Electronic Commerce & Privacy Legislation: Building Trust and Confidence
This page has been archived on the Web
Information identified as archived is provided for reference, research or recordkeeping purposes. It is not subject to the Government of Canada Web Standards and has not been altered or updated since it was archived. Please contact us to request a format other than those available.
Notes for an address to Bill C-54: The Personal Information Protection and Electronic Documents Act
and the Role of the Office of the Privacy Commissioner
February 23, 1999
Privacy Commissioner of Canada
(Check against delivery)
I have divided my brief keynote remarks into two parts. I believe I should start at the outset at least with a brief reminder of what lies underneath all Bill C-54 and Electronic Commerce legislation. If you like, the philosophical underpinnings to all of these things.
Eight years ago I stood before a meeting very much like this one, a mixed group of public and private sector people, perhaps in this very hotel. It was put together by the same gentleman, Tom Riley, as this one, and I recognise at least a few faces here today who were present at what now seems like a long-ago occasion.
In that particular speech, I issued a warning, and a call to battle, if you like, a warning that something very precious to us all was in serious if not dire peril, something so precious that its disappearance inevitably would alter the very fabric of our lives and our society.
The warning was delivered with all the brashness, the confidence and urgency of a newly minted privacy commissioner, and some might have thought it was also tinged with impracticality or naivete, and may even have been a touch extreme here and there to some of my hard-bitten and experienced colleagues.
The call to arms was in the form of an appeal to all present that morning, and those beyond the hall, to go forth freshly resolved to be vigilant, and to recruit your colleagues and friends in the same cause.
And what is this cause? Nothing less that the preservation of a social system distinguished by personal freedom, autonomy and dignity of its members, and which yet retains those elements of mutual respect for one another which would permit us to claim the title of a civilised people.
Of course, I linked that cause directly, inextricably with the fate of privacy, and I am sure there were some present at the time who might have thought that I was really overdoing it a little bit, that attributing to such a commonplace notion such lofty characteristics was stretching the point just a little bit.
Yet if I got anything right in that speech, I think it was the clear connection between those two things. After eight years, I am more than ever convinced that privacy is the sine qua non, the absolutely indispensable ingredient, to constructing and maintaining a decent social environment.
Last week I had the pleasure of addressing the Senate of Canada about this issue, and in that speech I made the case that privacy is simply just another word for freedom. I might have added that it's an unfortunate word to serve such a high duty, because it conveys notions of reclusiveness, or separateness, or even rejection. What it really is, is merely a short and convenient word that embraces a complex set of values and considerations which, taken all together, have in every age set the terms of our social interaction.
And to really understand the truth of this assertion, put it this way: if you want to measure the degree of freedom that is extant in any particular society, look first to the degree of privacy which its citizens can by right command. You will find a striking correlation. And I only have to mention the experiences taught to us in this century by some of the totalitarian societies with which we have had to contend to make my point.
So privacy may be a tired, beaten, overworked and overused word, but if you examine it closely, give the tarnish a rub, you see that it still glows with the same light that illuminates the pathways that are trod by free men and free women. It's big stuff.
Look back over the last eight years. Would you say that society has improved in the last eight years? Would you say that the terms of social interaction are better or worse? The answer is self-evident. I think society has been coarsened a little bit in many ways, it's meaner, it's rougher. Our media are tougher, are less forgiving, are less understanding, are less considerate. Our public administration and businesses are meaner and tougher than they were.
And I don't think it's any accident that during those eight years, the right to a private life has suffered the worst battering and bruising that I have witnessed in my own lifetime, with the single exception of war, when, of course, we had to give up a good deal of our freedoms for the simple purpose of saving our lives.
So the warning I uttered in 1991, in my view, is still valid. Vigilance is still required.
There have been many thousands of miles and thousands of cases, and hundreds of speeches that I've made since then, but my basic attitude has never altered about the desperate necessity to preserve a good element of private life in our society.
There have been many defeats along the way and a few victories and occasional flickers of light.
In the public sector, my office has experienced much willing co-operation from the federal public service.
In the private sector, I have been pleased to see a growing awareness of the problem, and even some willingness to respond in constructive fashion.
And finally, what brings us here today, is something that might be described as a major breakthrough. A bill now before the Parliament of Canada, Bill C-54, extends beyond the reach of the federal public service for the first time, legal privacy rights in one very important area of the privacy spectrum.
The bill represents, I think, a courageous act by the Government of Canada because it is not without its controversy. It breaks new ground, it asserts a federal constitutional power in areas where the government has been very reluctant to tread in recent years, all in the name of protecting people's rights to personal informational freedom. This is the first comprehensive step towards giving individuals some legal control over their personal information in commercial transactions in this country, with the single exception of the province of Quebec, which has for several years past enjoyed legal privacy rights that have been denied to the rest of Canada.
There are, in this bill, many many good things. And I want to say at the outset that I certainly support it in its generality and that I support many of the particular features that are in it.
