ETHI Committee Meeting

     Good morning, everyone.

    This is the Standing Committee on Access to Information, Privacy and Ethics, meeting number 103. Today, pursuant to Standing Order 81(4), we are considering main estimates 2018-19, vote 1 under the Office of the Commissioner of Lobbying, vote 1 under the Office of the Conflict of Interest and Ethics Commissioner, vote 1 under the Office of the Senate Ethics Officer, votes 1 and 5 under the Offices of the Information and Privacy Commissioner of Canada, referred to the committee on Monday, April 16.

    This morning we welcome, from the Office of the Conflict of Interest and Ethics Commissioner, Mr. Dion.

    Go ahead.

     Thank you very much, Mr. Chair, and thank you, honourable members of the committee for inviting me to appear this morning as the committee considers the budgetary submission for 2018-19.

    I am accompanied by Ms. Sandy Tremblay, our Director of Corporate Management and Chief Financial Officer.

    It's been almost four months, and only four months, since I started as commissioner. When I arrived at the office in January, as I said when I last appeared before you, I found a well-organized office, a fully staffed office with effective structures and processes in place. I am therefore in the envious situation of being able to focus on the matters that should require some improvements as opposed to having to rebuild and reimagine what should have been there as has been the case before once in my career. I've done that.

    In fact, when I showed up the morning of January 9, my office had already submitted the estimates for the fiscal year 2018-19. I quickly reviewed them and saw no reason to revise anything. They seemed perfectly appropriate, so I did approve the $6.9 million that was submitted for that purpose. To provide some context for this figure, this $6.9 million, I'd like to discuss some of our office's priorities in terms of how we intend to fulfill our mandate in the coming year.

    Under the approach the office will take under my leadership, one of the first things was to develop a mission statement for the office. We did that, and in February, we came up with the following mission statement, which I'll read to you. It's not long. Our office “provides independent, rigorous and consistent direction and advice”—we do both—“to members of Parliament and federal public office holders.”

    It also “conducts investigations”—that's the second thing we do—“and, where necessary”, the third thing we do is we “make...use of appropriate sanctions in order to ensure full compliance with the Conflict of Interest Code for Members of the House of Commons and the Conflict of Interest Act.”

    The office is an institution that serves an important purpose. Our role is to contribute to the announcement of Canadians' trust and confidence in elected members of Parliament and appointed public office holders. The mission statement reflects our responsibility for administering to similar but distinct, quite different in fact, regimes and various means, some preventive, others reactive by which we will do so.

    The mission statement will be hung in our meeting rooms. It serves to remind our staff that our day-to-day work is governed by the very rules we administer and to help keep our focus on what matters most.

    I think it's important that external audiences also have a better sense of what we do.

    That's why I spent some time developing the mission statement and will spend some time broadcasting the mission statement.

    In addition to doing that, we've also refreshed our office's brand identity. We've done some branding not only because it's fashionable, but also because I think it is important to have a distinguishable appearance in the products that we release. I hope you'll like it. You'll see it when we table our annual report next month. Early next month, we will table our annual reports, I should say—one under the act, one under the code—and you will see new colours and a new appearance.

    I think our effort was to—and I think we have successfully communicated our independent and impartial character, the nature of the work we do and the way we do it, which is to say with integrity, rigour, and consistency. That's also important—consistency.

    The second thing that had almost been completed when I arrived was the strategic plan, which describes our priorities for the next three years. It was already well advanced. Since the direction set in that document was in line with my vision, we decided to approve it after making a number of minor changes to it. You will also be able to read it in the annual report that we will be presenting at the beginning of June.

    The plan identifies priorities in three key areas.

    Education and outreach is such an area.

    As I told you in my previous appearance, I want to make sure public office holders and Members of the House of Commons have the information they need to understand a somewhat complex set of rules and to be in a position to actively meet their obligations at all times. In fact, my goal is the following: if they do contravene the Act or the Code, it will not be because of ignorance, nor will it be by omission or a lack of awareness.

    In order to provide education, we will go beyond the traditional classroom approach and leverage instead new-media technologies to reach out to our clients, through webinars and online videos, for example. People who are governed by the Code and the Act are busy and don’t always have time to travel to spend two hours in a classroom doing training. They must be able at anytime to consult vignettes, videos, and webinars that explain any given aspect of the Act. It would be very short, very precise, very thorough, but also very accessible.

    Similarly, last March, we signed a memorandum of understanding with the Commissioner of Lobbying to work together on the development of common products since Nancy Bélanger’s mandate and mine somewhat overlap. This, in turn, will allow us to conceive products that will be useful to our community.

    In the coming months, we will review all of our educational materials and revise them as necessary, which will allow us to reach our goal.

    When public office holders and Members seek advice from my Office, we aim to provide them with clear and consistent direction every time. Everyone should receive the same information. It’s very important that we be consistent and not give contradictory information.

    I have already made it clear that I will strictly enforce the Act and the Code by investigating, as promptly as possible, potential contraventions of both regimes, and by making use of appropriate sanctions when contraventions are found.

    We will also make greater use of the media to inform the public about our activities, to the extent permitted by the Act.

    As far as modernization is concerned, we have replaced our financial management system and started upgrading our electronic case management system. We are also planning the redesign of our website in the next fiscal year.

    I’ve thus summarized for you the activities pertaining to education and to the modernization of the systems used.

    The third sector is that of operational excellence. We wish to focus on accountability, leadership, integrity, transparency, and stewardship.

    I therefore have much to do in the coming months. I intend to review all of the policies that are on our website and to update them as necessary to reflect best practices in public sector management.

    Generally speaking, this is what we’re doing.

    I will now talk about budgetary requirements.

     Barring unexpected increases in the demands on our resources, I expect our office will be able to implement its mission in 2018-19 with an annual operating budget of $6.9 million as we have sought.

    Salaries account for the majority, 81%, of our expenditures. We're fully staffed. We typically experience a low employee turnover which is a good thing, because it's a very specialized line of work. It takes time. There's a long learning curve for people who join the office.

    We have 49 positions in total, and 18 of those positions are directly used to provide advice to public office holders and MPs. The other positions are used in corporate services, communications, outreach, legal services, investigations, and in my own office.

    Major expenditures this year include the upgrade of our electronic case management system. We talk about consistency. We talk about accuracy and rigour, so it's important to rely on state of the art when it comes to the system we use.

    We we will also modernize the public registry and redesign our website. There will also be a cost associated with the MOU with the Commissioner of Lobbying.

    We will make full use of our budget, for the first time ever, this year.

     For the last year, our surplus is less than 2% of the budget. This year, it will be lower because we basically have granted pay increases to our employees. We will be able to live within our means, barring something really unforeseen, but it will be much tighter this year than it was last year.

    In fact, you may not know this, but the budget of $6.9 million is the same budget as when the office was first created 11 years ago. It is essentially at the same level, $6.9 million. The budget was never fully spent. In fact, I brought a graph with me which shows the distance between approval and usage. There's always a big gap. I think the lines will cross this year on expenditure and budget.

    We've had significant increases in some areas; for instance, there was a 22% increase last year in the number of situations where advice was sought—22% is quite something. We have 2,900 situations where people have sought advice, which is much more than the 2,400 the year before.

    Public communications, probably in large part due to the Morneau situation and “The Trudeau Report”, but nevertheless, went up 30%. Contact with the public and contact with the media in the last fiscal year went up by 30% compared to the year before that. In case you were wondering, we had 2,700 situations where the public was in touch with us. The public means people who are not subject to the act and are not media representatives. The media was in touch with us 411 times last year, compared to 315 times the year before that.

    We've accommodated this within the existing budget. It's becoming tighter. We'll make better use of technology. I think it's quite predictable that, if things remain as they are currently, we will need an additional injection of resources in future fiscal years. However, my team and I will do everything we can this year to live within our allocated budget, although there are supplementary estimates that we know exist, and if there is a compelling reason to do so, we will be making a submission.

    Thank you, Mr. Dion.

    Mr. Chairman, I was finished anyway.

    That concludes my remarks.

    Thank you, Mr. Dion.

    First up is Mr. Baylis for seven minutes.

    Thank you for coming, Mr. Dion.

    First of all, I see that you have been very busy over the last four months.

    I would like to start with the changes that you’ve made. Is your mission statement completely new or was there already something in place?

    There was already something in place that I reviewed. It was not very well known, even within the Office. It was a little more muddled and vague. That's why I felt I should rewrite the mission statement to make it very clear.

    Was it vague for your employees or for everyone?

    It was for me, which means that it probably was for other people as well. That's why I decided to revamp it slightly.

