Proceedings of the Standing Senate Committee on
Social Affairs,
Science and Technology
Issue 4 - Evidence
OTTAWA, Wednesday, December 1, 1999
The Standing Senate Committee on Social Affairs, Science and Technology, to which was referred the subject matter of Bill C-6, to support and promote electronic commerce by protecting personal information that is collected, used or disclosed in certain circumstances, by providing for the use of electronic means to communicate or record information or transactions and by amending the Canada Evidence Act, the Statutory Instruments Act and the Statute Revision Act, met this day at 3:37 p.m. to give consideration to the subject matter of the bill.
Senator Michael Kirby (Chairman) in the Chair.
[English]
The Chairman: Honourable senators, we are here for another afternoon of hearings on Bill C-6. We have two sets of witnesses this afternoon. Our first panel consists of Valerie Steeves, Director of the Technology Project, Centre for Law and Social Change, Carleton University, and Mr. Ian Lawson, a lawyer from British Columbia. Ms Steeves and Mr. Lawson are regarded in their communities as experts on privacy issues. Following their presentation, our final witness will be Mr. Bruce Phillips, Privacy Commissioner of Canada.
Thank you for coming. Please proceed.
Ms Valerie Steeves, Director of the Technology Project, Centre for Law and Social Change, Carleton University: In 1997, it was my privilege to take part in the public consultation on privacy rights undertaken by the Standing Committee on Human Rights and the Status of Persons with Disabilities. In addition, I also participated in the Privacy Forum, which was an on-line Web site created by public interest and consumer groups to solicit Canadian views on the discussion paper that preceded what was then known as Bill C-54.
Public consultations make it quite clear that Canadians see privacy as a human right and as a fundamental social value. They expect their government to take a leadership role in protecting privacy in the information age.
I would suggest that Bill C-6 is an important part of the privacy puzzle. It establishes what we see as the baseline of privacy protection -- namely, that information can only be collected with the individual's consent, and the purposes for which the collection is made must be reasonable and appropriate. It also gives the privacy commissioner a strong ombudsman role and a mandate for public education.
These are important victories. However, on the other hand, Bill C-6 is not a perfect bill. Its imperfections reflect the fact that it is a consensus-driven document. The bill has the support of private sector leaders, consumer groups, civil libertarians and privacy advocates. That in itself is a remarkable achievement. It might not be the bill that any of us would have drafted, but it is one that each of us can live with.
It is also crucial to remember that Bill C-6 is e-commerce legislation, not privacy legislation per se.
I understand that my colleagues from the Canadian Medical Association have indicated to you that health information as a whole requires stronger protections. I wholeheartedly support that position.
I would suggest, however, that the pharmaceutical lobby has made it quite clear that health information is also an extremely valuable commodity, and one that is traded for commercial gain. Bill C-6 quite properly captures some health information because the health care industry is an industry.
I have grave concerns about delaying the passage of Bill C-6 to enable one stakeholder to have a second kick at the can.
The health information debate is far from over. I personally consider that it will be the most important battle that privacy advocates face in the next five years. Bill C-6 may not be the appropriate place to resolve these issues, and there are two reasons for that.
First, as the standing committee recommended in its final report, privacy protection requires two kinds of legislation. The first is an umbrella piece of legislation that would articulate broad principals of privacy rights. The second involves specific pieces of legislation that are designed to deal with sectoral issues and concerns.
Bill C-6 is not a definitive statement of privacy rights. It is one of the smaller pieces of a puzzle that is designed to deal with the commercial exploitation of personal information.
Second, public consultations have made it abundantly clear that consent is the absolute baseline that Canadians expect when it comes to protecting their privacy in general. They demand higher standards of protection for their health information.
Bill C-6 helps us in that battle in two ways. It establishes the baseline, and it does not hamper the provinces in exercising their jurisdiction. In addition, it does not impede organizations like the Canadian Medical Association from articulating standards that would apply in the field of health care.
As the Province of Quebec has shown, taking leadership in this area -- as Bill C-6 is doing -- encourages other jurisdictions to follow suit.
For those reasons, I come before you in support of the bill. Those are my opening comments. I look forward to discussing the matter with you further.
Mr. Ian Lawson: I am a lawyer in private practice. For the past eight years I have done a fair amount of work in the area of privacy protection in the private sector. It is an area in which I am particularly interested, and it is where I have focussed most of my work.
In 1992, I had the opportunity to look at what could be done for individuals who were concerned about invasion of privacy in the private sector, in the business world. It was an easy conclusion to make that there was little legislation -- in fact, almost none -- that would be of assistance.
I did some work and came up with a fairly major study of how to use the common law to protect privacy in the absence of any others tools to do so. That was seven years ago.
In 1995, I was very fortunate to be involved in the preparation of one of the first studies of how to design a regulatory regime to govern protecting privacy on the information highway. I did that for the Information Highway Advisory Council.
Having done that work, I know that it is very difficult to design a regulatory scheme to afford adequate protection in the age of electronic commerce. It requires a creative and unique approach, because the problems that we are dealing with are unique, and they have never before really been considered from a legislative perspective.
It is my view that Bill C-6 is indeed a creative and fairly unique solution to this new and difficult problem. I am here to speak in favour of passing it in its current form.
I will make three points in the remaining time. First, it is an understatement to say that there will obviously be a constitutional challenge to this legislation. The constitutional issue is alive.
It was my view in 1995 -- and it is still my view today -- that the federal government has ample jurisdiction to enact this legislation. The bill that we are considering deals with protection of privacy in a domain that is, by its very nature, beyond provincial boundaries.
The commerce that is facilitated by Part 2 of this bill is innately transprovincial and transnational in nature, and that is why the bill must proceed in its current form. There was some discussion at some point about separating Part 1 from Part 2. In my view, that is definitely not a recommended step.
The two parts cannot be separated, because the constitutional foundation for Part 1, the privacy protection, is found in the new regime for facilitating electronic commerce and the creating of enforceable and provable documents under the Canada Evidence Act. Part 2 is one of the first steps in building a proper information infrastructure for Canada.
The protection of privacy in this new world of commerce is an absolutely essential element of our national information infrastructure. In that light, I agree with what Ms Steeves has said. Bill C-6 is not a privacy law. It is a law that governs the conduct of business in the new electronic marketplace.
When the Americans were building their national information infrastructure many years ago, they accepted that some form of privacy protection must be built in when designing this new world of commerce.
The fact that the privacy part of this bill is coming from Industry Canada is not surprising, because it is an industry concern. It is not necessarily a privacy-oriented part, but I expect that Industry Canada's concern would be that our electronic marketplace would be gravely weakened without built-in privacy protection.
The United States has had a highly developed system of privacy protection under tort law for about a century. Privacy has been recognized as a constitutional right there. Under the civil code in Quebec, matters of human dignity have received similar protection for nearly as long. Of course, Quebec was the first province to address the protection of privacy in the private sector.
The remainder of Canada, for the most part, is basically a lawless frontier when it comes to controlling the commercial use of personal information.
I am sure you all have had witnesses remind you about the European Community directive that came out in 1995. That again is a real concern for building privacy protection into our information infrastructure. As we all know, the directive says that member states shall not engage in commerce and provide personal information to other countries unless that country affords an adequate level of privacy protection for that personal information.
It has been four years since that directive. Unless we have Bill C-6 on the table and passed, Canada will be completely unable to demonstrate an adequate level of privacy protection.
With Bill C-6, Canada can play a leadership role on the international stage in the design of effective private-sector privacy legislation, and that is because it incorporates the CSA code. The CSA process, as you may know, commenced with working on the Quebec statute by brokering a set of rules and development with business interests. The CSA code has been developed, and it has been accepted by the private sector.
The advantage of having the CSA code incorporated into this legislation is that there should not be a need for a massive legislative scheme to control data users -- that is, to force compliance, as there is in most of the European countries. I say that because education is really the only effective way to handle the mammoth size and scope of private sector use of personal information. Fostering good business practice is the key to ensuring privacy is respected in the world of electronic commerce. That is why I am supporting this bill today.
The Chairman: Before turning to questions, I wonder if I could ask Ms Steeves a question. I would also like to hear your comments, Mr. Lawson, although you did not comment directly on the health care issue.
Ms Steeves, you said that privacy and health care will be the major issue in the coming years because Canadians want a higher standard to be applied to health care. Second, both of you have said that this is an e-commerce bill, not a privacy bill, and in large measure the health care issues are privacy issues, not e-commerce issues.
Third, Ms Steeves, you said that you would not want this bill delayed to give the health care people "a second kick at the can". Suppose that the whole bill went into effect, other than its application to the health care sector. Therefore, the e-commerce part would be there, but not with the notion of giving health care a second kick at the can.
You stated that the health care situation is different from other situations. If we were to put a very tight time frame on those differences, the only way to do that is to leave in a position that the bill will go into effect on health care unless the tight time frame expires. You must put pressure on people to agree.
Propositions in that general vicinity have been advanced to us by a number of witnesses, and also by a number of my colleagues around the table. Where do the two of you stand on ideas like that?
Ms Steeves: Perhaps I could clarify one thing. I did not mean to leave you with the impression that health care is not necessarily an e-commerce issue. In fact, I believe that the pharmaceutical lobby has made it quite clear that this is a commodity. It does have other applications in our lives, but it is true that health information is being treated as a commodity.
In many ways I have a great deal of difficulty with what you are proposing. It seems to me that if the industry that deals with this health information is profiting from the trade and sale of it, they have made it a commodity and it should fall under the same rubric as other commodities. At the same time, however, this bill is not intended to deal with all health information issues. It is restricting its application to the commercial activity which occurs when people trade, sell and exchange health information as a commodity.
The benefits to leaving health information in this bill are many. First, it provides a baseline. Consent is the lowest we can go on this. Canadians are quite clear that with health information they need more consent. As a privacy advocate, my job is much easier when I undertake this debate with the health care sector to argue for a higher standard when we know that we have the baseline in place. Strategically, having Bill C-6 in place raises the bar to a certain extent.
Another concern I have with delaying the legislation is that there is some confusion over the issues. I do not know how you feel about this, but one thing I found really fascinating is that I am having trouble finding out what these commercial entities are doing with my health information. The thing about Bill C-6 is that it allows for a certain level of transparency, because you need to ask. Right now, I believe that a number of the pharmaceutical companies and the pharmacists themselves are basically saying that they are doing this for our good, this is for public policy and for a health care system which is important to our social fabric, so do not even ask us what we are doing with this. Just trust us.
Bill C-6 gives us a certain inroad in that we suddenly have an opportunity to see what is happening; that reciprocity, that openness, that transparency has not been there. It has been extremely difficult, sitting on the other side of the table, to come up with counter-arguments when you are not even allowed to find out how the information is being used.
I am also concerned about the delay because we have a precedent in Ontario for allowing that delay to, in effect, kill the issue. I understand from people who were involved in the provincial privacy legislation process back in 1978 that hospitals made a very similar argument. That is, they argued that health information is unique and should be traded separately, and that we should look at it in more depth and be more careful and cautious in making sure we have appropriate standards.
I called the Ontario Privacy Commissioner's office today. They advised me that hospitals are still not covered in Ontario, and that was 1978 to now. I believe what you probably heard from a number of privacy advocates is a concern that a delay will mean that there will be no protection.
Where I differ from my colleagues at the Canadian Medical Association -- and again, we are on the same team, we do not have a lot of disagreements in this area -- is that, if Bill C-6 is passed, there is nothing that stops the provinces from legislating in their jurisdiction. There is nothing that stops the CMA from sitting down with their membership and saying, "Hey, let us take this issue seriously," and forwarding the improvement of privacy standards in the health care field. Once Bill C-6 is passed that is an easier argument to make.
Again, as I said, you have that baseline. I would be quite concerned to see health information carved out in any way; either with the expectation that we will have lower standards or with the expectation that that will bring higher standards.
My final comment in response to your question is, as a touchstone, to return to the standing committee's report. I believe that that is the most comprehensive and appropriate legislative plan for privacy, not for E-commerce or the health industry, but for privacy as a whole. It is essential that we articulate fundamental principles in some overarching piece of legislation, but that is missing at present.
Bill C-6 is an important piece of the puzzle. It deals with commerce activities, and it addresses a real need. Passing it does not mean that we are no longer able to look at health information. My concern is that if health information is somehow caught under the Bill C-6 umbrella completely, or that if there is this second kick at the can, we will lose the opportunity we now have to recognize that, if health information is being traded and sold, it is a commodity and it should be treated as one. When health information is within the health care industry as a whole then we must look at broader interests. Public policy arguments will then have more relevance to the debate.
Mr. Lawson: I do not disagree that there may be a battle. There is certainly a great interest in the health community. I have read through the proceedings so far. This afternoon I picked up IMS Health's brief, which was given to you. I am puzzled and I am wondering whether the battle is happening for the wrong reasons. I am not blaming anyone, however, I look at the third paragraph of IMS Health's executive summary and it says:
IMS Health never obtains or collects patient identifiers from any of its data sources.
This bill defines personal information as information about identifiable individuals.
The Chairman: I can probably help you. I think it is fair to say that under questioning from this committee, the IMA argument was destroyed.
Mr. Lawson: I am glad to hear that.
The Chairman: It was quite a different issue, however, with respect to the doctors.
Senator Murray: The point is that they do not collect information about patients but they do collect information about doctors.Doctors are identifiable individuals.
The Chairman: The CMA argued quite strongly that, because this bill is weaker than their code, it would send the wrong signal. The puzzling situation for this committee is that most of us are used to situations where representatives from various industry segments will come here and say that they do not like a bill.
In this particular case, however, two things are unique. First, there is only one industry segment that is complaining at all. Everyone else is describing it as "a good balance, a delicate balance, a reasonable way to proceed", and so on. Only one industry segment is concerned, and even they are fragmented. Half of them are arguing that it does not go far enough and, therefore, it should not be passed in its current form; the other half argue that it goes too far and should not be passed. That is a very unusual situation for many of us who have looked at business-oriented legislation around here for a long time.
Senator Murray: I wish to have a clarification or elaboration on what you just said about the health care sector. I think it would be fair to say that the professionals -- the doctors, dentists, and others -- are on one side, and they want they bill strengthened. Indeed, the doctors want their code appended to the bill, suitably modified, to give it the force of law for the entire health care sector. The dentists are with them. The others, however, are more on the commercial side, except for the hospitals. They agree with the doctors and the dentists on the impracticability of trying to disentangle commercial from non-commercial, but their position is that the consent provisions are too onerous for their businesses.
I have a couple of quick questions and then I want to have a word with Mr. Lawson about the bill or about the two bills that are contained in one.
Do you support the provision of this bill that allows for the collection of personal information without the knowledge or consent of the individual if the collection is solely for journalistic, artistic or literary purposes? Do you support it in that form?
Ms Steeves: The language is, perhaps, difficult, but it is my understanding that it mirrors what is contained in the European Union legislation dealing with that issue. Clearly, it is an attempt to deal with the Section 2 provisions under the Charter giving freedom of expression, freedom of the press, and so on.
Senator Murray: Would you support the entrenchment of the right to privacy in the Canadian Charter of Rights and Freedoms?
Ms Steeves: Oh, yes. If you could do that for me, it would be a good Christmas present.
Senator Murray: We cannot do it for Christmas.
The Chairman: I would like to have the witnesses answer your first question rather than slide off it. You stated that they were in the Charter, and I understand that. However, that does not tell me whether or not you agree with it. The question Senator Murray had is: Are you happy with that clause; are you prepared to support it?
Ms Steeves: Yes, I am. It is necessary, because of the Charter, to use the language that is used in the European context. There are also other legal protections in place, namely through tort law, which allow us to effect the appropriate balance between that kind of expression and privacy.
Senator Murray: If the Canadian Charter of Rights and Freedoms had a provision that put privacy on the same basis as the rights that appertain to freedom of the press, freedom of expression, and so on, it would not have been necessary to exempt journalists from this bill. Do you agree with that? Journalists are exempt in here because people felt that if they were not exempt, a case would arise where someone would plead that his or her rights to privacy had been infringed. There would then be a case, and that journalist would successfully plead that he or she was protected by the right to freedom of expression in the Charter.
Ms Steeves: Even if it were contained in the Charter, we would still have to include some form of provision that makes that clear, because we are balancing Charter rights against each other.
Senator Murray: Exactly. The right to privacy would be there on the same basis as the right to freedom of expression. In a given case, someone would have to decide where the balance lay, is that not the case?
Ms Steeves: Yes. The courts would do that. In fact, they will continue to do so under this legislation.
Mr. Lawson: Enshrining a right to privacy in the Charter would be a wonderful event, but it would only cover government activity. It would not handle any of the stuff that is behind this bill.
Senator Murray: What do you mean? If this bill went through and did not exempt journalists, and a case arose in which someone claimed that his privacy had been infringed by a journalist but the courts found in favour of the complainant under this law, then the journalists would presumably appeal on the grounds that they were protected under the Charter.
Mr. Lawson: For what it is worth, the remedy that would be available under the Charter would not be applicable to a private sector actor such as a journalist.
Senator Murray: The journalists would claim that this law was unconstitutional, would they not -- that is, unless they were exempted from it? They would invite the court to read in to this law an exemption for journalists, would they not?
Mr. Lawson: They could argue that. From my perspective, I am not troubled greatly at all, and the bill as it is currently written is acceptable to me.
Senator Murray: All right. Let me ask you both, then, to try to give me a principled defence of the provision that allows personal information collected for commercial purposes to be disclosed 20 years after I die -- that is, if it is about me.
Mr. Lawson: I may live to regret saying this, but the right of privacy is usually assigned to a living person. I am speaking about how we consider the interests at stake. In fact, when it comes to litigating and to enforcing rights of privacy, I wonder whether it would be possible at all for a person's interest to be at stake if that person is deceased.
Senator Murray: I appreciate your opinion. I hope everyone heard it. Perhaps we should do something about that. What about you, Ms Steeves?
Ms Steeves: Ultimately, the interest we are trying to protect is one of autonomy. I differ with Mr. Lawson in this regard. There are all sorts of ramifications for the survivors of that individual as well. However, the sensitivity of personal information declines over time. There is another issue that must be addressed, namely, access to the public domain. That is from a historical point of view.
Senator Murray: That is another issue entirely. I think it is covered in other laws, which I would like to get my hands on some day, too. This relates to your credit card information, Ms Steeves, and information about your mortgage, or whatever personal information may have been collected about you or me or any of us.
