2000 Legislative Session: 4th Session, 36th Parliament
SPECIAL COMMITTEE ON INFORMATION PRIVACY IN THE PRIVATE SECTOR
MINUTES AND HANSARD

SPECIAL COMMITTEE ON INFORMATION PRIVACY IN THE PRIVATE SECTOR Tuesday, July 4, 2000 3:30 – 4:30 p.m. Birch Room Parliament Buildings, Victoria

Present: R. Kasper, MLA (Chair); J. Weisbeck MLA (Deputy Chair); P. Calendino, MLA; S. Orcherton, MLA; E. Walsh, MLA; G. Plant, MLA; K. Whittred, MLA

Unavoidably Absent: G. Clark, MLA; G. Janssen, MLA; G. Abbott, MLA

Other Members Present: Colin Hansen, MLA

1. The Chair called the Committee to order at 3:38 p.m.

2. The Committee continued its briefings and heard testimony relating to the following issues:

• Bill C-6 Coverage Issues
  Chris Norman, Information, Science and Technology Agency
• Health Information Issues
  Kevin McKee, Information, Science and Technology Agency
• Discussion on Consent and Justification in Bill C-6
  Patricia McNamee, Information, Science and Technology Agency

The following electronic version is for informational purposes only.
The printed version remains the official version.

REPORT OF PROCEEDINGS
(Hansard)

SPECIAL COMMITTEE 
ON INFORMATION PRIVACY
IN THE PRIVATE SECTOR

TUESDAY, JULY 4, 2000

[ Page 131 ]

The committee met at 3:38 p.m.

R. Kasper (Chair): Noting that we have a quorum, I'd like to call the Special Committee on Information Privacy in the Private Sector to order. We have circulated an agenda. It was distributed last week. And this is a continuation of presentations of information from the Information, Science and Technology Agency. The first item is Bill C-6, and it's dealing with coverage issues. Chris Norman, I understand, is going to be making that presentation. So I'll turn it over to you, Chris.

C. Norman: There should be a piece of paper for you called "Application of Bill C-6" with a backgrounder. In keeping with the approach that we've taken to date, we'll do a very quick run-through of the information on the paper, and then you can ask whatever questions you have. Certainly feel free to stop us anytime if you've got any queries about any of the things we bring up.

[1540]

We've had a fair bit of discussion to date on the exact nature of the application of C-6. That's ranged from everything from its purported plan to cover the provinces within a certain period of time if they've not enacted substantially similar legislation through to the conflicting or potentially conflicting jurisdictional issues that might come with transborder data flow or with even defining exactly what is or isn't covered by the legislation.

We've tried here to give you a bit of an overview, but I will caveat this by saying -- as I've said in the little intro here -- that many of the issues raised by the lack of clarity will not likely be addressed until C-6 is implemented and tested. So I still believe there are a number of areas of either jurisdiction or definition -- or the implementation of definition -- that will wait for testing before we're clear. That certainly has been verified by my contacts with some of the people from Industry Canada and the federal government, where specific examples of "What happens if. . . ?" are answered in some cases by: "We're not really sure, but we think this might be how it works."

Many of the federal-provincial discussions have also raised a fair number of issues, particularly with interjurisdictional aspects of the legislation where there seems to be a bit of fuzziness. I think some of that is in part because of the approach they've taken with concentrating on the trade and commerce powers as their authority. Relying on that has posed for them certain problems in how they've been able to define what things are covered and what aren't.

I've indicated here that the precise coverage has been the subject of considerable discussion, and I think that's an understatement, given the somewhat complicated definitions of coverage that exist in C-6, the phased implementation schedule, which has now carved out the health information, for example, and put it in a different track, and the coverage of the provinces. If you look and you try to sift through in the legislation how the provinces are covered and are not covered, it's a bit of a mind-game to try to follow through it and say, "Well, it's covered, but it won't be covered if it does this and that," so it's quite complicated. And lastly, the jurisdictional issues, as I mentioned, raised by these -- the trade and commerce provisions.

What we do know and what is very clear is that on January 1, 2001, C-6 will apply to "personal information collected, used and disclosed by federally regulated organizations: (a) in the course of their commercial activities, or (b) where personal information is about an employee of the organization and in connection with the operation of a federal work, undertaking or business." Now those are defined, and I'll touch on those below.

On January 1, 2002, C-6 will apply to federally regulated organizations that collect, use or disclose personal health information. And there's a definition for that, again, in C-6. Kevin will speak a bit about the health information issues that occurred during the passage of C-6, but this was a rather last-minute pull-out of personal health information, putting it in a special category. While the compromise was that it will still cover it, it is covered on a slightly different schedule.

And on January 1, 2004, unless a province passes substantially similar legislation. . . . Again, a term not defined in the legislation. But just so you know, Quebec's private sector privacy bill has been deemed substantially similar, so at least we have some benchmark against which to compare. We've been given some guidance by the feds as to what would be considered substantially similar, and I'm happy to talk about that later if you wish. In three years C-6 purports to apply to organizations under provincial jurisdictions and operating within a province, even if it's wholly under provincial jurisdiction and wholly operating within the province. Note: provincial organizations are those which collect, use or disclose personal information wholly under a province's jurisdiction, and provincial jurisdiction seems to be limited to only commercial activities wholly within provincial boundaries.

The second note was that if a province doesn't pass substantially similar legislation, the Governor-General-in-Council may exempt an organization, an activity or a class of organizations or activities from the application of the act. So again, this piece doesn't tend to get a lot of emphasis, but it is within the purview. Let's say hypothetically that Ontario or B.C. or Alberta does not pass substantially similar legislation. A certain business or organization or sector, or even a class of organizations as yet undefined, could potentially approach the federal government, and the federal government could exempt them from the coverage.

[1545]

What is not covered? Any government institution regulated under the federal Privacy Act. So again, in keeping with their intent to only cover the private sector, they're indicating that they would not cover those things already covered by the Privacy Act. The interesting thing about that definition will be that things like some of the Crowns -- and there's been a lot of controversy about them not being covered under the federal Privacy Act, unlike our provincial jurisdiction which does cover Crown corporations. . . . Entities like Canada Post would then be covered as a private sector organization. So they will have to follow those rules. I think they're probably just as happy that they didn't get covered by the federal access act, which allows them to still not have to respond to FOI requests.

What else isn't covered? Private individuals who collect, use or disclose personal information exclusively for personal or domestic purposes. In other words, if you collect information for your own use in your home, that would not be covered. You're not considered an organization for the purpose of the legislation.

[ Page 132 ]

Then there's the carve-out for journalistic, artistic or literary purposes, which do not collect, use or disclose for any other purpose. The latter part is the one that's a bit more contentious, because I think the journalists may have a slightly different view than what might have been intended by Industry Canada. I think we will likely get into some issues around secondary use, even if it's a media organization.

Definitions. There are a number. . . .

P. Calendino: Before you go on with that, in the last point you made about journalistic uses. . . . I guess artistic or literary would be the same thing. Journalists can access information, which an individual may consider is private information, through freedom of information -- right?

C. Norman: Yes.

P. Calendino: But journalists then have that freedom to include that information in some kind of article that they may be writing.

C. Norman: There's a difference here. If a journalist is getting information through an access act, such as using the B.C. FOI and Protection of Privacy Act, they would still be subject to the provisions, the privacy and protection provisions, in our public sector legislation under a request. If they were to ask for information about myself, then they would have to go through an FOI request, and they would get some more -- perhaps not all or perhaps none -- of my personal information. But it would be adjudicated under the FOI and Privacy Act.

What this pertains to is instances where a journalist is getting information which is held in the private sector, for which no FOI legislation would pertain. But it gives them ability for journalistic purposes to collect that information, to publish it in the newspaper and to write appropriate articles on it.

P. Calendino: So things like my stock investments, if I had any, they would have the freedom to. . . .

C. Norman: If they were able to get that from a private organization, then they would be able to make use of that for journalistic purposes only.

The definitions. I've given a few here. As I indicated, there are a number of areas where there aren't definitions, which might be helpful. But either for conscious reasons or for reasons of omission, I suppose, they've not defined everything. That happens. One of them that is particularly interesting, given some of the coverage issues on the first page, is the one about the definition of "federal work, undertaking or business."

The definition is a very extensive one, but in short, it means any work, undertaking or business which is within the legislative authority of Parliament. Again, we should note the emphasis on trade and commerce. It includes, but is not limited to, radio broadcast stations, banks, telecommunications companies, any transportation enterprises that connect provinces or extend beyond provincial limits and any other organizations that trade in personal information across provincial or national borders, such as credit reporting agencies and insurance companies.

The other note on this is that a federal work or undertaking can also include a work that, although wholly situated within a province, is declared by Parliament to be for the general advantage of Canada or for the advantage of two or more provinces. That again gives them some additional jurisdictional authorities here, and they could define something wholly within a province as having federal significance.

[1550]

R. Kasper (Chair): I have a question. In light of a most recent announcement by the federal government dealing with the authority of credit unions to actually expand across the country now, would they be included in this list?

C. Norman: Yes.

R. Kasper (Chair): Another thing. . . . It was probably more tongue-in-cheek when I actually asked about it in a limited way. What about political parties? Does C-6 specifically exclude them, or doesn't it even mention them?

C. Norman: I think that if the information were used for commercial purposes, it would be covered.

K. McKee: If, for example, a political party chose to sell its list of members to a private company, it would probably be covered by Bill C-6 for that transaction.

G. Plant: I think that's right.

R. Kasper (Chair): Okay.

C. Norman: Further definitions. There's one of "an organization," which includes an association, a partnership, a person -- and that could include a corporate person -- and a trade union. "Commercial activity" means a particular transaction, act or conduct or any regular course of conduct of a commercial character, including the selling, bartering or leasing of donor memberships or other fundraising lists. Again, that's in part where, say, even non-profits could potentially be covered if in fact they sold their membership lists or their donor lists. That's an important distinction.

"Personal information" is a very simple definition that they've given, but a very embracive one. Personal information is defined as information about an identifiable individual, period, but does not include the name, title, business address or telephone number of an employee of an organization. In other words, it covers everything except business information about an employee of an organization.

Coverage issues. I thought I would just end this up by pointing out some of the coverage issues, in some of which there are clear lines drawn and in some of which there aren't. One of the coverage issues is obviously the constitutionality of C-6's purported coverage of organizations under provincial jurisdiction.

As we've noted previously, the minister responsible for the provincial Freedom of Information and Protection of Privacy Act did respond to the federal government, indicating that the province did not cede the jurisdiction issue but planned to make its own response to private sector privacy. In other words, it was declaring that it would reserve the right to

[ Page 133 ]

raise that issue, but that for all intents and purposes, it was moot, given that the province intended to prepare some form of its own response.

The other one would be ensuring consistency of standards between provincial legislation in C-6, particularly as the federal government proposes to "pass judgment on provincial acts." Federal cabinet, no less, will look at individual pieces of provincial legislation and deem them, or not deem them, substantially similar.

The jurisdictional logistics of interprovincial and international coverage of personal information. In other words, when is personal information regulated by C-6, by provincial legislation or by international legislation? There could very well be instances where three or more jurisdictions might make claim to jurisdiction over particular personal information. The European Union, the federal government and one or more provincial governments could potentially claim jurisdiction. That will need to be addressed.

