Personal Information Protection Act Review — Issue No. 4

2007 Legislative Session: Third Session, 38th Parliament
SPECIAL COMMITTEE TO REVIEW THE PERSONAL INFORMATION PROTECTION ACT
MINUTES AND HANSARD

REPORT OF PROCEEDINGS
(Hansard)

SPECIAL COMMITTEE TO REVIEW THE
PERSONAL INFORMATION PROTECTION ACT



CONTENTS

		Page

Briefing: Office of the Information and Privacy Commissioner		21
	D. Loukidelis

Committee Business Plan		24

Report on PIPA Conference		25

Chair:

* Ron Cantelon (Nanaimo-Parksville L)

Deputy Chair:

Harry Lali (Yale-Lillooet NDP)

Members:

* Mary Polak (Langley L)
* John Rustad (Prince George–Omineca L)
* Leonard Krog (Nanaimo NDP)

* denotes member present


Witnesses:	David Loukidelis (Information and Privacy Commissioner)

R. Cantelon (Chair): I'd just like to quickly review the agenda. We have David Loukidelis here, who's going to provide some context to our review. Following that, we'll review the business plan and what the plan is to proceed with the advertisements; an invitation for the stakeholders; a brief report on the PIPA conference; and then any other business that members have. Is there anything anybody wishes to raise at this point?

R. Cantelon (Chair): All right, then, David, I'd like to turn it over to you, and we'll invite comments and questions afterwards.

D. Loukidelis: Thank you, Chair and members of the committee. I appreciate the opportunity to be with you today to, as the Chair has just indicated, provide a bit of an update for the committee, as you embark on the next phase of your review of the Personal Information Protection Act, on some recent developments in relation to privacy protection in the private sector across Canada since I was before you at the end of May of this year.

Without repeating the remarks I made on May 29 when I appeared or about my office and how it is we go about our work under the Personal Information Protection Act, also known as PIPA, I propose to update you on some of the work we have been doing and, more generally, to give you a sense of developments across Canada in this area.

By way of doing that, I'd like first to offer some selected perspectives on the importance of privacy to Canadians, as reflected in a poll conducted for my federal colleague the Privacy Commissioner of Canada in March of this year by Ekos, a professional survey firm. I've provided the research staff for the committee with a link to that resource, in case it's of interest to members. I did want to highlight some of the results of that opinion poll, as recently reported by my federal colleague in her annual report to Parliament.

Some statistics for you from that poll. Seventy percent of Canadians feel that they have less protection of their personal information now than they did ten years ago. Only 17 percent of Canadians believe that the government takes protecting personal information very seriously, and only 13 percent believe that businesses take protecting personal information very seriously.

Eighty percent of Canadians place great importance on having strong privacy laws. This is an interesting statistic: fully 69 percent of us believe that we are doing a very good or good job of protecting our own personal information, yet 46 percent of us continue to carry our social insurance card in our wallets — the social insurance number, of course, being one of the prime keys, if you will, to identity theft.

At the same time, while we believe that we're doing a very good job or a good job of protecting our own personal information, just about half of us don't know that warranty cards, when we purchase a product, are not legally necessary in order to gain the protection of a warranty offered by a manufacturer, and 40 percent of us don't know that many companies use the warranty card information solely — or as well as for warranty or recall purposes — for marketing purposes.

The last figure is that 72 percent of Canadians believe that unsolicited junk mail — or spam, as it's known — remains a significant problem in Canada. Indeed, this is an area in which an expert committee has called for action by the federal government, and that has yet to occur.

These are some figures or statistics from earlier this year that I think really underscore the findings of the select committee of this Legislature in 1999, when it did its own polling. Personal information protection is a high priority for British Columbians and, as I've just illustrated through these statistics, for Canadians more generally. What was true in 1999 quite clearly remains true now, some eight years later. I believe that this sets some good factual context, if you will, for the work that this committee is doing in reviewing the existing private sector privacy legislation here in British Columbia.

Turning to the more particular and to the experience of my office for the year to date, when I was before you in May, I provided you with a snapshot of our work for the fiscal year ending '05-06 as reflected in our then most current annual report. Since that appearance, I've reported again to the Legislative Assembly for the fiscal year '06-07, and today I'm just going to offer you some anecdotal information about our work in the more recent fiscal year and in the year to date since April 1 of this year.

That said, the bottom line continues to be the case that most of the complaints we receive from individuals about private sector organizations' practices are about inappropriate collection, use or disclosure of personal information; collection of personal information without appropriate notice or consent; use of personal information once collected for a particular purpose for another purpose without getting fresh consent for that other purpose; and inappropriate or unauthorized disclosure of personal information, again without notice or consent.

Those complaints form the bulk of the matters that come before us through complaints or requests for review. In addition to those, we also continue to have a fairly high proportion of complaints that are about organizations' ongoing failure to give individuals access to their own personal information, which is a right, of course, given under the legislation.

In addition to opening formal complaints files in these matters and addressing them — primarily through mediation and investigation but occasionally through a formal inquiry process resulting in an order — we have continued our work in responding to requests for information from organizations, individuals and stakeholder groups. We've continued our work in providing, wherever possible on a proactive basis, guidance for organizations to help them comply with the legislation both in letter and in spirit, recognizing in the latter case, as I mentioned when I was before you in May, that good privacy is good for business.

Since I was last with you, we have issued, with our colleagues in Alberta and federally, joint guidance on the ability of retailers to ask customers for photo ID — when using credit cards, for example.

We have reached the final stages of part 2 of our FAQs, frequently asked questions, on collection of personal information in the hiring process. This latest version will address issues such as medical testing as a condition of employment, aptitude tests, drug and alcohol testing and matters of that sort — in response to requests for information from employers in the private sector.

We're working on FAQs for condominiums. As I think I mentioned in May, a surprisingly large number of the complaints that we've had in the last couple of years have related to what strata corporations are doing with personal information of residents as well as employees.

We're working on landlord and tenant FAQs to help landlords and tenants when it comes to the collection, use and disclosure of tenant information when people apply for rental premises.

We're about to embark, having consulted with non-profit organizations, on FAQs to help charities and other non-profit organizations comply with the legislation.

Moving to the developments across the country. As I recall mentioning to you in May, a committee of the Alberta Legislative Assembly, as mandated under Alberta's Personal Information Protection Act, has been reviewing Alberta's legislation, which is very similar to but certainly not identical to British Columbia's PIPA. That committee, most recently having held a number of public hearings and having received written submissions from a variety of stakeholders, met on October 15. Judging from the transcript of the committee's meeting, it appears that a draft of the committee's final report had been circulated to members the week before.

It would be my guess — and it really is not much more than a conjecture — that the committee is about to report back to the Legislative Assembly in Alberta. My understanding is that the Legislative Assembly only began to meet again last week, I think it was. So I think it's very much a matter of in the next short while — again, speculation — that the committee will be reporting back.

I mention this, of course, because of the similarities between the two laws. The fact that the two laws were developed jointly by public servants in both provinces, in my view, means that what the Alberta committee has to say will be of interest to this committee. I would certainly urge the committee, when that material is available, to take it into consideration so that the work that's been done in Alberta can be of benefit here in British Columbia to the extent applicable.

Similarly, the report of the parliamentary committee to review the Personal Information Protection and Electronic Documents Act, which is the federal private sector privacy law, proceeds. The report was tabled in May, just before we last met together. Since then, the government, through an Industry Canada consultation document, has responded to the recommendations for reform in the federal private sector privacy legislation.

Roughly two-thirds of the recommendations made by the PIPEDA review committee have been accepted by the federal government, but some of the major recommendations for legislative reform that the committee made have not been immediately accepted by the government. Industry Canada has embarked on a consultation process to get further input from industry, businesses, consumers and civil society on those recommendations.

The ones that are likely to be of interest to this committee, the recommendations that are out for further consultation, involve breach notification — I'll come back to that in a moment — the whole question of work product and whether the federal legislation should have a concept of work product, which is found in the British Columbia private sector law.

There's the issue of lawful authority for organizations to disclose personal information to law enforcement authorities; the question of consent by minors to collection, use or disclosure of their personal information; and also alternatives to designation of investigative bodies, which is a pressing issue federally but not one that in my view arises so immediately at all in the provincial context.

One other issue I should mention that is relevant because of recent federal developments is the whole issue of ID theft, to which I've already referred. When I last appeared before you, there were questions about identity theft and what might be done to help prevent it or to cut down on its incidence, because of course, it is a crime that is on the rise.

A few weeks ago, as part of the omnibus criminal law reform bill introduced by the federal government, amendments were proposed to the Criminal Code that would create new offences related to identity theft, that would — roughly, to paraphrase — make it a criminal offence to possess personal information with intent to use that personal information to defraud another — offences that do not now appear in the Criminal Code and that I think will equip law enforcement agencies with important new tools, if I may say, to combat ID theft.

I mention this because, of course, identity theft is an issue that is going to come up for you. Certainly, the Ekos poll to which I've already referred shows that it's really at the forefront of the minds of many Canadians, because 77 percent of respondents to that poll believe that government agencies and affected individuals should be notified if sensitive personal information is compromised as a result of a privacy breach, and 66

percent believe that government agencies and affected individuals should be notified if non-sensitive personal information is compromised.

The link, of course, to identity theft lies in the concern that if personal information is lost or inappropriately disclosed through a so-called privacy breach — an unauthorized disclosure of personal information, in other words — identity theft may result from that. For example, if through careless disposal of credit card applications or loan applications, identity thieves are able to come into possession of that information and make use of it to obtain credit cards falsely and so on…. There is a link, it is said, between that inappropriate disclosure, that so-called privacy breach, and identity theft. That clearly is something of concern to Canadians, as indicated by this poll.

The federal government is consulting on this whole question, again related to identity theft, of whether or not the federal private sector privacy law should require organizations that have, in effect, lost other people's personal information…. If an organization loses its customers' personal information, should there be a legal duty to notify those customers and/or the federal Privacy Commissioner of that loss — in the case of the customer, so that they can take steps to protect their credit rating and otherwise to protect themselves from identity theft?

That is a fairly hotly debated topic. It's quite clear from the submissions made to and the testimony given to the parliamentary committee to review PIPEDA that there is a wide range of opinion on that issue. Of course, it remains to be seen what the government will do once that consultation process is closed.

For my part, I suspect that similarly you will, as you embark on your work, be hearing from members of the public and organizations on this issue. It is my guess that this will in fact be quite a prominent issue for you. I wanted to alert you to the fact that in the federal context this is something that has yet to be resolved, and it remains to be seen, of course, what, if anything, the committee in Alberta will be recommending finally on that issue.

The last point I wanted to touch on today, before inviting questions from you, is the question of stakeholder consultation and so on. I again respectfully urge the committee to consider holding public hearings, as I said to you in May — certainly, I would recommend, in the lower mainland — and also to invite submissions from a broad array of stakeholders, whether they are businesses, non-profit organizations, consumer groups, the public generally and stakeholder groups as well. I think you'll get a pretty rich and varied array of responses from them.

That said, I will be making a submission to the committee when the time is right. For my part, as I think I've indicated before, it is unlikely that I will come forward and recommend to you any major substantive policy changes in the legislation. I've said before on a number of occasions publicly — and I continue to believe — that the policy choices reflected in the legislation are sound and remain sound.

To the extent that I have anything to say to you, it is very likely that I will focus on questions I've already touched on in an earlier appearance before you around the drafting of the legislation and some of the complexities — unnecessary complexities, I believe — introduced into the interpretation and application of that law, both in terms of its effect on our ability to cost-effectively and efficiently administer the legislation but also given the implications for private sector organizations faced with complaints, faced with investigations by my office and the challenges they face in actually being able to figure out what they're expected to do under the legislation when faced with official contact from my office.

That said, I'm happy to answer any questions that committee members may have and to offer any thoughts on any points that you might wish to raise.

L. Krog: I find the statistics you report arising out of the polling not surprising. Although when you actually hear them, I suppose they're still quite striking in terms of the numbers of Canadians who take this issue very seriously.