Ms Steeves: One of the things that is different about this too, and I agree with you, is the that now there is so much information about us. Ten or 20 years ago there was much less information that could survive us.
It is a question of an appropriate time limit. I am not uncomfortable with a time limit, and it may be that 20 years is not an appropriate time limit. Those issues are being examined in connection with the census, for example. I would suggest that, because a five-year review is built into this legislation, the time limit might need to be revisited. However, I am not uncomfortable with a time limit.
Senator Murray: Do you not think that commercial organizations that are collecting personal information about you or me ought to be obliged to destroy it after a certain amount of time? Why should they ever be able to disclose it? The possible justifications having to do with investigation of crimes and so on are in the bill, but what possible public interest is there in ever disclosing personal information about you that your bank or credit card company has collected?
The Chairman: Given your comments on the health issue, why should a journalist who wants to write your biography 20 years hence have access to information obtained by a private medical lab as a result of a test? Truthfully, the best argument is the archival argument, because there is continuity from a historical point of view. To address your concerns, that is dealt with under another section of the bill.
Senator Murray: That may be a bit too generous, but we will leave it at that. I have great concerns about this. We will address the issue with the Privacy Commissioner.
Mr. Lawson, you did wade into this rather arcane area of parliamentary practice and tradition, and it has yet to be decided if this constitutes one bill or two bills. Leaving aside the testimony that ministers and others have given on that point, you have stated that, in terms of the government's commerce power, there is a constitutional link between one part of the bill and another. I am not going to ask you to go into that. I did not quite understand it or follow it, but we will leave that aside. We will have a chance to look at it in black and white at a later time.
I do not know whether your argument would help or hinder the government if it ever faced a constitutional challenge under this law. Be that as it may, what you have offered is a constitutional justification for something which, in parliamentary terms, is quite irregular. I am certain that those who are trying to put their best foot forward to defend this irregularity had not thought of that. They will be pleased that you have, and they will use the argument. We will see where it leads us.
Tell me, what would you say is the principle of this bill?
Mr. Lawson: The principle of the bill is to design a playing field for people engaged in electronic commerce. There are rules of the game that are critical and absolutely essential to that effort. They are set out in Part 2. Part 1 is equally essential to that playing field. If we do not have Part 1, we are making a grave mistake, because that playing field is not going to work if privacy protection is not built into it.
Senator Murray: Part 1 relates to personal information no matter how it is collected, whether electronically or by other means.
Mr. Lawson: That is why I am so concerned that Part 1 be tied to Part 2. We have federal legislation addressing protection of the privacy of personal information precisely because of the way it is dealt with on the information highway. That is the source of the federal jurisdiction. As you will hear from the constitutional experts, there is not a lot of room for federal legislation on privacy issues that are separated from the world of commerce. We have personal information flying from here to Seattle and to Tokyo and back again in the course of a transaction. That is what the bill is designed to cover.
Senator Murray: Parts 2 to 5, the e-commerce portion, deal with the ability of citizens to conduct their business with the federal government and its agencies through electronic means and the ability of the judicial system, broadly understood, to take documentation by electronic means. Surely that is incontestably within federal jurisdiction. Will anybody challenge the bill on the basis of Parts 2 to 5?
Mr. Lawson: The amendments to the Canada Evidence Act are the most significant. They create the playing field that is being designed. These amendments will ensure that you actually have an enforceable contract or a signature that you can rely on. That is not restricted to the federal sector. Those are essential rules of the game. I would agree that part of it deals directly with federal contact but it is the playing field that is in Part 2.
Senator Murray: Are you suggesting that if there were two bills, one or the other of the bills would be more vulnerable to a challenge under the division of powers?
Mr. Lawson: If Part 1 were passed by itself it would be extremely vulnerable in my view. The only reason we have it is in order to connect to the undertaking of designing a playing field for electronic commerce. Without that connection, it is pretty tenuous.
Senator Murray: I have not heard that argument before as a justification. The government will be happy that you supplied them with that argument. I will want to try it out on Mr. Tassé. If it is confirmed, I may take another view on the splitting of the bill.
Senator Robertson: What do you see as the biggest threat to privacy in Canada today?
Ms Steeves: There are so many threats, it is a hard question to answer.
Senator Robertson: Canadians are so concerned about privacy, but nobody seems to know what the biggest threat to their privacy is and that is unfortunate. I do not know what the biggest threat to my privacy is.
Mr. Lawson: My recollection is that Mr. Phillips had an excellent answer. I will attribute it to him. The answer is ignorance, especially ignorance in this huge area of commerce. That is the field that brought me into privacy protection in the first place. There is an absence of any rules of the game for the vast amount of commercial activity that takes place. There are no laws covering it and it is unregulated. We could design a huge structure to implement command and controls over the private sector but ignorance really is the biggest threat. With education and the development of a privacy-sensitive mentality, a lot of the problems we are seeing would disappear. That is the value of the CSA process. That is what I was stressing.
Senator Robertson: Canadians generally just do not know.
Mr. Lawson: Canadians are usually the subjects of this use but I am also speaking about ignorance, poor practice and attitudes on the part of businesses that use and gather this information.
Senator Robertson: Therefore there is a major education task ahead of us.
Mr. Lawson: Yes.
Senator Robertson: Yesterday, none of the witnesses who appeared before the committee was supportive of the bill. I got the impression from the deputy minister that he expects a number of amendments to the bill in the years ahead. Is developing privacy legislation so complex and untested that we must develop it in a piecemeal manner?
Mr. Lawson: The CSA process has developed a very useful model for the whole world to follow, and that is the development of rules for industry players to follow that they themselves have designed to fit their particular needs. The health sector is a logical and very distinct group of players on this field, and there is obviously a desire to see some particular rules in place. However, the CSA code is the minimum, and it also illustrates the importance of being able to sit down with industry players and work on some modifications.
Around the world, the code idea is used in several legislative schemes. A couple of countries even have a plan where industry can draft its own scheme and it can be adopted as part of legislation particular to that industry. That is not what we have in this bill, but that might be a way to handle things in the future.
The code of the Canadian Medical Association appears to be quite superior and specific to the needs of that industry. There is no reason why that industry could not carry on with those rules and not be hampered in the least by the Schedule 1 of this bill, which is the starting ground for similar codes.
Senator Robertson: Do you think we could draft a better bill?
Mr. Lawson: Absolutely, but I would not be here advocating the passage of this bill if I thought it was fundamentally flawed. This is unique and creative. It is an idea that I thought would work long ago, and I am very happy to see it in legislation.
Ms Steeves: Rather than the word "piecemeal" I would use the word "sectoral". Part of what we must do is look at particular issues. You asked us to identify the biggest threat to privacy. I think it is the fact that information that other people know about me can be used to discriminate against me and I will not even know about it. If it is learned through my genetic information that I have a weak heart, I may not get a job that I have applied for, and I would not even know why.
It is that potential for discrimination that causes the greatest concern, but it arises from all sorts of different kinds of information. Genetic information is an area that we will have to look at very seriously over the next few years, because the potential for discrimination is phenomenal.
Health information as a whole, commercial activity, on-line marketing techniques, all those types of things are areas that have come to our attention because of emerging practices. Dealing with them one by one in a sectoral approach might make sense. It makes the best sense when you have overarching legislation that says that Canadians have a right to privacy and defines what that right entails.
It would be a better process if we had that legislation in place, but it is also something that we are working towards. Bill C-6 is a step in that direction.
Senator Carstairs: I have a very narrow interest in this bill, in the sense that my gravest concerns are the health care issues. When someone is ill, they are asked to sign a variety of consent forms. They sign whatever is put in front of them. I suggest that 99.9 per cent of patients do not read every single word in those forms. They just want to get pain relief. They want to have surgery, chemotherapy, or whatever is required.
The doctors raised a concern that had an impact on me. They said that this is a bar, as you have both said. It is not a high bar, but a beginning bar. I believe that it was the head of the dental association who said that he was concerned that unscrupulous members of his own profession might say that, since the bar in Bill C-6 is not as high as in their own code of ethics, they need not follow their own code and will be protected by the law of the land.
That causes me concern. I should like to hear your comments on that.
Ms Steeves: My initial reaction is that they are not paying much attention to their code of ethics at this time. We do not have uniform support for the CMA code. I have attended meetings of researchers where they have debated it. I have talked to doctors who are stripping off their patients names and selling their records to drug companies. Therefore, I do not buy that.
Bill C-6 says that, if you are ignoring your own code, this is the very minimum by which you must abide, and that strengthens the position of those who are arguing that we should revisit this and create higher standards for health information.
Mr. Lawson: Bill C-6 is not intended to compete with the industry-specific code that the CMA has developed, which is a marvellous document. Bill C-6 covers the commercial use of personal information about identifiable individuals. If the activity that Ms Steeves described is happening, although it is to be hoped that it is a rare event, enacting this bill would send the message that that activity has to stop, or it has to be controlled. That is a fairly strong message.
With regard to the battle that we talked about earlier, the health sector is concerned, but it is my view that this is the wrong place to raise their concerns. The purpose of this bill is to cover certain specific activities. Their remarks are valuable in considering it, but this is not about designing the perfect health sector code of privacy.
Senator Carstairs: Are you saying better this law than no law at all, and let us work in the future to make this better?
Mr. Lawson: Yes.