The jurisdiction over personal information of Canadians collected, used and disclosed by foreign companies. The definition of commercial use for non-profit organizations. Some non-profit entities have indicated that they take a very different interpretation than what the federal government seemed to be suggesting. The distinction between what is covered by public sector privacy acts and private sector acts, given the differences between the coverage of public sector acts. Example: B.C. covers most of its health sector under its public sector act, while Ontario does not. So B.C. covers hospitals; Ontario doesn't. That's been a source of considerable contention. Kevin will address that a bit more.

Under "Qs and As" it essentially repeats some of the information earlier, but just in a different form for you. I've probably raised more questions than I've given you answers in this, but that seems to be a bit of the nature of the animal here.

[1555]

R. Kasper (Chair): Okay. Well, we'll see. Do any members have any questions of Chris?

G. Plant: With respect to part 3 of the stage implementation, which is the part that deals with the problems, when Bill C-6 reports to apply to organizations under provincial jurisdiction and operating within a province, will it. . . ? I assume it will do so only in relation to personal information collected, used and disclosed in the course of commercial activities or where the personal information is about an employee of the organization and in connection with that organization.

C. Norman: My understanding is that it will apply to the information as it relates to commercial activities, but that it will not apply to employee records, because the second part of the definition indicates "in connection with the operation of a federal work, undertaking or business." As I'd indicated, I think, in an example in an earlier session, you could conceivably have a chartered bank on one side of the street that would have all of its personal information used for commercial purposes and employee records covered and a provincially regulated credit union across the street that would have its personal information covered for commercial activities but not its employee records.

R. Kasper (Chair): Any other questions?

Okay, thank you very much, Chris.

The next item is dealing with the health information issues. I understand that Kevin McKee is going to be leading off with that.

K. McKee: My name is Kevin McKee. I'm with the corporate privacy and information access branch of ISTA.

Basically what we're going to talk about is sort of a brief overview of what was probably the most contentious issue while C-6 was in debate both in the House and in the Senate. That's with regard to health information. During both the lead-up to the initial entry into the House as Bill C-54 and throughout its time in the House and in the Senate, there were major discussions going on with certain elements of the health sector regarding this legislation.

Basically it comes down to there being three issues or three different positions taken. The federal government took the position that while personal health information was sensitive and required protection, it could be adequately covered by the framework established in C-6. Certain parts of the health care industry in Canada -- most notably the Ontario Ministry of Health but not the Ontario government -- and the pharmaceutical industry took the position that C-6 was too restrictive, that it would create severe difficulties for them being able to continue to operate, particularly with regard to the issue of consent to use personal information. They felt that they would be restricted in terms of their ability to conduct research and their ability to communicate across organizational lines dealing with personal information.

What's interesting is that at the same time that they made that presentation, the Canadian Medical Association and the Canadian Nursing Association made presentations basically saying that C-6 wasn't strong enough -- that it didn't provide enough protection for the personal information of a medical nature -- and argued that they wanted stronger consent clauses or else separate legislation dealing only with health information.

The position of the federal government was based on the premise that if we took one sector out of the coverage and covered it separately, we ran a greater risk of uneven coverage across the country, that it would create an atmosphere in which each sector of the economy would be coming forward and arguing for why they need to be treated differently than everyone else, that the nature of Bill C-6 allowed it to provide a broad framework of coverage that would include all forms of personal health information and that there was enough breadth within the definitions being provided within the framework of the model code that was being adopted to allow every industry to fit within that structure.

[1600]

The federal government felt there was a real concern that if it moved on the issue of health information, it would be pressured quite severely to move on some other industries. The other thing that the federal government argued is that the real reason behind the concerns of the pharmaceutical industry related to reductions of revenue and that the industry was interested in being able to use personal information as a means of gathering more revenue. That was an issue that they put out there. The pharmaceutical industry did not respond directly to that. We're not in a position where it can really evaluate the reasons behind the arguments that they put forward. That was speculation, I think, on the federal part.

[ Page 134 ]

The position of the pharmaceutical lobby and the Ontario Ministry of Health were at times somewhat confusing and contradictory but seemed to basically be based upon the idea that there needs to be an atmosphere of cooperative sharing of personal information in the health field and that there needs to be an ability to directly identify people for research purposes. Although when questioned about that, they weren't really clear as to why you couldn't use some form of pseudonym structure to accomplish the same goal or some methodology. Their chief concerns seem to be that they felt there would be a really extensive increase in costs for seeking consent in the use of information and that being required to go back to an individual and ask for permission to do a second use of information provided to them in the first place would create major organizational costs for each of those parts of the industry.

The Canadian Medical Association and the Nurses Association contended that health information is special; it's different than that of other sectors. Therefore it needs stronger controls over collection, consent and use and disclosure of the information. They felt that C-6 might be too open to interpretation and that patients ought to have the ultimate control over what happens to their personal information in consultation with their physician. So they were looking for legislation that would be exceptionally restrictive as to what could be done by any organization without the consent of the individual patient.

In conclusion, through C-6 the federal government created a general framework with a minimum set of standards for the protection of all types of information. There's nothing in C-6 that prevents a sector, including the health information sector, from developing their own more stringent codes of privacy protection. They can take Bill C-6 as a minimum standard and build upon it.

The important thing to remember in the context of B.C. is that the Freedom of Information and Protection of Privacy Act of B.C. covers the vast majority of medical information in this province. Unlike Ontario, we have covered our hospitals as public bodies within the context of the FOI Act. We already have a standard of protection that isn't, for example, available in Ontario. Therefore the argument of the Ontario Ministry of Health has to be seen in the context of partially an argument against coverage by federal legislation, but also an argument against coverage by provincial legislation within the context of their own FOI Act. And within Ontario there is an ongoing debate as to whether hospitals should be covered under their public sector legislation. So that's something we have to keep in mind as part of the background to their arguments before the federal act.

