer some protection in many areas. It has been asserted that you cannot control the Internet. We do not believe that that is actually true. One way is to inform consumers so that they are more aware and thus demand more from Internet service sites. This bill will require companies to be transparent about the information and to seek consent for the use of that information for other purposes. It will require companies to list their purposes. As consumers become aware, as this bill rolls out, they will become more discriminating before releasing information on-line, which most consumers are doing without knowledge of how that information is being bought and sold. It is a big secret that it is bought and sold.
That should cover some of your concerns. There is a safeguard principle in the schedule that says that organizations must protect the information.
Senator Kinsella: Which schedule is this?
Ms Perrin: This is Schedule 1 at the back of the bill. The 10 basic principles outlined therein have to be adhered to. Someone has to be accountable on those Web sites for the use of personal information. There must be someone accountable to whom consumers can complain, should the need arise. These new rules will help to inform consumers and will assist them in being more assertive of their rights.
The safeguard principles, I think, address your hacking question. Companies will be obliged to protect their Web sites to the industry-standard level of security so that more attention will be paid to preventing hackers from getting in there. Yes, it is illegal, but not enough care is being taken in security right now.
Senator Maheu: Taking into account your response, how will you handle American versus Canadian law on things such as divulging information with respect to usage of, say, credit cards? We do not control what the Americans do.
Mr. Binder: That is a good question. Whether having privacy safeguards is a comparative advantage or not is an issue that has been raised many times. If we can believe what consumers are telling us, the fact that a particular site provides a clear understanding of what happens to personal information, such as credit card information -- in other words, that they do not sell this information without your consent -- will be a competitive advantage. Consumers will know the difference between sites or service providers that protect their information and those that do not. We are not the only ones who believe this. I can tell you that the chartered accountants and the banks are very aggressively pursuing the approach that by putting safeguards in that consumers can trust they will get the business. Anyone who goes offshore should beware, because there is no protection. It is no different than doing business by telephone or through the mail. A significant amount of fraudulent activity occurs without recourse. By enshrining this code respecting fair management of personal information, the companies that adhere to it will have a competitive advantage.
Senator Carstairs: When this proposed legislation comes into force, which minister will be responsible for enforcing which section?
Mr. Binder: I will defer to the two legal witnesses here. My understanding is that our minister is responsible for Part 1 and that Parts 2 to 5 are the responsibility of the Minister of Justice.
I am told that Parts 1 and 2 are brought into force by the recommendation of the Minister of Industry and that Parts 3 to 5 are brought in by the Minister of Justice through an Order in Council.
Senator Carstairs: That partly explains why, at some point, there was some discussion of dividing this into two bills.
I have some more specific questions. I am sure that you are well aware that the Canadian Medical Association is not happy with this piece of proposed legislation. They do not believe that it has enough safeguards, particularly for patients. They are concerned that, without those safeguards, they will not be able to collect the information they require to provide better help not only for an individual patient but also for patients with similar conditions.
Since the CMA was not involved in setting the standards, has there been any consideration to giving them the same three-year buy-in provisions that have been given elsewhere in the bills?
Ms Perrin: The issues in the medical arena are tricky because of the constitutional basis and the division of powers. I shall defer to my colleague to straighten me out, if I misspeak here.
This bill covers organizations engaged in commercial activity. That would include such players as insurance companies, who, at this time, have not been covered by medical privacy bills at the provincial levels. A broad spectrum of organizations may have medical information in their files that need to be protected. It is not possible for the federal government, either through this bill or through any other, to reach into hospitals, into most doctors' offices or into the patient-caregiver interface to dictate consent. The Canadian Medical Association actually developed their code based on the CSA standard. They did exactly what organizations are encouraged to do, namely, to take the basic set of fair information practices and tailor them to your own needs. The banks did it, the insurance companies did it, and the medical association did it.
From our perspective, we cannot get into the issue of consent being given between a patient and a doctor. That is not our area of jurisdiction. However, it is very important to cover that entire medical file when it arrives in the insurance company's dossiers. That is what this bill will do.
Mr. Binder: If I may add other points here, we did not develop this code by sitting in a dark room somewhere and plotting to force it on the world. This code has been developed over 10 to 15 years of discussion about privacy issues in this country, both domestically and internationally. After we finished the discussion, we published two consultation papers.