    This was really part of your duty to frame the objectives of your Office, was it not?

    That's it. The goal is to have a type of alignment so that people know what we're trying to accomplish everyday. It will be front and centre in our Office. People governed by the Act and the Code will also know what we do and do not do in life. They will also be able to hold us accountable.

    We're committed to doing things accurately and thoroughly. It might not always have been the case. We will try to be more thorough and coherent. As such, these are the commitments we're making in a mission statement, which will be useful both internally and externally.

    With this new mission statement, you did an overview of your department and you saw where there might be some needs. You've identified three areas that you want to work on. Is that correct?

    In fact, those are the only three areas that my office should be concerned with and has been concerned with in the past. It simply serves to clarify with as much precision as possible that we do three things in life. We do preventive work. Our office provides direction and advice. There's a distinction between advice and direction.

    We also sometimes get in touch with MPs and public office holders, even though they have not called us. For instance, when you were elected the first time, we did communicate with you to require you to make an initial statement. That's an example of providing direction.

    We also provide advice. In the course of doing the first declaration or when your office wants to know something precisely about a situation that is arising, we will provide advice. That's the first thing we do, and that's what we burn the majority of our resources on—preventative.

    —on preventative.

    You touched on education and dissemination of information. When you talk about education, you're talking about not just educating the people who are subject to the act or the code. Is your staff going to be upgraded too? Are you educating all around? Things are changing rather rapidly, as we know.

    Is the educational goal aimed at all employees?

    First and foremost, we don't have the resources to do much more than the people who are governed by the act and the code. We start there. That's the most important thing, and it's not done completely at this point in time. We can do much more and much better. We will not, at this point in time, do anything other than what we do except maybe tweet a bit more for the 545 people who follow us. We hope to increase that number to 1,000, which is not much, before this year is over. That is still modest but achievable.

    We will focus on the people governing. That is where it counts the most. That's where the education matters the most vis-à-vis the objective, which is to make sure that the act and the code are respected.

    Part of respecting the act is really to understand the act.

    Yes.

    For example, in my personal experience, when I was first elected, I didn't know anything about the act, and there was a lot of work. I would have benefited from more education on how to navigate it. I would definitely agree with you on the part that the more we're educated, the more likely we are to be able to make sure we properly follow it.

    The premise is that people who are elected to Parliament are usually law-abiding. It is important to give them the tools to make sure that, through omission, they don't do something they will come to regret.

    In the light that you're adding more emphasis on education, you have 49 full-time staff. Could you give me an idea how they're assigned? What are the different groupings of people?

    We have 18 people who are providing direction and advice, and who are also involved in education. It's not their main job, but they are the most knowledgeable in the office. Those 18 people actually end up not setting up the logistics of training but the provision of substantive training.

    We have eight people in legal services and investigations, three lawyers and five non-lawyers in the group, who work very closely together. They are supervised by the same person.

    We have 11 people in what we call corporate services, finance, human resources, IM and IT, who essentially make sure we have proper policies in place to manage people, money, information holding, and so on and so forth.

     We have eight people in communications and outreach who are the drivers of the education that we're talking about. They are in charge. They are responsible to see to it that the videos I was talking about and the webinars are developed and delivered, even though they will draw on compliance and advisory to actually create the substance, because the knowledgeable people are in compliance and advisory positions.

    My office has four people.

    That's the breakdown.

    Approximately 40%, 18 of the 49, are derived directly for case work interfacing with the different actors.

    They do nothing but that, and they're not managers either. It's more than 18 if you include management.

    Then you add another six that are in communication.

    There are eight people in communication.

    Together, more than 50% of your staff is driven toward looking outside to either provide advice, direction, or communication.

    That's right.

    Thank you Mr. Baylis.

    Mr. Kent.

     Thank you, Chair, and thank you, Commissioner, for your attendance. You're a frequent visitor to this committee, and you're always welcome.

    It's interesting to see the venture into social media, and I'm sure you are following some of the other responsibilities that this committee has with some of the dangers therein.

    Could you, for the record and for our large television audience, advise us of your Twitter handle?

    I have some staff in the room. They will write down the Twitter handle and give it to me because it's not polite to take out my iPhone.

    Will you be considering Facebook Live at some time in the near future?

     I don't think so, because it's a fine balance, using these tools. Our office has to project an image of seriousness and professionalism, and I'm not sure Facebook does that all the time.

    The Twitter handle is @CIEC_CCIE. It's federally regulated, so we have to be called that. We have no choice. It's not very user-friendly, but that's what the department is called.

    Is it fair to assume that most of the content in these tweets will be advisory, will be reminders rather than updates on investigations?

    Essentially, we cannot update on investigations. Most of them will be advisory. One new practice I have instituted is that we will tweet also when we impose a penalty. The minute it's put on the registry, the same day, it will be tweeted so that media representatives, for instance, who want to keep track, or political offices, will be able to. They won't have to look at the registry every morning to see whether something has happened.

    Also, when we table a report, we will have several tweets on the findings in the report, as opposed to a single tweet attaching the report. We'll try to decipher the report for our Twitter followers.

    You mentioned the increased workload in the last year with regard to the Trudeau investigation and the Morneau investigation.

    We understand that this one major investigation of Minister Morneau is continuing. Do you still expect to file your report by June?

    Yes.

    Can you tell us, without compromising any of the other investigations you might have, how many other major investigations are under way by your office?

     “Major” is a very tricky thing. It's very subjective.

    We have seven investigations, including the one involving Minister Morneau, and we have eight other matters that we are currently looking at in order to determine whether we should investigate. That's a total of 15 cases under active consideration, including seven investigations.

     These other matters that you're considering investigating haven't been provoked by requests from members for investigation, but they have come to your attention.

    Some are the result of a complaint made by some members of Parliament, and some others are at my own volition under the act and the code.

    Right.

    A lingering question that I have involves unacceptable gifts. You made it clear and the Prime Minister has indirectly made clear that unacceptable gifts do not have to be registered. That prompts any number of questions.

     Do you think unacceptable gifts need to be reported and publicized? In other words, if an unacceptable gift is received but given back only because it has been identified as an unacceptable gift, do you not agree that perhaps there should be a consideration or a process to report the offering of an unacceptable gift, particularly by a registered lobbyist or representative of a lobby organization?

    Mr. Chair, by answering this question, I'm wandering into the area of potential legislative review, because under the current act, it is very clear that an unacceptable gift does not have to be declared.

    If the committee or the government were considering legislative review, I would say that the spirit of the act is that, first of all, you don't accept a gift that cannot be accepted. Some people realize a few hours or a few days after they've accepted a gift that it should not have been accepted. If you return the gift, you should be forgiven. If you keep the gift for five years and then suddenly decide to return it, maybe that should be sanctioned. It's a question of facts. Each case is a question of facts, and by their very nature, some gifts cannot be returned. They can be reimbursed but not returned. Therefore, this has to be carefully looked at.

     The intent of the current act is that you don't accept gifts that should not be accepted. When gifts can be taken to mean that they can influence you in your future decisions and actions, you simply don't accept them and that's the end of the story. You only have to declare gifts that are acceptable, that are in excess of $200, 30 days after they've been received, and 60 days in the case of the code applicable to MPs.

    You've made clear in your mission statement that you will provide independent, rigorous, and consistent direction and advice to members, and I assume, to government. Will you be making a recommendation in the annual report with regard to strengthening the act and the code, and requesting greater, meaningful penalties as you've discussed with us previously?

     In the upcoming annual report, I will refrain from doing so, because I think it's too soon. I would like to have the benefit of a few more months of active practice before starting to make any pronouncement about what would be good or not good.

    All I have are the recommendations that were made by my predecessor. I've gone through them. I disagree with some of them. I'd like some maturity in the process to set in before I do that.

    My hope is that I'll be asked next fall to express a point of view. If I'm not being asked, then I will have something in the annual report for 2018-19 that will be tabled in June of 2020.

    Would you expect to be asked by this committee or by the government?

    I think the natural place for it to happen would be this committee, based on my historical observations.

    We'll put that in our datebook.

    Thank you, Chair.

    Thank you, Mr. Kent.

    Next up, for seven minutes, is Mr. Angus.

    Thank you, Mr. Chair.

    Mr. Commissioner, we have had very long, involved, ongoing conversations with your predecessor at this committee about many wide-ranging issues. This committee, I guess, is the interface for parliamentarians on trying to bring forward recommendations on how we work well with the act.

    I think that the education component, as my colleague had raised, is really important. I don't find that many parliamentarians are aware of how the office works, for instance, proactively calling the office to check in, which I think would save a lot of people a lot of grief in the long term. It may not be top of mind, so I'd like to ask your ideas on how you could start a better relationship with MPs as well, so we can start to talk about how we work.

    Ordinary MPs are not designated public office holders. We're not the senior bureaucrats. We're the ones who are out going to three and four events a night, getting dinners and talking to people. Having clear rules means a clear conversation.

    I appreciate your comments, Mr. Angus. I fully agree, Mr. Chair, with what the member has said.

    We will put a lot of attention on developing modern approaches to doing that. I think it would also be important that MPs be encouraged by their leaders and whips to make use of those tools. It takes two to tango, as you know. We can develop all we want. It has to be well known. But the MPs, nevertheless, have to go and click and have a look, and listen carefully for a few minutes.

    Thank you for that.

    In the previous Parliament, I was sometimes unpopular with my colleagues because I was always in caucus reminding them that it's not just the letter, it's the spirit.

    To that end, one of the discussions we had with Ms. Dawson many, many times was on how you influence a politician. She was very much interested in gifts. I said that when a purple blanket from the Insurance Brokers of Canada has been left, I don't even notice it's in the room. That's not influencing me. However, the potential for a lobbyist to hold a fundraiser for me could influence me. The interpretation was always, well, that's not a direct benefit. In the world of politics, if someone is holding a fundraiser for your riding association, to me that's always been a direct benefit.

    The office never set out rules. Ms. Dawson always talked about dealing with it, but we never got there. Are you looking at issues like how to determine fundraising events in a fair way, so that we can have clear rules?

    You'll see in our annual report that we will have a graph showing the interest in gifts. We had 2,800 requests for advice, and I think 400 of those were related to gifts. The subject of gifts has a high area of interest.

     The guidelines we currently have are pretty long and cumbersome. I intend in the coming months to review them carefully to give as clear and concise advice as possible. It has to be based on the act, obviously, and the code. It has to be accurate. I'm trying to make them a little more user-friendly and, to the extent that I can, give indication in advance of how clearly the office will interpret a situation such as the one you've raised.

    It would be useful if members or the committee could draw up a list of the most common occurrences where it would be important for MPs to get clear direction, what is in and what is out under the code.

    When we talk about MPs, we talk about the code. The act is not applicable to MPs. Members of the government, of course, parliamentary secretaries and ministers, are governed by both the code and the act. However, as far as MPs are concerned, if I knew precisely, I would have a better sense of the most commonly arising situations where it's not clear to MPs.

     On the issue of fundraising—and we talked about this with your predecessor—someone who may like my political position on say, telecoms, might buy a ticket to my fundraiser. I didn't sell them the ticket, but they buy a ticket to the fundraiser. That's an open event; they can do that. There's a difference when someone who is trying to lobby for a licence hosts a fundraiser for you. To me, that would be fairly clear.

    We had issues where the Commissioner of Lobbying felt there was a very clear breach, but the Ethics Commissioner felt it was not quite as clear. When you talk about an MOU with the lobbying commissioner, are we going to try to move towards a common understanding of apparent conflicts and direct conflicts, so that the lobbying commissioner is not going after the lobbyist while the Conflict of Interest and Ethics Commissioner is saying, “Well, I don't know, it's a grey area”?

    To the extent it's possible. We're both independent, of course. We have started to talk. We've had several meetings already.

    I'm in charge of interpreting the code; she's in charge of interpreting the Lobbying Act. Nothing in the act prohibits us from talking. If we can agree on a set of common rulings, I think it would be in the best interest of everyone. We'll work on that.

    I noticed in one of the—

    We may have some disagreements, as well, profound disagreements.

    That's perfectly fair.

    Again, I think parliamentarians want a general set of rules, because we all want a fair playing field.

    In the previous Parliament, the Ethics Commissioner was bound—and still is, I believe—to suspend investigations if the RCMP opts to investigate.

    Or any police force, for that matter.

    Very rarely do the RCMP or police actually follow through, so investigations are suspended. In the case of Nigel Wright, it went on and on.

    It's still suspended. In fact, it's been reactivated recently with the Supreme Court of Canada's decision, and we have so informed Mr. Carson.

    Okay.

    Would you feel it better if you still had the ability to continue an investigation so that you could report to Parliament? Do we have to define terms on when.... If a police investigation doesn't follow through, should we be able to get a report, within a timely manner so that it matters to parliamentarians?

    I may be wrong, Mr. Angus and Mr. Chair, but based on what I've read in the past—I've always paid attention to this area of practice, even though I was not in charge of it—it's a rare situation. It's important, but if you look at all of the situations, it's a small minority. I think it's true that in most subject areas, that's the practice: to stop everything if the police get engaged in something, until such time as the police have disposed of the matter. I think it's prudent to do that.

    There could be more direction in the act, or the code, as to when or how quickly you resume afterwards. That would be fine with me. There's currently no such provisions.

    Thank you, Mr. Angus.

    Next up is Monsieur Picard. You have seven minutes.

    Welcome back, Mr. Dion.

    Good morning, Ms. Tremblay.

    Before I start, I'd like to make a brief comment.

    Allow me to say that your work does not only serve to maintain the integrity of the institution and of the elected officials who work there. More importantly, its goal is to ensure that the general population regains confidence in this important institution and that it loses its cynicism towards it. Ethics will increasingly become one of the elements that the public will take into consideration to assess the quality of its representatives.

    I have a few questions for you.

    First of all, are the sanctions that you apply monetary in essence?

    They are exclusively monetary and only cover a very restricted territory.

    Do you think it's suitable?

    At the moment, the only thing for which we have the authority to impose sanctions is the failure to meet the required deadlines.

    Are you considering different types of sanctions? Money is the sinews of war, but it might be different when it comes to ethics.

    When I came here on the 8^th of February, this was one of the issues raised. I believe it would be a good idea to consider the possibility of giving the Commissioner the authority to recommend other types of sanctions in the case of parliamentarians. As for people governed by the Act, the Commissioner could have the direct authority to impose a penalty. I think it would give teeth to the regime. Obviously, it'll be for Parliament to decide whether it is desirable to do so.

    The fact that we're governed by the Code instead of the Act takes a bit of the enforcement power away from you, doesn't it?

    Yes, and it's precisely because of parliamentary privilege. Parliament regulates internally.

    As for the sharing of information using new multimedia tools, the problem might not be to provide them to clients, but to make sure that clients take part in the process and use these tools to be better informed.

    When developing your techniques, have you considered measures not to control, but rather to record participation? You said that people would act in full knowledge of the facts. Noone should ignore the law, but does not being aware of a measure constitute a...

    This can clearly not constitute a defence.

    This is not a defence. However, when a person is in doubt, a lack of knowledge or misinformation can result in a bad interpretation.

    How do we ensure that a person acts in full knowledge of the facts?

    The Code distinguishes between the sanctions that can be imposed, depending on the degree of knowledge or oversight, and it contains a clause that governs MPs in that regard.

    I simply haven't thought about this, but I believe that it would be difficult to have a regime that would allow us to know which MPs have seen such and such vignette on a given topic. As for training, we don't want to institute a police state. It should rather be voluntary. During the legislative reform of the Code, the issue of making certain training courses compulsory could be raised. It could be possible, but it would have to be imposed by your peers and not by me.

    Those of us who have LinkedIn accounts know that members are periodically informed of the people or institutions that have read their profile. So I imagine that the technology exists.

    I would like to ask you a question about that technology.

    During your remarks, you mentioned that the Commission's budget had not changed in the last 10 years, and was still around $6.9 million. Also, you mentioned that 80% of this budget related to salaries, which leaves a little under $1.3 million for routine activities.

    Since you seek to turn more to multimedia, have you started to assess, using submissions or basic research, the means to achieve your goal and the associated costs? Where technology is concerned, if we start playing with multimedia, especially with video vignettes and animation, it could be fairly costly. Have you assessed whether the amount you have left is sufficient to meet your needs?

    I can tell you about what we want to do this year. In fact, we're already a month into the new fiscal year; the second month begins today.

    In reality, making videos is a lot less expensive than before. When I started, it was really costly. Today, for $1,200, it's possible to make videos that are not at a professional standard, but still presentable by using a small camera, a tripod, a good microphone, and a teleprompter. This year, this is the equipment that we're going to use. After that, we'll see what we can do.

    For the time being, we'll favour content over form. It'll probably be enough for what we're trying to achieve and won't look silly. We've experimented internally. I've made four short videos that are on our server and are very presentable.

    That's very good.

    Mr. Chairman, I'll give my last two minutes to my colleague.

     Thank you.

    Thank you very much for being here, Commissioner.

    You mentioned that there was a 22% increase in the number of questions for advice that you received from MPs.

    From all people on either the act or the code. I don't have the breakdown for MPs. It's in our annual report. We'll find out.

    These 2,800 requests for advice, is that what that is, that 22%?

    The increases, that's right. It includes the increase.

    Last year there were.... In fact, I have the precise number. There were 2,898 requests. We provided advice and direction 2,898 times as opposed to 2,381.

    What I'm interested to know in the limited time is, 400 requests were specifically about gifts. Do you think, if there were a less subjective rule around gifts where it's reasonably intended to influence.... If there were something like a firm dollar amount where it was very clear, would that reduce the number of requests so that you could focus your efforts on things that might be a little more substantive?

    I would say yes, Mr. Chair. It's self-evident.

    Thank you. That's it.

    Thank you.

    We'll go to Mr. Gourde for five minutes.

    Thank you, Mr. Chairman.

    Thank you, Mr. Dion and Ms. Tremblay.

    What impressed me the most in what you said, Mr. Dion, is that your Office still does its work despite receiving the same budget for 10 years. Demands and work must have evolved over that time, but you've still managed to provide the services we were expecting.

    What is it that, over time, contributed to the smooth operation of the Office? What allowed the Office to evolve in order for it to be able to provide the same services with the same budget? It might be an example that other departments could follow. As for us, our budgets have increased, and we do not necessarily work more than we did before. But you have succeeded.

    What is your secret?

    By the way, it's not me but the commissioner who was there before me. I have nothing to do with what is being discussed here this morning; I've only been in that position for four months.

    Let's pay tribute to her.

    In the beginning, the Office was much less known, so it received fewer requests for advice, obviously. I have seen graphics that show how requests evolved. There is a direct link between the number of requests and the costs. This played an important role.

    It took years to get a full staff. Ms. Tremblay has been in her position for a few years, but she hasn't been there from the start. Today, there are 49 positions allowed, but I'm sure there were fewer five years ago. There has been an evolution.

    The last time I appeared before you, I think I mentioned that, in my opinion, Ms. Dawson was a frugal person. She didn't hire people unless she knew there would be work to give them. That's more or less what happened.

    Ms. Tremblay, would you like to add something?

    In the past, there was a surplus every year. We didn't use all the funding we received. However, as Mr. Dion mentioned, last year, our surplus totalled just under 2%. We've used almost all of the funding that was allocated to us.

    The maturity of the Office must also be highlighted. As was mentioned, people keep their positions for a long time, which means that the Office now boasts a very specialized and experienced staff. This allows us to answer requests more quickly without having to do too much research. There are more previous cases on which we can rely. As such, it's not necessary to do as much research and analysis as we used to.

    In short, people remain in their positions for a long time within the Office, they have a lot of experience, and they are dedicated to their work, and this counts for a lot.

    Mr. Dion, you've also talked about the client approach. Among other things, you intend to make video vignettes. You want to find a way for us to be better informed. It's good and it's all to your credit. You said that it was voluntary, but we need to know what you're going to propose to us.

    How will you propose it to us?

    We'll try to make it as interesting as possible. We'll try to meet with people who can influence MPs. In fact, I have already offered to give presentations to the different caucuses. There will also be word of mouth. You know better than me that MPs are a tight-knit group. If it's interesting and useful, they'll spread the word. It'll be word of mouth, and that method costs nothing.

    It is really crucial that we always be informed of changes. As far as I'm concerned, I've been an MP for a long time and I know the basic rules relatively well, but changes occur periodically. As for new MPs, they must pay particular attention to these rules when they arrive on the Hill. At the beginning of each Parliament, there are always new MPs. They are caught in a kind of whirlwind during the first year where everything happens at the same time. It might be good to remind them of those rules in the second or third year of their term.

    Will you pay particular attention to new MPs?

    The period following the elections will obviously be very intense for the Office. It will also be the right time to catch new MPs before they’re too busy to talk to us.

    Earlier, your colleague asked for our Twitter address. I believe that it is an easy and affordable means of communications. Every 15 or 30 days, we repeat the same advice using this platform. Whoever follows us on Twitter will already be partially informed. Sometimes, we attach documents. When we are at the airport or waiting for someone in a given place, it doesn’t take long to consult our Twitter feed to learn a bit more. Once again, it costs absolutely nothing.

     Thank you, Mr. Gourde.

    Next up is Mr. Erskine-Smith, for five minutes.

    Thanks very much.

    I appreciate all the work you do, but I just want to dive into the numbers a little bit.

    Can you give the committee an example of the advice and direction that might be given to a member of Parliament?

    We'll focus on members of Parliament. When you first get elected and we get notice of your election, you'll get a letter within a few days. Each MP, whether elected or re-elected, will get a letter. That's one example. It says that they have x number of days to look at the form, to please review it, and get back to us in 60 days. That's the first contact.

     You had 2,898 advice directions in the previous year. Give us an example of those pieces of advice.

    It's all kinds of things. I have the data with me but I don't know it by heart. We have a complete report—

    The reason I'm asking for an example is that, as far as I understand, you have 18 individuals who provide advice. You have 2,900 pieces of advice given over the course of the year, which is about 160 pieces of advice per individual. This gives us about thirteen and a half per month, which, assuming the piece of advice is relatively straightforward, really doesn't seem like a lot of advice given by each individual over the course of the year. That's what I'm trying to figure out.

    Some of the advice is simple; some is very complex. It may take several days to develop the advice, including consultations with legal services and the commissioner. It happens quite frequently that it is not simple. When MPs get in touch with us, it's usually because they're not able to find the answer themselves. There's a degree of complexity in a good proportion of the requests for advice.

    We also fully document everything we tell an MP or a public office holder, so we have a chance to consult it in the future when the same MP or public office holder consults us. We have to be consistent, and we also have to be consistent between office holders. Documenting takes time as well.

    Do the staff docket their time?

    They do, yes.

    Would you have an exact sense of how much time they spent per file?

    Yes.

    What would be the average amount of time spent per piece of advice or direction?

    The director of compliance and advice is in the room somewhere.

    That's okay. There's no immediate urgency to this, so perhaps you could provide that in writing later on.

    Okay, we will.

    There are eight communications officials. You note there's been a 30% increase in the number of media requests, but over the course of a year, surely one person could field 400 media requests. What do the eight people do?

    One person, or full-time equivalent, fields media requests. The other people assist me in preparing for appearances like this. That's one example of what they do.

    We have an Intranet site so we have well-informed employees. They also have the Internet page to maintain and keep up to date, as well as the public registry.

    They also coordinate the work for the Canadian Conflict of Interest Network. All provinces and territories have an ethics commissioner, so they coordinate. They serve as the secretariat to what's called CCOIN, this association of federal, provincial, and territorial ethics commissioners.

    The communications officers are also the ones who put together the strategic plan and the reporting under the strategic plan. I have a document, which I'm considering making public, which contains a number of performance indicators, based on the strategic plan.

    That's grosso modo what the communications and outreach team is doing.

    Thanks very much.

     I'll share my remaining minute with Ms. Fortier.

    Thank you very much.

    I’d like to know which measures you take to assess your progress or the challenges you’re facing in your investigations.

    Our organization is small. Several times a day, I meet the director of investigations and the senior general counsel, who are, in fact, the same person. Once a week, we review each case in a structured manner. I spoke earlier of 15 cases, but the number varies a lot. This morning, there were 15, but in two weeks, there could be 12 or 21. I don’t know; it depends on what comes in and what goes out.

    In everyday life, I take part in all interviews, especially when a complaint was filed against someone, and we’ve decided to launch an investigation. I’m in the room and I add questions to those asked by the investigator. I’m in a position to keep track of all the investigations at all time by consulting with the investigator or his or her chief, and by sitting in on interviews. I believe that it’s a very good practice that allows me to see how things evolve in a case.

    Thank you very much.

    Thank you, Ms. Fortier.

    Next up for five minutes is Mr. Kent.

     Thank you, Chair, again.

    Commissioner, in your letter to Chair Zimmer in March with regard to the MOU to work with the lobbying commissioner, you explained again, as you explained in testimony to us, that your respective statutes limit the areas of potential integration as they prohibit, you wrote, “the sharing of certain types of information”.

    I know you're working on outreach and education. You're committed to working with the lobbying commissioner in that area, but, because many of the investigations in your office have a matching significant interest to that of the office of the lobbying commissioner, I'm wondering whether there might be a way in future for these two offices....

    For example, with the investigation of the Prime Minister's trip, surely the lobbying commissioner has been following it with interest and perhaps investigating. We don't know. It would have been interesting to hear the story, not only as the Ethics Commissioner interviewed or spoke to the Prime Minister about the registered lobbying foundation, the Aga Khan Foundation, but it would have been interesting to know the words or the response of both the Aga Khan and his foundation with regard to that investigation.

    Do you not think there's some logic behind reciprocal or matching investigations? When an investigation finds violation on one hand, should there not be an investigation or at least a report by your counterpart in the lobbying commissioner's office?

    It would be great, Mr. Chair, if the act was amended to allow the other commissioner and I to exchange information when it's useful, but we are currently completely prohibited from doing so.

    I understand.

    We cannot do it. It would be very useful. They're both positions of officers of Parliament, and I think we can have confidence that we would not do this lightly, that we would not make it public, and so on and so forth, and it would be an additional tool to make sure that what we do makes sense to the people who are subject to the act and the other act as well.

    I think, with regard to your earlier remarks about unacceptable gifts, it would be interesting to know, again from the party that offers an unacceptable gift, not only the party who received and returned in one time frame or another.... To that point, again, is it not relevant to mention what the unacceptable gift that was offered and returned consisted of?

    I've given this some thought. Human beings are curious as well. It's always interesting to know something.

     In the global scheme of the ethics theme, if somebody returns a gift very shortly after having received it, I'm not sure it serves a great purpose to make it public. I think it's a fact situation. It depends whether you return it after getting caught or you return it before getting caught. I think that makes a big difference as well.

    Again, as you say, human nature is inquisitive, but there would be a significant difference between an unacceptable gift that exceeded $200 and one that perhaps exceeded $10,000 or $20,000.

    The value has a relationship with the interest, of course.

    Thank you, Mr. Kent.

    The last questions go to Mr. Angus, for three minutes.

    Thank you.

    This has been a very interesting meeting. I know we'll have many more interesting meetings.

    I want to get back to the line of questions I was asking before in terms of defining the relationship of appropriate and non-appropriate, again with your predecessor. We spent a lot of time talking about gifts, but we didn't spend a lot of time talking about sponsored travel, certainly of a manner that could very much influence how a member of Parliament approaches an issue or how a member of Parliament votes.

    Have you looked into whether or not we need clear rules regarding sponsored travel of MPs either by other countries that are lobbying Canada for foreign policy issues or by corporations that may have an interest? Have you started to look into that area?

     Not really, no. As you know, the code allows sponsored travel. It is perfectly okay, as long as it's properly declared. That's the decision that was made several years ago by the applicable House of Commons committee.

    I think that this is a long-standing parliamentary practice and if it's done in the open—as it is, with our annual report, which we tabled at the end of March—frankly, I don't see any reason to change it.

    However, it's a profound issue of parliamentary habit, if you wish, or a custom, or a culture.

    I certainly agree. It's just that I remember our having spoken with your predecessor about whether or not a $50 gift should possibly be considered an influence, but if someone flies you around the world and puts you up in the best hotels and buys you drinks for two weeks, that's not an unacceptable gift.

    It just seems to me that, if they fly me around Ottawa for the weekend and buy me drinks, I could be influenced, but if I'm doing it in another jurisdiction, I'm not. Should we clarify the rules?

    The way our system works, something is unacceptable if the law prohibits it. Parliament decides what is acceptable and what is not, and sponsored travel is acceptable.

    What you're telling us is that you're putting the onus back on our committee to consider this.

    I'm talking about the other committee, on procedure.

    Procedure, yes, indeed.

    Thank you very much.

    Thank you, everyone.

    Thank you, again, Mr. Dion and Ms. Tremblay, for appearing. We appreciate your testimony today.

    We'll have a brief break, while Mr. Therrien takes his seat. Thank you.

    I call the meeting back to order.

    Thanks for attending, Mr. Therrien. I think we've seen each other several times over the past year, but welcome back. We'd like to hear your testimony for 10 minutes. Thank you.

    Good morning Mr. Chair and members of the committee.

    Thank you for the opportunity to appear before you to discuss the OPC’s 2018-19 Main Estimates.

    With me today is Daniel Nadeau, Deputy Commissioner of our Corporate Management Sector, and Barbara Bucknell, our Director of Policy, Research and Parliamentary Affairs.

    In the time allocated, I will discuss, first of all, recent changes to our organizational structure, adopted with a view to streamlining our work and moving it towards a more proactive and hopefully impactful approach for privacy protection. Secondly, I will talk about the growing resource pressures associated with fulfilling our mandate.

    As you know, our goal is to ensure that the privacy rights of Canadians are respected. The speed and breadth of technological advances have made achieving this goal increasingly challenging.

     In the face of these difficulties, this year my Office has gone through a streamlining and forward looking re-organization exercise. It has sought to achieve streamlining by clarifying program functions and reporting relationships. It sought to be forward-looking by shifting the balance of our activities towards greater pro-active efforts, with the objective of having a broader and positive impact on the privacy rights of a greater number of Canadians, which is not always possible when focusing most of our attention on the investigation of individual complaints.

    The approach, contained in our Departmental Results Framework, is explained in detail in our Departmental Plan tabled in Parliament two weeks ago.

     Very briefly, going forward, our work will fall into one of two program areas, promotion or compliance. Activities aimed at bringing departments and organizations towards compliance with the law will fall under the promotion program, while those related to addressing existing compliance issues will fall under the compliance program.

    We know that a successful regulator is not one who uses enforcement as a first or primary strategy to seek compliance. Our first strategy, therefore, under the promotion program is to inform Canadians of their rights and how to exercise them and to inform organizations on how to comply with their privacy obligations. Guidelines and information will be issued on most key privacy issues, starting with how to achieve meaningful consent in today's complex digital environment.

    We also want to work with government and industry proactively in an advisory capacity, to the extent that our limited resources allow, to better understand and mitigate any negative privacy impacts from new technologies. By sharing information and advice during the crucial design stage of new products or services, we believe Canadians will be able to enjoy the benefits of innovation without undue risk to their privacy.

    Under the compliance program, our strategy is to bring enforcement actions to ensure that violations of the law are identified and remedies are recommended. To this end, we will continue to investigate complaints filed by Canadians, but we will also shift towards more proactive enforcement. Where we see chronic or sector-specific privacy issues that aren't being addressed through our complaint system, we will proceed to examine these matters, for instance, through more commissioner-initiated investigations.

    You have previously raised the question of whether we have sufficient funds.

    While we have gone to great lengths to find efficiencies and make optimal use of existing resources of approximately $25 million, the growing importance of the digital revolution means we cannot keep pace.

    There is also a difficult tension to manage between our complaints work and our proactive work. Both are important parts of our mandate, and we cannot effectively do both under current funding levels. You recognized this in your PIPEDA review report when you recommended my office have discretion to better manage its caseload.

    The truth is, despite restructuring, there are insufficient resources, in particular to provide impactful advisory work. This is why I have asked the government for a measured increase in permanent funding above what is shown in the plan. This additional funding is necessary if we are to meet planned results highlighted in the Departmental Plan.

     In particular, this would help us, one, provide organizations with more policy guidance on emerging issues; two, improve education for Canadians so they may take control of their privacy; three, shift more towards new, proactive strategies; four, assist our overwhelmed investigators in more expediently addressing complaints filed by concerned Canadians; and five, deal with mandatory breach reporting, which comes into force in November of this year but without any associated funding, and which, as was the case in other jurisdictions, is expected to significantly increase our workload.

    In conclusion, in order for privacy protection to be truly effective and more than a pious wish, Canadians, of course, need modern laws, but they also need assistance from a regulator with the authority and the capacity to empower them with useful information, who can guide industry towards compliance with the law, and who can hold industry accountable when it is not compliant. We are doing what we can with the limited tools that we currently possess, but we are falling behind and we need additional resources to provide Canadians with the protection they deserve.

    Thank you, Mr. Chair. I look forward to your questions.

    Thank you, Mr. Therrien.

    First off is Mr. Saini, for seven minutes.

    Good morning, Mr. Therrien. Thank you very much for coming with your colleagues.

    I'm going to start off with a general question. As you're aware, we are now investigating the situation around Facebook. You were here I believe it was two weeks ago to provide your commentary. One of the things that you mentioned is that you are embarking on a joint investigation with your counterparts in British Columbia and the U.K. looking into AggregateIQ and Facebook. This is something that happened recently.

    Obviously, this is going to consume a lot of your resources. Do you have sufficient resources to conduct a thorough investigation or will you be coming back for additional funding?

    When an issue like this arises, and we're seized with a complaint as we are seized with the complaint, obviously, we devote the resources that are necessary to tackle that kind of important issue.

