Hon. Michelle Rempel (Minister of State (Western Economic Diversification), CPC)
Mr. Speaker, I am pleased to rise to speak on behalf of Bill S-4, the digital privacy act, which is referred to the House by the Standing Committee on Industry, Science and Technology.
When Parliament first enacted the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA, in 2001, it recognized there were certain limited circumstances in which an individual's right to privacy must be balanced with other fundamental rights and public interest.
One such interest is the need for investigations into breaches of agreements, contraventions of law and for fraud prevention, which in certain circumstances must be conducted by the private sector.
Examples of these are common. They include investigations into professional misconduct by self-regulating professional associations, like the provincial colleges of physicians and surgeons, as well as the law societies. Another example is cross-sector investigations to detect crime and prevent fraud, such as the work done by the Bank Crime Prevention Centre and Investigation Office of the Canadian Bankers Association and the investigative services division of the Insurance Bureau of Canada.
It is not difficult to see that there is a real public interest in ensuring that these organizations have the ability to investigate. In order to do so, they must be able to obtain personal information that is protected under PIPEDA.
The Privacy Commissioner told the committee:
I totally agree that there needs to be provision in PIPEDA allowing organizations to address the issue of fraud or breaches of agreements that they may face.
The need for such a provision is also recognized within the legal community. The committee heard from Eloise Gratton, leading privacy officer and partner at the law firm of Borden Ladner Gervais and a professor of law at the University of Montreal. Ms. Gratton spoke of her own experience as counsel to private organizations conducting investigations into wrongdoing. She said:
The bottom line is that I agree that we need to have a provision authorizing the disclosure of personal information without consent to address these types of situations.
To enable this type of information sharing, PIPEDA currently has a regime that allows organizations to disclose an individual's personal information in order to conduct certain types of investigation.
As it stands right now under the current law, investigators who want to access personal information must be listed as an investigative body in the regulations. This involves coming forward with an application to the government and if the federal cabinet decides that the application is warranted, the organization is added to the list.
This is an extremely burdensome process for organizations. During the first parliamentary review of the act in 2007, the Standing Committee on Access to Information, Privacy and Ethics recommended that this system be scrapped and replaced with a different set of rules based on those that had been in place for a decade in Alberta and British Columbia. The bill would implement this recommendation.
A number of witnesses who came forward at the committee to express support for the importance of the changes within the bill expressed many positive sentiments in this regard.
The Life and Health Insurance Association of Canada told the committee that these amendments would help the industry's effort to detect, deter and minimize insurance fraud, which is stated to be extremely costly to the industry. A witness from the association explained to committee members that there was a current gap in PIPEDA to which he said:
[It] restricts the ability of organizations to disclose information without consent...for the purpose of conducting an investigation into a breach of an agreement or of a law of Canada.
The Central Credit Union of Canada also testified that it supported the proposed exception for consent for fraud prevention. In the words of the Central Credit Union witness it would:
—reduce the administrative burden associated with some of the activities of...my organization's Credit Union Office for Crime Prevention and Investigation.
Finally, the Insurance Bureau of Canada also spoke to the importance of the proposed amendments for the investigation and prevention of automobile fraud. According to Insurance Bureau statistics, automobile fraud cost the Ontario economy an estimated $1.6 billion in 2014 alone.
The witnesses from the Insurance Bureau explained in detail to the committee how Bill S-4 would make an insurance crime easier to detect and prevent as a result of the changes our government was making, and this is great news. However, I should note that during the committee's review of the bill, some concerns were expressed about the potential for misuse of such an exception to consent or resulting in the over-sharing of personal information, as my colleagues opposite have noted today.
However, the bill would protect against this aspect. Organizations can only make use of the exception to consent when a four-part test is met.
First, the disclosure must be made to another private organization, not to the government or to law enforcement. Disclosure to government authorities must follow a different set of rules, for example, when police must obtain a warrant to get private information.
Second, the exception to consent is only available if the information is being shared for the purpose of conducting an investigation into a breach of Canadian law or a breach of an agreement, such as a contract, and it must be reasonable. This means that an average Canadian must be able to see the merit of disclosing the information in question for the purposes of an investigation.
Third, the investigation has to be legitimate. It must pertain to a contravention of law or a breach of agreement that has occurred, is occurring or is imminent. Information cannot simply be disclosed because an agreement might be broken.
Finally, it must be reasonable to believe that seeking the consent of the individual in question to disclose the information would compromise the investigation, for example, by allowing them to destroy or alter evidence.
The intention of this four-part test is to allow legitimate investigations that are in the public interest to take place in a manner that is being balanced with an individual's right to privacy.
My colleagues have brought up the issue of copyright trolling. Certain concerns have been raised that copyright lawyers could abuse the amendment to target Canadian consumers. Let me be clear. This type of activity is not an investigation. Nor is it fraud prevention. Under no circumstances do we believe this proposed amendment provides a backdoor that could be used for trolling, due to these tests. PIPEDA has always provided a legal certainty with respect to the rights of legitimate private sector investigations. Bill S-4 maintains that legal certainty.
I also want to touch on a couple of comments that have been made in light of the bill.
First is the definition of “significant breach”. There has been some doubt as to what this means. As set out in the bill, a significant breach is a breach that poses a real risk of significant harm based on the sensitivity of the personal information involved in the breach, the probability that the personal information has been, is being, or will be misused and any other factor prescribed in the regulations.
The definition of “significant harm” was also brought up. It is defined in Bill S-4 as bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record or damaged or lost property.
There was also some doubt about “private investigation”. It is defined as an investigation carried out by private sector organizations, therefore, not a government authority into an alleged contravention of a Canadian law, or an alleged breach of agreement.
Since we are getting to the end of this session of Parliament, should I not have an opportunity to rise again in debate in the next few weeks, I would like to thank all of my constituents in Calgary Centre—North for the privilege of allowing me to serve them in the last four years, as well as my volunteer team and certainly, in a moment of non-partisanship, my colleagues across the aisle and in the House who every day travel away from their families to spend time in the honour of public service. This is not a job. This is service. Certainly, when we all rise here in debate to discuss these issues, we might be passionate opponents one way or the other but we all do it to build a better Canada.
It is a wonderful position to be in to rise to support bills like this, which are common sense measures to make Canada a better place, to support better legislation, better privacy, better access to information and strengthening Canadian laws. These are the things with which we as parliamentarians are often seized.
It is always a great pleasure to speak in this place and it is a great pleasure to be here as a parliamentarian.
Subtopic: Digital Privacy Act