I get a bit agitated when I hear that we did not consult extensively. First, practically every organization that cared about privacy was at the table; second, we are not talking about organization. We are talking about data in commercial enterprises. Medical activities that are not involved in commercial activity are not covered by this bill. We have spoken at length to the medical industries and have not been convinced that this bill impedes research, collection of data, and the health business.
We have been engaged in this dialogue now for a significant period. We are convinced that this bill, being general in nature, does what it is supposed to do, namely, protect Canadians when personal information in commercial transaction is occurring.
Senator Carstairs: According to CMA, they were not one of the players at your table. We will take that up with them.
Clearly, the best objective that could be achieved would be that provincial legislation, which hopefully will come down the pipe, and this legislation will mesh. However, you have specifically provided for exceptions in this legislation. In looking at the Quebec law, there is clearly a difference in the way they have established the means by which they will do this. For example, they have a lower level for consent but a higher level for disclosure. Why did you go with a different option from what they have put together?
Ms Perrin: That is a policy decision. In the Canadian standard, which is based on consent -- and the consent is the lynch pin to that standard -- there are different expectations for collection, use, and disclosure. We believe that disclosure should have a higher standard, that you should document those purposes for which you are disclosing, and that you should document all your purposes -- separate the three out.
There is a fundamental difference between the basis of the Quebec legislation and the basis of the federal legislation. The Quebec legislation is based on a sound civil code that expresses property and civil rights in Quebec. We do not have that basis under federal jurisdiction, so it changes the way you draft the bill. The proposed legislation before us is based on commercial activity because that is where the federal power lies.
It does not mean that the two bills are not harmonious. The Quebec legislation was based on OECD guidelines. In fact, the Quebec privacy commissioner participated in the drafting of the CSA guidelines code because at that time they were drafting the bill. There was an attempt to try to harmonize as best we could, but the fundamental basis for acting legislatively is different.
Senator Carstairs: I understand "commercial activity" also includes barter and exchanges. I will give you a hypothetical situation. The Canadian Cancer Society is different from the Manitoba Cancer Society. As I read this, the Canadian Cancer Society could not share some of its information with the Manitoba Cancer Society, let us say, about donors from the Province of Manitoba. Is that how you read this bill?
Mr. Binder: I have a mental test that I apply to hypothetical situations like this. I ask: Are we talking about personal information? Can individuals be identified in this particular data? Is it commercial? It is a simple test. If the information is personal, and if it is commercial, chances are it is covered. If it is not, then it is not covered. However, if the information if being sold to a third party for purposes for which it was not collected, why should it not be covered?
Senator Carstairs: Given my hypothetical about the Canadian Cancer Society and John Doe who has given them $1 million, you are saying that the Manitoba Cancer Society cannot learn that information. I see it as personal information from an individual, and I see it as an exchange of information that is prohibited.
Ms Perrin: There are two aspects to this. You could assume that the transfer of the list is covered because there is some sort of consideration in there. They are sharing information for gain. The issue, though, is whether they get the consent of the individual, which is the foundation of this.
The Canadian Marketing Association is strongly in support of this legislation. They can live with it. I would suggest to you that many of these charities are members of the Canadian Marketing Association. They have looked into it. The issue is whether the individual, at the time of giving the gift, is informed of the practices. Are they given the opportunity to opt out or opt in? A fundamental principle of the ethics guidelines of the marketing association is that you give an individual the opportunity to opt out before you trade their name. This puts that into the legislation.
Yes, it could be covered. We do not like to make a legal determination on each one of these hypotheticals. Does that mean that the world stops when they are covered? No, it does not. The threshold for meeting the requirements is not insuperable.
Senator Callbeck: I am trying to get this thing clear in my own mind. As I understand it, three years after this legislation becomes effective, if the provinces do not pass their own legislation, then it applies to the province. What about universities? Are they exempt under this act?
Ms Heather Black, Legal Counsel, Legal Services, Department of Industry: "Exempt" is not the term I would use. Commercial activities are covered. After the three years, this law applies in a province if that province does not have substantially similar legislation. The application of Bill C-6 to organizations in the province has been exempted.
In the case of a university, to go back to Mr. Binder's test, do universities engage in commercial activities? I think we generally must assume that they do not, in the same way that schools and hospitals do not. However, if a university is selling lists of its alumni, and universities do that, then I would suggest that that is a commercial activity. That part of the information that the university has is a commercial activity. Their student list is not commercial activity because it is being collected in the course of providing education.
Mr. Binder: I keep repeating myself, but please indulge me for one more minute. This bill is not about institutions; it is about personal data. An institution can engage in several activities, many of which will not be covered because they are not commercial activities. It is the actual data that you collect and what you do with it that is covered by this bill. It is important that we do not, because of one particular institution, jump to conclusions about what happens to the actual data. We are coming to a world where information will be in vast databases and where people can mine this data and pull out profiles of Canadian citizens. They can do it right now, and many of them do it. You are receiving letter solicitations based on some data, the source of which probably will surprise you. It surprises me. This is the kind of things we are talking about. We are not talking about organizations; we are talking about personal information.
Senator Callbeck: Some of the activities at the university could be covered.
Mr. Binder: Yes.
Senator Callbeck: I wish to return to the clause Senator Murray inquired about, clause 7(3)(h). If my bank receives confidential information from me and tells me that it will be confidential, do I understand correctly that the bank can disclose that information 20 years after I pass away? You said that there had to be a purpose or a legitimate reason for doing so. Tell me what that might be.
Senator Murray: The historians want to know how much you owe.
Senator Callbeck: That is not good enough for me.
Senator Murray: Nor for me.
Ms Perrin: I think they will have a difficult time justifying disclosing that data. Just because there is a provision in this proposed legislation under the consent clause that they do not have to get your consent, that does not mean that they then can release that information. They must justify it. I am hard-pressed to think of why your personal, confidential information given to them with the duty of confidence would be disclosed. The bank, of course, is in a particularly special situation there because of the duty of confidence. I cannot think of an example. It might be a good question for the bankers, actually, if they appear before you.
Senator Murray: Senator Callbeck is a former premier of Prince Edward Island. She is a former member of the House of Commons and a present member of the Senate. You mentioned historians and archivists. I suggest to you that there is perhaps more than one historian or archivist or social scientist or political scientist who would be quite interested in doing a history of Prince Edward Island and in knowing how well or how poorly Senator Callbeck did in her long business career before she entered politics. They would make quite a case that it was important. I do not think it is any of the public's business. I do not think that we should do anything to encourage that kind of thing. I assure you there are academics and journalists and others who would make a very sincere case that they and the public are entitled to have that information about a public figure, even if it relates to a time long before she ever came near politics.
I appreciate your point that the bank would have a hard time justifying the disclosure.I have a hard time justifying the clause in the bill.
Ms Perrin:Remember, the Privacy Commissioner still exists. Once this bill passes, organizations will take a very hard look at their liabilities and responsibilities. I think the banks would think carefully about releasing information to a historian. The journalistic exemption allows the organization to gather information, but there is no obligation on any other organization to release for that purpose. Therefore, if you say, "I am writing a book on Senator Callbeck, and the Privacy Act does not apply to me," then the telephone company or the bank will say, "Well, I am sorry, it applies to me, and you are not getting that information."
If you remove this provision, then you severely constrain the ability to release other not-so-sensitive types of information.
Senator Murray: I appreciate that, and that will be something we must bear in mind. There may be ways of improving the clause.
Senator Kinsella: I should like to turn to the definition section. The minister is not defined in the bill. Is there a reason for that?
Ms Black: There are so few references to the minister in this bill because essentially it is not a government machinery bill. The minister's role is extremely limited. There are so few references that the minister is referred to by his title, the Minister of Industry. Towards the end of the bill, you will find that the Minister of Industry, for example, may ask the Privacy Commissioner to undertake research, and that the Minister of Industry is responsible for bringing something into force. Other than that, the minister has no ongoing oversight or administrative role, certainly as far as Part 1 is concerned.
Senator Kinsella: Turning to page 41 of the bill, in Part 3, it speaks of the minister. Which minister is that? If you look on page 40, clause 22 mentions the Deputy Minister of Justice. Then, over on page 43 of the bill, we see the coming into force provision of clause 72 -- and we alluded to this in part a few moments ago. What happens if this bill is passed by the Senate and receives Royal Assent, in terms of the coming into force, if there is a reorganization of the machinery of government and there is no Minister of Industry? What will apply? Will it be the Financial Administration Act?
Ms Black: When a reorganization of government departments is done through a statute, that statute would have transitional clauses and clauses that say that wherever you read "Minister of Industry" you will now read "Minister of whatever."
Senator Kinsella: Yes. On page 4 of the bill, subclause 7(1) mentions a note that accompanies clause 4.3 of Schedule 1. What is the status in law of a note that is in a bill?
Ms Black: Notes do not normally appear in bills. There are notes in the CSA code. The notes are in the schedule, which covers the principles and commentary of the CSA code. That code was drafted not as legislation but as a voluntary code; it contained notes, and those notes are essentially explanatory. In clause 4.3, for example, the note explains the circumstances under which consent for a collection, use or disclosure would not be required. However, it is an open-ended list; it contains examples. When we came to bring the CSA code into legislation, we had to be more precise than that. Therefore, what we have done is we have said: "Do not pay any attention to the note. Subclause 7(1) gives a limited list of circumstances where you may collect without consent; subclause 7(2) gives a limited list of circumstances where you can use without consent; and subclause 7(3) gives a limited set of circumstances where you can disclose without consent. Do not read the note."
Senator Kinsella: Is the note that it is on page 52 of this bill part of the bill or not?
Ms Black: For legal and enforcement purposes, it is not.
Senator Kinsella: Subclause 7(1)(a) states that the collection must be clearly in the interests of the individual. Can you give me an example where the state will determine what is clearly in the interests of the individual, as it will apply here?
Ms Perrin: It would not be the state deciding in this case. Let us imagine that I am staying in a hotel in Vancouver and I have gone out to a restaurant with friends. Let us also say the concierge happens to know where I am and that the hotel gets an urgent call indicating that my son has fallen and cracked his head open, and they ask the concierge, "Where is she? We need to get her now. What is her cell phone number?" The hotel, because they would be caught by this bill, will be able to look at that clause and say, "Yes, it is clearly in her interests to release this information," and they will release it and tell them where I am or who I am with and track me down.
Senator Kinsella: That is helpful, thank you.
Further to Senator Callbeck's raising the issue of the university environment and the data banks that are managed by universities, the most important data, I suppose, would be the academic transcripts. How will this bill relate to that kind of data?
Ms Black: It would not cover that kind of personal information because it is not collected, used or disclosed in the course of a commercial activity. What the university does is not a commercial activity; it is an educational activity. It is beyond the scope of this bill. This bill rests on the trade and commerce power. It is, therefore, limited in its scope to commercial activities.
Senator Kinsella: Most universities have these data on their computers now. Is the situation of people accessing them, but who are not authorized to access them, covered by the present legislation or not?
Ms Black: Only the provinces can pass legislation that deals with that. Some of the provinces have public-sector legislation that may apply to that kind of thing. Some of them do not.
Senator Beaudoin: I have two questions. The first one was raised by Senator Callbeck. Did you address what happens if this bill is not adopted by the provinces within three years?
Ms Black: In the first three years after coming into force, the bill will apply to the federally regulated private sector, such as banks, telecommunications, et cetera, as well as a rather narrow category of interprovincial and international transactions, that is to say where the data itself is the subject of some sort of a commercial trade for consideration. In three years after coming into force, if a province has passed substantially similar legislation that covers the same sorts of organizations as Bill C-6 covers, then, by order of the Governor in Council, the application of Bill C-6 will be lifted from those organizations with respect to intraprovincial transactions. Regardless of whether all of the provinces enact legislation that is substantially similar -- and Bill C-6 does not apply to any intraprovincial transactions other than in the federally regulated private sector -- Bill C-6 will always apply to interprovincial and international transactions.
Senator Beaudoin: The jurisprudence is very clear-cut that intraprovincial commerce is provincial and that interprovincial and international commerce is federal. Does this mean that if the provinces do not legislate in their field -- that is, intraprovincial commerce -- the Parliament of Canada may do it?
Ms Black: That is correct. This is based on the general branch of the trade and commerce and it meets the five tests as enunciated by the Supreme Court in 1989, in General Motors v. City National Leasing.
Senator Beaudoin: That is fantastic. You mean that if the provinces do not legislate in their intraprovincial trade and commerce area, the federal authority may do so because the provinces do not legislate? The General Motors case is very clear-cut. I agree entirely with what the Supreme Court said in that case. We have the intra- and extra-provincial trade and commerce, and we have the general trade. The general trade is a federal responsibility. I do not have any problem with that. In fact, I agree entirely. However, how can you reach the conclusion that, if a province does not legislate in the intraprovincial domain of commerce, the federal authority may apply its own law in that field?
Ms Black: I realize that I am debating here with a noted legal scholar.
Senator Beaudoin: I am merely raising a question.
Ms Black: Yes, but I am not a constitutional expert. The advice that we have is that the General Motors case established the principle that, where a general regulatory scheme is subject to an oversight that regulates trade as a whole rather than a sector, the provinces, jointly and severally, cannot act. That is to say, it meets that test. Furthermore, a failure to include one or more provinces would jeopardize the operation of the scheme and you would have a legitimate exercise of the general branch of the trade and commerce power.
Senator Beaudoin: I will wait to hear from officials from the Department of Justice.
Ms Black: I think we will all be waiting for the courts. I speak for the Department of Justice and I am relying on the advice of the Department of Justice. That advice was also reviewed in this bill in its earlier version, as tabled in the other place. It was also reviewed by Professor Peter Hogg. In his opinion, it meets the test.
Senator Beaudoin: That is an excellent opinion. I will return to this matter. This is a very interesting bill. Obviously, the division of powers is at the very centre of the bill, as are sections 7 and 8 of the Canadian Charter of Rights. We cannot avoid the constitutional question because it is a masterpiece, in a way.
This is why I hope we will hear from some very independent experts on this later on in our hearings.
To begin with, obviously there is a division of powers. In the field of intraprovincial trade, it is a provincial responsibility. We all agree with that; there is no problem there. However, you said that, if the provinces do not agree or do not legislate, after three years the federal authority may occupy the field. That is an interesting argument. However, I should like to think more about it.
[Translation]
Senator Gill: This is a nice bill for those involved. I do not wish to comment, but in our type of society, we are overregulating. This is additional work, it is complex and so on.
In the application section, under Part 1, I read that this does not apply to any government institution in which the Privacy Act applies. Therefore, it does not apply to the federal government but it applies to institutions that come under federal jurisdiction or are regulated by the federal government?
I am specifically speaking about Native communities. Of course, they are under federal jurisdiction. I wonder how the process would apply to some fields of activities, education, social services and so on, which usually fall under the jurisdiction of provincial governments. Would it apply to Native communities? Is it the same application as in the case of the federal government?
[English]
Ms Black: As a law of general application, yes, it would apply to commercial activities on a reserve. If I understand your question correctly, that is the answer.
[Translation]
Senator Gill: In fact, what you are saying is that it would not apply. The Privacy Act applies to the federal government. The reserve is a delegation of power or management from the federal government. So which one applies?
[English]
Ms Black: The Privacy Act applies to government institutions and to agencies and agents of the Crown. Those are all listed. If you are not listed in the schedules to the Privacy Act, you are not covered. As far as I am aware, there are no aboriginal institutions or anything listed in the schedules to the Privacy Act; they are not covered by the Privacy Act. This is a law of general application that would apply, as with those similar laws, to commercial activities involving the collection, use and disclosure of personal information.
[Translation]
Senator Gill: In fact, this will have to be dealt with another time. I am not really satisfied because it is a complex issue and there are a lot of question marks regarding the management of communities. It is often said that they fall under the provincial or federal jurisdiction. We might have a discussion on some aspects of their administration elsewhere, another time.
[English]
Senator Murray: I have two points before I get to some questions on the health care sector. First, concerning Senator Beaudoin's point, I come at this from an entirely different perspective, unencumbered as I am by any legal training whatsoever. I wonder why you stop where you are in terms of commercial activity, given the impossibility, about which we have some testimony, of disentangling "commercial" and "non-commercial". Under the commerce power, could you not have properly gone farther than you have gone in this?
You may be interested to know that we will have two witnesses here at a later time -- one of whom is Mr. Tassé -- so that we will have an opportunity to explore those questions.
I read somewhere in my research that the government had indicated that, even concerning those parts of the bill that applied purely within the federal jurisdiction, it would not proclaim for a year. Is that true? The minister gave that undertaking, did he?
Ms Black: That is true, yes. The law is brought into force by an order of the Governor in Council on the recommendation of the minister, and the minister has undertaken that it would be approximately one year before it would be brought into force.
Senator Murray: Yes, and it would be three years from that date before it would apply to those provinces that had not legislated.
Ms Black: The three-year clock starts running when it comes into force. Essentially, it is more like four years.
Senator Murray: For the provinces.
Ms Black: Exactly.
Senator Murray: Thank you.
