Appearance before the House of Commons Standing Committee on Industry, Science and Technology on Bill C-27, the Electronic Commerce Protection Act
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
June 18, 2009
Statement by Elizabeth Denham
Assistant Privacy Commissioner of Canada
(Check against delivery)
Thank you Mr. Chairman and members of the Committee for inviting our Office to address you on this important government initiative. I am Elizabeth Denham, Assistant Privacy Commissioner, and I am joined today by Hedy Kirkby, Acting Senior Legal Counsel and Carman Baggaley, Strategic Policy Advisor.
The Office of the Privacy Commissioner of Canada has long called for anti-spam legislation. We welcome and support the introduction of the Electronic Commerce Protection Act.
This is an important piece of legislation that addresses a serious problem. Much more than a mere nuisance, unwanted electronic messages, or spam, has significant consequences for our economy, affects productivity and undermines confidence in electronic commerce.
This legislation has the potential to help both individuals and organizations deal with unsolicited electronic messages and it provides important redress mechanisms, including a private right of action.
We believe that it strikes the right balance between giving people greater control over the e-mail and text messages they receive while allowing legitimate businesses to continue to communicate with their clients and customers.
The legislation will help us fulfill our mandate to promote the protection of personal information. E-mail addresses are personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA). Our Office is concerned about e-mail addresses being collected and used to send spam without consent. We are also concerned about the growing use of spam e-mails containing malware or spyware to collect personal information in order to commit frauds such as identity theft.
I should also add that we see this legislation as complementing S-4 that will amend the Criminal Code to deal with identity theft and related misconduct.
Role of the Privacy Commissioner
The Canadian Radio-television and Telecommunications Commission (the CRTC), the Competition Bureau and our office will share enforcement of the Act and we look forward to working collaboratively with these two agencies and Industry Canada in carrying out our new responsibilities, including educating the public about this important new legislation.
ECPA contains provisions to facilitate consultation, referral and information sharing among the three agencies to enable more efficient and effective investigations and enforcement actions.
The three agencies will also have the authority to share information under written arrangements with foreign states where the information may be relevant to an investigation under a foreign law that addresses substantially similar conduct. This is an important provision that will help us deal with the challenge of dealing with a problem that does not recognize national boundaries.
The CRTC and the Competition Bureau will have shared responsibility for enforcing the anti-spam provisions—the provisions dealing with the sending and the content of electronic messages. The Privacy Commissioner will have responsibility for investigating related contraventions of PIPEDA—specifically, the unauthorized collection and use of personal information through e-mail address harvesting, dictionary attacks and the use of spyware to collect personal information.
The legislation will not change the existing enforcement powers of the OPC, nor is it expected to prompt a significant increase in new complaints to our Office. We anticipate that many complaints will be directed to the CRTC or the Competition Bureau.
Amendments to PIPEDA
The bill “imports” two significant sets of amendments that have been discussed in the context of the review of PIPEDA. Under the first set of amendments, the Privacy Commissioner will have the discretion to decline to investigate a complaint, or to discontinue a complaint investigation, including where the matter could more appropriately be dealt with by either the CRTC or the Competition Bureau.
Under the second group of amendments, the Commissioner will have the authority to collaborate and exchange information with all provincial counterparts, not just those with substantially similar legislation, and with foreign counterparts who enforce laws similar to PIPEDA.
To be clear, these amendments apply to all our activities, not just those related to combating spam.
Investigation of Complaints
Under the proposed amendments to PIPEDA, the Commissioner may decide not to accept a complaint if she believes the complaint could more appropriately be dealt with under other available procedures—this includes procedures provided for under other federal or provincial laws, or grievance or review procedures. A complaint may also be refused if it is not filed within a reasonable period of time from the date when the issue arose.
The Commissioner will notify complainants and the respondent organization if she decides not to investigate a complaint and she will provide reasons for her decision. The Commissioner may reconsider a decision not to investigate if satisfied there are compelling reasons to do so.
As well, the Act provides the Commissioner with the discretion to discontinue some investigations, for example, if she is of the opinion that there is insufficient evidence to pursue the investigation or that the complaint is trivial, frivolous or vexatious or is made in bad faith.
Rationale for Greater Discretion
The Office of the Privacy Commissioner of Canada has previously asked Parliament in the context of PIPEDA Review to provide the Commissioner with the discretion to refuse and/or discontinue complaints.
Traditionally, privacy issues have arisen in the context of interactions between one person and an organization. They have come to light as a result of a complaint by an individual. More and more often, however, critical privacy issues are arising from systemic threats resulting from rapidly advancing information technologies, including Internet applications and surveillance technologies. This discretion to refuse and/or discontinue complaints will allow our Office to better focus investigative resources on privacy issues that are of broader systemic interest.
In closing, I would like to thank the Committee for providing us with the opportunity to explain our role in enforcing this important new legislation and why we believe that this initiative will help the Office of the Privacy Commissioner of Canada better protect the privacy interests of Canadians.
- Date modified: