ETHI Committee Meeting

    Good afternoon, colleagues. Welcome to meeting 58 of the Standing Committee on Access to Information, Privacy and Ethics.

    Today we are pleased to have appearing, pursuant to Standing Order 81(4), on the main estimates, from the Office of the Privacy Commissioner of Canada, Mr. Daniel Therrien, who is the commissioner. With him is Ms. Patricia Kosseim, senior general counsel and director general, and Mr. Daniel Nadeau, director general and chief financial officer. They, too, are not strangers to the committee.

    Welcome, Commissioner. We have one hour to go through the main estimates. Please give us your opening remarks, and then we'll proceed to questions.

    Thank you very much, Mr. Chair.

    Ladies and gentlemen of the committee, thank you for the opportunity to appear before you to discuss the 2017-18 Main Estimates.

    In the time allocated, I will first discuss the sustained demands on our office and the management of our financial resources. Secondly, I will talk about our policy agenda for this coming year.

    In recent years, the Office of the Privacy Commissioner of Canada has maintained its efforts to find efficiencies and make optimal use of existing resources of slightly more than $24 million to be as effective as possible in addressing the privacy risks of an increasingly technological world.

    Fiscal year 2017-18 will be no exception. Amidst competing demands, we will not lose sight of our mandate: ensuring that the privacy rights of Canadians are respected and that their personal information is protected.

    In 2017-18, we will continue to fulfill our core mandate, which includes conducting investigations, examining breach reports, undertaking audits, reviewing privacy impact assessments or PIAs, providing guidance to individuals and organizations, and offering advice to parliamentarians.

    On the investigations side, we have become more efficient in part through increased use of early resolution to find appropriate solutions. In 2015-16, 38% of complaints were resolved in this manner under the Privacy Act and 50% under the Personal Information Protection and Electronic Documents Act or PIPEDA. As a result, our response time on average was seven months for both public-sector and private-sector complaints.

    However, the number of complex files is growing, which is creating a backlog of complaints that are not resolved after 12 months. In the coming year, I intend to devote temporary resources to address this situation.

    In 2015-16, we received 88 new PIAs and completed 73 PIA reviews, in addition to opening 13 new consultation files. As you know, we would like to receive more PIAs and draft information sharing agreements, as we believe reviewing programs upstream is a good way to mitigate privacy risks.

    In addition, we are taking steps to prepare for the coming into force of the breach provisions of Bill S-4. These new provisions will require private-sector organizations to report certain breaches to my office.

    Public education and outreach are important activities to ensure Canadians are empowered to exercise their privacy rights and organizations are able to comply with their obligations. Last year, we revamped our website both in its structure and content to make it more user-friendly. This year, we will continue to update its content to provide helpful advice to Canadians.

    We will continue to offer guidance to specific industry sectors deemed to be in need of greater privacy awareness, as well as vulnerable groups such as youth and seniors. We will also provide new guidance for individuals, and we will continue to advance our privacy priorities on issues such as online reputation, the body as personal information, the economics of personal information, and government surveillance.

    Despite these efforts, we need to do much more to ensure that privacy rights are truly respected, a key condition for consumer trust and growth in the digital economy. Our goal is to complete all investigations within a reasonable time, to engage in some proactive enforcement, to give proactive advice to government, and to issue research-based guidance on most current and upcoming privacy issues.

    In my annual report to be tabled in September, which will include our conclusions on improvements to the consent model and recommendations to amend PIPEDA, I will be able to bring more specificity to our compliance and proactive strategies. This, in turn, will inform a discussion on what might be an appropriate level of investment in OPC activities for the next few years.

    I will now turn to some of the policy issues that we're seized with.

    First is consent. Last May, my office released a discussion paper on issues related to privacy and consent. We then, through an extensive consultation process, sought input from industry, privacy experts, and Canadians. As mentioned, our final report will be released in September, and we will then work to implement the chosen solutions.

    Second is online reputation. My office has also launched a consultation and call for submissions on the issue of online reputation as part of our efforts to address one of our strategic privacy priorities: reputation and privacy. We will share our policy position on online reputation before the end of the calendar year.

    Third is legislative reform. My office has long stressed the need to modernize Canada's legal and regulatory frameworks. While the introduction of Bill S-4 was a positive development, Canada's federal private sector privacy law is now more than 15 years old. Technology and business models have changed. Our work on both consent and reputation will help inform the recommendations we will make to Parliament on reforming the law.

    On the public sector side, I would like to express my gratitude to members of this committee for supporting my office's recommendations for modernizing the Privacy Act. My office now looks forward to participating in the government's review of the act to ensure that it meets the needs and expectations of Canadians, and in our view this work should proceed without delay.

    On government surveillance, issues related to government surveillance will also form an important part of our policy agenda in the coming year. We note your recent report on SCISA, and we thank you for it. We also note the report just made public by SECU, the committee on national security, which also touched on information sharing under SCISA. We now await the measures the government will put forward to modify Bill C-51 to ensure that Canada's national security framework protects Canadians and their privacy.

    We also have a number of investigations related to national security and government surveillance, and we are seeing heightened concerns from Canadians about privacy protections at the border and in the United States. Further to the adoption by President Trump of executive order 13768 of January 25, which deals with security in the interior of the United States, I had written to ministers to ask for confirmation that administrative agreements previously reached between Canada and the U.S. will continue to offer privacy protection to Canadians in the United States. Upon receipt of the government's response, which I expect shortly, I will inform Canadians of my conclusions.

    In closing, to face the sustained volume but increased complexity of our work, we will continue this year to make the most efficient use of our resources as we have tried to do in the past.

    Thank you, Mr. Chair. I look forward to questions from the committee.

    Thank you, Commissioner. I appreciate that. I think we're going to have a really good discussion here today.

    We'll now start the seven-minute round, please, with Mr. Long.

    Thank you, Chair.

    Thank you, Commissioner Therrien, for coming in, and thank you for your great work this past year and in years gone by.

    As we talked about the last time you were here, my background is business. I've been through many budgeting processes, and strong budgeting processes are obviously a very important part of any business, whether government or private.

    Commissioner, can you elaborate on the process of budgeting, how you work with your department and your staff, and how each department contributes to the overall budget?

    The first element to mention is that the strategic priorities on which we consulted Canadians when I arrived and that were developed a year after, in 2015, are a big part of the budgeting exercise. When we look every year at the activities that we want to engage in and to fund, the strategic priorities that were developed two years ago are certainly important. They're particularly important for work of a discretionary nature. We have to respond to complaints that are made. That's our statutory obligation under PIPEDA and under the Privacy Act. That's not discretionary. We have to do it. But for all the work that is discretionary—it's part of the statutory mandate but it's somewhat discretionary—the priorities are particularly relevant.

    Government surveillance is part of it, and improving the privacy of Canadians. The economics of privacy is another. We also have strategies under this plan to do more public education and outreach, educating Canadians. All of these priorities and strategies are part of the mix as we look at the amount of money we want to spend every year.

    More mechanically, we look at whatever discretion there might be in the budget—for instance, monies unspent or staff positions that have not been filled, or are not permanently filled at a given point—to see whether there's any discretion to devote and allocate resources to priorities.

    I used to call it “budget challenge” with some of my departments, when I would actually push back and challenge. Does that happen in your department?

    Certainly we have ongoing discussions about the efficiencies of processes. A big part of our work, taking about 50% of our resources, is spent investigating complaints. I can't push and say, “Are you sure you want to do this or that?”, because we have a statutory obligation to deal with complaints, but we do have ongoing conversations around whether the process we use to investigate complaints is efficient and so on.

    When you started your presentation, you talked about finding efficiencies in the department. Can you elaborate on what efficiencies you did find and on what you did about those?

    The most important efficiency has to do with early resolution processes. We have no choice but to investigate complaints, for the most part, but we have a choice as to how we will investigate complaints. One way in which we increase efficiency is by trying to resolve cases in a mediation-type process, which obviously is less time-consuming than a full investigation. We also categorize the complaints we receive according to either the risk they pose to the complainants themselves or to whether they raise a systemic issue that would be worth investigating in a more thorough way. It's in part risk management and in part an attempt to resolve cases in a mediation-like process to the extent possible.

    You've mentioned advances in technology—I read that somewhere yesterday—and how that will outpace your office's ability to be effective. Can you elaborate on that and on what you plan to do about it? As well, where is that reflected in your budget?

    The technology for our office is of course an extremely important factor. It affects us in that technology creates new business models, some of which create privacy risks. There are new privacy risks all the time that are created by new business models and new technologies. One of the biggest challenges we face is to keep up to date in understanding these technologies and business models to make sure that we know the privacy risks, advise Canadians appropriately, and provide appropriate guidance to organizations so that they can implement these business models in a privacy-protected way.

    Okay. You noted that your new online information request form had led to a large increase. I was surprised. I read here, from 555 in 2014-15 to 2,097 in 2015-16. Do you expect to see that trend continue? Do you have numbers or a feel for what's going to happen there?

    It may well happen. We have had an information centre for a long while, and this has meant answering telephone calls from individuals who are interested in certain privacy issues, short of filing an official complaint. We've now developed this tool whereby people do not have to call. We're available 24-7, actually, through the Internet, so they can raise issues with us. I think if you—

    Do you feel you have the necessary resources?

    It's a challenge, but we have no choice but to make our services available as much as possible. We know that there are many privacy problems out there. We want to be out there and available to people. Do we have enough resources? We try to do the best we can with the resources we have.

    My last quick question is this. What percentage of your budget is salaries?

    It's the majority, 70% for salaries.

    Thank you very much.

    Thank you.

    Mr. Kelly, you have seven minutes, please.

    Thank you, Mr. Chair.

    From your numerous appearances you've made at our committee we know there are quite a number of moving parts and changes that your office may go through as a result of the recommendations that this committee has already made through its reports, and may be adopted. One that I hadn't yet contemplated was what you had raised in your remarks about the implications of executive order 13768. What sorts of contingencies on resources have you contemplated?

    I'll let you expand on that one first.

    Simply to describe what is the impact of that order, that order is an executive order that does not change U.S. law. It's an executive order by the President of the United States. It says to U.S. officials that, to the extent that privacy protections of a discretionary administrative but not legal nature were offered to non-U.S. citizens previously, these protections are at the very least at risk. Canadians who until then, and perhaps now—we'll see what ministers say in response to my letter—had certain administrative protections under, say, the Five Eyes alliance, such that those countries do not spy on one another's citizens. That's not a legal instrument, but an administrative agreement that provides certain administrative protections to Canadians. Certain border arrangements, also of an administrative nature, provide certain privacy protections to Canadians.

    The executive order can be read as saying these discretionary protections for non-U.S. citizens no longer apply. The order is ambiguous. It can have that impact. I have written to three Canadian ministers so that they can determine through conversations with their U.S. counterparts how the U.S. administration will actually apply this order. I'm simply saying there's a risk here. I've asked the Canadian government to verify how the U.S. administration will apply the order. Will it reduce the privacy protections of Canadians in the U.S.? I'm told that within a few weeks I will have an answer to my query to the Canadian government.

    I'll receive an answer from the Canadian government, and then I'll have to assess what the effect of that order is exactly, and I'll need to inform Canadians—I feel I need to inform Canadians—of what the effect of the order is on their level of privacy protection in the U.S., for instance, when they appear at the U.S. border, or when they use electronic means of communications where their data may go through the U.S. in going to a merchant, a colleague, a friend, etc.

    In terms of resources, we will give advice to Canadians on what we think the consequences of the order are. I think that's an important activity to undertake. I don't think it will be hugely expensive. The issue is to determine what is in fact the impact of that order on the protections to privacy of Canadians in the U.S.

    At this point you've identified a potential threat to Canadian privacy, you have expressed that to government, and you are waiting for a response back from them. You think it will be incumbent upon you to inform Canadians of perceived risks, depending on how—

    Correct.

    Is it too early then to guess whether this would trigger additional complaints that would put stress on your department?

    Yes. It could very well trigger complaints.

    But is it too early to tell?

    Yes.

    Okay.

    How about some of the other recommendations that we have made as a committee? You're aware, obviously, that we are also studying PIPEDA. You are also studying PIPEDA and anticipate a discussion paper in the fall.

    At this point, in terms of the adoption of recommendations that we've made on the Privacy Act or on SCISA, do these estimates contemplate the implementation of recommendations that have been made?

    No, they do not anticipate that. For potential amendments to the Privacy Act, the government's response to your report is that it will proceed in due course with a PA review, so to cost any amendments might be premature at this point. We need to see what the government will table in terms of legislation down the road.

    In terms of PIPEDA review and activities that would flow from our consent report, when we publish our report in September through the annual report, we should be able to give an estimate of costs.