Respecting health care issues, the first issue is the impossibility, testified to by virtually all of the people in the health care sector -- whether they feel this bill is too strong or too weak or they want an exemption or they want amendments -- that it is impracticable at best and impossible at worst. It is illogical, senseless and ludicrous, is one of the phrases from the Heenan Blaikie legal opinion, to try to separate out in the health care sector commercial from non-commercial activity.
Without going into it too much, let me just refer to the illustration given by the Canadian Health Care Association and the legal opinion they received from Heenan Blaikie. For example, an older patient is hospitalized for hip injury. He opts for a single room covered by his private insurance. His physician orders X-rays from the hospital, orders blood work from a commercial laboratory, and prescribes painkillers. The patient's wife has his prescription filled at the hospital pharmacy on the first floor. After leaving the hospital, the patient undergoes three months of physiotherapy at a health clinic near his home. He is assessed by an occupational therapist sent by his private insurance company. At his most recent visit to his family doctor's office, the doctor, a private practitioner, recommends and arranges for the services of a home care nurse. Eventually the patient's situation worsens and he is placed in a nursing home. A physician specializing in geriatric care seeks access to the patient's medical records for the purpose of a research project funded by a pharmaceutical company to be carried out in the hospital where the patient had originally been hospitalized. The patient's health information is transferred to the government for the planning and management of health care delivery in the province.
The lawyers say that it is difficult to conceive how commercial and non-commercial activities in the above hypothesis could be neatly separated in any meaningful way and how different legal requirements respecting the collection, use and disclosure of personal information could be imposed in each case. They say that obtaining the appropriate consent required in each instance, whether express or implied, whether specific at every stage or sufficiently broad to cover multiple uses and/or disclosures, would, alone, be impracticable to manage. From that, of course, they argue for an exemption for the whole health care system, and I have already indicated, and I think there is a general feeling around here, that we are opposed to that.
The CMA makes much the same point about the entanglement. I might as well put this on the record as well and give you an opportunity to reply to the whole thing. They talk about the difficulty of delineating what activity is considered health care and what activity is considered commercial. Then they ask about the movement of health information from the health care setting. This is much of what I read from Heenan Blaikie. The CMA says that recognizing that this is not easily distinguished from the commercial setting, for example, health information provided to insurance companies when health information is collected in a health care setting and transferred to a commercial setting, which rules apply, Bill C-54 or no rules? In CMA's view, there is no clear way of distinguishing commercial activity from health care activity in a way that ensures that the health care record is subject to different rules than those pertaining to other records. Moreover, the dilemma for the government is that, even if such a distinction could occur, it would be desirable that health care records be subject to no rules. Put in another way, will those organizations that currently collect health care information be entitled to claim that, since the information forms part of the health record, they are not subject to the provisions of Bill C-54, as it was then?
Let me leave that with you and ask for your response. We will be hearing from these people in due course, but I think we should hear what you have to say about that.
Mr. Binder: I will turn to Ms Perrin in a moment, as she has read the material and knows some of the arguments. However, we are happy to hear that you subscribe to the idea that, just because it is difficult, it does not mean that we should not be able to find a way of dealing with the most sensitive personal information that Canadians relate in a health application.
Senator Murray: Yes, of course. That was my point.
Ms Perrin: Further to that point and the example that you mentioned -- we tend to call them "train wreck scenarios" -- it is possible in all of the sectors to find incredibly complex flows of data. In the health care sector, the questions that seem to be asked are: Is it commercial? Is it not? Is it covered by the bill? I think the better questions are: Is it personal information? Does it deserve protection? What is protecting it right now? In the health care area, there is surprisingly little data protection out there.
We look at Bill C-6 as a bill of broad general application. It is a floor, not a ceiling. We do not see that inherently having a set of rules in place, a set of fair information practices, will stop the train and cause all this chaos. It could if you focus all of your time attempting to be a constitutional lawyer, determining which activity is commercial and which is not. It is interesting to ask in that example what data is being sold and what data is being transferred outside of the health care situation.
Senator Murray: It is fairly clear, I think. There would be personal data, one assumes, in that example. Some of it would be going to a commercial pharmacist and some of it would be going possibly to a home care nurse, and some of it elsewhere. You heard the example.
Ms Perrin: The data is being moved around for the purposes of giving care to that patient. When a patient enters the system, he or she is probably entering it in an area under provincial jurisdiction upon arrival at the hospital. There is a consent there to get patient care and to furnish information for those purposes. That consent is not explicit in most scenarios in Canada at the moment, and this bill obviously would not apply in the hospital. Not only that, the bill does not require explicit, express consent in all situations. It does urge for more transparency.
When you get to the commercial organizations such as the laboratory or the pharmacy, yes, there are other obligations on pharmacists that are provincially regulated, and they have a duty of confidentiality. However, in very few provinces are they actually subject to data protection legislation. There is a fundamental distinction between a duty of confidentiality and being subject to a privacy act that has the broader set of principles and the fair information practices. That is a distinction.
We do not accept that there will be a huge kerfuffle when the patient's wife shows up at the pharmacy to get the prescription. There is an implied consent there. There is a consent for purposes. The pharmacy would be under an obligation under this bill to document what they are doing with the information. Most patients would like to know what the pharmacy is doing with the information, and it is not at all clear what they are doing with the information.
However, the notion that has been advanced in many of the briefs that we have seen is that at every step of the way you will have to get an express, signed consent as if you were going in to give away your gallbladder. That is not the case.
If I may make a parallel to the banking scenario, when I agree to have a credit card, I sign a form, the better banks have privacy statements on them, they have a privacy code. I do not need to know where all that data is travelling. When I use it overseas, I expect it to function. I realize the data must travel in order for it to function. I do not need to know that my cheques are cleared with EDS or whatever company is doing that processing. I have consented to its use for those purposes and I do not consent at every interaction in the chain.
We think that the same sort of situation applies for routine use when you enter the health care chain. Medical data is sensitive, but so is financial, I would argue. There may be other junctions where an additional consent would be required. It is certainly true that more transparency and documentation as to where that data is going is necessary, and that would be a change.
However, if the direct marketers, the banks and the telephone companies can meet this bill, why can the medical organizations not? Why can the pharmacies not?
Senator Murray: We will see. I think they would argue, and we will hear from them when they come, that the scenario by the Canadian Health Care Association, which is the organization that represents the hospitals, is not extreme, that it is not really a train wreck situation. What it has to do with is the daily functioning of the system. Anyway, I will let them make that point if they want to when they come here.
You are aware, I am sure, that on the question of consent, the hospital people, if I may call them that, complain that potentially this bill puts too onerous a requirement on them in terms of multiple consent all the way down the line.
The Canadian Medical Association takes the position that there is not enough provision in the bill for explicit consent. This is something that the committee must grapple with.
Senator Fairbairn: I just want to add that I am from Alberta and we are now looking with interest at certain propositions involving a proposal by the premier and his government to insert another step of medical participation in the current system, that is, contracting out to private institutions. The question that arises in my mind is this: Where would privacy of information sit if it were subject to a contracting-out process?
Ms Black: Alberta has just tabled a bill to protect health information. That bill covers a long list of what are called custodians, that is, custodians of health information. It lists all of the current actors in the provincial health care sort of scene, if you will, including pharmacists, nursing homes, the Alberta Cancer Board. It is a fairly extensive list.
I do believe that any privatization of current, publicly delivered health care in any of the provinces will be covered by provincial health legislation. If it is not captured, if it escapes that sort of legislation, then in most cases it would fall under the provisions of this bill as a part of the private system. As it is, the health care system is essentially 70 per cent public and 30 per cent private. This bill affects the private sector part of the health system.
Mr. Binder: I would like to remind everyone that what we are trying to do is create a digital, unified national market. The doomsday scenario is that every province does its own thing and that data is being treated differently in every province. This will not create an electronic market that will allow us to address jobs, growth, and the economic dimension of all of this. Our aim is harmonization across the whole country. This bill allows every province to determine how they wish to manage health. If Alberta decides to privatize health care and institute some form of database management, then that is fine with us. The whole idea here is that Canadians must trust in the personal information.
Senator Murray: You will end up with a patchwork, Mr. Binder. If three or four provinces decide to legislate and to apply fairly tough standards in this field and four, five or six do not, then they will be governed by this bill.
Mr. Binder: Which is a floor of a minimum standard.
Senator Murray: Which touches only commercial, whatever that is, aspects of health care, right?
Mr. Binder: Right. That is the point. That is exactly our focus, commercial activities.
Senator Murray: Why do you not persuade Ms Black that the thing to do is have a federal law in this matter?
