[Recorded by Electronic Apparatus]
Tuesday, February 4, 1997
.1108 
[English]
The Joint Chairman (Senator Oliver): Order, please.
I'd like to extend a welcome to Mr. Bruce Phillips, Privacy Commissioner of Canada. This is a continuation of the hearings of the Special Joint Committee on a Code of Conduct. We have asked Mr. Phillips to come today at the request of members of the Bloc, the official opposition in the House of Commons, to deal with some of the privacy issues in relation to the code of conduct issues, particularly disclosure, which we've been discussing.
Mr. Langlois of the Bloc is at another meeting, Mr. Commissioner, but to take advantage of the time we have perhaps you could begin now. When Mr. Langlois comes in I will briefly summarize what you've said and then we can proceed to questioning.
The floor is yours.
Mr. Bruce Phillips (Privacy Commissioner of Canada): Thank you, Senator Oliver,Mr. Milliken, gentlemen.
[Translation]
I prefer to speak and answer in English, as it is easier for me. I am still learning the other beautiful language.
[English]
First of all, I thank you very much for inviting me to come here. At the outset, I have to say that whether there is to be a code of conduct or a code of ethics for members of Parliament and their families, and if there is to be one, what it's to contain, are not properly matters for comment by me. That's entirely the business of the members of Parliament themselves. It is perhaps, though, in some senses, my business to offer to help with some of the privacy aspects of such a proposition.
It's perfectly clear that any collection of personal information, particularly of the type contemplated in a code of conduct, requires the sacrifice or the loss of some element of personal privacy. It is sensitive personal information, which is given up for disclosure to other parties. The issue is what constitutes a reasonable loss of privacy for the purpose intended. That decision is a decision that this committee and the Houses of Parliament must make.
.1110
Before dealing with this, I think it might be helpful to remind you of my role and the jurisdiction of the act under which I operate so that we don't lose sight of what's now in place and what the role of a privacy commissioner is.
The privacy commissioner - I'm sure most of you know this - is an officer of Parliament. I am not an employee of the government of the day. This means that I report only through the Speakers of the two Houses, that I am an independent auditor and sometime critic of federal government administration and legislation, and an independent investigator. My powers stem from the federal Privacy Act.
The act establishes the right of individuals to see information about themselves that is in the possession of government departments and to ask to have any errors corrected. However, the most vital component of the Privacy Act is its regulation of government collection, use, and disclosure of personal information, what we in the trade call ``the fair information code''. Individuals can complain to me if they're dissatisfied with an organization's handling of their request or if they believe government's collection, use, or disclosure of personal information violates the fair information code.
I should underline - particularly to this committee - that the Privacy Act applies only to the approximately 100 federal organizations that are named in the schedule to the Privacy Act. In the present context of this meeting - the code of conduct - the act does not apply at all. In fact, the Privacy Act does not apply to Parliament, to the courts, to crown corporations, to the federally regulated private sector, or to provincial or municipal governments. So in a sense here I'm talking about something that in no way comes under my jurisdiction. That is the limit of my jurisdiction.
So I'm before you really just as a basic privacy resource, or, if you like, as a counsellor or an adviser. I hope to be able to give you some privacy perspective as you look at the issue of this code.
The best place to begin is to set out those principles that are the foundation of the Privacy Act and of virtually all comprehensive privacy law. These are the principles that should govern any collection of personal information for whatever purpose by any organization, whether it's a jurisconsult or a deputy minister.
An organization should collect only the information it needs to operate its programs. It must be collected directly from the individual concerned wherever possible. The individual must know the purpose of the collection. All reasonable steps should be taken to ensure the accuracy and the completeness of the information. It should be kept long enough to allow the individual to have access to it to verify its accuracy. The information should be used only for the purposes for which it was collected, or for a use consistent with that purpose, and should be disclosed only for the purpose for which it was obtained, or for a use consistent with that purpose. The information should be protected against unintentional disclosure by appropriate security and confidentiality measures, and information that is no longer needed should be disposed of in a secure fashion.
It seems to me that the most important questions for you to consider are the following.
First, you must consider whether personal information needs to be collected at all. I should think the answer to that is obvious if you decide it is in the interests of Parliament to go ahead with such a code.
Second, if so, what details should be collected and who will manage the information, including disclosures of that information, and under what rules?
Finally, will there be independent oversight, and if so, by whom? I mention independent oversight because in the case of those parts of the government that are covered by the Privacy Act, I function as the independent overseer.
I hope this gives you the background you need to consider the privacy aspects of the code. I am at your disposal to clarify or to help as much as I can with any of your questions.
Thank you.
The Joint Chairman (Senator Oliver): Thank you very much, Mr. Phillips.
.1115
I'd like to call on the co-chairman, Mr. Milliken, to put a question to you about the code as we're looking at it now. Mr. Milliken.
The Joint Chairman (Mr. Milliken): Thank you, Mr. Chairman.
Mr. Phillips, do you in the course of your work have any responsibility in respect of the code of conduct that applies to public office holders, ministers, and parliamentary secretaries?
Mr. Phillips: No, only insofar as I am, like all other class 1 office holders, subject to and bound by that.
The Joint Chairman (Mr. Milliken): So you're bound by the code and you have to meet the disclosure requirements under that code in respect of personal assets.
Mr. Phillips: That is correct.
The Joint Chairman (Mr. Milliken): Do you feel the disclosure requirements under that code - and you may think this question unfair, but I'm asking it because we'd like your opinion on this - are unduly onerous or unfair? In other words, do they meet the criteria you listed in your remarks, or is more information demanded than is necessary?
Mr. Phillips: I was hoping not to be drawn into this kind of a discussion, but since you ask it about something that applies to me and would not necessarily apply to yourself, I'll do my best to answer it. I personally have not found the code onerous. That may be because of the very modest return I have to make. The reporting requirements are simple and straightforward.
There is a significant difference, though, between what office holders are required to do with respect to the disclosure aspects of it. Although as a public office holder I am required to disclose all my assets and liabilities to the ethics counsellor, the public access to that is rather different from what I understand is being contemplated here.
The public aspect of disclosure would only indicate that a public office holder is in compliance or is not in compliance, whereas I understand that what is contemplated here - I have to point out to you that I have not seen a copy of the code that you are looking at, and I'm told that is still a confidential document - is a register that would give public access to the nature of the assets of members of Parliament, although it would not necessarily specify the value of them. There is that significant difference.
In answer to the question put by the co-chairman, no, I don't find it an onerous chore. If it was the decision of governments and parliaments that public office holders should make these disclosures, I have no difficulty with that.
The Joint Chairman (Senator Oliver): As between ``is or is not in compliance'' and a disclosure, which of the two do you prefer?
Mr. Phillips: I'm going to pass on that question, Senator Oliver, for the simple reason that I feel that as a privacy commissioner it inevitably is going to draw me into a discussion of the degree and manner of disclosures that this Parliament may or may not consider to be necessary.
If it is the view of members of Parliament that public confidence in this institution requires a certain level of disclosure of the assets and liabilities of MPs, I believe it is the opinions of the members of Parliament themselves that are relevant here. I could only reply to that question as a citizen, speaking for myself, and not as a privacy commissioner. I think it is outside my responsibility and purview, and it would be inappropriate for me to answer that question. I would very much like to - of course, I have an opinion on the subject as a citizen and as an individual - but I think it would be wrong for me as a privacy commissioner to have these two issues confused. I would not want anyone from the media to go forward from this committee, for example, saying the privacy commissioner thinks there should be this or that level of disclosure. I don't think that is my business.
.1120
The Joint Chairman (Senator Oliver): Mr. Epp.
Mr. Epp (Elk Island): Thank you, Mr. Chairman.
I would like to ask you a couple of questions. First of all, you said the Privacy Act applies only to federal agencies, not to individuals. Is that correct? Did I hear that right?
Mr. Phillips: The Privacy Act applies to the personal information holdings of 100 or so different federal entities listed in the schedule. Of course it applies to individuals. It applies to information held in the records of the government. That is what the Privacy Act covers.
Let me put it this way. Doubtless, somewhere in the files of the Government of Canada, there is information relating to you, sir. At some point in time you might wish to see that information. You have a right, under the Privacy Act, to see it. You have a right, under the Privacy Act, not to have that information used for purposes other than the reasons for which you gave it to the government.
Mr. Epp: So the act applies to citizens of Canada.
Mr. Phillips: It applies to the records in the Government of Canada, yes, affecting citizens of Canada.
Mr. Epp: Okay. When you're talking about the 100 federal agencies, you're talking about those agencies of the government that maintain database information on Canadian citizens.
Mr. Phillips: Yes, that's right. Generally speaking, that means all the major departments of government, all the boards and tribunals and so on. There are some exceptions, which I mentioned in my outline. Parliament is excluded - the activities of Parliament, the courts and federal crown corporations, with the exception of the post office, which is included.
Mr. Epp: I want to ask you specifically about the conflict of interest and post-employment code for public office holders. Is that covered under the act or are they exempt? Can cabinet ministers claim protection under the Privacy Act?
Mr. Phillips: No, they can claim only that level of protection covered by the rules pertaining to the operation of the public disclosure rules, which do set out those elements that are available to the public.
Public office holders - and as defined here, they include deputy ministers, ministers of the crown, parliamentary secretaries, members of ministerial staff and full-time Governor in Council appointees such as me - are required to make a complete disclosure of their assets and liabilities to the ethics counsellor, who thereafter prepares a public declaration that's available to the public.
So that public declaration is available for public scrutiny. The balance of that information is not available to the public. It is personal information as defined by this act. As a consequence, the public does not have access to it. The individuals who have contributed the information that makes up their individual files of course have access. Not only do we have access but we're also required from time to time to report any changes to the holdings.
Mr. Epp: What I'm driving at here, then, and what I would like to know, is that if in our proposed code of conduct for MPs and senators we were to have requirements to disclose certain information, would that then come under your jurisdiction as to how much of that we can do?
I get a conflicting interest here. You were invited here to give us advice, yet from what I heard in your preamble, you would not have jurisdiction over this.
Mr. Phillips: Not unless you passed a piece of legislation saying that this will be subject to the Privacy Act; otherwise, it is not. Parliament and its activities are not covered by the Privacy Act.
Mr. Epp: Would you recommend that we include that in this code?
.1125
Mr. Phillips: I would recommend that you seriously consider a regime for protecting this information, for making a clear decision about the amount of information you think needs to be made public and the amount of information you feel should not be made public and then embody that decision clearly in the rules and accompany it with a proper regime, so members may have access to it, they can be satisfied it will be securely and confidentially held, they can verify its accuracy from time to time, and when the member or the senator, as the case may be, withdraws from membership in Parliament, the information contained in that file will be destroyed within a reasonable time. That is the point I wish to make.
This is all your information, members of the committee, and it is for you to decide how much of it you feel is necessary to be made public to meet the purposes of this code. I did read all the evidence of the previous witnesses from the provinces and from Mr. Sharp and so on. I presume the point in your minds is that you feel public confidence requires a code of this kind. The judgment about the degree of disclosure necessary to meet the test of public confidence is something you must decide. What I am trying to tell you is whatever information is collected from members and senators, you have to set up a proper system for safeguarding it. That's what I'm trying to say.
The Joint Chairman (Senator Oliver): Mr. Collins, please.
Mr. Collins (Souris - Moose Mountain): Thank you, Mr. Chairman.
Just a simple question. You have touched on it twice now. At a point when the information is no longer needed, you said it should be disposed of. Can you give me some idea of what we're talking about in length of time? I think that's very important. When it's not in the interests of anybody, it should be disposed of. Who would do it and what kind of a time element are you talking about?
Mr. Phillips: Let me address the practice generally and then try to zero in on code of conduct. It is the practice, in fact it is a requirement, that all departments of government have retention schedules for personal information they collect from Canadians. These schedules vary. In the case of routine information, if you make an application for a grant or something, probably the retention schedule for that would be quite brief; maybe two years. If it is information of a law-enforcement character, information the police felt they had to keep on file for a prolonged period, it would be a much longer period.
These retention schedules are worked out between the departments of government and the public archives, who have experts who try to make a reasonable determination on the life expectancy and life utility of any particular kind of information. The departments are responsible for disposal thereafter.
In the case of a code of conduct, I believe in the existing code for public office holders there is already a disposal schedule, and I think it's only two years. Yes, here we are. It says here:
- (3) It is the responsibility of the Ethics Counsellor to ensure:
I think in this case, although it doesn't state it right here, it's two years. We can check up on that.
Mr. Collins: Just one other question. You may or may not be able to answer it. It's purely hypothetical, but it's one I've come across and if you can answer it I would appreciate it.
It comes through on banking. We now are going to review and we're going to find out when we do credit ratings... In Saskatchewan, for instance, we have an agency that does credit ratings. The same agency is responsible for collection. Where they have difficulty with collection, they start to report your credit rating according to their success.
.1130
Is that not a conflict of interest? How do we circumvent that so we don't get agencies walking in two different minefields at the same time, releasing information on citizens that is based purely on their opinion of their successes or failures in dealing with those individuals?
On codes of conduct, some of what has been released comes through later. Information and documents may come out about you and somebody may say ``Whoa, I have another piece of information that's come forward here''. I might say ``Just a minute, is that fair?'' I just wonder whether you have ever visited that topic.
Mr. Phillips: I'll try to deal with that. The kind of problem you perceive here would depend, to a very large extent, on the kind of information you feel ought to be disclosed in the public interest. If a member's assets and liabilities were made public, down to the last penny, it might expose that person to that kind of problem.
It doesn't seem to me, though, that you'd have the same sort of problem if the disclosure referred only to the type of asset and not to its value. It seems to me you could obtain the kind of protection you want from that problem.
With respect to credit reporting agencies, that's another whole issue I would love to come back and talk about some other time.
Mr. Collins: Thank you very much.
The Joint Chairman (Senator Oliver): Mr. Pagtakhan, and then Mr. Laurin, please.
Mr. Pagtakhan (Winnipeg North): I would like to pursue the one about SIC guarding the document, returning it, and destroying it. Are copies allowed to be made of the original documents submitted?
Mr. Phillips: That's a question I can't answer. You'd have to ask the ethics counsellor what his practice is. I presume, without certain knowledge, when a public office holder files a return with the ethics counsellor, as many copies are made inside the ethics counsellor's office as are necessary for management of the program and no more.
The return required of us does not require us to supply all the supporting documentation. It is sufficient for the ethics counsellor's purposes that you tell the ethics counsellor, as a public office holder, what your assets and your liabilities are. I take it the assumption that underlies that approach is that you are trusted to be honest in your return; otherwise you'd have to supply copies of your mortgage, your monthly VISA bills and everything else, and that kind of detail is not requested.
Mr. Pagtakhan: Whatever document is submitted by the office holder would be in the original. To safeguard the sanctity of that information at the end of the period, would it not be better to return the original to the office holder rather than destroy it? Unless you see the actual destruction, theoretically, you will not know whether or not the document has been destroyed.
Mr. Phillips: I take your point. I'm sorry, I think I misunderstood your original question.
Generally speaking, that is not the practice with the government at the moment. It routinely disposes of vast quantities of personal information holdings by shredding them, or other forms of destruction. To return every piece of information in those circumstances would be a very substantial and expensive undertaking. Nevertheless, you make a point. It might be something you would want to consider in writing the rules for your own code, if you decide to have a code. In that particular case, you would want all the documents returned to the member.
.1135
I have no reason to believe that under the existing code for public office holders there has been any slippage or negligence, although I have to say that as a privacy commissioner I have from time to time come across cases of sensitive personal information being lost or otherwise improperly cared for by the government and falling into hands that it should not have. That has happened more than once in my time as privacy commissioner. You make a point, sir.
Mr. Pagtakhan: Thank you.
My last question, Mr. Chair, is this. Why wait for two years? What was the rationale behind it?
Mr. Phillips: I'm not certain, sir, when I say two years. I just think it is. It's not stipulated here, and I'm only going by my memory.
There is a post-employment aspect to the code. Public office holders operate under some restraint when they leave their jobs, and the information is contained at least for that period. Most public office holders are under some restraints for any activities in which they engage for a period of at least a year after they leave the service of the government. It's clear that there's a good reason to hold the information for that period of time at least, and I suppose for another twelve months or so, to allow for the proper administration and destruction of the files.
The Joint Chairman (Senator Oliver): Mr. Laurin, please.
[Translation]
Mr. Laurin (Joliette): Mr. Phillips, given that freedom of the press exists and that it is almost untouchable in Canada, how can we ensure the efficiency of a system of confidential disclosure if, on the one hand, the Privacy Commissioner cannot disclose some information, whereas on the other hand, the press can if it happens to learn that a member of Parliament has a stake in a certain company or some other type of interest?
Would we have to limit freedom of the press to ensure the efficiency of the Privacy Commissioner's system of confidential disclosure? In my view, information that cannot be disclosed by the Privacy Commissioner should not be disclosed by the press either.
[English]
Some hon. members: Oh, oh!
Mr. Phillips: You certainly raise a very interesting question. The right of Parliament to abridge the freedom of the press is a subject of interesting debate, sir. Any such proposed abridgement would, I'm sure, be instantaneously challenged before the courts as a test of the Canadian Charter of Rights and Freedoms. I could not begin to guess how that might be resolved.
You are quite right: the press can publish anything it wants and that it can get its hands on, subject to the libel laws and such other laws as are already on the books. That is why, in the case of a code of this kind, care must be taken that only that information is made available to the public record that you decide should be on the public record, and, equally, that information you do not wish to be on the public record is kept absolutely safe and secure in the hands of a proper authority.
If there is any leakage from that system, then you would want to know how the leaks occur. But I am at a loss to know how you could possibly inhibit or prevent the press from publishing material that comes into its possession by lawful means.
The Joint Chairman (Senator Oliver): Manila envelopes -
Mr. Phillips: I would not expect the ethics counsellor or the jurisconsult or whoever was in charge of administering such a code to ever have either himself or anybody on his staff putting stuff in plain, unmarked envelopes.
.1140
That is a risk of public life. The press is always interested in every detail it can dig up about people who are in public life. If they can come by information, they are going to run it if they feel it's newsworthy. The only way you can protect yourself against that sort of thing is by being sensible and careful. It may be you don't want to.
By definition, people in public life have a reduced expectation of privacy. When you seek the public's confidence, you have to tell them enough that they can make an informed judgment about whether you deserve their confidence. That's the game.
But when it comes to matters of this kind, highly sensitive, intimate personal information, you can set up a system by which that information, if you give it to a manager of a code of conduct, will be adequately protected. Only that information that you decide needs to be made public will be made public.
Unless I misunderstand your question, sir, I don't think...
Let me put it this way. We have now had a code of office for public office holders for some years. There has been no leakage from that office; not one that I'm aware of.
[Translation]
Mr. Laurin: Mr. Phillips, if we are required to give the Privacy Commissioner a confidential disclosure of our personal assets, how can we have a truly efficient system and protect the public from conflict of interest if you do not have the authority to step in if a member of Parliament or a public office holder ends up in a conflict of interest?
In other words, why should I provide you with a confidential disclosure if you're going to keep it in a drawer and if no one is responsible for advising me that I may be in a conflict of interest?
[English]
Mr. Phillips: Is that not one of the proposed functions of your jurisconsult, that in cases of doubt in a member's mind you would be able to go to such a person and say here is a situation, I am in some doubt as to whether it does or does not meet the tests of the code, please give me your advice? That's one of the functions. It would not be mine, but...
[Translation]
Mr. Laurin: If that is the case, it seems clear to me that we could entrust confidential information to the Privacy Commissioner on condition that there be some certainty that he is independent enough to ensure that the information remains confidential.
This leads me to a question I asked during the previous session. Do you think that the Privacy Commissioner is currently independent enough to carry out this function or do you think he should have the same amount of freedom as the Auditor General?
[English]
Mr. Phillips: I'll answer that question in two parts.
I have all the independence I require to do my job, absolutely. Bear in mind that independence consists of two things. It consists of the formal structure of the office and it consists of the character of the person who occupies it. I can think of no circumstance that would persuade me to compromise my independence, and the government has established this office in ways that make it convenient for me to do my job.
The second part of the question, whether the Privacy Commissioner should have a role in the management of personal information respecting members' assets and liabilities, I have some doubt about that, sir. I'm not sure mine would be the appropriate office for that purpose. It seems to me the person who is responsible for managing personal information of that kind would be the same person to whom you would want to feel free to go for advice in the management of your affairs, or for discussion of areas of doubt in your mind about what is or is not appropriate for a member of Parliament to be doing. That is a study requiring an expert in the field whose sole responsibility is to make those determinations. I don't think I'm the right person for that job. I think you want to get somebody who has no other responsibility outside of management of this code. That's my opinion.
.1145
I'm flattered that you think this might be a good job for me to do, but I think you would be better off getting somebody else to do that, and that alone. I have lots on my plate already.
Does that answer your question?
The Joint Chairman (Senator Oliver): Thank you very much.
Are there any others?
[Translation]
Mr. Laurin: I was not referring to the actual person. I would have confidence in anyone in that position. However, I am afraid that if the person reports to the Prime Minister or to the Governor in Council, he or she will not necessarily have the necessary freedom. How could the person refuse to respond to a request from the Prime Minister to disclose confidential information obtained as a result of these delegated powers? The Prime Minister is in a position of authority over the Privacy Commissioner. How can you avoid giving in and say that because of the powers imparted to you, you regretfully cannot comply with his request? The Prime Minister would have the choice, or at least the privilege, of telling you that you are no longer the person needed to carry out these duties and of appointing someone else who would have a better understanding of a Prime Minister's request, but this is not in reference to our current Prime Minister.
[English]
Mr. Phillips: I do not report to the Prime Minister, for one thing. I report to the Speakers of the two Houses - and there are other officers in the same position. It does seem to me, sir, that if it is the desire of Parliament to establish a code of conduct of a nature that requires the appointment of a jurisconsult or a manager or a counsellor - whatever you want to call him - it is entirely up to Parliament to decide to whom that person would make a report. That appointment could report only to the Speaker, only to a committee such as this, or to whomever you feel is the right party to whom the custodian of all of that personal information should report.
In essence, what I'm saying is that it is entirely up to Parliament to decide on these rules and to assure yourselves that you are going to obtain here the kind of confidentiality, privacy, and security the situation demands. It's in your hands.
The Joint Chairman (Senator Oliver): Are there any further questions that anyone would like to put to the privacy commissioner?
Seeing none, I would like to thank you very much for coming today, Mr. Phillips.
I would like to remind all hon. members that the next meeting of this committee will be Wednesday, February 5, 1997, in this same room in the Centre Block at 3:30 p.m.
Thank you very much. This meeting is adjourned.