Generally, so far the B.C. Ministry of Health has been supportive of framework legislation similar to Bill C-6. We have not, in our discussions with them, felt that there has been any real concern about a need for individualized personal health information protection in B.C. They seem to be satisfied with the general nature of legislation that would be similar to Bill C-6.

What happened with Bill C-6 is that when it hit the Senate, the pharmaceutical lobby and other groups of that nature created a bit of a firestorm in the Senate, constantly bringing up the argument about the organizational cost that would be included or would be generated for them. As a result, the Senate made a recommendation and in fact passed an amendment that allowed them a one-year grace period before the legislation would cover the health information sector. So that's why, as Chris mentioned earlier, there's this sort of three-tiered approach: 2001-2002 for health information in the federal sector, then 2004 for that not covered by provincial legislation. Originally, it was intended that in 2001 everything under the federal sector would be covered, but they made an amendment for that purpose.

[1605]

I guess the other key question. . . . You'll see in the back that we've got some Qs and As. The one that you may be asked most by the public is: what happens to physicians' records? Are they covered by Bill C-6? Would they be covered by provincial legislation? The problem is that it's unclear right now as to how C-6 will apply to physicians' records, because there are two issues involved. First, health is a provincial matter, and there are jurisdictional questions as to whether this federal act, which relates to trade and commerce, should apply to provincial health issues and information. Second, Bill C-6 applies to personal information generated or used in the context of commercial activities. It is uncertain -- and the definition of commercial activity does not help us to understand -- whether a physician working with a patient or treating a patient is undertaking a commercial activity. So at this point in time we don't know whether physicians' information will be covered.

It's also important to note that physicians are already covered by their own codes and their own ethical standards with regard to confidentiality. So even though they are not covered by our public sector legislation, they do have a standard of confidentiality that is very similar in nature to the activities or the controls that are already in place.

C. Norman: Two points to add in that respect. One is that there was a federal court case of a number of years ago which confirmed, in opposition to what a physician was alleging, that the information that a physician holds about you is your information. In other words, you are entitled to access to a copy of any information the physician holds about you. The second thing is that any physician working in a publicly funded facility -- in other words, one working in a hospital or a publicly funded clinic. . . . Records of that physician would be considered in the control or custody of the public body.

So we're only talking about those physicians who are not working in a particular facility. My understanding is that the federal government does see that the C-6 net or the provincial nets will in fact encompass them. I think what we're indicating here is that we're not exactly sure yet how they'll get covered, but I think the intention is that they would be.

G. Plant: But to put something that Kevin expressed a minute ago slightly differently, it's only if the exchange of health information can be characterized as commercial activity or "a transaction, an act or conduct that is of a commercial character" that it enters the picture at all. I mean, I can accept the proposition that there might be some debate about the scope of that, and it doesn't surprise me, I suppose, that the pharmaceutical companies might have some concern there. But in terms of the ordinary doctor-patient relationship, if I had to choose which side of the argument I would prefer to be on, it would be on the side of the argument that says that the exchange of information between doctor and patient is not commercial in character. It's something else. But that's something that people will argue about.

[ Page 135 ]

I think, for me anyway, the mystique around the health information thing grows when I lose sight of the fact that we are talking about. . . . It only applies if we can characterize the information transaction as commercial in character. If it isn't, then Bill C-6 doesn't apply.

[1610]

C. Norman: That's correct. But I think that's one of the reasons why, say, in B.C.'s response to private sector privacy, we would need to be sensitive to that fact and determine that if we have provided a standard of protection for health information in publicly funded enterprises, then -- even if there isn't a commercial activity involved -- we would at least want to address whether or not we'd want to provide an equal standard of protection for health information in this province.

A physician operating within British Columbia -- is that one of the holes in the net that British Columbians would be satisfied with? So C-6 doesn't cover it, but as we're finding, sitting back and essentially allowing C-6 to cover a province covers some of the information in the province, but there are a number of holes in that net, such as employee information and provincially regulated entities and health information not involved in a commercial activity. Part of our response will be determining whether we want to plug those holes in that particular net.

R. Kasper (Chair): Does that answer your question, Geoff?

G. Plant: Yeah. Chris is basically helping us understand what we could make our job or not make our job -- at least as a committee -- and the government then does what it wants to do. I'm already of the view that the challenge of figuring out what the correct approach is in relation to commercial activity might be enough for one committee.

R. Kasper (Chair): Kevin, did you want to add something before Geoff leaves?

K. McKee: Yeah. I might add that what this does do, if we take it outside the context of the health information field, is that it also raises the issue of the relationship of other professionals to their clients. What would the relationship between a lawyer, a dentist or an accountant and an individual be? Are those commercial relationships, or are they not commercial relationships? I think that's an area that will have to be investigated. I expect it will probably be one of the first areas before the courts, starting next year.

G. Plant: That insight is helpful, because one of the challenges is to see in practical terms how and where a provincial statute would operate. And to avoid any pitfalls created by unhelpfully vague definitions would be probably a good thing, rather than a bad thing.

K. Whittred: I was just going to ask for your comment. The way that I see the debate in the health information field is that the commercial activity is a result of several steps that happen in the gathering of the health information. So the initial contact between a doctor and a patient, by my definition, would not be a commercial activity. But the information that may be collected then becomes part of either a statistical base or a research base. Then, at some point down the line, after the pharmaceutical company has developed the drug, perhaps based on its research, then you have a commercial activity.

I guess my question would be: how do we build in, how do we do the definitions, or what can you foresee as a way to handle that sort of long process that I think is the main concern that people have?