Senator Fairbairn: Just to enlighten me, my friend Senator Murray has slipped me an article that appeared a couple of days ago in the Calgary Herald in which this very issue is being raised. According to this particular piece, which would seem to be almost an editorial, there are no laws stopping such health agencies as private hospitals from broadly sharing patient medical files.
There is nothing more closely held in an individual's life than privacy in medical files. If in fact there will be differences in the way that various parts of this country deal with something like this, then that should be uppermost in the minds of those who are concerned with this legislation and beyond.
Mr. Binder: We are hoping that, by passing this bill and the code, there would be consumer pressure on all governments to adhere to something very similar.
It took a long time, but the same thing happened with respect to privacy. The federal government was the first to pass privacy legislation; the provinces followed thereafter.
As I said before, this proposed legislation is only a base; it is a minimally acceptable standard, as far as we are concerned. Each province is free to apply higher standards, and hopefully they will. We believe that provinces will apply higher standards because as consumers become more aware of the digital on-line commerce they will demand such protection of personal information.
Senator Fairbairn: I hope you are right.
Senator Murray: I hope we will have the officials, perhaps even the Minister of Health, here before we have finished with this bill. In the meantime, may I ask whether you are familiar with the Advisory Council on Health Infostructure?
Mr. Binder: Yes, we are.
Senator Murray: In their final report, chapter 5, they make two points that I would simply like to place before you. First they say that, within the legislation, there should be a transparent definition for "custodians" or "trustees" of personal health information -- the persons responsible for ensuring the protection, confidentiality and security of personal health information -- and that their obligations should be precisely defined. They also say that they should apply equally to public- and private-sector organizations as well as to organizations acting as an agent or contractor for the custodian, and that the definition of "guardians" and their obligations should be clearly set down in the legislation. This legislation does not do that, does it?
Ms Perrin: No, actually, it does not. I think it is fair to say that those remarks are addressed to provinces, whose responsibility primarily it is to legislate in this field. It is a sad thing that most of them have not. That guidance is targeted at the provincial seat of power.
Senator Murray: They call on the federal minister to take the lead in encouraging an accord among provincial, territorial and federal governments to harmonize the approaches in their respective jurisdictions. I cannot ask you, but I will ask them when they get here, whether that has been done. Instead of that, we have the bill.
Ms Perrin: I do not wish to speak for them, but they are actively working with the provinces on a federal-provincial accord as to what those standards are. In fact, I believe they have accepted the CSA standard as the basis for fair information practices. How you actually implement a specific sectoral bill on health information is quite different from our goal in setting a broad set of fair information practices. The fair information practices can be the same but the scope and the definitions necessarily are different.
Senator Murray: That is an important point, even for us, and for our future consideration of this bill. Let me give you another comment they make, and then I will close. They say that the legislation should also contain a clear prohibition against all secondary commercial use of personal health information. This bill does not do that, does it?
Ms Perrin: I think it does achieve that, yes.
Senator Murray: A prohibition?
Ms Perrin: Yes. You must get the consent of the individual. We do not prohibit, if the individual consents to those further purposes. However, the bill forces an organization to obtain the consent of the individual, to document their purposes and their information flows. It allows the individual to get access so that they can then complain and can take a complaint to the Privacy Commissioner and then to the Federal Court. Therefore, I think we have actually looked after that end.
If I might respond to your further comments on consent and the debate on both sides of whether we have strong enough consent provisions in here. At the risk of sounding like Goldilocks, when one side is saying that we are too onerous and will stop health care and the other side is saying that it is nowhere near strong enough and does not do the job, that tells us that we are right in the middle.
Senator Murray: Yes, that is what we always say.
Senator Callbeck: I wish to return to the question I asked before about universities. You indicated that certain data would be under the federal legislation provided the province does not legislate. Would student records be under this legislation?
Ms Black: No, they would not.
Senator Callbeck: So the fact that a student pays for education does not make it a commercial activity?
Ms Black: That is not a commercial activity. If the university undertook, for example, to sell all their student records to Visa, that would be a commercial activity. The fundamental assumption is that universities are not engaged in a commercial activity.
Senator Callbeck: What about private business? We see private businesses setting up everywhere, such as, for example, computer colleges.
Ms Black: That is commercial.
Senator Callbeck: So there is a double standard here.
Ms Black: In a sense.
The Deputy Chairman: I thank the witnesses for appearing. It was a very lively and informative discussion.
The committee adjourned.