    This complaint raises a number of very important, systemic issues that potentially will affect a great many Canadians. One of my points is, I want to give priority to work that affects the greatest number of Canadians. It's not that I don't want to investigate complaints that are case or individual specific, but if I have a choice to make, I must make the choice of undergoing work that affects the most people. That complaint, we will devote the resources necessary to. It may be that there will be a cost to pay elsewhere, but for that investigation, we will put in the money necessary to investigate it properly.

    The second question I have is regarding your departmental results indicator. I read here that there's a rather significant decrease in the percentage of complainants responded to within service standards compared to the previous year. Can you explain why and are there any measures being taken to correct that?

    There are two explanations for the two investigative groups. The explanation is a bit different in the two cases.

    For the public sector investigative group, the Privacy Act investigative group, the increase in the time required to complete an investigation is, I would suggest, oddly enough good news in that we had a backlog of older cases that we have taken measures to tackle and we have now completed these investigations. This has the effect of lengthening the average response time for all of our work. Yes, the average response time under the public sector investigations has increased, but this is because the backlog of files older than one year has been reduced by roughly one-third, by 30% to 33%.

    On the private sector side, there is also an increase, although that response time is generally a bit shorter than on the public sector side. That's a function of the number of complaints and the complexity of complaints. Given the fact that they are more and more technologically complex, that the business models we're investigating are more and more complex, it takes more time.

     Going back, in your 2016-17 departmental results report, you noted, “On the public sector side, the Office has noted a significant drop in breaches reported in 2016-17 (147 breach reports compared to 298 in the previous year)”, and that your office intends to follow up to determine the reason for this decrease.

    Do you have anything to share about what you've discovered so far?

    We have undertaken a review of this phenomenon. It is not quite complete, but we are almost at the end of the examination. We have been in touch with a number of departments. We are trying to ascertain the reasons for this phenomenon. The number of breach reports has increased slightly from last year, so it was at a certain point. It decreased drastically in the year you mentioned, and it has increased somewhat in the last fiscal year.

     Our study essentially demonstrates that the number of cases reported is much lower than the number of breaches that occur and that the relevant Treasury Board policy is not particularly well understood by departments. We will report on that when we complete our study, and it will be part of our next annual report. But I can say at this point that this is of extreme concern.

    I want to leave off with a very general question, because I think it's been an important one recently, with the Facebook issue and Cambridge Analytica.

     In previous testimony you've said that outreach to Canadians, especially educational outreach, is extremely important. Looking at the situation that happened and at how many Canadians it has affected not just here domestically but more broadly around the world, do you find it important that there be greater outreach from your office, especially specifically targeting social media platforms?

    The short answer is yes. Our main communication tool is our website. We have quite a few people who consult our website when we're working on the practical usefulness of the advice that we give on our website. An important challenge is to bring more people to that source of information. A number of years ago, it used to be that consumer protection offices, for instance, would do ads in the media to raise the profile of a certain issue. Privacy has a certain profile; I recognize that. But there is an issue in terms of bringing people to the source of information that we have to offer, and I think that's part of the solution.

    Thank you, Mr. Saini.

    Next up for seven minutes is Mr. Kent.

    Thank you, Chair.

    Thank you, Commissioner. It's always good to see you here in committee.

    In your opening remarks, you addressed the growing importance of the digital revolution, and you said it means that you cannot keep pace under the current budget of $25 million. With regard specifically to the expected costs of the Facebook, Cambridge Analytica, AIQ investigation, will you find it necessary to contract out investigative services with regard to what has been done and the range of conflicting explanations and untruths that we, at this committee, are coming across?

    Probably not. We will work in concert with our colleagues in British Columbia, the U.K., and other jurisdictions. That's one way in which we divide the work so that there is a certain distribution of work between data protection authorities. We have a solid number of experts. If there is a cost, as I said a few minutes ago, it would be the impact on the investigations that may affect fewer people.

    In your search for the truth—again, given a variety of explanations, justifications, and probably mistruths—do you swear all of your witnesses when you take evidence in Canada?

     We do not do that as a matter of practice. I don't think we have ever done that in practice. Although we have the authority to compel people to testify, and to do that under oath, we usually receive co-operation from the organizations that we investigate, or the departments that we investigate. However, we have these powers, and I would not hesitate to use them if I faced a less than co-operative organization.

    We've discovered in the largely borderless digital world a variety of jurisdictions and inappropriate, if not criminal, activity in different jurisdictions involving associated companies. Do you have the authority to find wrongdoing under your current mandate?

    No, I do not. I cannot impose an administrative fine and I do not have any jurisdiction with respect to criminal behaviour.

    Is your annual report to Parliament due this spring?

    It's in September that we usually table it—

    Oh, it's in September.

    —when Parliament returns after the summer break.

    Will you be renewing your request for greater authority, greater ability to apply meaningful penalties?

    Yes.

    With regard to penalties, on April 18, just a couple of weeks ago, the government published in the Canada Gazette the long-overdue regulations for mandatory breach reporting and record keeping in Canada. I would just recall for our audience that on June 18, 2015, the previous Conservative government passed the Digital Privacy Act to amend PIPEDA.

    Most of that act came into force then, but it's taken three years for the new regulations on mandatory privacy breach notification. We are told it will only come into effect in November, although it's been long expected by those who are aware they will come under the provisions of this reporting. Is that a justifiable delay in your mind?

    I think this could have come into force much earlier than November, so I think it's late in coming. It's of course welcome news, but it's late in coming.

    I'm looking at a document generated by Fasken, but a number of law firms have advised their clients. I'll quote the Fasken's advice, which says:

    What's your office doing in terms of advising those who will be covered by the provisions of these new regulations?

    It's only since mid-April that we have known the content of the regulations, so it was difficult to give precise advice to organizations on how we would implement them. We're currently in the process of developing guidance now that we know the text. That being said, before the regulations were published, we were, and are still, in the world of voluntary breach reporting, and we have contacts, and we have conversations with organizations on the information that we think helpful when they report, currently voluntarily.

    Am I correct in believing the maximum penalty you have under these regulations is $100,000?

    I'll ask my colleague, Madam Bucknell, to speak to this issue. I think it is not the OPC that has the authority, but the amount seems right.

    That's correct. The amount is $100,000, but it is not the OPC that issues the fine. It's a penalty, and we would have to refer it to the Attorney General.

     Now, I expressed the belief that $100,000 was a pretty trivial penalty for a significant breach violation. A member of the government on a television panel that we were participating in said that the $100,000 actually would apply to each of the individual violations. If there were 100,000 individuals affected by that breach, it would be multiplied. A possible penalty could be multiplied by $100,000. Is that correct or incorrect?

    I've heard that as well. I think we'll have to get back to you with some more specifics on that.

    Would that be with regard to your reading of the detail of the regulations?

    Yes.

    Thank you, Mr. Kent.

    Next up for seven minutes is Mr. Angus.

    Thank you, Mr. Chair.

    Thank you, Mr. Therrien. We're very pleased to have you. We think we should have a special desk for you here, because you're at our committee all the time and we're using your advice consistently.

    Mr. Daniel Therrien: [Inaudible—Editor] that's true.

    Mr. Charlie Angus: That's wonderful.

    I am concerned about the transformation of the struggle over the privacy file over the last 10 years. Even as we update PIPEDA, this seems to be affecting many other elements.

    I would refer you to a recent statement by the Bank of Canada, which normally doesn't weigh in on these matters. The deputy governor of the Bank of Canada, Carolyn Wilkins, said that they're very concerned about the effect on competition in the Canadian economy by the massive control of personal data by a few giant tech firms, mostly American firms. She stated:

    Would you consider it necessary that we start to advocate for more powers for your office to start to deal with the more diversified issues that are coming up with the growing data giants, whether it be issues of anti-competition or issues of privacy protection?

    The short answer is, yes, I would agree with the deputy governor of the bank. Although I don't think it would be appropriate for the Office of the Privacy Commissioner to review all of these issues, I think from the privacy perspective, the issue at hand, or one of the main issues at hand here with the growing centralization of powers in the hands of a few and the lack of authority or sanctions for actions that violate privacy, is the issue of trust.

     If the digital economy is to grow, then consumers, citizens, need to have trust that when they engage in that economy, their personal information will not be sold or misused, and that there are sanctions. Others, such as the Competition Bureau, would certainly have a role to play in the issue of whether monopolies are created. Yes, I think new technologies raise very important concerns that I think have to be addressed through a number of laws and regulators with the capacity to share information and co-operate with one another.

    Thank you.

    To that end, I'm concerned, and have heard from many people, about the new agreement that Rogers is putting on its consumers, saying that if you use their services, you're essentially agreeing to give them access to your personal contacts as terms and conditions of use.

    In your view, would that be a breach of PIPEDA?

    We've been in touch with the company in question. My understanding is that they have agreed to remove that particular aspect of their privacy policy. We're also investigating other issues with respect to that organization. On that specific point, my understanding is that they have agreed to withdraw that part.

    Thank you for that.

    I guess my concern is that we have Rogers as a Canadian company, very well protected by Canadian law to maintain their market, and it's a Rogers portal that then goes to a U.S. server. How do we determine that Canadian information that ends up on an American server like Yahoo is still under the rules and rights of Canadian law?

     We were able to convince the sum of companies at stake here to change their practices, even though some of them are American. I think the law was satisfactory from that perspective, in that case.

    Thank you very much for that. That's good to hear, because we've have had a lot of concern over it.

    In 2016, there was a data theft of 57 million users from Uber that was traced back to a Canadian. Uber did not release that breach. They paid them off, which some U.S. congressmen said was reprehensible behaviour.

    I understand that you have been looking into this matter.

    We're formally investigating it now.

    You're formally investigating it.

    It has come up again because of the recent testimony of Brittany Kaiser at the U.K. hearings that Cambridge Analytica had met with Uber, which Uber is denying. There are questions of whether or not that data may have been sold.

    This is all speculation but, to clarify, will you be raising the issue of Uber and that breach with your U.K. counterpart when you speak?

    We're starting with an investigation of the breach. If that leads us to the issue you're mentioning, we will go there and we will talk to our U.K. colleagues.

    That's good to know. Again, what I want to know is that these issues being raised in the public and at committees in various jurisdictions are being followed up. I'm very pleased with that.

    With regard to the issue of this hacker in Canada who was paid off, to me that's a very concerning breach of trust by a major corporation. What we're seeing now, with the breaches of 85 million users, and 57 million users, is that these are very serious breaches that could have major effect. This person could have sold that money to eastern European blackmail gangs or to Chinese operatives.

    How do we establish, internationally, rules that actually force these companies to play by the law? Many of them seem to think that laws are somehow quaint and only for domestic companies. They see themselves as international and above domestic law.

    We're investigating some of these issues, including the Uber case, which is all fine and good. We will try our best to find the truth and make recommendations.

    I think part of the solution starts with sanctions. There have to be credible sanctions that give a message to people who would otherwise violate the law that they need to get in line.

    As to international norms, it's a laudable objective. I would start with having co-operation between DPAs, data protection authorities, of various countries, and try to harmonize laws to the extent possible.

    That brings me to the issue of adequacy and whether Canada's laws should be closer to the GDPR. International norms are laudable—

    You would support our adopting the GDPR?

    As an inspiration.

     I've made certain recommendations that you have in your PIPEDA review report. We don't have to align exactly to the GDPR, but the GDPR is a good model.

    Thank you, Mr. Angus.

    Next up for seven minutes is Mr. Erskine-Smith.

    Thanks very much.

    I want to first understand whether Facebook and AIQ, and some of the other players you're investigating in relation to the Cambridge Analytica scandal, have co-operated so far with your investigation.

    We've had a number of meetings or exchanges of correspondence with Facebook, so I would say yes. With AIQ, I don't think we've really started. We're trying to define our questions to them, so the question has not arisen as far as we're concerned with respect to AIQ.

    When you do have them answer questions, having had them here before us, you may want to administer the oath.

    When it comes to a company that had 272 Canadians authorize the sharing of information with an application, and as a result of that authorization, actually sharing the information of their friends in the amount of over 600,000 Canadians, I know there's an investigation going on, but I struggle to see how this is in compliance with the existing law.

    We can talk about changes to the law to improve it, but I can't understand and I can't wrap my head around how this could possibly be in compliance with the existing legislation that we have.

     We're investigating. You're asking, doesn't the current law address that problem? The current law talks about consent. It doesn't define consent really, but there is room within the current law to give guidance to organizations on what we expect, as a regulator, consent to mean: meaningfulness, information to individuals as to what's at stake, and so on and so forth. To that extent, yes, the current law gives us quite a bit of latitude in defining our expectations.

    That being said, it would be important for you to understand that we had communications with organizations regarding draft guidance on consent following our report last year. One of the things we were told by some companies was that the OPC has no role to interpret the current law more than, or in addition to, what the law allows.

    In other words, the law is written generally, and some committees are telling us that we have no role in trying to define that more practically for consumers. I find that of concern.

    That's a concern given the clear language in the principles related to meaningful consent. There's zero chance that the sharing of such information in the way that it was shared is in compliance with our law.

    You are undertaking an investigation, and we've had witnesses before our committee. You don't have to answer now; you can submit names in writing, but it would be of interest to me to have additional names, proposed witnesses, to flesh out our study as we go. If you have suggestions of names of people who we are not bringing before us, I would appreciate it if you would submit their names to us.

    I can do that.

    I'm going to split my time with Ms. Fortier.

    The last question I have is in relation to new powers for your office. We can talk about order-making powers, the ability to define broader audit powers, including the discretion to undertake investigations or not. If you had that basket of powers, would we not be in a much better position to address scandals like we've seen with Facebook and Cambridge Analytica?

    Absolutely.

    Thanks very much.

    Ms. Fortier, you have the floor.

    Thank you.

    I’d like to come back to the Main Estimates. I have a few questions.

    You mentioned earlier the communication pressures. You must have the necessary resources and find new ways to inform Canadians. What is your plan to reach out more to Canadians in the coming year to help them comply with the Act?

    We’re presently conducting a number of advisory or educational activities. We’re very much focused on our website. We also take part in certain events, like workshops, exhibits, and conferences. The issue we have relates more to the scope of these activities. I think that the information we have is accurate, but we find it difficult to reach people to ensure that more Canadians have access to that information.

    This brings me to the possibility of having to use advertising, although I can’t afford it at the moment. There could be other ways.

    You can’t afford it on a financial level, but do you have the necessary human resources?

    We have a communications group that could do part of the work, and we could hire staff to help us with advertising. Advertising is very costly. I don’t want to say that it would be the only method we would use, but our main issue is to be able to reach a greater number of Canadians.

    The information that we want to disseminate is not only aimed at individuals or consumers. We would also like to reach companies or organizations. We already provide guidelines, including those on consent that should be published shortly, to help companies comply with the Act.

    During the consultations that led to our report on consent last year, consumers and companies told us that one of the important roles of the Office of the Privacy Commissioner was to provide advice and guidelines. We’ve established a list of 30 important topics on which we would like to be able to provide guidelines or advice to consumers and companies. In light of the current budget, one of the major limits is time. Given the diverse nature of our work, including investigations, we will be unable to give advice on all 30 chosen topics within a reasonable time. Yet, I don’t believe that the list contains outlandish topics. These are all important subjects on which we should be able to give advice, but we can’t.

    Finally, beyond general advice and guidelines, in specific cases more likely to concern many Canadians, we would like to be able to give advice to companies about to implement any type of commercial measures. Once again, we have very limited financial resources, so we can only do one or two of these interventions.

    Thank you very much.

     Thank you, Ms. Fortier.

    Next is Mr. Gourde for five minutes.

    Thank you, Mr. Chairman.

    Mr. Therrien, my question focuses more or less on the same topic. Sometimes, you provide advice to a company that uses some private information. People contact you when they think that a company might have gone too far and a complaint has been filed. Would it be possible to do the opposite?

    For example, can a company that must use certain data related to people’s private lives contact you to ensure it complies with legislation? Right now, it’s a bit of a free for all. Companies try their luck, they sell apps, they profile Canadians based on certain data, and if they get caught, they change the way they proceed.

    Could we make it compulsory for these companies to consult your before they get into these troubles?

    We might not be able to force this on companies. This being said, this idea is in accordance with our desire to expand our activities. We give general advice and guidelines, but we would also like to be able to advise companies regarding specific activities.

    We don’t want to become the legal services for all companies in Canada; that’s not what we want. However, if we could have more resources to provide advice to some companies that take actions likely to impact a large section of the population, that’s the type of work we would wish to do.

    At the moment, we’re only able to do it once or twice a year. We’d like to be able to do it more often in order to prevent privacy issues instead of intervening only at the end, once rules have been violated. We’d prefer to intervene when programmes are being developed to ensure that these issues don’t occur.

    A representative from Facebook Canada who testified recently told us that, according to its business plan, this media sells targeted advertising to companies or individuals based, for example, on their gender, their region, and their age using information that people provide themselves on Facebook. It becomes a type of screen in relation to privacy and Canadian legislation. These companies claim that they use services offered by Facebook to advertise on that social media in order to reach their target customers. This way, they assume no responsibility with respect to the privacy of Canadians.

    Do I describe the situation well? Do you think it’s possible to take measures to help companies act legitimately?

    As Privacy Commissioner, I don’t think it is for me to challenge business models. I must operate in the economic world of a democracy with a free economy. However, it is my duty to ensure that privacy principles are respected in the exercise or application of these business models.

    If, among other things, the notion of consent is not well applied by companies that want and are entitled to make a profit using people’s data, it’s not for me to second guess the business model, but to make sure that privacy principles are accepted. I would like to be able to do so more often at the beginning of the process rather than at the end, as is often the case right now.

    The problem seems to be exacerbated by the size of the company and the billions of dollars that flow everyday on Facebook. An annual budget of $25 million seems really limited. Facebook admitted to us that it would add 10 000 employees to comply with the rules. I think that you’re far from being in a position to add even 50 employees to your office.

    Are your means to respond to this problem very limited?

    If it were possible to impose real sanctions at the end of the process, and if organizations responsible for data protection all over the world could pool their resources, we would not reach the size of Facebook, but we could influence, to some extent, its behaviour.

     Thank you, Monsieur Gourde.

    Next up for five minutes is Ms. Vandenbeld.

    Thank you, Chair.

    Thank you, Commissioner, for being here once again.

    Earlier you mentioned the new EU rules that are coming into effect, the GDPR, and you recommended that perhaps we could look at Canada's being more in line with those rules. Those are coming into effect later this month. In the interim, do you see any impact on your work? Obviously data flows between countries. If there's data flowing between Canada and Europe, would this impact work that you're doing in terms of Canadian data and privacy?

    The real impact of the GDPR as far as the OPC is concerned will be felt when the European Union makes a decision on adequacy, and that will take a while, according to the information we have.

    A number of Canadian companies that collect or use information about EU citizens are subject to the GDPR directly, because the GDPR has that extraterritorial application, but for my office, the impact will be felt mostly after the decision on adequacy.

    Thank you. I appreciate that.

    That will be a few years coming.

    This wouldn't have an immediate impact in terms of your resource needs.

    Mr. Daniel Therrien: No.

    Ms. Anita Vandenbeld: Okay. Thank you.

    Earlier today we heard from the Ethics Commissioner, who suggested that it would be useful if officers of Parliament were able to exchange information with one another with, of course, all of the protections in place that it wouldn't be made public. Do you agree with that?

    Yes.

    Okay. Good.

    One of the things you mentioned is that you are looking to do more commissioner-initiated investigations. How would you prioritize? How would you identify where you would do those investigations?

    A big factor for me is the number of individuals affected, the number of individuals whose privacy is affected, so I will prioritize an investigation that will have an effect for more people than fewer people. The seriousness of the violation, of course, is an important consideration, as well as the sensitive character of the information at play.

    Finally, I was listening to the words that you used in your opening remarks. You said things like “our overwhelmed investigators” and “the limited tools”. You've indicated a number of areas where you feel that technology is advancing to the point where your resources are not sufficient.

    What would be the key priority areas where you would see an immediate need for more resources?

    I would go back to the need for balance between investigative and proactive work. Both are parts of our mandate. We have a legal obligation to investigate complaints, so we need to do that, but as part of our statutory obligations, we also have an obligation to educate the public, meaning not only citizens but also organizations. We need to do both, and that's a big challenge we have. I think my answer is that we need money on both sides to be effective.

     What is the current breakdown of your staff on the investigative side and then the education and proactive side?

    It's roughly the same, a little more on the promotion side.

    Daniel, you had a number a minute ago.

     It's about 70 staff on the promotion side and about 65 on the investigative side, the compliance side.

    You feel the need for more on both of them.

    Mr. Daniel Nadeau: Yes.

    Ms. Anita Vandenbeld: Okay, thank you.

    Thank you, Ms. Vandenbeld.

    Next up for five minutes is Mr. Kent.

     Thanks again, Chair.

    Commissioner, it seems that a lot of what we're looking at when we look at Facebook, Cambridge Analytica, and AIQ is along the lines of dealing in stolen property. One company acquires improperly harvested personal data and then markets it or transfers it to other unassociated bodies and we have a company like AIQ that says they didn't do anything wrong in harvesting the data. They developed programs based on data that was given to them by another party.

    Do you think it's time for specific legislation in this, again, relatively lawless, borderless digital world where, when data is used by a third, fourth, or fifth party, there has to be some identification of the origin of that data?

    In theory, we have that already.

    How do you determine that?

    If consent rules were properly applied and, if breached, properly sanctioned, that's part of the answer. There's an issue if a first company acquires information. To do that, there needs to be a link to the services it offers to the customer. Then consent can be obtained for other purposes. Is that consent properly applied? If not, which happens, there should be a sanction against that company, which leads to another company that also has an obligation to collect but only for certain purposes.

     If you follow that chain, I think the concepts exist in the law, consent being an important one. What's missing, at least in Canada, are the real sanctions for those who violate these laws.

    AIQ says, not explicitly but in waffling terms, that they were hired to take a bundle of data and then fashion programs to use it to influence a referendum in the United Kingdom, the Brexit referendum, and elections in the United States. They indicate they had no interest but they were just dealing with raw data. Do they have an obligation under the law to determine that this is lawfully obtained data?

    It gets tricky for me now because we're investigating....

    Let's talk in general, sir.

    Conceptually, a company acquires information; it has to be to deliver a service to the consumer. That company may contract with another company to deliver certain services. That's fair game. The question is what kind of service is offered and did the consumer consent to that ultimate goal being achieved with their personal information.

    Ultimately what I am saying is that I think the concepts are found in the current law. They are at a high level of generality, and that's a level of concern. Then there are questions that I keep mentioning about the authority of the regulator, who can act on behalf of individuals, find out where the problems are, and sanction inappropriate conduct. At the level of the standards, I think we have rules of the game in terms of consent and so on that are adequate. It's the apparatus to determine whether compliance occurs and what the sanctions are if a determination is made that there has been inappropriate use, that's where the bigger flaws are.

     Next up is Mr. Picard, or are you okay?

    Mr. Michel Picard: Yes.

    Okay.

    The last question goes to Mr. Angus for three minutes.

    Thank you.

    I want to follow up on two things my colleague, Mr. Kent, said.

    First, could you present to our committee your analysis of whether or not the fines for breaches are per breach or an overall maximum? We would need that.

    Second, he spoke about the difficulty we're facing with this culture of lawlessness in terms of some of these third party operators, but it's exacerbated by the fact that credible corporations that should be following the law seem to have an internal opt-in, opt-out clause for themselves. An example is Facebook. The morning Facebook came here, we found out that they had just shifted 1.5 billion users out of the reach of Ireland so that they could escape the GDPR provisions. As we have seen with Uber paying off a hacker so that they don't have to report it, it becomes very difficult for us to play catch-up with companies that are that powerful.

    Mr. Therrien, our committee can make recommendations to Parliament. We can issue reports. You say you don't have the budget. What kind of budget is needed to start going after...proactively but also to do public awareness? What tools do you need to be able to ensure that? Have you started a conversation about where your office would fit in with the larger issue of how we deal with data giants? Whether it's anti-competition, whether it's electoral integrity, those are clearly beyond the confines of your particular office. However, your office could provide some guidance on how we need to start addressing taking on data giants so that when Facebook comes to us, we know that the Facebook users of Canada are going to be under the laws of Canada and can't be shifted to another jurisdiction to avoid being held accountable.

    I'll undertake to provide that analysis, but I come back, at least in general terms, to the fact that there are a number of areas of the law at stake. We own part of the puzzle. Others, such as the Competition Bureau, own another part. I think co-operation is needed.

    The fact that I can only intervene on complaints, for the most part, and if there are reasonable grounds to believe that a violation has occurred means that we have some knowledge of corporate practices, but we do not have a very good knowledge of corporate practices. Before I would feel comfortable providing an analysis as to what kind of regulation is required.... I have some knowledge, but I'm not sure I have all the knowledge I need to make good, solid recommendations to you. Perhaps the solution is to start relatively small. Ensure that all areas of law are adequately dealt with, including competition. Ensure that there is good co-operation between regulatory bodies, who will then be able to have a better sense of what's going on. Then proper laws can be adopted.

    Thank you, Mr. Angus.

    Once again, thank you, Mr. Therrien, for appearing before our committee. I wish you a good day.

    The meeting is adjourned.