K. McKee: I think there are a couple of factors that we need to look at. The first is: any legislation only applies to identifiable information. So once information moves from being about an individual into a statistical norm or into a grouping, it's no longer identifiable, and we no longer are faced with an issue of protecting that information.

Where the issue lies -- and this is one of the reasons why I said that there's a lot of confusion in the positions taken by some of the detractors of Bill C-6 -- is that we found it hard, when we were looking at their arguments, to say why you would need the information in personally identifiable form. If what you're doing is research on a group of patients or a statistical group of individuals suffering from a particular ailment, why do you need to know the names of each of the individuals involved? How does that in any way impact the research?

The federal government asked the same question and did not get a real answer to that question. One of the issues that's out there is that it would seem to us that for research purposes you don't need to know the name of an individual in the vast majority of cases. If you don't need to know the name or a way of identifying a particular individual, then you don't have an issue with Bill C-6.

It would be the same in the context of what you're talking about. We may want to say that initially the discussions between a physician and a patient are not commercial in nature, and the transfer of that service between the two stays outside. But what about the transfer of that information by the doctor to a private lab to do some lab work? Is that commercial in nature? Clearly the private lab is acting in a commercial capacity. We're going to have to find a way to create a fine line between the patient-doctor relationship and the commercial activities that underlie that relationship.

[1615]

C. Norman: If I could just add this, I think that one of the difficulties that the federal government's emphasis on commercial activity has created for us is that protecting personal information shouldn't be limited to commercial use of the personal information. We get ourselves all tied up in knots trying to look and say: is the activity of this doctor or this lawyer or this accountant. . . ? Is the collection and use of that information for commercial purposes or not?

Personally, I would prefer to step back from it and define what personal information and what uses collection, use and disclosures of personal information we would find satisfactory so that when you go to your doctor or your lawyer and you give them personal information, you have a confidence that they know the rules of the road around that personal information -- whether there's any potential commercial use of that or not, or whether they choose to give it away. If they choose to donate that information to a research facility and denote it in identifiable form, potentially they might argue

[ Page 136 ]

that it's not a commercial transaction. But I don't think that would be any more acceptable to you or to me than if they sold it to somebody for those purposes.

If we can try, as a province, to step back from the handcuffs that the federal government put around it so that they could use their trade and commerce powers in this commercial activity piece and look at the information we want protected and the rules we want around that information, I think it will allow us to much better serve British Columbians by looking at it in a cleaner way than under that particular lens.

P. Calendino: I think my questions have been answered by the last question and by Kevin. What I was going to say is that the information that a doctor collects about a patient. . . . That doctor, for example, has a large number of patients suffering from prostate illness or something. There are companies that are doing a lot of research and developing drugs, etc., and they're always looking for more cases and more evidence. Now that doctor could transfer the information on all those patients to that company. If they took the name out, they would not be violating Bill C-6 or any other legislation. As soon as they give all the information with the name and without consent, then they would be in violation of the act.

The second part, Chris, is that you were mentioning that the hospitals are covered by legislation in B.C. in terms of collection of information and privacy of that information. But all the doctors, I think, are affiliated to hospitals in one case or another. That patient information gets transferred to hospitals as well. Would that legislation then cover those patients whose files have been transferred to a hospital for some reason or other?

C. Norman: I would think that we could conceivably have a case where a physician had a private practice but also did work in a hospital for which they were paid. The patient information within that medical facility, the hospital that he or she might be working out of, would be, I think, under the control and custody of the public body, in this case the hospital. His or her private practice would be a different instance. In that case, you could have different standards applied for the information depending on where it happened to reside, and in what capacity.

P. Calendino: But it is the same information that basically goes. . . .

C. Norman: It could potentially be, yes.

K. McKee: It's important to note that physicians and other professionals already operate under codes of conduct that are basically very similar to what would be put in place under any kind of a regime within the province. We're not talking about a significant change for them, were they to be covered by provincial legislation. For the most part, it's the same for the business community.

P. Calendino: This is not the case, though, in Ontario at this time -- right? -- or in the U.S anywhere.

[1620]

K. McKee: Correct.

P. Calendino: So doctors are free to do whatever with their information, other than their code of conduct?

K. McKee: Yeah.

K. Whittred: I have one more question. I think it's covered, but there are, as well as health care professionals, multitudes of organizations and even volunteers that have enormous access to people's private records. Where does that fall within the existing legislation or C-6?

C. Norman: You mean with regard to health care or just generally?

K. Whittred: Health care in particular.

K. McKee: If it's related to a provincial public body like a hospital. For example, the volunteers that work within the hospitals operate under the same rules and conditions as any employee of the hospital with regard to the requirement to protect personal information. So in fact when the FOI Act went through, there were a number of training sessions done with hospitals and with regional boards around the concept of understanding that volunteers are under the same obligations as the employees of the hospital. They are required to protect that information as required by the legislation. So in that context, organizations operating in the public sector are already covered, including the volunteers that work for those organizations.

The issue is with regard to the private sector -- like the Red Cross, for example. If they were defined as undertaking commercial activities, then they might be covered by Bill C-6; they probably would be. But it will depend on what they're doing and how it's defined -- whether it would or would not fall within that "commercial envelope." And I think that's what Chris was trying to get at -- that unfortunately Bill C-6, because of where it came from in the federal government, placed restrictions around how it could operate. It had to relate to trade and commerce, and therefore they had to use definitions that fit within that stream. That's why it's created this sort of issue around the commercial relationship. That need not happen at the provincial level.

R. Kasper (Chair): My question deals with -- and I think you touched on it earlier -- the relationship with researchers and other health care providers. Would they be covered by this? Is there some organization called CIHI or something? What is it -- the Canadian. . . ?

G. Plant: Institute for Health Information. It just released its first annual report on health care in Canada.

R. Kasper (Chair): What would their role be -- or other research organizations?

C. Norman: Again, CIHI is a very contentious organization right now, in part because -- as I think some people describe it -- they're neither fish nor fowl. They're not government, but they essentially subsist on government money. They in fact claim that they only use anonymized information. I think there are some who question that claim and certainly some who indicate that they would very much like to get into, if they are not now, dealing with identifiable information. Again, the other issue and that sort of handcuff we continue to have around C-6 on the commercial activity piece is defining what it is that CIHI does with its information. It would appear

[ Page 137 ]

that they sell the results of their research fairly extensively and that they're funded to do a lot of the work that they do both by governments and, to some extent, by the private sector.

My understanding of them, though, is that they will likely make the argument that it's not a commercial activity. So again, as long as we continue to be handcuffed by this definition of commercial activity and not look at it and just say that this is personal information and therefore there should be protection for it, we will continue to have some of these issues around these bodies that don't necessarily fit cleanly into kind of one category or another or that might make an argument that what they're doing is not a commercial activity.

The legacy that C-6 presents for us as we try to chart our own course in this province is to say: "Do we want to cover based on the type of activity of the information rather than have a coverage for all personal information?" In a sense, you say that if it's personal information and it's in the private sector, it is entitled, no matter what's being done with it, to protection. You know, do you want to continue to have the bar? You only hit the bar when you start to do something with the personal information, particularly of a commercial nature.

[1625]

R. Kasper (Chair): So how would they operate in B.C., based on our act -- or do they?

K. McKee: There is some transfer of information to CIHI from the province by the provincial Ministry of Health, but it's in an anonymous form. At least, that's the understanding that we have been given by the Ministry of Health.

R. Kasper (Chair): Right. I think that the commissioner's office, maybe four years ago, made a ruling on that research information being released. It was under strict criteria.

C. Norman: Anonymized form.

K. McKee: It must be in a non-identifiable form. What tends to happen, in fact, is that when they're doing research in the Ministry of Health, if they require some form of identifier, they create one -- mixed-up PHN numbers or some random selection of numbering -- so that they can identify the particular file or patient file, but they have no idea who that actually is in reality.

That key is held by a small group of people so that if, for example, they come up with a wonderful cure for something, they can then relate it back to the name of the person involved. The number of people that actually have access to that information is exceptionally limited, even within the Ministry of Health. They would transfer information to CIHI in that anonymized form. If CIHI comes up with some sort of resolution to the issue, it could then come back to the ministry, which then could forward the information.

One of the arguments that was made at the federal level is that, surely, all research could be done in the same form. The physician treating the individual holds the identifier and the identifying key and provides it in an anonymous form to the researchers. When they come up with something of import, they then transfer it back. The physician translates it back to the identifiable person, which is a way in which the system could operate without having to really release personal information to any large degree at all.

R. Kasper (Chair): My last point deals with the question of commercial activity in regard to health care. I think there might be something in the Health Professions Act, and then I think there's another piece. Is there another piece -- a health care practitioners act? There is something in provincial statute that says that a health care practitioner can in fact give out information or what is deemed to be private information about a patient as long as it's being done in the context of providing a health care service or treatment.

You had mentioned that perhaps there has to be a clearly defined box as to what can be released and under what circumstances, if it is deemed to be of a commercial nature. One could argue that, okay, when people are giving information -- be it a health care practitioner to a lab or to someone else -- there is actually a financial transaction involved, but the information would be given for that person's well-being or treatment.

[1630]

C. Norman: The continuity-of-care definition or concept, as you say, is identified in a number of pieces of legislation and in a fair bit of practice. My understanding is that there have been judicial rulings around this as well, although what it does do is get us back to the issue of whether in fact we consider that the physician's disclosure to a clinic and, say, disclosure to other health care facilities or to specialists or that kind of thing is continuity of care and therefore not a commercial transaction.

Yet there is all the more reason that it begs the question: as long as that information is out of the commercial realm, is it not therefore covered under C-6? And if it's not covered by the public sector act, then in essence one could say you have no privacy protections in and around that information other than whatever codes the medical community might have. If you take that definition to its full extent, it makes the hole in the net a bigger one -- the commercial transaction issue.

K. McKee: If I may continue, that's what was at issue for the Canadian Medical Association. Their concern, when they made their presentations, was that Bill C-6 is based on commercial activity. They perceive that what they do is not commercial activity. Therefore they believe that they would be outside the scope of the legislation. To them that was disturbing. Their belief is that any transfer of information regarding any patient should be done on the basis that the patient consents to the doctor to the transfer of the information.

In other words, if I'm a physician and I'm treating somebody and I'm going to send their information to the lab, I should discuss it with them, and they should be in agreement that that information go to the lab. The way that's done normally is that they fill out a form saying: "Do this test," I take it from their office to the lab, and I hand it in. That's consent. I know the doctor has told me that I'm going to have this test, and I'm consenting to the test by actually taking it and presenting it.

The physicians' argument, the CMA's argument, is that that's the way all health care information should be treated -- that basically all activities relate directly back. So what, in essence, they were arguing before the federal government on Bill C-6 was that they wanted legislation that was outside this concept of commercial activity. They wanted legislation that would cover personal health information in all circumstances, and they made that a very strong argument.

[ Page 138 ]

G. Plant: The model code, which is the foundation of Bill C-6, is a model code developed, I think, largely by the business sector. You've talked about the principle of consent in the context of what the CMA said was their issue around Bill C-6. Did the CMA say anything about the utility of the principles of the model code as being principles that should apply to all transactions?

K. McKee: The initial point of their presentation, the first point they made, was that they had no quarrel with using the model code as the standard to build upon. What they wanted to do was take that as a base and then argue that there should be even higher standards within the medical field. They would like to make it more stringent.

G. Plant: Could you give me an example of a higher standard? I mean, would that be no use without express consent, as opposed to whatever the code says about implied consent?

K. McKee: Exactly. That's exactly what they would do. There would be no such thing as implied consent.

R. Kasper (Chair): So it's written authorization -- right?

C. Norman: Or at least informed consent.

K. McKee: I mean, you could verbally agree with your doctor. They make notation that you have verbally agreed, and then it goes forward.

R. Kasper (Chair): Are there any other questions on this section?

A Voice: No.

R. Kasper (Chair): Now we're going to deal with the last item, which is dealing with consent and justification in Bill C-6. We have sort of touched on it briefly. Chris, that's your section.

C. Norman: Yeah. I'll make this very short.

In looking at provincial legislation, in looking a provincial response in British Columbia, whatever the path chosen. . . . This has come up already in our discussions both with regard to the coverage of C-6 and also in the health information area. The issue here has to deal with the concepts. They're seen as very fundamental concepts. For many privacy advocates, the measure of privacy legislation is the standard of protection that's provided for collection of information. One of them indicated to me recently that once the information is collected, the initial invasion has occurred. So the standard that you have around the collection of information is very important to most privacy advocates.

[1635]

Normally, individual and informed consent is considered kind of a fundamental standard for collection. The individual should consent to the collection of their information. Along the lines of what we've just discussed, the Canadian Medical Association believes that should be a fundamental approach taken with all health information. Some would argue that that should be the fundamental principle taken with all personal information -- financial information, any kind of information you might have.

In instances where collection is allowed. This is where we get to the justification part. If you start from the principle of consent and say, "In all cases or in nearly all cases, you should have consent," there are a number of instances where collection without consent might be justified. Again, another measure of the quality of privacy legislation is: how many kind of carve-outs do you have?

I think some of you were at the privacy conference in Vancouver in the spring. There was a presentation done by the Ontario Ministry of Health individual. He was talking about their proposed health protection information, which is really. . . . Most people have labelled it health disclosure information, because it has a lot more provisions to use information than it does to protect it. If you remember, the individual had finished his presentation talking about how wonderful this act was going to be and that, yes, they theoretically subscribe to the principle of consent.

One individual from the Canadian Medical Association in Ottawa, actually stood up and asked the individual how many carve-outs for indirect collection without consent they allowed. He said: "Oh well, not many." And he said: "Well, can you give us a number?" He said: "Oh well, it's probably a dozen." And he said: "A dozen. So you're saying for the record that there's only a dozen." He said: "Well, maybe two dozen." And then he said: "Now, you're sure it's two dozen; that's the number?" "Well," he said, "maybe three dozen, but it's not too much more than that."

Well, it got a round of applause in the audience. I think the reason that that drew out is that it really laid bare what the legislation was all about. Most privacy advocates would argue that consent should be the principle, and that you should have a very limited number of carve-outs, and that they should largely be a justification carve-out. In other words, the organization should have to justify why it's doing that.

If you look around the country, C-6 sets a very high standard, because it is consent. There is a very limited number of carve-outs, and when there is a carve-out, they must justify it. There must be a justification for why there's a carve-out. Many provincial legislations don't have. . . . Or at least it's contended by privacy advocates that the test is lower in some provincial jurisdictions. The test might be just that it's needed for something or it's necessary for a purpose. That certainly has raised some issues for privacy advocates, and they are ones that jurisdictions that are looking at a provincial response will have to look at in determining what standard they wish to meet.

That's all I'll mention about that particular topic. But it's certainly one I wanted to flag for the committee.

R. Kasper (Chair): Okay, then that's it. Do you have any paper on that?

C. Norman: Yes.

R. Kasper (Chair): Are there are any questions?

J. Weisbeck (Deputy Chair): I just have one more question for Chris. We talked about creating something that's

[ Page 139 ]

substantially similar, and we also talk about our own act. How does that relate? Can we create an act which sort of refers to our own Privacy Act? I've always asked the question of myself: do you take the current act and modify it to deal with this?

C. Norman: Well, there would be a number of options that we could take with regard to provincial coverage. One of those options is legitimately to take the current public sector act, particularly those provisions that apply to privacy protection and writ them larger to the private sector. It would take some customizing; it would take some changes to do that. But that's certainly a viable option; that could be done. I have no way to verify this; it's simply that the definitions of what are substantially similar aren't there. But what has been indicated to us from the federal government is that there are certain basic components of what they would look for in deeming something substantially similar.

Our public sector legislation has all of those things, like limits on collection, use and disclosure, consent for collection, explicit provisions around what uses can be made from the information and, perhaps most importantly, an oversight mechanism such as the commissioner, which we have here. Our public sector act as it currently exists, or the privacy parts of the public sector act, would, I would contend, quite easily meet the test of substantially similar for the federal act. The decision that this province will have to make is that if it chooses to prepare its own response and prepare legislation, it has a number of options open to it, one of which could be to adapt the current vehicle to cover the private sector. Another would be to prepare a separate but parallel piece of legislation, which would do it as long as it met the test of substantially similar.

Another, I suppose, would be to have sector-specific pieces of legislation that would create a patchwork of some sort that we would feel satisfied covered the private sector. But it certainly is a viable option of using the current legislation and writing it larger.

[1640]

J. Weisbeck (Deputy Chair): So we don't have to have one piece of legislation that is substantially similar. Rather, we could draw on a number of them in reference to each other.

C. Norman: Sure.

J. Weisbeck (Deputy Chair): Okay, you do that. Thanks.

R. Kasper (Chair): My question would be. . . . Oh, sorry. I'll let you go first, Katherine.

K. Whittred: I wanted to ask about "for journalistic, artistic or literary purposes." I really have to ask this question. You spoke earlier about the medical profession being governed by its own code of ethics, and that is true of many. Similarly in journalism, you know that the New York Times may have a code of ethics that is quite different from the National Enquirer. Is there any code or standard of conduct that is implied or demanded of journalistic, artistic or literary purposes?

C. Norman: To my knowledge -- and this is just to my knowledge; I could be in error -- there are probably codes in place that govern either parts or all of some of these sectors. I do not know personally if journalists. . . . I understand they have a number of broad-based associations. There is the sort of Canadian journalists' association, and I believe they do have codes of ethics and standards to which they subscribe.

I think one of the key differences to any code or standard between a code or standard in legislation -- and from my understanding, for the public this seems to be a point at issue -- is that yes, it's fine that the marketing association or the insurance people or the banks have codes and that they are a very useful vehicle to raise consciousness and to get a particular organization or sector in compliance in a broad sense. But the major point of contention to the public seems to be the oversight piece. In essence, if you have a complaint from somebody about a bank that is doing something inappropriate, without a legislative oversight and without something like a commissioner, you're in essence going to the bank to complain about the bank's practices. A lot of people have indicated in polls that: "Sorry; even if we're confident that they're doing their best to get to the bottom of it, we'd like some option of going to another independent place to have it looked at if they come back and say, 'We don't see any problem.' "

So it tends to be more of an issue of where you go to get redress or where you go to get oversight, rather than whether they're doing it to code in good faith.

R. Kasper (Chair): We're just going to let Pietro ask a question first. Then maybe. . . .

P. Calendino: Yeah, maybe Kevin wants to add to that.

R. Kasper (Chair): Okay. Kevin, do you want to add to that, then?

K. McKee: I was going to add that the carve-out for journalism for artistic purposes is a limited one. If, for example, a newspaper gathered a list of names for whatever purpose for an article, then handed it over to their marketing people and said, "We want you to go send this information out, sell it to another company -- a subsidiary company or something of that nature -- to try and see if we can get them to all buy copies of a new journal that we're selling," that would fall within the legislation, and it would be governed by Bill C-6. So when they use the information for journalism -- i.e., in the context of making public an article or something of that nature -- it's not covered. But when they use it for any other purpose, then it may be covered if it's commercial. So they can't just sell that information to someone else.

[1645]

Where there are even broader concerns is that there's no real definition of what artistic or literary is. In fact, I asked one of the federal people at a conference recently: "If I publish the information on the Internet, is that an artistic or literary work?" They weren't able to answer that question. So would it be an artistic work, for example, if I took a list of names and addresses, stuck them on the Internet and argued that that was a piece of literature? That will have to be determined by the courts. That's one of the areas that is grey within the legislation.

R. Kasper (Chair): Okay. Does that answer your question?

[ Page 140 ]

K. Whittred: Yes, thank you.

P. Calendino: A different type of question now. We're talking of journalists and literary and artistic endeavours, but what about the police forces and the RCMP and some community groups? In the last little while there have been a number of very zealous community groups who want to protect their neighbourhoods from sex offenders or people who have been released on criminal charges, etc. Some of these people are actually making the names public. Does that fall anywhere under this protection of privacy?

C. Norman: Bill C-6 does provide allowance for law enforcement activities. So if a law enforcement organization requires the information for. . . . Keeping in mind, this does apply to the private sector. So in essence, one of the areas of concern that the credit grantors had with C-6 was their ability to pursue people who default on loans. And C-6 was amended to ensure that if they are trying to disclose information or acquire information to allow them to try to get money owed to them, they would have the ability to do this. The law enforcement agencies such as police forces, etc., are already covered by the public sector legislation.

P. Calendino: Okay. What I don't understand is when sometimes the police do it -- the name of a criminal has been released, or they release the name of a sex offender. Is that in violation of any act, or is that exempted from the act?

C. Norman: In the B.C. public sector legislation, there is a provision for releasing information in what's deemed the public interest. Police forces that have released information on sexual offenders have claimed that provision.

R. Kasper (Chair): Okay. My question then deals with. . . . Would it be possible to expand or amend the existing Privacy Act? There is a piece of legislation on the provincial statutes right now -- you know, as an option.

C. Norman: Again, that could be an option to be looked at. My understanding is that the existing Privacy Act's sole intent is to allow or legitimize a tort action for invasions of privacy. So if a privacy invasion has occurred, it gives you the ability to sue over that particular thing and collect damages. I believe similar legislation is on the books in other jurisdictions. To my knowledge, no other jurisdiction is looking at taking that type of tort action authorization and expanding it big enough to make it cover the rules you would have to follow to avoid the tort action.

K. McKee: If I might add, the other part of that would be that if we were to expand that and leave it within the realm of torts, it might mean a significant increase in workload for the courts.

R. Kasper (Chair): Oh, I see.

K. McKee: You'd have to take into consideration that because it's a tort action, it must be before the courts, which means you would have to go through the process. Also, there would be an expense for an individual in bringing that kind of an action; whereas under a Bill C-6 type of structure or in the public sector under our legislation, generally the costs are limited at least till the stage it reaches the appeal. I think that's a factor that would have to be taken into account.

[1650]

R. Kasper (Chair): Are there are any other questions? All right.

I'd like to thank the people from ISTA for giving us a technical briefing. In many of the instances, it was beyond just technical. I know that you've done your best to keep the committee informed over the past few months. You've given us a lot to think about, and I'd like to thank you for doing the presentations.

No other business? We'll adjourn.

The committee adjourned at 4:51 p.m.

[ Return to: Legislative Assembly Home Page ]

Copyright © 2000: Queen's Printer, Victoria, British Columbia, Canada