You've concluded your presentation by suggesting that you probably will not be making any major recommendations with respect to legislative change of our statute, which you say is very similar to Alberta's. I appreciate that I'm asking you to speculate a little, but I'm assuming there's always a certain amount of discussion between various public bodies.

Do you have the impression that there may be recommendations made in Alberta that will suggest significant changes? If so, what are the issues that have arisen, even if you can't comment specifically, during the course of their review?

D. Loukidelis: I think there are two things I can touch on. I'm basing what I'm about to say on my reading of committee transcripts and some of the submissions that have been made to the committee in Alberta.

Just before the bill that is now the Personal Information Protection Act was passed in Alberta in 2003, a decision was made to amend it to exclude not-for-profit organizations, except to the extent that they collect user-disclosed personal information for commercial purposes. My read of what's gone on before the committee to date and what the committee has indicated suggest that they may well recommend, finally — and they've taken steps and said things about this already — in their report that the legislation be changed to now encompass not-for-profit organizations, thereby bringing it further into line with British Columbia's law.

Another issue is that of work product. B.C.'s law has an explicit work product exclusion from the concept of personal information. The intent is to ensure that work done by employees for an organization for their

employer…. A memo that I might write, for example, for a mortgage company for which I work is not somehow then my personal information, which then gives me some control over it, respecting which the organization has to get consent before it can make use of it. That's explicitly addressed in the B.C. legislation.

It's one of the recommendations that's out, again, for further consultation for amendment in the federal legislation. That's something I think you may well see in the Alberta context in terms of legislating that more explicitly in the Alberta context.

One of the challenges I've heard from time to time is that sometimes information in the health care system…. There are some challenges in information being shared between different authorities or between different organizations in health care, particularly for things like research as well as some of the statistical information that can be collected in hospitals.

I'm wondering your opinion on the current act with regards to health care information — whether or not there is a need to take a look at changing that from a perspective not just of the privacy of information for the public but also for being able to better serve the public with the information that we have available.

D. Loukidelis: I'll answer that in two parts. First, by way of introduction or setting of context, of course there are considerable investments being made in this province, as elsewhere in Canada, in electronic health records and health information systems. Those are investments that are being made almost entirely in the public sector, and in the public sector we have, of course, public sector privacy requirements, or the Freedom of Information and Protection of Privacy Act.

Those provisions, in my view, are entirely robust enough to allow the sharing of personal health information of particular patients within the circle of care for the purpose of the diagnosis and treatment of those patients. To the extent that concerns are raised in a given instance that somehow the public sector privacy law has inhibited the timely and full exchange or transfer of information for the purpose of diagnosis and treatment, I would be skeptical that there actually is a problem in the sense of how the legislation works — as opposed to mistakes, perhaps, or omissions in the particular case.

When it comes to research, again the Freedom of Information and Protection of Privacy Act, through section 35, has a very robust and, when it was enacted, a very forward-looking set of rules around disclosure of personal information for research purposes. They have worked well, in my view, and continue to serve well to allow research to go on.

The question of whether or not personal information — and it bears emphasis at this point that we're talking about information on identifiable individuals — can be shared for the purposes of program evaluation…. Quality assurance and resource allocation are other issues. Certainly, the public sector privacy provisions allow the collection, use and disclosure of personal information for those purposes if the public body — and again, we're talking public sector — sets about it in the right way.

Again, I would take the view that the legislation, for the very greatest part, is more than adequate to the task of ensuring that information flows are there and of ensuring quality of service, efficiency of service and what have you.

When it comes to bridging the gap between the public and private sectors and health privacy issues there, as I mentioned when I was before you in May, unlike four other Canadian jurisdictions, British Columbia has not taken the approach that there has to be a sector-specific health privacy law. Alberta, Saskatchewan, Manitoba and Ontario all have health privacy–specific laws.

The laws here in B.C. — the Personal Information Protection Act and the Freedom of Information and Protection of Privacy Act — are certainly a very sound basis for dealing with privacy issues as health information crosses between the public and private sectors. Whether there needs to be amendments to those two laws to make them work better, particularly in the electronic context, is ultimately a question, obviously, for policy-makers. Whether there should be a sector-specific third privacy law in British Columbia with which the public sector and the private sector must comply is a question for policy-makers as well.

R. Cantelon (Chair): Seeing no further questions, I will move to the next part of the agenda, which is to review this business plan.

R. Cantelon (Chair): The intent of the plan is as follows. We're meeting today to set things up. It will consist, in discussions with the Clerk's office, basically of three things. We'll be sending out invitations to the usual suspects — that is, the people who replied in the first place to show concerns about initiation of the act. That list will be circulated to all members of the committee. If you see anybody that you feel should be added to that list, please feel free to do so, and the Clerk will send them an invitation as well. That draft e-mail is here in your papers.

The other two parts of it will be doing an invitation to public hearings, which will be scheduled to fit everybody's schedules. The idea would be sometime towards the end of January or beginning of February. Then the third part will be a newspaper advertisement to invite written submissions, e-mail or otherwise. We'll have specific invitations: a public invitation to submit applications and then two public hearings, one in Victoria and one in Vancouver. All submissions are to be presented and turned in by February 15.

Following that, the commission will then review the submissions, have discussions and move towards a final report before the Legislature rises. This, of course,

does not preclude us from specifically requesting materials from Alberta, the federal government or any other source we may wish to draw upon for assistance. That's the concept.

I would hear a motion to adopt the business plan and then discussion on that plan. Any discussion or modifications?

L. Krog: It strikes me — I would make this request, and it may well be underway — that Mr. Loukidelis's office and he himself be consulted with respect to a list of potential invitees, if you will, to make sure that they do have an opportunity to make submissions to the two committee hearings. I suspect that that information and the groups are probably fairly widely known, but I think we should.

The other question I have is in terms of advertising. How broad will the advertising be provincewide? Are we talking the major newspapers in the major communities or just Vancouver and Victoria? In other words, just a little more flesh on it.

R. Cantelon (Chair): Good question, Member. Yes, we did consult with Mr. Loukidelis on that. He reviewed the list and made additions. I'll defer to the Clerk to answer the question regarding advertising.

C. James (Clerk Assistant and Clerk of Committees): On the matter of advertising, we thought we would advertise in the major dailies throughout British Columbia at least once. Then I have a press release, which will be circulated through the usual channels, that would hit virtually every community.

In terms of the list of expected invitees, Josie Schofield is in possession of the list, I believe. If not, she's aware of the ones…. And we'll share that with you, of course.

R. Cantelon (Chair): Of course, this does not preclude the research individual members may take, and the next report indicates some of that, that they wish to bring to our attention. We hope you do take an active interest in bringing your thoughts to the committee's deliberations.

R. Cantelon (Chair): The last item on the agenda is the PIPA conference. I was unable to attend, and I apologize to Mr. Loukidelis. This certainly, if you read through it, gives a lot of information and websites. It's a rich source of information that you can review and avail yourself of. I'm not going to ask you to review it or make comment now, but certainly at the next meeting you may bring issues forward, if you wish, at that time. It will certainly give you some sites.

Mary Polak, the member for Langley, attended; so did Josie. I'm sure Mary would be happy at this time to make any comment she wishes to make, since she was there.

M. Polak: Josie's done a masterful job of outlining what happened. It's great.

J. Schofield: Could I add that at the conference I picked up a map of privacy laws to illustrate the complexity of the legislative context. That's another addition from the conference.

R. Cantelon (Chair): Thank you. We welcome that information to assist us in our task.

It is going to be challenging, and this will probably be the quietest meeting we have in terms of information that's going to come at us. We're going to certainly seek all the members' input and diligence in preparing this report.

If we're all in agreement, I have no further business. Does anyone have anything else they wish to raise?

Hansard Services publishes transcripts both in print and on the Internet.
Chamber debates are broadcast on television and webcast on the Internet.
Question Period podcasts are available on the Internet.

Committee Staff:	Josie Schofield (Committee Research Analyst)

REPORT OF PROCEEDINGS (Hansard)

SPECIAL COMMITTEE TO REVIEW THE PERSONAL INFORMATION PROTECTION ACT

REPORT OF PROCEEDINGS
(Hansard)

SPECIAL COMMITTEE TO REVIEW THE
PERSONAL INFORMATION PROTECTION ACT