When I started out on this journey, eight years ago, I was a skeptic about the need for any further legislative action on the part of the federal government. I am, by disposition; opposed to any unnecessary extension of the federal power into our private lives , we have enough of it already. I felt then that the marketplace could be relied upon to deal with these problems.
But as time went on, I changed my mind for a variety of reasons. The first, and not the least, was what I considered to be an inadequate response by the private sector, the second was the extension of a common data protection standard in Europe and the promise of possible barriers to informational exchanges as it came into force, the third was the very extensive transfer of federal government activities into the private sector and with that a consequent potential loss, and in some case, an actual loss, of privacy rights that had previously been enjoyed by federal government employees. And finally, the fact that it was becoming ever more difficult to distinguish what was a public sector and a private sector activity, given the enormous amount of informational exchanges that are going on and that will continue to grow.
All of those things led me to believe that we really had to do something to establish legal privacy rights in the field of personal information in the commercial world if we were ever to salvage anything at all.
One of the good features about Bill C, 54 is that it builds upon the CSA code which was developed by a committee of both public and private sector people and thus represents a consensus about this issue among some of the major players in the commercial world. As such, it does in a sense represent something that they created and over which they can claim some ownership. And if it were not sensitive to commercial requirements, they would only have themselves to account for it. Somebody said the other day that, as a consequence, the CSA Code has some "moral force" in the business community.
Certainly Bill C, 54 deals with one of the major problems that we have now in the business world, it establishes a level playing field and it should help to prevent rogue informational practices from tarring the reputation of the rest of the private sector, most of which is responsible and law, abiding. It does put the onus on business for the first time as a collectivity to serve their customers information interests.
There are some very novel aspects to this bill that really set it apart from most others. For one thing, this is a bill in which the Government of Canada proposes to invoke its constitutional power under the Trade and Commerce powers of the British North America Act. It will also extend this bill to that portion of the business world that falls under provincial jurisdiction if provinces do not act within a three year period to provide equivalent protection through their own legislatures.
I'm very glad to see that. I expect that over the course of time most of the provinces will act. Some will not, I think, because they will be quite happy to live with the federal act (here I'm thinking of the smaller provinces.)
Here is a strong incentive for the provinces to act in ways that will harmonize their legislation and provide a true national standard for data protection in this country.
The bill contains, one thing, without which, I felt, it would be essentially nothing more than a statement of good intent and that is independent oversight. It assigns to the Office of the Privacy Commissioner the role of investigating complaints, which have proved insoluble through the normal complaint mechanisms of business, itself, and it preserves, so far, at least, the role of the Privacy Commissioner in an ombuds function.
There has been a good deal of debate within the committee hearings whether the Commissioner has been given inadequate powers to deal with the business world. And there have been some consumer associations that have said that the Commissioner should be able to write orders. I fervently disagree with that concept.
I feel particularly when you are treading into a new field such as this that the path of mediation, negotiation, problem, solving rather than blame, finding is the right way to go. It is certainly the way that we operate now in terms of relationships with government departments. In the course of my eight years we have probably handled something in the neighborhood of 17,000 complaint cases and we have only had to go to court on a mere handful of those.
It is a non, confrontational, non, adversarial relationship which allows for people to meet each other in a civilized atmosphere to try to get to the bottom of whatever it is that has given rise to the complaint and find not only some relief for the complainant but also to fix any systemic problem that underlies it.
The other terribly important element in this bill, from my point of view, is that it provide my office, for the first time, with a specific mandate to conduct public education exercises. That is something that is absent from the existing federal Privacy Act and something that we have long needed. I hope that one day soon this will be corrected by the Government of Canada when it takes a look at the federal Privacy Act, which will, at least, have to be brought up to the same standard as now proposed to apply to the business sector.
A few weeks ago, I was asked by one of the Members of Parliament at the Commons Committee reviewing Bill C, 54 what in my view was the single most important privacy problem in this country? And I had no difficulty with that. The most important single is ignorance. , unawareness. If we had a more informed and enlightened body politic, a great many of the things that are happening today would not be happening and as a consequence we have got to make strenuous efforts to tell the public more about the way government and business operate in the field of personal information. And the Privacy Commissioner, assuming the office is
adequately funded for that purpose, will play a key role. The more people know, the less fear there is and the more informed decisions and choices they can make.
The Commissioner, bereft of the power to make any orders, has to depend, as a consequence, on his or her powers of persuasion, and the power of embarrassment, if you want to put it that way. I've always thought that this was sufficient. I know of no government department that liked it very much when the Privacy Commissioner of Canada had to take them to the woodshed in any public way, and I feel that this becomes an even more effective device when it comes to business. Business depends for its very survival on a consuming public that has confidence that its rights are being respected. So no business will take lightly its obligations under this act.
I feel that that is a far more effective process than one in which a Privacy Commissioner makes a finding and it is immediately appealed by some corporation's lawyers to the Federal Court or beyond. That can tie things up for years and in the end you get no real solutions to the problems, you get an argument among lawyers that enriches them but impoverishes everyone else. And I don't mean just in a financial way.
I'm looking to solve problems, not to embarrass people, not to impede business, and not to spend a lot of time in the courts.
There are problems with this bill. Some aspects of the CSA Code need improvement, we've suggested those. There are some ambiguities in the bill. We need a better definition of "personal information" in the bill. The definition of "commercial activities" needs to be improved. There are a number of observations that I could make of that kind.
There are some serious problems with it as well where the bill allows the Minister of Industry to delegate the powers of the Privacy Commissioner to other persons beyond the Office of the Privacy Commissioner. That, I feel, can lead to perceived if not real conflicts of interest. No department of government, which may be subject to investigation by the Office of the Privacy Commissioner, should ever have the right and authority to diminish his powers by delegating them to some outside agency. I have also made these observations to the Committee of the House of Commons.
But in the main, this is a very good bill and I hope there will not be any disposition on the part of private sector entities who are going to make their observations to the Commons Committee to nibble this thing to death.
We are embarking into a new field and I would rather see this bill with whatever improvement it might yet need get into the law now so that we can start work with it, so that we can find out where it is most effective and where it needs to be fixed. It may be that the code will be improved as time goes on. But what we have here is a very solid beginning to what has been desperately needed in this country for a long time, which is to establish your legal rights to the control of your information.
This is not some new Eureka, like, Edisonian discovery, it has been in existence in Europe for many years, it exists in other jurisdictions, like New Zealand, and in other countries with similar economic, social and political system as ours. We're in the process of catching up, high time!
In the course of all this, I hope we can also refer to the existing Privacy Act, which does need fixing badly. Some of the exemptive clauses are far too broad. I have always thought, for example, that it was a scandal that we had a Privacy Act that allowed investigative bodies to exempt from any kind of access by people to information simply because the information had been gathered in the enforcement of any law of Canada or a province. No exemption, in my view, should be even permitted, that did not have the capacity to demonstrate some injury to the enforcement process. It is altogether too tempting for bureaucrats, either lazy or with something they would like to hide from the public at large, to simply say, "Sorry, this was gathered by an investigative body, you can't see it!" Not good enough! So, I'm pressing for that change.
There is also an itch I've been anxious to scratch for a long time. Section 55 of the Privacy Act allows for the possible appointment of the Information Commissioner to act as well as a Privacy Commissioner. I hope everybody understands now that there is a total dissimilarity between the Information Commissioner and the Privacy Commissioner. The only thing that the Information Commissioner has in common with my office is that he must take the Privacy Act into account when recommending disclosure of personal information. And that is all. The number of occasions when we have had a contest between the two of ourselves or, in fact, any real issue of mutual interest, I could number on the fingers of one or two hands over the course of eight years.
And I am very concerned, now that we are going to get into the business of privacy law in the private sector, that no confusion should ever arise in the mind of any corporate executive that their affairs might come under the purview of somebody whose sole business is public disclosure. That is a real problem.
Businesses should be able to approach this subject in the assurance that any investigation will be totally in private and that their commercial secrets will be utterly, totally, completely safe. So we must amend the Privacy Act to dispose of this clause.
There is a total lack of symmetry now. There might have been an argument ten or fifteen years ago when my office was seen simply as a complaint investigation bureau. I can tell you that the privacy landscape has been so transformed in those years that our work, as a consequence, has changed as well. We have a branch of Issues Management now, when we began, we didn't even have any issues other than the investigation of complaints. But we are now so consumed with the need to understand what is happening in our society in a hundred different places that we have to spend a good deal of our resources, total un, funded and un, mandated, I might add, simply trying to understand what is going on so that we can give cogent advice to Parliament, which after all our master.
We could not run, in my opinion, at the federal level anyway with the kind of statutes we have with two offices such as ours under one Commissioner. I can say that now because as most of you know I am leaving office in fifteen months and nobody can accuse men of self, interest.
This came up as a government proposal in 1992, and it very nearly happened. We had to exhaust nearly a year and a half beating that off because when government makes decisions like that, it seems to have a disposition never to admit that a mistake had been made. In that case, they were big enough to say that this was not a good idea. But it crops up from time to time and I must say it has its advocates who continue to press its case both in the political world and in the information field. In my view, however, it would be a serious blow to effective privacy protection.
I am going to conclude at this point by saying that the warning I issued eight years ago needs to be repeated again, there is still a problem. This bill only covers data protection. There are all kinds of other privacy problems such as surveillance, DND, biometrics, etc., They will always continue to arise and we will always need to be vigilant on this issue.
If I can borrow a Churchillian phrase, "This is not the end indeed, nor is it the beginning, it is the end of the beginning." Thank you.
- Date modified: