Appearance Before the House of Commons’ Standing Committee on Access to Information, Privacy and Ethics to discuss PIPEDA
Ottawa, ON — February 23rd, 2017
This afternoon, I appeared before the House of Commons’ Standing Committee on Access to Information, Privacy and Ethics to discuss the review of the Personal Information Protection and Electronic Documents Act, SC 2000, c. 5.
The English translation of my opening remarks is posted below (the French version is available here).
The audio recording of the opening remarks made by Michael Karanicolas, Teresa Scassa and myself, as well as of the discussion that followed, is available here. Dr. Scassa’s opening comments are available here.
I would like to thank the Members of Parliament for their invitation and for the friendly discussion we had.
[Update March 25] A full transcript of the hearing is now available here.
[Update April 30] Following my hearing, I submitted a brief summarizing all my comments and recommendation that is available on the House’s website.
Speaking Notes (English translation)
Thank you, Mr. Chair.
I would like to thank you for this opportunity to contribute to your work on the review of the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and thus offer me the chance to share my thoughts with you about an issue of importance to Canadians.
I am an Assistant Professor of Law and Technology at the Common Law Section, Faculty of Law of the University of Ottawa, where I teach Digital Economy Law, and am the Director of the Centre for Law, Technology and Society. Nonetheless, I appear before you today in my personal capacity.
My comments will be built upon the letter sent to you by the Commissioner last December 2nd. I will focus on the issues of enforcement powers and reputation. I will then move to the scope of the Act, before concluding with some reflections as to its accessibility and readability.
Throughout my presentation, I will draw references to new European Union’s General Data Protection Regulation (“GDPR”), particularly due to the adequacy issues raised by the Commissioner.
– AS TO THE ENFORCEMENT POWERS:
I believe it is essential to strengthen Commissioner’s powers in order to ensure the effectiveness of the Act, in particular by granting the Commissioner order-making powers and the authority to impose administrative monetary penalties.
The ability to impose fines appears to be the most effective way to ensure protection. As with everything, the protection of personal information is subject to a cost-benefit analysis. It is now a matter of either investing in a protection by design or choosing the possibility of… a slap on the wrist. With the risk of monetary penalties, the cost-benefit analysis will favour a protection by design approach.
Obviously, the amount of the fine will be a critical parameter for its effectiveness — a prohibitive amount is required. For example, if a $500,000 fine may seem important — and it will be for small and medium-sized businesses –, it’ll be an insignificant amount for companies like Amazon, Facebook or Google. In that respect, it was by imposing a $ 22.5 million fine that the US FTC succeeded in getting Google to modify its DoubleClick advertising program.
In order to prove effective against big players, we need the maximum fine to be specified based on a percentage of worldwide turnover — for example, 1%. To ensure that the fine is not ludicrous for small and medium-sized enterprises, a second limit should be provided — for example, $500,000; with the greater limit to be retained. Incidentally, the GDPR is based on such a mixed approach.
In my view, this does not threaten the collaborative relationship between operators and the Commissioner. On the contrary, I am of the opinion that strengthened powers will encourage a greater cooperation within actors, before any damage. Besides, such powers seem necessary to obtain an adequate decision of the GDPR.
In order to avoid the appearance of conflicts of interest, fines should be made payable to the Receiver General.
So as to protect small businesses and not slow down innovation, we could provide a procedure for a preliminary conformity assessment. In the event of damages, sanctions would only be imposed after an issued recommendation has not been acted upon within a reasonable time.
Finally, I am of the view that none of the Commissioner’s powers, including those of order and sanction, should be limited to the receipt of a formal complaint — the totality of these powers evidently remaining subject to possible judicial review.
– AS TO THE RIGHTS OF INDIVIDUALS AND ONLINE REPUTATION:
Many favour the creation of a “right to be forgotten” … — In the way it is imagined and requested by some, I find this proposition dangerous. The Internet is the archives and the libraries of tomorrow, the new collective memory. Archives have never previously been erased because they were disturbing — at least, not legally in a democracy. This is dangerous ground, and similarly, it is dangerous to want to delegate censorship powers to private actors or to give the power to decide what should be accessible or not to a select few. In the same vein, the right to de-index seems illogical to me, in that it would entail the removal of the index entry, but not the content itself.
Legislation protecting personal information should not be used as a reputation management tool to remove what is embarrassing, but only to remove anything that is unjustified or inaccurate. Otherwise, I am not sure that such a mechanism would satisfy the Charter test.
The actual problem with Canadian law is that PIPEDA recommends, but does not require, the erasure of inaccurate or unnecessary data. Certainly, in its recent and already famous Globe24h decision, the Federal Court circumvented this deficiency through the illegitimate and unauthorized nature of the disclosure.
Nevertheless, the erasure of data should be compulsory — and not simply recommended — once it is no longer necessary or accurate through stricter controls of the retention of data over time.
I should point out that this need does not only relate to the Internet, but to all databases, computerized or not.
It seems to me that these amendments are necessary — but sufficient — to the GDPR adequacy.
– AS TO THE SCOPE:
Canadians should be ensured that any harmful collection, use or disclosure of data be subject to strict standards of protection. The definition of the scopes of the two federal statutes does not meet the citizens’ expectation of protection in a global and interconnected world, including protected data and in particular with respect to the subjected organizations.
A solution for organizations would be to redefine the scope of PIPEDA in such a way that would render it applicable to all organizations operating under federal jurisdiction and that are not covered by the Public Sector Act or any other federal law. Evidently, and analogously to our partners, the law shall retain exemptions for personal or journalistic use.
– AS TO THE ISSUE OF ACCESS TO LAW:
If it is undeniable that the law requires modifications in view of new realities, the legislator must seize the opportunity of this reform by performing a complete overhaul of the law, instead of making simple amendments.
Indeed, PIPEDA belongs, undoubtedly, in the Hall of Fame for the worst drafted federal laws — and we know that there is, in that matter, some competition there.
The cornerstone of PIPEDA lies in an appendix copy-and-pasted from a document drafted by a private standardization organization. The Act only supplements this document and other appendices by making constant references to them. This poses a problem in terms of the public’s access to law. A rewrite of the law, clearly explaining the right and obligations of each, would therefore be welcome — especially to make mandatory all that is presently recommended.
In terms of drafting, the Act should remain conceived according to the principle of technological independence and be principles-based. Such an approach is essential to enable the Canadian legal framework to adapt to future social and technological changes, including the development of Robotics, of the Internet of Objects and Artificial Intelligence.
In terms of readability, the limitation of the legislation to the protection of personal information would be welcomed. Functional equivalence rules for electronic documents are irrelevant and should be transferred elsewhere.
Conversely, it would be desirable for a single act to contain the entire framework for the protection of personal information, that is, for both the private and public sectors. The concomitant reconsideration of these two Acts by this Committee offers this opportunity. This would also allow for the creation of a coherent framework for both the protection of personal information and the role of the Commissioner — even if it means providing several sections… if it was considered necessary to maintain a public sector exemption regime.
CONCLUSION
As a final thought, I would like to draw your attention to the need of providing statutory rights of actions and damages.
Equally, I would like to underline that it is necessary to update our law in order to satisfy the GDPR’s suitability test, but that we must nevertheless consider two important factors: first, that the test does not require a carbon copy of the GDPR and secondly that this applies to all protection frameworks, and not just PIPEDA.
I hope that these few thoughts and recommendations will be useful to the Committee.
Sadly, I wasn’t able to finalize on time a short bilingual brief with examples and recommendations. However, I could sent it to you afterwards.
Thank you. I’ll be happy to answer any questions that you may have.
On a side note: I would like to thank Marie-Christine Robert for the discussion we had prior to my hearing, and Olivia Gile for the English editing. Opinions and errors remain mine.
