Study of the Privacy Act

Letter to the Standing Committee on Access to Information, Privacy and Ethics about the study of the Privacy Act

September 13, 2016

Mr. Blaine Calkins, M.P.
Chair, Standing Committee on Access to Information, Privacy and Ethics
House of Commons
Sixth Floor, 131 Queen Street
Ottawa, Ontario  K1A 0A6

Dear Mr. Chair:

In my letter to your Members in support of your Review of the Privacy Act (the Act) in March 2016, you will recall that I highlighted two concerns regarding Canada’s federal framework for the protection of personal information: the lack of sufficient recourse and remedies under the Act, and the need to improve the ombudsman model for the investigation of complaints.

These are important and inter-related points for your consideration as you make recommendations to the Government on the need to reform the Act. In our last submission, we undertook to provide the Committee with the results of our further research and analysis on these questions to support your study of the Act and subsequent report.

Recasting the role of the Office of the Privacy Commissioner of Canada (the OPC)

Traditionally, the OPC has played an ombudsman-type role in privacy disputes, as was initially envisaged when the Office was established in 1983. In that capacity I pursue compliance through investigations and audits and make non-binding recommendations. As you are aware, I currently do not have order-making powers. Though I can investigate complaints concerning the full array of rights and protections under the Act – and make recommendations to the Government – departments cannot be compelled to undertake or cease any action unless the matter involves a denial of access, proceeds to Federal Court for a de novo hearing and results in a court order.

Parallel to my investigative role, I am also mandated with championing privacy rights in other ways, such as commenting on legislations before Parliament, consulting with departments on various initiatives involving personal information, reviewing and commenting on Privacy Impact Assessments, and intervening in, and in some cases initiating, proceedings before the Court.

Given that I currently do not have order-making powers, my multiplicity of roles – as both investigator and privacy champion – are compatible and pose no legal issue as long as I continue to respect principles of procedural fairness and remain mindful of the distinct functions I assign to different branches in my organization. The question I further explored this past summer is whether this delicate calculus would be altered from an administrative law and conflict of interest perspective, if I were granted order-making powers. Would I be able to continue to proactively promote privacy rights of Canadians, if also expected to act as an impartial adjudicator affecting parties’ rights in specific cases?

Order-making provisions

I realize in the course of your study, and that of the Access to Information Act, the question of order-making powers has been a recurrent one. The Office of the Information Commissioner of Canada has argued that the current ombudsman model is not the most efficient and can present real challenges for citizens seeking redress. As highlighted in my submission to you regarding the study of that Act in May 2016, I fully support that position.

While most institutions eventually agree to my non-binding recommendations, there can be lengthy delays in reaching a satisfactory conclusion given the lack of pressing incentive to do so in a regime that largely relies on voluntary compliance. These lengthy delays are inconsistent with the objective of the ombudsman model, which is to provide a quick and low-cost recourse to ensure that the privacy rights of individuals are respected.

When I last appeared, I indicated that I was not, at that time, seeking order-making powers and that other alternatives should be considered, including the “hybrid” model under which the Newfoundland and Labrador office now operates. Given the key roles of promotion and adjudication at play, and the potential risks that order-making powers could introduce, my Office committed to studying the question further to see how these risks could be mitigated.

After careful examination of the issue over the summer months, I am now of the view that the adoption of order-making powers at the federal level, on balance, would be preferable to the hybrid model. We have concluded that there indeed are legal risks with one body having both adjudicative and promotion functions.  However, we believe these risks can be largely mitigated through a stricter separation of adjudicative and promotion functions within the OPC. It must be said that such separation of functions would necessarily entail some organizational restructuring and additional costs, but we believe the risks and necessary mitigation strategies would be the same even under a hybrid model such as that which exists in Newfoundland and Labrador. Given this, I now recommend that the Act be amended by replacing the ombudsman model with one where the Privacy Commissioner would be granted order-making powers.

Should my office be given full order-making powers, our previous recommendation to broaden review by the Federal Court as articulated in section 41 of the Privacy Act may no longer be necessary. With full order-making power under the Act, individuals would not need to seek recourse from the Federal Court via a de novo hearing as they would be able to obtain a remedy directly from my Office. Further, orders would be subject to judicial review under s. 18.1 of the Federal Courts Act. Departments seeking to challenge my orders would have to initiate these proceedings, carry the burden of proof and be limited in the evidence they could rely on. This would encourage departments to be more forthcoming and timely with their submissions to my office up front during the process knowing that they would be generally committed to this evidentiary basis should the matter be judicially reviewed before the courts.

I welcome the opportunity to further support the Committee in undertaking this important study. Please do not hesitate to contact me through my Parliamentary Affairs Officer, Pierre-Luc Simard, at 819-994-6015, to make any necessary arrangements.

Sincerely,

c.c.: Michel Marcotte, Clerk of the Committee, ETHI