Ms Steeves: I believe that that is the general consensus of the privacy community. I have had ongoing discussions with members of the CMA and CDA, and that is the Catch-22, even with Senator Murray's concerns about the 20-year limit. I agree that this is not a perfect bill, but it is better than no bill at all.
Senator Carstairs: I wish to discuss the constitutional issue in a little more detail. With the greatest of respect to Mr. Tassé, he is not the only one with a constitutional opinion in this country. Would you elaborate on your view that Part 1 and Part 2 hang together in a constitutional way?
Mr. Lawson: That is my chief concern. In fact, the view that I expressed before the House of Commons committee was that I wanted more language that connected the two. I am no longer as panicked by it, but I am concerned that the separateness between the two parts is visible. They do not hang together very well. However, all that means is that whenever the constitutional challenge comes, as it certainly will, we will rely heavily on the way that this is presented before the court. We have no power to stop that from happening, because the privacy provision is an integral part of the commerce provision. That is why it is there and I believe that that is how it must be presented.
Senator Carstairs: Did you provide to the committee any suggestions as to how to better connect the two parts?
Mr. Lawson: I suggested that language be added to the preamble that defines the fact that the privacy concern arises from the commercial use of information in the electronic world, in order to make that connection directly. That connection can be made because that is what is happening here, but it does not have to be written. In a way, that demeans the court's ability to figure out what this bill is about. It would be helpful, and that is how I presented it.
That is what this is about. The privacy ingredient to this bill is there because it must be there, because this bill is primarily about building an infrastructure. That is tremendously important, and it is significantly overdue for Canada.
The Chairman: Ms Steeves, in response to questions, you have said a couple of times that it is better to have this bill than no bill at all. It is important to keep in mind that there are other options possible. I do not think anyone around the table would disagree with that statement.
My question is: Is it better to have this bill than an amended bill? If it is amended, what should the amendments be? I am not asking to you respond, but I think you took the two extremes in your response to Senator Carstairs, and I do not know anyone that is in support of doing nothing. Therefore, the real question is: Can you make the bill better? You may wish to think about that while we come up with other questions.
Senator Finestone: Would you say that privacy is a human right?
Ms Steeves: Clearly.
Senator Finestone: I am not asking you if it is inalienable, but you say it is a human right. Would you agree that section 15 of the Canadian Constitution says that privacy rights are equally given to all? Do you agree that all Canadians are expected to be covered under personal information as a privacy right?
Ms Steeves: Under section 15, the equality clause?
Senator Finestone: We were talking about the Constitution and that popped into my head, that we should all be treated equally. Therefore, I presume all citizens of Canada should be treated equally.
Ms Steeves: The Charter right should apply to them equally. Therefore, if privacy were a Charter right, it would apply equally. It is under section 8 as part of protection against unreasonable search and seizure.
Senator Finestone: In light of the fact that personal information is part of privacy rights, let us refer to the bill. Clause 7(3) reads:
For the purposes of clause 4.3 of Schedule 1, and despite the note that accompanies that clause, an organization may collect personal information without the knowledge or consent of the individual only if the disclosure is
(iii) requested for the purpose of administering any law of Canada or a province.
One of the concerns that has been expressed by a number of the members of health service organizations that have appeared before us is that it clearly creates two tiers of privacy.
Here you have a citizen in the public sector, be it hospital or home care, any kind of protective care, who would be exonerated or excluded from any kind of personal information collection of data. If you are in the public sector, you are not protected. Therefore, your protection is better in the public sector under this new clause than in the old clause. Are you familiar with that particular aspect of the bill?
Ms Steeves: I am trying to locate it.
Senator Finestone: I can tell you that Ms Sholzberg-Gray was here. She was one of many who expressed her serious concerns because they are both public and private sector servers. In the public sector you would have no protection, and in the private sector you would be subject to all kinds of concerns that the other health industry has put forward. Is this something that needs to be addressed?
Ms Steeves: Yes, and the place to do it is in an overarching statement of principles or in a sectoral code that deals with health information that allows for some kind of uniformity between jurisdictions.
Senator Finestone: That does not call for an amendment, in your view?
Ms Steeves: I am not sure you can get where you wish to through Bill C-6.
Senator Finestone: Is there a way that you think we could amend the definition of commercial activity so that it would be more inclusive of the health care or the professional sectors which are involved, and of the NGOs as well?
Ms Steeves: The problem I see is constitutional or jurisdictional. The federal government does not direct jurisdiction over much of the health area. Obviously, it will fall into the realm of provincial jurisdiction.
Senator Finestone: You outlined a number of issues, Mr. Lawson. The constitutional issue which you raised was the fact that the domain falls under commerce and that there is ample jurisdiction.
If doctors, dentists, psychiatrists and psychologists, are involved in the delivery of health care in a commercial activity, some of their duties are commercial and some are not. It is very hard to uncork the two or to differentiate between them.
It was made eminently clear that their responsibilities fall under this bill by a clear definition under commercial activity. Would that not make it more effective for the population to understand the full import of this bill?
Mr. Lawson: The easy answer is that it is always helpful to have specific direction in legislation that would help people like physicians. However, I do agree with what Ms Steeves said. That is to say, I do not wish to go down the plank so far as to suggest that we could do that because the federal government can regulate the commercial activities of physicians. Again, this is electronic commerce.
Senator Murray: It is more than that, Mr. Lawson.
Mr. Lawson: It is, because in order to capture the electronic activity, you will also capture the non-electronic activity. The idea of the legislation is to establish some rules of the game. If physicians are engaging in commercial use of identifiable information about their patients, then they have to follow these rules. That is the only way to approach it.
I have sympathy for the physicians. They are obviously concerned that this is not really clear, and that might be an arguable point. That is what I would say about the big constitutional issue.
Senator Murray: You know what they want to do. They want to append their code to the bill and to give it the force of law throughout the health care sector. There are probably constitutional questions there.
Mr. Lawson: As I said, this is not the place to try to do that. I think that should be the answer that is politely given to the physicians. However, to conclude, there are a significant amount of questions. This proposed legislation is no different from many other statutes where there are interested parties who are puzzled how it will impact on them. As you well know, I would say it is not always possible, in legislation, to cover off all those problems. Sometimes you must wait until a conflict is resolved in some other way before you can know where you stand.
Senator Finestone: There is another problem which concerns me. My sense when the deputy minister was here yesterday was that Health Canada had come into the scene a little bit late in the picture. I do not know if those witnesses had a close enough look at this bill in order to offer improvements on time. However, he was quite insistent that we use the OECD model, and you talked about the European Union and the Netherlands perspective. They were not happy with the extent of the privacy cover, and I know that my colleague, Senator Carstairs, said to you the bar is at a certain level and nothing prevents us from using the Hippocratic oath.
Many obligations and codes are imposed upon professionals, and accepted by them. In Holland and in Germany, they found a need to go beyond the European model and the OECD model. In 1997, the Netherlands set up a medical checks act which covers almost every single aspect that concerns us around this table.
Your sense is that we should move forward with this bill and perhaps look at that model. How do we ensure that such a move should be taken? Should we suggest an amendment? You say no. Should we suggest delay? You say no. You are comfortable enough to tell us to go ahead with this and seek improvements as we go along, perhaps in the five-year review process.
Ms Steeves: The opening to address these issues is through the health info structure system. We must deal with Health Canada. Their report makes it clear that privacy is an important value, one which they will seek to develop through consultation with the provinces as they put the health info structure into place. There will be a consultation process. The flaws that I see in the report can be challenged directly through that process.
It is also clear that the different parties involved within the health field need opportunities to consult, to debate, and to reach some form of consensus. That is why I am not uncomfortable with passing Bill C-6 as it is. It probably catches the commercial activity when the commodity is health information, but it does not stop that process from happening. That process is underway. The battle has been engaged to a large extent already.
Senator Finestone: There has been a lot of discussion about "cookies" on the Internet and the not-so-subtle way that they gather information about all of us. Some witnesses have tried to assure us that trust has been established and that, because of that trust, some users will visit their site and will not go to another site. They say we should not worry, but each Internet user has a profile of their viewing habits and shopping habits.
Senator Robertson is concerned about what Canadians know and what we do not know.
When applying for a job today, you may be required have to a medical check-up in order to be signed up for the pension benefit. The medical record is given to the pension insurer. In many cases, there are no fire walls between the insurer or the trust company and the bank. That is where we see tremendous linkage. No one knows who will see that information once it is released to the insurer. If your insurance agent happens to be your brother-in-law, he may see information which you did not want him to know, particularly genetic information.
Is there any way that this bill can stop the sharing of that kind of information?
Ms Steeves: Yes, if information is passed from one organization to another, the bill requires that consent be given. This is a difficult exercise for me, personally, because, to be honest with you, I see the consent provisions as the weakness in this whole mechanism.
Senator Finestone: That is exactly what I wanted to ask you. The word "consent" is very wishy-washy. There is nothing to indicate an informed consent, or a knowledgeable consent, or a consent based on a true understanding of the information given by or to your doctor or pharmacist.
A job applicant is looking for a weekly wage paid in return for good work but can only get that on the condition that a medical check-up is done and the information is forwarded to the pension insurer. Somehow or other along the way, the DNA stuff comes in there as well. There may be genetic problems which show up in the check-up which will impact on the hiring process. No boss wants an insurance premium increase in order to cover a risky employee. There are many implications there.
Informed consent means the knowledge is there. Understanding secondary use is vital, and tertiary use also becomes very important. Would you agree with that?
Ms Steeves: Yes.
Senator Finestone: How should we change the bill to more strongly require informed consent?
Ms Steeves: This is not a perfect bill. It came from a consensus-driven process. Compromises were made by several different parties in order to bring the bill to the table. The political realities are such that informed consent did not fly.
Senator Finestone: So that is what happened.
Senator Callbeck: Mr. Lawson, you were asked about the single biggest threat to privacy, and you indicated that it is ignorance. Under clause 24 of this bill, the federal privacy commissioner has a mandate to develop and conduct information programs to foster public understanding of the privacy provisions of the bill.
Obviously, you feel there is a need for the public to be educated, and for organizations to be educated. Do you have any ideas or opinions as to how the commissioner might go about this?
Mr. Lawson: First, he should do so as aggressively as possible within the budgetary constraints of his office and within the new responsibilities of that office.
In response to Senator Finestone's question, I was thinking of that very thing. If only we could cultivate a population of people who are entirely aware not only of their own rights in the course of divulging personal information, but also of their rights to find out about what their employer is doing with their information. An employee is allowed to know where his or her DNA sample is.
Transparency is a critical ingredient. That is why it has been in the OECD guidelines for 20 years now. Those guidelines are tried and true. They are very effective way to answer most of the worries that people have. However, without an educated populace and an educated business world, privacy problems will continue.
That is a very simple concept. If people are aware of what is going on, there will be fewer instances of people being upset about events that have already happened. If people are ignorant then, yes, we will continue to have privacy problems all over our society.
Ms Steeves: I do a lot of privacy education. For example, I work with the Media Awareness Network, which is a leading Internet site dealing with privacy education. I developed a total curriculum from Kindergarten to Grade 12 on privacy issues. The linkages between citizenship -- active participation in the democratic process -- and critical thinking skills are extremely strong. So privacy education must be placed in this greater context.
Privacy, like any human right, only works when citizens exercise it and value it. That is the real challenge of privacy education today. That is why I see the mandate for education in this particular bill as a very valuable step forward. The Privacy Commissioner can take a strong lead in this area, and that will have many positive ramifications.
Mr. Lawson: I am very happy to see the word "shall" in section 24. The commission has no choice in this matter. He shall do certain things. I am not implying that he has not done so to date but I am happy to see that language, because it shows the priority is as it should be.
The Chairman: I am not quite sure the witnesses understood the question that I asked at the beginning. I will ask it again, because I was puzzled by your earlier answer. Ms Steeves, I believe, said that Bill C-6 does not accomplish what it was originally meant to accomplish.
In your opening statement, Ms Steeves, you talked about the need to effect special legislation with respect to the health professions.
Both witnesses acknowledged significant potential problems in this bill vis-à-vis the health care sector. Indeed we heard that from everyone.
Yet, when you were asked to choose whether we should proceed with the bill or whether we should do something with it, you clearly said, "Proceed with it." Your other answers make me think that that answer may be coloured by a couple of things. You used, for example, the 1978 Ontario case. In response to Senator Carstairs you said, basically, "Better this bill than no bill at all." Let me put a precise proposition on the table and get your reaction to it, since this proposition was put on the table yesterday and I need a precise answer.
The proposition was that this bill not apply to the health care sector for a period of two years, after which this bill would automatically come into effect, vis-à-vis the health care sector, unless it had been replaced by a better piece of legislation. Thus, the 1978 Ontario example is not valid in this case because it automatically goes into effect unless there is a replacement piece of legislation. A two-year delay is really only a one-year delay in practice because the bill will not be in effect for a year after it is passed. Some of the fears you expressed -- not in your initial answer to me, but subsequently to other people -- may have coloured your initial answer.
If I give you that specific proposition, which constitutes an amendment, what is your reaction?
Ms Steeves: I do not see that you gain much because of it. This bill, if it applies after whatever time limit you put on it --
The Chairman: Unless it is replaced by a better one.
Ms Steeves: This bill will only apply to commercial activity. Jurisdictionally, that is all it can capture. Constitutionally, all you have on the table is the commercial activity that is involved when it comes to the trading of health information. I do not see that waiting an extra year will put us in a better position at the end of it because it delays it for one year. I do not see that connection. I am not trying to be obtuse. I am being honest with you.
Mr. Lawson: I repeat my earlier suggestion that there is some misunderstanding on the part of the health community. I only say that because they are very concerned that this is their only chance to design legislation, but it is not. I think that is the misunderstanding.
When you look at the types of personal information that we are dealing with here, I would say that health information is the most sensitive. Commercial disclosure information that is identifiable to an individual is the most sensitive example you can imagine. I would have grave problems skipping that. Thus, I say "no" to excluding the health sector.
The Chairman: I thank the two of you for coming.
Our final witness today is Mr. Bruce Phillips, the Privacy Commissioner of Canada.
Welcome and please proceed.
Mr. Bruce Phillips, Privacy Commissioner of Canada: The Privacy Commissioner is a servant of Parliament. I am an ombudsman. I report to you, and you are my masters. It is a comfortable position in which I find myself.
I have listened with great interest to the evidence presented by Ms Steeves and Mr. Lawson, and I have tried to keep myself as informed as possible about the statements of previous witnesses. Let me say right at the outset that the establishment of legal privacy rights for the people of Canada in the commercial sector has been an objective for which my office has been pressing throughout my term, which is close to 10 years.
Looking at the potential array of this bill's opponents, I consider it a minor miracle. I implore the committee to let this miracle live.
The bill was described earlier as an e-commerce bill, as a partial bill, and as a piece of the puzzle. I think all of those descriptions do a disservice to this piece of legislation. Yes, it is relevant to electronic commerce. Yes, it is applicable only to a portion of the personal information world in which we live. Yes, it is a part of the puzzle. However, if you looked at the map of Canada in terms of a puzzle, I would say the biggest pieces of that puzzle would be included under this bill. It covers that area of our society where there is the largest single transaction of personal information involved, namely, the commercial sector. Therefore, it is an important piece of privacy legislation. I do not like to see it minimized by describing it as something merely to accommodate electronic commerce, although that may be one of its effects.
I will not deal with its imperfections. There seem to be plenty of people around who are capable of doing that. I want to stress the advantages of this bill.
First, it establishes legal privacy rights immediately over an enormous volume of personal information management in this country, namely, those things that come under the jurisdiction of the Parliament of Canada.
Second, it will capture immediately a great deal of the personal information traffic that moves between and among provinces and across international boundaries.
Third, down the road, it may or it may not apply to activities that are taking place wholly within the boundaries of the provinces. However, it does establish a very important benchmark and an incentive for the provinces to accept their responsibilities and get on with the job of doing what has been absolutely necessary in this country for a long time, which is to say that the citizens of this country are entitled to have some rights and control over their personal information.
In summary, that is how I feel about this bill. I am happy to answer any questions.
Senator LeBreton: Mr. Phillips, the summary of Bill C-6 adds to your already onerous responsibilities by setting out that the bill provides for you, as the Privacy Commissioner, to receive complaints concerning contraventions of the principles, to investigate, and to resolve complaints. It further states that unresolved matters can be taken to the Federal Court for resolution. In addition, you will be mandated to undertake public education.
Many people who have appeared before us have said, "Oh well, when all else fails, we will turn to the Privacy Commissioner." Given the complexities of this bill, coupled with the public's real concern about their own privacy, as you have outlined so many times, what is your anticipation of the workload that may flow from this bill? Will you require additional staff and resources to handle all of these responsibilities?
Mr. Phillips: Obviously, we will need additional staff. It is to some extent a complaint-driven organization. The investigation of complaints now consumes about one-half of our resources. If a substantial number of complaints are generated by the private sector, that will obviously require additional resources.
It is impossible to estimate how many additional complaint investigators I will need until we see the level of complaints.
We have had a thoroughgoing analysis done of the resource issue by analysts recruited largely from former Treasury Board people. They did an A base review on our operation, and I am pleased to tell you that they found us to be a very lean machine. They have come up with a considered estimate of what we will need in order to do this job, which is now before the Minister of Industry.
It contemplates a substantial increase in our resources -- not necessarily just for complaint investigation but also for research, policy and educational work, which I think Ms Steeves said, in the long term is probably one of the more important aspects of this bill. I agree with that.
The educational function has many levels to it. It is essentially open-ended, and it depends entirely upon how much funding is made available for the purpose. Initially, I see it working at two levels. First, we would work with the private sector to understand their problems, to learn more about their information management processes and to give cogent advice where we think improvements can be made. That will take a great deal of time and a great deal of resources. We see ourselves creating several teams to do that outreach work. I know there will be an appetite for it in the private sector.
The other level at which we would work is the more general issue of public education as a whole, which has to be seen over a longer term. That will depend entirely upon how much money we get to do that kind of work.
Senator Finestone: Mr. Phillips, your description is fine, and the mandate is excellent. Have you had a conversation or any dialogue with the minister to ensure yourself that at least some of these funds would come available? You said in the other place that you estimated a 40 per cent to 50 per cent increase in your allocation from the budget. Have you been given some assurance? If not, what is your view of this bill?
Mr. Phillips: My responsibility is to the Parliament of Canada. If after discussions about funding have concluded, and I am of the opinion that insufficient funds have been provided to my office to discharge the mandate that is contained in this piece of legislation, I will report back here directly.
Senator LeBreton: Mr. Phillips, most people feel that we are in a lost generation when it comes to e-commerce and electronic transmission of data and our personal information. The other night while driving home after sitting on this committee I was listening to CBC Radio. There was an interview an MHA from Newfoundland, Fabian Manning. He was telling a story about his personal bank card being duplicated. He was in Newfoundland doing his business as an MHA, and his personal bank card was duplicated in Niagara Falls, Ontario. The person that went into the bank had all of his information, including his social insurance number. He asked for a replacement card, saying that he was Mr. Manning and that he had lost his card. The person that was perpetrating this fraud had a lot of information on him. The bank asked a series of questions. There are checks to see if they have the right person. This person was able to provide all this information to the point that he even had the pin number. This person was able to extract almost $1,000 out of Mr. Manning's personal bank accounts.
That is the kind of situation in the e-commerce debate that scares people. Would you receive a complaint from a person like Mr. Manning, or are things like that brought to your attention? Do you have to go to the bank and question them? The ordinary person hearing that would like to think that someone could stop that kind of thing.
Mr. Phillips: No, I do not have to wait upon someone to bring a complaint to me. If we feel that the issue is sufficiently serious, we can initiate a complaint of our own and commence an investigation.
With respect to the particular problem you mention, I am not sure the Privacy Act by itself, or any privacy statute, can deal with all of those circumstances. There are other things involved. There is obviously fraud and theft from the sound of it.
Crooks are very ingenious when it comes to finding ways to beat the system. The Privacy Act is not a law enforcement device. Any good privacy statute would be helpful in making it more difficult for fraud and criminal activity by making access to personal information less easy to come by. However, it would not cure the problem.
Senator Oliver: Mr. Phillips, you may recall that, when you appeared before the Senate, I asked a series of questions about the privacy of personal medical records. It is something that has concerned me for some time, and I know if is something that has concerned you for some time. You have spent a lot of time on this matter.
I read your annual record of the Privacy Commissioner. In that report you talk about the importance of protecting patient privacy and also the importance of ensuring that patients' data is secure. Notwithstanding the way that you began your speech today about the benefits of Bill C-6, to what extent do you now think that Bill C-6 offers privacy protection for health information? I am speaking specifically about the collection, use and disclosure of information in a commercial context. You know it is very hard to have a dividing line between commercial and non-commercial in terms of medical care and health care records.
As well, there is a very important paragraph on page 9 of your report. It poses a very difficult question, and that question goes unanswered. You basically say that Bill C-6 and the existing Privacy Act contain some important differences that need to be reconciled. For example, the existing Privacy Act permits recourse to the Federal Court only in cases of denial of access to records. Complaints about collection, use or disclosure of personal information are not included. Those are at the heart of any privacy code.
You go on to say that Bill C-6 allows an appeal to the court for all such complaints, but you note that it is hardly defensible the way it is left. If it is not defensible, what, if anything, should this committee do about that conundrum?
Mr. Phillips: What is not defensible is an existing Privacy Act, which, assuming the passage of this bill, will establish in Bill C-6 a broader level of appeal for the Canadian public than is now allowed under the existing Privacy Act.
You can only go to court under the existing Privacy Act in cases of denial of access. If you are aggrieved by improper disclosure, usage or collections, you cannot take that to court. That is set out in the act.
Bill C-6 makes a substantial improvement. If you are dissatisfied with the relief processes in the bill, you can go to the federal court on all of those headings -- access, use, collection and disclosure.
The federal Privacy Act needs to be amended in due course to rectify that shortcoming.
Senator Oliver: Is it something that should be done concurrently? Is there any problem there?
Mr. Phillips: We are in the process now, and nearly finished, of doing our own internal review of the act. I think we have approximately 100 plus suggestions to make to the Department of Justice. They are anticipating its early arrival. We will see where it goes from there.
I might add that previous committees of this house have dealt with these questions before, and we have not received satisfactory action. I am more hopeful now that proper amendments to the existing federal Privacy Act covering the operations of the Government of Canada will be amended simply because the government now has in front its own statute, which establishes a higher standard than the private sector. They could hardly have a lower bar for themselves than they are erecting elsewhere.
Senator Oliver: The first part of my question is really the meat of it for me, and that is whether or not Bill C-6 does offer protection for health information. You said this is an important piece of privacy legislation, but I would like you to deal specifically with health care information and the protection thereof, particularly having regard to the language of clause 7.
Mr. Phillips: I hope you will give me a little latitude here, because I may wander beyond the terms of your question.
I have heard this debate about health information now for several days. I asked myself some questions. There are many kinds of personal information that this bill proposes to cover. Health information is one of them, as is financial information, and many other kinds of information. The essence of privacy is the recognition that, in the end, what is sensitive and what is insensitive or less sensitive must depend upon the judgment of the person to whom the information relates. That is what the concept of privacy is all about. It is indistinguishable and inseparable from the notion of individuality, autonomy and personal dignity. Some information that you may think is highly sensitive, if it were applied to me, I might think it not sensitive at all. The essential ingredient of good privacy law is the recognition of the personal element and personal choice.
Therefore, to begin with, we make an assumption. We bundle in all health information and say that somehow or other that is more deserving and more important or less important of privacy protection or must be treated in some special way from other kinds of information. There are many people who may think that their financial information -- let us assume that they are particularly healthy and have never had any need of medical assistance -- is far more sensitive.
We are not excluding financial information from this bill. Why, then, is there talk about taking health information and putting it in some totally separate character as though it were part of a different world? It is all personal information that relates to identifiable individuals. It is the establishment of the individual's right in connection with that information that is involved here.
It is reasonable for people who have been doing things the same way for a long time in the health information business, the financial information business, the credit reporting business, or any other activity to feel a certain amount of anxiety about the necessity to face some change. Yes, this bill will bring transparency and openness and public visibility to the way a good deal of personal information is now being gathered across the whole of society, including part of the health industry, if you want to use that term. That is the point of this bill. When people come in and say, "It is going to make our life more difficult for us," I say, "Gee, maybe it is a good idea to make it a bit more difficult."
When the Canadian Standards Association code was constructed -- by the way, the health industry did have some input into that, although I understand some witnesses said the opposite -- business hailed the CSA code as being the perfect answer. We could all now go away because this was a consensus of business and they had signed on to it and we could expect they would observe it to the letter and we could all stop worrying about our privacy.
The sincerity or the credibility of that statement was tested the day the government came out with Bill C-6 and said, "Just a moment. We think we have to go a bit beyond this if for no other reason than to satisfy European data processors who want a higher standard in this country to permit free transatlantic data flow." Suddenly people who were very enthusiastic about the CSA code began to find very serious flaws with it. The answer to that is simply this: It is very easy to walk the walk, but much more different to talk the talk. The talk that we are talking here is one that is desperately needed in this country.
Senator Finestone, I will try to address your question. You asked about a two-tiered system. Yes, it is entirely possible that passage of this bill will create a somewhat higher standard of privacy observance in a portion of the health industry than now exists. You can eliminate it, and you will have nothing whatsoever. You will have nothing in the private sector and nothing in the public sector. I ask you which is better, to have part of it covered and part of it not covered, or to have none of it covered. That is the consequence of the argument. Yes, it is a two-tiered system, one tier which would be very good and the other one which would need some repair. That is my answer to the two-tier question.
A great deal of the health information about which people are concerned would not be touched by this bill at all. I was very impressed by the statement that Mr. Dodge made yesterday. David Dodge is responsible for one of the largest collections of health information in the country. He is engaged in the constant exchange of massive amounts of "health information" with provincial governments and other entities. His own evidence at this committee bears some notice. He put his own people to work on this thing and said, "Try to find me examples where this will prove an impediment to the efficient management of the health information system," and the answer he got was that there were no such examples.
Senator Oliver: The study is not completed yet.
Mr. Phillips: That is fair.
Senator Finestone: What he really said is that he tested the specific ones.
The Chairman: Senator Oliver has the floor.
Senator Oliver: I am satisfied.
Senator Murray: Mr. Phillips, I think I agree with just about everything positive you have said about this bill. You have told us that you want us to let this miracle live. I do not know anyone here who wants to let it die. We have been confronted by some witnesses -- not you, but some -- and by communications by letter and e-mail and so forth making the following case to us: This bill is the result of arduous negotiations. It is a delicate balance. The trade-offs have been made. The House of Commons has passed amendments. The Senate should now butt out.
I would say to all those who think that way that we do not view our responsibilities in that light. With all the positive things you and others have said, and that most of us believe to be true about this bill, this is the last chance that there will be to identify and discuss any possible flaws in the bill and to correct them. That is our responsibility. I do not need to tell you that. We will go about it as conscientiously and expeditiously as we can.
I have three or four questions that have nothing to do with health care. I want to put them to you, but you engaged in a discussion on health care with Senator Oliver and Senator Finestone. I respect and appreciate the view that you have expressed about this, but I hope you are not doing an injustice to any of the people who appeared from the health care sector to argue about the impracticability or even the impossibility of disentangling the commercial from the non-commercial in their affairs.
The Canadian Medical Association has said that Bill C-6 permits the collection, use and disclosure of information without knowledge or consent on grounds such as expediency, practicality, public good, research, offence investigation, historic importance and artistic purpose, and that the laxness and breadth of these exemptions as applied to health information is unacceptable.
Perhaps you think that is exaggerated, but it is well meant. It speaks to a serious concern on the part of an important profession in this country. I think we need to take it seriously.
Mr. Phillips: I agree with almost everything you said.
Senator Murray: And not for the first time.
Mr. Phillips: Let me hasten to add that, in my enthusiasm, I certainly mean to convey no disrespect to any of the evidence given by any other witness. Nor do I pretend, Senator Murray, to offer advice to the Senate as to the nature of its duty.
Let me say something about the CMA code, about which my office has spoken very approvingly on past occasions. I think I repeat other witnesses, particularly Ms Steeves, when I say that the bill does not impose any limitation on the CMA's right to impose its own, more strict standards. The medical profession, after all, had been operating in the field of ethical enforcement long before there were statutes of any kind in this country, because there was no country. The medical profession is accustomed to the notion of fairly rigorous ethical observance. If the CMA wants to impose restraints on disclosure of patient information that are more rigorous than those contained in this bill, I simply say hallelujah, good for them. I would applaud that.
Senator Murray: Their real concern is about secondary and tertiary use.
Mr. Phillips: I understand that. One of the things I am sure every witness -- and probably a number of you senators as well -- has had trouble with is understanding where the problems arise. You need practical examples of informational exchanges, disclosures or transmissions that somehow or other would be impeded because of this bill. I have certainly had that problem for a long time.
In the course of discussions with the advisory council on health information established by Minister Rock, we had a number of meetings with the people involved in that exercise, at which we said, "Please show us the data linkages, the data exchanges, and the personal information that you propose to put into the information highway, where it enters the system, and where it goes. On that basis, we can make some rational observations about its relationship to privacy observance." So far, we have not had an answer to that question. I have the same difficulty when I listen to witnesses or read their testimony. They say they will have a great deal of difficulty, but until you can actually see the information management process itself, it is very difficult to offer a judgment as to the value of that kind of evidence.
One of the great benefits of this kind of a statute is that it starts to roll up the blinds, open up the windows and let some light in on the process. That, I think, is probably its greatest virtue, because it then puts everyone on notice that there is a standard to which they will have to comply, in due course, being given a reasonable opportunity to do so. They then have to look at their own systems harder than they have before, not merely from the point of view of the bottom line and convenience and efficiency for the purposes of the enterprise, but also to take into account the obligation those people have to their clients and customers. That is an exercise through which many of them will not have been before. Consequently, there will be some irritation, some inconvenience, some cost. The question that I would put to this committee is: Do you feel that the objectives of this bill are worth whatever inconvenience and cost may be involved for the companies and enterprises concerned?
You have to determine whether it is sufficient for anyone -- whether it is the health sector or financial sector or anybody else -- to say, "We are a special case, because we are handling sensitive information" -- thereby making a judgment, by the way, about what all the people whose information is concerned may think about it -- "and we are entitled to some kind of special treatment here." It is not an argument in which I put a lot of stock.
I grant you, senator, the health information field is complex. So is nearly every other business field. This will not be a walk in the park, either for the Office of the Privacy Commissioner or anyone else. Merely getting to understand the culture of business and how it is working is, by itself, a substantial undertaking. We, as the oversight mechanism, will have an awful lot to learn. The same thing is true of the health sector as it is for anyone else.
Senator Murray: That is fair enough, Mr. Phillips.
Mr. Chairman, I have several questions that are quite brief and to the point.
Mr. Phillips, we were told yesterday that the powers proposed for your office under clause 12 offend the Charter rights against unreasonable search and seizure and offend also against procedural fairness and natural justice. I hope that you would tell me that the Privacy Commissioner, of all people, had taken special care to ensure that any powers that are given to his office would be fully respectful of those rights and would never infringe them. You have legal advice on this, I presume.
Mr. Phillips: Yes. It is the view of our legal advisors that the powers granted to us in this bill do not offend the Charter. With respect to the exercise of the powers that are granted, I have to rely upon the track record to speak for my office, and I think that the track record does tell a good story. We are very careful. We have only ever had to resort to the courts on a handful of occasions over that whole period of time.
The whole essence of privacy observance in an ombuds office, as opposed to a regulator or tribunal office, is to get to the bottom of the problem and try to find a workable solution, and that is deeply embedded in the consciousness of everyone who works in my office. When it comes to the business world, where there is the additional problem of companies which have shareholders, bottom lines and other powerful economic considerations, we try to be careful to ensure that whatever we are doing is not going to be done in a way that impedes business, brings it to a stop or produces some kind of paralysis in the informational system.
Let me come back to the favourite topic of the last couple of days, health information. My approach to that subject would be to convene a small team of specialists in my office and to say, "Let us now sit down with all of the important players in the health information community and find out what their problem is, how they are collecting information, what they are doing with it, and the nature of their relationship with their clients. Let us have a look at it, let us see how well it fits. If there are problems, let us see what kind of solutions there are."
There were discussions here a while ago about consent -- "consent" being a very elastic word. It certainly is, and I am glad it is, especially when you look at the various ways in which information is collected. Yes, there are occasions when secondary and tertiary uses must be covered by prior consent; otherwise the whole system would not work. I think of that in certain medical and health situations. When a person checks into a hospital, it is necessary, for the sake of proper treatment, that certain informational exchanges occur, some of which will go beyond the doctor and nurse immediately involved. No sensible patient at that stage will withhold consent, although a few have -- for example, people with certain religious convictions. This is not a case where the Privacy Commissioner charges through the front door, senator, and says, "I have a bill here. You better be in compliance, or you are in trouble."
Senator Murray: I was going to ask the commissioner what he thought about the exemption for journalistic information, and about the 20-year rule for disclosure, but perhaps others can ask those questions.
Senator Wilson: It gives me some comfort to read in your brief that you consider privacy to be a fundamental human right, and that you believe privacy deals with the autonomy and dignity of the person.
I also notice in your brief that your office will be given a formal mandate to undertake public education. Sometimes that is interpreted to mean that it will be given a formal mandate to undertake public acceptance of the bill. I am wondering, if you distinguish between public education and public acceptance of the bill, what your strategy for public education might be about. You have already said it will depend upon the money, but you must have a strategy apart from money.
Will the bill as passed include the delicate balance that some have mentioned here? Will it include some further amendments seen as necessary? Will you be working with partners in the public sector? In brief, what is your strategy for public education, as opposed to public acceptance?
Mr. Phillips: I regret that I cannot give you a complete blueprint. With respect to the first question -- will we be educating the public about the bill -- that is certainly a part of public education. If there are privacy rights about which the public is unaware, it is important that they do learn.
I think of public education in the broadest possible context. For example, I believe that the absence of human rights education in the lower schools, if such there is, is something that ought to be rectified. If we had a new generation coming up which, because of the enormous impact of technology on society in many manifestations, became more aware in the course of learning how to live with a technology based society -- the human rights and ethical dimensions of that subject -- we would be a long way towards solving the problem. We are not there yet.
I would certainly regard discussions with educational authorities, who will have the last word on matters of that kind, as part of the function of the Privacy Commissioner. To the extent that the office is funded for mass education programs such as advertising and so on, we would certainly be, and will be and are, consulting with specialists in mass education techniques about the best way to use our dollar in terms of the message we wish to send.
We have not made any decisions on that subject yet. We have no idea at this stage how much funding will be available. However, it would certainly be a multi-armed approach to the whole subject of the distribution and communication of information.
Senator Finestone: Welcome, Mr. Phillips. We have much respect for you, and wish you much courage to undertake this enormous task.
There are two areas with which I should like to deal. In your appearance before the committee of the other place, you were quite specific about the need, in your view, for an amendment in clause 2; that is the definition under commercial activity. You said:
The absence of a bit more precision is what is meant by commercial activity.
The issue of commercial activity does touch such things as health information.
how much of the whole spectrum of health information is captured by this bill, and there's some doubt in our minds.
Now, public education is part of your mandate. Therefore, even those who deliver the service need to be educated as to what is needed if you think that, as you say here:
the definition of "commercial activity" should be expanded to make sure that professional associations and non-profit organizations are covered as well, if there is any consideration involved in the work they are doing. For example, when a charity buys a list of potential donors, is that commercial activity, yes or no? When a lawyer draws up a will for a fee, is that a commercial transaction? We ourselves are not entirely certain.
I presume, therefore, from the time you appeared in the month of March this year until now, that you are now certain what commercial activity means. I wonder though, as you were not certain then, whether you would like to see those things straightened out. It would help a great deal if it came up, and if you came to question some of the issues around health information. Have you changed your mind in that regard?
Mr. Phillips: Touché, senator.
Senator Finestone: I thought you wanted me to put that on the record, Mr. Chairman.
I wonder if you were grateful to the bill drafters. You can change the definitions, but what is it you want from us?
Mr. Phillips: They had a go at it, as you can see, because it was a minor amendment to the commercial activity clause.
Senator Finestone: I did not notice that. I do not think so.
Mr. Phillips: Yes, there was. I did not think that it really helped a whole lot.
Senator Finestone: I am glad I am asking these questions.
Mr. Phillips: Upon reflection, senator, we are confronted with this problem: To try to define what is a commercial activity that would be sufficiently precise would probably take more pages than my briefing book could hold. It was something that we would need to learn by getting our feet wet, but that is often true of the work of the ombudsman. You really must look at the particular transaction involved and know all the details and then get competent legal advice and have a discussion.
I realize how pitiful that answer is, but it is my best answer.
Senator Finestone: Taking that pitiful answer and my curiosity, did you think perhaps if you got consulted a little bit, and if you worked with the committee that has been set the task under FPT, and the Department of Health, you might come up with something?
That could be included in the regulations that we then may wish to look at, Mr. Chairman, that would indicate to the sectors exactly who is covered. Do you think that would be a good idea?
Mr. Phillips: Your advice is duly noted, and it will be acted upon.
Let me be frank with you; it is simply not a subject on which we have turned our minds to the exclusion of other problems in the office. Let me put it that way. We have other things to do so we just have not got around to that point yet.
Senator Finestone: I know that the deputy minister, Mr. Dodge, indicated that it was a very difficult issue. The courage of the minister to go ahead and do this must be recognized. That does not mean that the Minister of Health did not need to have some input too. I suppose somewhere along the line, with the change of deputy ministers and everything, something fell between the cracks. I would hope that you are being consulted by this task force of the FPT that is looking at the issue of health information. Would you make note of that?
Would you know, Mr. Foran?
Mr. Brian Foran, Director, Issues Management and Assessment, Office of the Privacy Commissioner of Canada: I do not know at the moment, but we will certainly look into it.
Senator Finestone: What I am concerned about, frankly, is not only the definition, which we have already dealt with, but the issue of consent. I heard what you said about consent just now. Notwithstanding your broad open-handed and open-hearted view -- and I would accept that it is important that we accept this bill -- I do not believe we need to accept some of the errors. I do believe the error that deals with consent must deal with some form of informed consent; not just trickle down consent, not just oblique consent, but fundamental consent, so that I am making an enlightened decision.
It goes without saying, if you go to your doctor and you are sick and he gives you a prescription, you go get it filled out, no problem. However, when I heard some of the things that they are doing with this information, non-identified anonymous information is absolutely fundamental for the changes needed in the health care system. There is no question about that. They need to have outcome and inputs to know where the problems are in the system.
I do believe there should be informed consent. You do not think we should put the word "informed" in there?
Mr. Phillips: To me, consent is not consent if it is not "informed".
Senator Finestone: You are talking about a dictionary definition.
Mr. Phillips: I will not get into a semantic argument with you, because I will lose it. I agree with you that for any consent to be meaningful, it needs to be informed.
Senator Finestone: We could live with it like it is and not present an amendment, just assume that consent was informed?
Mr. Phillips: I will refrain from giving any advice of that nature to this committee.
Senator Callbeck: Mr. Phillips, do you feel there is an inconsistency in this legislation? When you look at clause 5(2) of Bill C-6, the word "should", when used in Schedule 1, indicates a recommendation and not an obligation. Clause 11(1) states that, "An individual may file with the Commissioner a written complaint against an organization for not following a recommendation as set out in Schedule 1." Under clause 18(1), the Privacy Commissioner may audit the personal information practices of an organization if he has reasonable grounds to believe that it is not following a recommendation. Clause 5(2) says that, "These are recommendations, not obligations." Yet, from the other clauses, they are held accountable for following through with them.
Mr. Phillips: It is important to remember that the CSA code was drafted at a time when the drafters themselves were not contemplating its inclusion in a statute of this kind.
The Chairman: They were not contemplating that it might actually be enforced.
Mr. Phillips: The words are yours, but I will not disagree with them. It is fair to say that they were looking at things that you absolutely had to do and here were things that, in terms of "best practice", one should do. The CSA code is a kind of chatty document when you look at it that way. It is that sort of thing. That is why it sticks out in a piece of legislation, namely because it is outside the usual style.
Having taken account of these notes and "shoulds" and "shalls", the bill makes clear those things which, for the purposes of the act, must be done and those which would be nice if they were done, but you will not be dragged to court if you do not do them.
That was a necessary distinction that the writers of the legislation had to make as a consequence of the way the code was written. Does that answer your question?
Senator Callbeck: You do not feel that there is any inconsistency there, then? That is to say, the bill is straightforward with regard to obligations and, where there are recommendations, they will not be held accountable for recommendations?
Mr. Phillips: We will be guided by what the bill instructs us to do. Where it says "shall" it is shall, where it says "may", it is may; where discretion is allowed, it will be allowed.
If the proposition is that everything should be mandatory and everything should either be a recommendation or be discretionary, that would be one thing. However, the bill is not constructed that way.
Senator Finestone: You are not the police force.
Mr. Phillips: No. It does not constitute difficulties as far as I am concerned. You may think that there is a better way, but I do not see this as a difficulty in terms of living with it, no.
Senator Carstairs: Mr. Phillips, you said that we should not think in terms of hierarchies. You said that to some individuals their financial information was equally as important as -- or, perhaps, more important than -- their health information. However, I think if you did a poll of Canadians and you asked them to rate the hierarchies of issues about which they had particular concerns in areas of privacy, they would list health as their first area of concern and then commercial information, perhaps because they do not completely understand the impact that commercial information might have on their day-to-day lives but they do understand the impact that spreading their health care information might have on their individual lives. Would you agree or disagree with that?
Mr. Phillips: I will certainly not disagree with it, no.
Senator Carstairs: You indicated that you want to get the important players together. Clearly, you stated that you wanted to identify the health players. One of the issues that doctor and Senator Keon <#0107> one in the same person -- raised was that he is concerned, as a physician, that if individuals do not feel they have adequate privacy, then they will not have confidence in their physicians to give the very information that they require to provide the quality of care which their patients need. That has been my concern about this from the very beginning, namely, that if this bill and its passage would weaken in any way the patient-doctor relationship, then we must do something to strengthen the bill so that does not happen. Clearly, however, you do not share my concern on this.
Mr. Phillips: If I believed that it would weaken the system, I would share your concern. However, I take the other view. I do not see how introducing a standard of legal privacy rights into Canadian law where none now exists can possibly make the situation worse. I cannot imagine it being worse than it now is. Someone cited a hypothetical lawyer who said, "Since that is the standard and it is lower than our own ethical standard, I do not have to pay any attention."I certainly hope I never have a lawyer like that handling my business.
The Chairman: So that you are clear, yesterday the president of the Canadian Dental Association made exactly that point. His view was that if Bill C-6 had a lower standard than the Canadian Dental Association -- which he claims it does -- then some of his professional colleagues would adopt the lower standard and effectively thumb their noses at the professional standard.
I do not wish to be argumentative. This is not an issue that we have thought up; this is an issue that professions themselves have raised.
Mr. Phillips: I hardly know what to say about that. When the spokesman for a professional association says that his or her own colleagues would deliberately, knowingly, seize an opportunity to treat their patients with less respect than is required by their own ethical code, I really do not know what to say about that. I guess I will get myself a dentist in Ogdensburg. That is my answer to that. It is like saying, "It only takes 50 per cent to pass the examination" and everyone is saying, "Good. Let us not do any better than that." One person, however, says "I will go for 100 per cent because I will get a scholarship and better job. I will be a better person and a better dentist." It baffles me that anyone would make a statement like that. That is my answer.
Senator Carstairs: Having said that, it baffles me, too. Nevertheless, it was said. Therefore, I wanted your reaction to it.
From my perspective, the problem is that the patient-physician relationship -- even more so than the patient-dentist relationship -- involves a certain amount of sacred trust. That sacred trust must not in any way be weakened. I am pleased that you do not believe that it will be weakened by this legislation. Essentially, that is all I have to say.
Senator Murray: I know that Mr. Phillips advocated, as long as nine or ten years ago, entrenching a right to privacy in the Charter of Rights. My question is, if such a right were there, would it have been necessary to exempt personal information collected for journalistic, artistic and literary purposes in this bill?
Mr. Phillips: It might still have been advisable to exempt journalists; I do not know.
Senator Murray: Your view, though, is that a right to privacy should be entrenched in the Charter on the same basis as the other rights, including the right to freedom of expression? Is that your view?
Mr. Phillips: That is right.
Senator Murray: Let me take you now to what I call the 20-year rule. I invite you to offer us a principle justification for the provision in this bill that personal information collected for commercial purposes can be legally disclosed 20 years after the death of the person in respect of whom it was collected. Justify that for us.
Mr. Phillips: I will not try. That provision is the same one found in the existing Privacy Act. It is written by people who obviously believe that privacy rights expire at the grave.
Senator Murray: We had a lawyer tell us that today.
Mr. Phillips: If that is so, and if that is an accepted principle in law, I think it is an unhappy one. I take a different view. I have learned in my experiences as a Privacy Commissioner that many people are very concerned about the personal information that may linger on after their deaths, and about what happens to it. We need only consider the example of the enormous lengths taken by many people regarding the security and inviolability of their personal papers post-mortem. The assumption that people do not have a privacy right simply because they are dead, in my opinion, is a very poor one.
This argument, as we both know, is coming up in another context. The Privacy Act now holds that, 20 years after your death, personal information does not qualify.
Senator Murray: There is no reason to apply it to the commercial sector as this bill does, is there?
Mr. Phillips: I do not draw a distinction between any kind of information. It is what the owner thinks about it, senator. You are right. The question is why?
The Chairman: Mr. Phillips, thank you. As usual, you have been very helpful.
Senators, we will meet tomorrow at 11 a.m.
The committee adjourned.