    I talked with Mr. Long about the non-discretionary nature of investigative work. One issue that we might include in the suggestions to reform PIPEDA and the Privacy Act would be a greater discretion to not investigate certain complaints. In other words, we could choose to some extent the complaints we would investigate so that we spend more time on issues of systemic importance and perhaps less time on other issues. There is a link between the recommendations we might make for legislative change and workload issues.

    That's interesting. You mentioned in your response to Mr. Long the statutory requirement to investigate all complaints.

    That's the current law. Subject to certain exceptions, by and large the current law requires us to investigate all complaints.

    What would be a reason not to? I don't want to stray too far off of the actual estimates before us, but what would you contemplate a...?

    Often, administrative tribunals such as ours would have discretion not to investigate—in the worst-case scenario—a frivolous complaint. One of our realities is that in the last two or three years, we have had a couple of individuals who have filed in the order of 5,000 complaints. Just two people have filed 5,000 complaints.

    Vexatious and frivolous complaints....

    Yes.

    I understand that, but—

    We're a bit over time, so if you don't mind, Mr. Kelly, I think we'll have an opportunity to get back to your line of questioning.

    Ms. Fortier, please, you have up to seven minutes.

    Thank you, Mr. Chair.

    Hello, Mr. Therrien. It is a pleasure to meet you.

    As a member of the standing committee on access to information, privacy and ethics, it is an honour to ask you a few questions. I am new to this committee and am trying to better understand the investments set out in the 2017-18 Main Estimates.

    I understand that human resources account for about 70% of your expenditures. What about the remaining 30%? Do you have enough money to do your work?

    The remaining 30% goes in part to information technology. I will ask my colleague Daniel Nadeau to tell you more about non-salary expenditures.

    Let me would point out, however, that the budget provides a breakdown of salaries versus administrative costs, including information technology, but there are also activities we fund from our budget. The main budget items are for investigations. In fact, 48% of the budget goes to investigations. Another 13% goes to research and policy development. There are also communications and public education, which account for 12% of our budget. This last item is important to us because members of the public are often not well informed about the protection of privacy. It is important for us to educate the public in this regard. Finally, there are internal services, which account for 27% of our budget.

    I will ask Mr. Nadeau to provide further information about the 30% of non-salary expenditures.

    Certainly.

    The 30% of non-salary expenditures include a range of expenditures that the organization as a whole must make in the course of its normal daily operations. I will spare you all the details, but let me mention some of the most important items.

    In the Main Estimates, there is a item for professional services, which accounts for close to 50% of these non-salary expenditures.

    As a small organization, we cannot afford to have expertise in all areas of our organization. As a result, we obtain certain professional services under contract. The translation of documents and the layout of all our publications are examples of professional services. We have offices, computers and IT equipment, among other things, that are essential to our operations. Our offices are in a building and that involves costs, including security costs. These are the types of items that are necessary for the normal conduct of our activities.

    Perfect.

    Human resources account for 70% of your budget. Do you have a high staff turnover rate? Are there a lot of vacant positions?

    Our turnover rate is about 10% for just under 200 employees, which is fairly normal.

    Very good.

    Let us return to the 2015-16 departmental performance report for your office. In it, you stated that advances in technology are outpacing your office's ability to be as effective as possible.

    What steps are you taking to address the challenges posed by advances in technology? How will these challenges affect the services you offer to Canadians?

    In accordance with current legislation, whether for the public sector or the private sector, we conduct the activities I mentioned. Investigations are in large measure non-discretionary spending. We have to educate the public in order to inform Canadians about the impact on privacy of new technologies. We are conducting activities in that regard.

    We conduct research and provide advice and guidelines to companies so they can better manage risks to privacy.

    We also consider that there is need for changes to the legislation. In fact, we have already made recommendations about the public-sector legislation, and we will make further recommendations in the fall in our annual report and in our report on consent.

    In short, we do what we can with the resources at our disposal, and in accordance with the current legislative framework. There is no doubt in our minds that this framework should be amended in order to better manage these risks for Canadians. In the fall, we will have further recommendations in that regard.

    I read earlier about your concerns about public education and the fact that there are a lot of questions related to that. What public activities do you conduct? Will you have the necessary resources, given the increased use of social media? The increase in public education activities will probably put pressure on your office. Do you have an action plan to address those needs?

    We started implementing our plan by completely revamping our website, as I said in my opening remarks. Our website is our main public education tool. It provides information, guidance and advice for Canadians and for companies. It is a very important component. Revamping our website is important and we will continue to update it and make its content more user-friendly to ensure that Canadians can properly understand the information on it.

    We also participate in various conferences where we have information booths. We give presentations right across the country. We reach out to people that way as well. Each event is attended by a few hundred people. So the most important tool is still the website, which get millions of hits every year.

    So maintaining your website, the ability to maintain ...

    ... is the key tool.

    Do you have the resources to continue to maintain it?

    Yes.

    Thank you very much, Ms. Fortier.

    We now move to the five-minute round with Mr. Lobb, please.

    Thanks very much.

    Thanks for being here today. I have just one question. I don't know if you touched on it.

    For office space, where do you have offices throughout the country?

    The vast majority of our employees are in the national capital region, in Gatineau, in an office building occupied with other agents of Parliament.

    We have a small local office in Toronto. Obviously, many companies that operate in a way that has an impact on privacy are in Toronto, so we have a small office there.

    With regard to the one in Gatineau, is the building owned by the Government of Canada?

    No.

    It's not owned by the Government of Canada.

    Okay, so you work with Public Works to secure the leases and all that.

    Yes.

    All right.

    That's a good one. I've read a few articles through the years about all the empty office buildings that the government owns throughout the country, and I often wonder why we don't rent more of our own buildings. I know that's none of your concern. That's more Public Works, but maybe there's an opportunity there.

    I know the last person who asked questions talked about the website, and behind the scenes is the server network that you have in the data centre. Are you hosted by Shared Services Canada, or do you operate with someone else?

    I'll ask Mr. Nadeau to answer that question.

    We own and maintain our own IT infrastructure.

    Okay, so you've never had any pressure then to go with Shared Services Canada? You've been able to—

    No.

    The initial wave was focused on larger organizations. When we moved to our new building three years ago, we had the opportunity to revisit whether it would be with Shared Services Canada, with external hosts, or with us, and we looked at the various options. At the time, we concluded that the way we went was the best way.

    Do you host internally, or do you use the cloud or a private company?

    No, we're not in the cloud. We host internally.

    You're happy with your own service then. It's better than Shared Services Canada.

    Yes.

    That's good.

    Another question I have is on health records. Let's say I'm from Ontario. I believe the Ontario privacy commissioner deals with that. Do you work back and forth with the Ontario privacy commissioner to ensure, for example, that Ontarians' health records are protected?

    As we all know, we live in a beautiful federal country, and one of the areas where there is a division of power is in relation to privacy.

    On health, our Ontario colleagues are responsible for overseeing privacy management for departments and institutions, including hospitals that are provincially regulated. However, federally, we are responsible for certain companies that operate in the health area and are not within provincial jurisdiction.

    Therefore, we are both in the area, which requires us to work together, not only with Ontario but with every province and territory in Canada. There is good co-operation between our office and provincial commissioners who have authority over access to information and privacy.

    Say, for example, with your investigations into CSIS, if you wanted to do a search with CSIS and investigate how many hundreds of thousands or millions of Canadians have had their phones surveilled, their emails surveilled, or where they search on the Internet, is there an ability for you to work with CSIS to come up with a number, so that Canadians know how many Canadians have had their privacy investigated without them knowing about it?

    We have jurisdiction over all departments and agencies of the federal government with respect to privacy. You'll understand that there are resource implications that come into the picture here. There are also other review bodies. CSIS has its own review body and is overseen by SIRC. It could ask these kinds of questions. We are responsible for privacy issues as they affect CSIS.

    We have jurisdiction to ask the questions you're referring to, but because we're responsible for every department, not only for national security but privacy in respect of all government activities, we have to focus our investigations. Currently, with respect to CSIS, the subject matter we're reviewing is how CSIS is implementing the decision of the Federal Court that Mr. Justice Noël rendered in late 2016 with respect to the retention of data by CSIS for people who are not security threats. We are investigating that particular issue. We have jurisdiction to ask the questions that you refer to, but we need to choose our areas of investigation.

    Thanks, Mr. Lobb.

    Mr. Saini, you have five minutes.

    Thank you, and thank you very much for coming here again. I was looking at your departmental plan, and I have some questions on that.

    When it comes to the response times for individuals, when they're trying to get answers to their information or requesting complaints, there seems to be a new way of measuring the success with meeting those targets. Can you give us the background on how you have changed the system, or what new way of gauging success is in play?

    I'm not sure I have the document in question in front of me. On average, we have a response time of seven months for complaints, both under the Privacy Act and PIPEDA.

    I mentioned the fact that we have early resolutions more and more, and these cases take less time, on average, than more complex cases. It's seven months on average, less so for an early resolution. We have a number of more complex cases where it's taking more than 12 months to complete an investigation. Currently, we have about 50 cases under PIPEDA that are older than 12 months, and we have in the neighbourhood of 400 under the Privacy Act. That's particularly a problem under PIPEDA, because under PIPEDA we have a legal obligation to complete our investigations within 12 months.

    Here, in one of the performance indicators for the federal government institutions and private sector organizations, “are they meeting their obligations under the federal privacy legislation”, you had a target of 85%, but in 2015-16, the actual results were 79%.

    Can you give me some understanding of what needs to be done? Do you have a plan in place to improve those numbers?

    At the conclusion of an investigation, we make a recommendation. Are you referring to how often the government institution or the private sector organization complies with our recommendation? The target is 85%, and the result in 2015-16 was 79%.

    Right.

    It was 76% in 2014-15, so there has been a bit of improvement there. It's a question of ongoing discussions with departments and companies to ensure they comply with our recommendations. Of course, this is relevant to our recommendation under the Privacy Act for order making powers. If we had order making powers, that question would either not arise or would arise only exceptionally.

    Right now, we make recommendations. For the most part, the institutions that we oversee comply, so that's almost 80%. It's good, but if we want to increase that percentage, order making would certainly be relevant.

    The other vision that you have is to have more outreach and public education.

    Yes.

    In another part of the report, it talks about the percentage of Canadians who feel they know their privacy rights. You targeted 70%, but the last measurable year was only 32%. How are you trying to fill that gap?

    That's probably our biggest challenge overall.

    That's especially true with young people, I think.

    We have quite a gap, between 30% and 70%, which is our objective. I think it's going to take a while before we get to 70%. In part, the website is the tool that we have. For education, there are certain activities that the OPC can undertake, like the web and participating in conferences. We have certain material that we give to teachers, although that is not part of the official curriculum in most provinces in Canada, but teachers who want to use our resources are free to use them in class. That would be another way to do that.

    Do you think it should be? Do you think it's an important endeavour?

    In the official curriculum...? Absolutely.

    One of the other things I noticed is that in this year or the coming year, you're going to spend more money on capital assets. I was wondering what capital assets you would be spending more money on?

    Monsieur Nadeau.

    Are you referring to table in the—

    I don't have it in front of me. I had it before. I'm trying to look for it.

    It could very well be. I don't have it in front of me either. As an organization, we have thorough planning as it relates to our IT infrastructure and our ongoing equipment and assets. From year to year, we go out and invest certain sums to make sure our equipment and infrastructure is up to date.

    This year, I don't think it should be a large bump, but perhaps our IT infrastructure. The refurbishment this year is—

    May I ask one last question, if I have time, Mr. Chair?

    Yes, you may, but quickly, please.

    Out of curiosity, when we look at total revenues, in 2016, you forecasted revenues of $100,000. In 2017-18, you're forecasting a revenue of $200,000. Then it will drop down to $100,000. What is the revenue?

    We were talking earlier about hosting our IT infrastructure. I believe you had the Commissioner of Lobbying earlier this week. We have this collaboration with them where we are actually hosting their website and a portion of their infrastructure on ours, so we invest some expenses and in return, they pay for that through this revenue authority.

    Thank you very much.

    Mr. Kelly, go ahead, please, for five minutes.

    I'm going to pick up right where I left off before. You were going to talk about the stress that certain frequent complainers have on your office. I would like to get the details and your answer or expansion on that. You talked about one particular source of, I think you said, 5,000 complaints. How do frivolous and vexatious complaints affect your budget?

    In the last two or three years, two people have been responsible for over 5,000 complaints, 5,400 complaints to be precise, for the period from 2014-15 to 2016-17. There are other people who complain frequently, although not at that level of volume.

    If we had the authority not to deal with complaints that are frivolous and vexatious, an authority we have under PIPEDA but not under the Privacy Act, that would certainly help with some of our workload pressure.

    Currently, we have some discretion in how to deal with these cases, not to refuse to investigate, but in order to ensure that a small number of people do not monopolize our resources, we ask these complainants to choose from their many complaints which five or so they want us to give priority to. That way, somebody who has one or only a few complaints is not disadvantaged by our having to devote our time to one or two people who complain more often. This means that the all but five or so complaints of these one or two people are held in abeyance and there are administrative costs that come with that. People will write to us about the status of their files and so forth. It is less than desirable.

    These two individuals present the biggest problems, but the problem of vexatious and frivolous complaints is broader than just two individuals. I don't want to exaggerate the problem, but these are some of the circumstances where the authority to refuse to investigate would provide some relief to our resources.

    Thank you. I appreciate the detailed information.

    Do you know what percentage of your budget or what portion of your budget is being, as you put it, monopolized or unduly taken up by a handful or small number of vexatious...?

    Because of the strategy we adopted, the percentage of our budget currently monopolized is not huge. It is less than 5%.

    Okay.

    We still have this backlog of unresolved cases on our books.

    It's a problem not only of your budget but also of unfairly preventing other complainants from having their cases addressed.

    Yes.

    You'll have to forgive me, I didn't review our testimony from your earlier appearances. You have the recommendations of this committee in addition to your own recommendations to give you these powers. Is that correct?

    Yes.

    Okay.

    Mr. Erskine-Smith.

    Thanks very much, Commissioner.

    First, with respect to the backlog, do you see that as being resolved with a one-time influx of resources to get this out of the way so that the monies you have on an annual basis will be consistent? Or with the resources you have, is that backlog, even if you have a one-time influx, going to creep up again?

    We're going to devote some resources to reducing the backlog under the current circumstances, under the current law. We will reduce the problem. I'm not sure if we will eliminate the problem. Long-term, the solution is to have the kind of discretion I've been advocating. If we have more discretion to choose cases—

    You mean discretion in order making powers but not necessarily more funding?

    Not necessarily.

    Whether it's the use of Facebook, Instagram, or other social media—you have a report on the Internet of things—privacy seems to loom larger and larger in Canadians' lives, yet your funding has not increased and has actually gone down over the last five years.

    On the issue of funding, don't you think it would make sense to empower the office a little bit more, what with the issue of privacy increasing in importance, or at least affecting us so much more these days?

    It would make sense, yes. But before I actually say that we want more money, I'd like to relate these monetary requests to specific activities so that you can determine whether this is a good investment for money. This is why, in terms of PIPEDA, I would prefer to wait until the fall for the recommendations I will make substantively. Then you can see whether it would make sense for Parliament to provide additional investment.

    For now, it's the status quo, and you'll come back in September with new initiatives and proposals.

    Yes.

    With regard to the status quo, if we look at the percentage of complaints responded to within established service standards, in 2014-15 it was 96%, which is great, but that went down to 83% in 2015-16. You have a goal of 90% this year. What explains that 13% dip, and how do we get it back up?

    Here we are talking, in part, about formal complaints, and like I said, among those who did not receive an answer to their complaints are those who are frequent complainants.

    That may explain the 13% drop...?

    That explains it in part. In part, as well, we have a new informatics system to answer calls from individuals who are not making a formal complaint but who want to hear from us. We've done that with existing resources. It's a service that we think is necessary, but we were never funded for it. That also explains why there may be some delays.

    To get back to the question about increasing budgets or not increasing budgets, do you look at comparable organizations, such as the privacy commissioners' offices in the U.K. and like-minded countries, and look at, on a per capita basis, what they're being funded? Are we adequately funding our Privacy Commissioner's office as compared to our allies?

    I don't recall whether we've done an exact comparison recently.

    It may be useful when you come in September to....

    Yes, I think it's comparable. In the U.K. and France in particular, there have been recent investments in privacy issues. We will come back with that analysis.

    With respect to future activities, do you foresee further advocacy or work on Bill C-51 as the government undertakes its review? Perhaps you could speak to other initiatives that you see taking up your time—I know I spoke at the outset about StingRay—and to areas that this committee could work together with you on as you pursue these initiatives going forward.

    The Minister of Public Safety has announced that there will be a bill—before the summer, if I'm not mistaken—to amend Bill C-51. We will obviously have things to say about that. In our annual report, we will report on how Bill C-51, SCISA in particular, has been used. We have a number of investigations, such as the use of StingRay technology. The border will be an important theme. I've mentioned the executive order of President Trump, but also in Canada there is the extent of CBSA's practices in terms of border searches, the searches of technological equipment such as cellphones, etc. Issues related to the border will also be an important theme of activity.

    Thank you very much.

    Madame Trudel, do you have any questions to wrap up with?

    Thank you.

    My apologies for being late. I was with some people from Italian television. It was time-consuming and a bit difficult owing to interpretation. I already have difficulty with my English, so you can imagine what Italian is like for me.

    Thank you for your presentation, Mr. Therrien. I read the report and would like to go back to the questions my colleagues asked. We were talking earlier about the rate of reporting, which will soon be mandatory. I would like to know how that will affect your staff, whether financially or in terms of human resources.

    Do you have the necessary resources right now or do you need more?

    You are referring to companies reporting privacy breaches, which will become mandatory under the provisions that will soon come into force. Under the act, companies will be required to report major breaches. So we will have to look at those reports. Companies currently report on a voluntary basis. In the past three years, we received about a hundred reports each year.

    Judging from experience when a similar provision was implemented in Alberta, we expect a significant increase in the volume of incident reports when the provisions come into force.

    We currently have the equivalent of two people working on these matters. If the volume increases substantially when the provisions come into force, that will create much more pressure on us. We will have to deal with that. We will see what the new volume is, but as it is we do not have much leeway. There might be problems in that regard.

    As a rule, we do a fairly superficial review of those reports because we do not have the resources needed to do much more, except when the risk is especially high. In recent years, we conducted some investigations of that kind when the risk to privacy was high. So we do a lot of relatively superficial analyses and a much more detailed examination in certain exceptions.

    As a result, you will have to ...

    Possibly.

    Perfect.

    Thank you very much.

    Very good.

    Thank you very much.

    This brings our rounds of questions to a close.

    Commissioner, I want to thank you and Mr. Nadeau and Ms. Kosseim for continuing to appear before the committee and answering our questions. I think we've learned something new and valuable here at the committee today. I'm looking forward to engaging with you in the future to handle some of the coming challenges. We look forward to seeing you at a future date.

    Committee members, we'll suspend for a few minutes and then we'll resume with Madame Legault.

    Colleagues, we'll resume our meeting now in the second hour.

    We are pleased to have with us from the Office of the Information Commissioner of Canada Madame Suzanne Legault, who is the commissioner. With her is Ms. Layla Michaud, who is the acting assistant commissioner for complaints resolution and compliance.

    This is with regard to the main estimates.

    Madame Commissioner, we have your opportunity for opening remarks, and then we'll proceed to our questions. Welcome again to our committee.

    Thank you, Mr. Chair.

    Thank you very much for the opportunity to discuss the main estimates for the Office of the Information Commissioner of Canada.

    The Access to Information Act establishes the Office of the Information Commissioner as the first level of independent review of institutions' handling of access to information requests. I am required by law to investigate all complaints within my jurisdiction. These investigations are conducted in an efficient, fair, and confidential manner.

    My office receives two kinds of complaints. Administrative complaints relate to matters such as delays in responding to requests. Refusal complaints relate to matters such as the application of exemptions used to withhold information.

    The fiscal year that just closed was one of significant activity for the Office of the Information Commissioner of Canada. On the investigations front, the main areas of focus were the implementation of a simplified investigation process, with supporting advisory notices; the roll-out of interest-based negotiation and mediation for investigations; and putting into operation the special allotment funding received as part of last year's Supplementary Estimates B. I appeared before this committee in November on those supplementary estimates and would again like to thank this committee for supporting my request for additional funding.

    This year, the overall main estimates for my office are $11.2 million, including employee benefit plans. The main estimates allotment for 2017-18 is in line with amounts received in previous years without the special purpose allotment. Given the number of complaints we receive, this amount is not sufficient to carry out the mandate of the Office of the Information Commissioner and to serve Canadians adequately.

    Let me elaborate.

    The number of requests made under the Access to Information Act has been increasing every year, as have complaints to the Office of the Information Commissioner. In 2010-11, when I became information commissioner, the government received approximately 41,000 requests. Last year, the government received 75,000. This is an 81% increase.

    For the past two years, the office has received over 2,000 complaints per year. In addition to the continuous rise in complaints, there are other factors and risks that must be taken into account when forecasting our workload for the upcoming year. These include an anticipated surge in complaints related to Phoenix pay issues and the declining performance of institutions.

    The inventory of complaints remains an issue for the office. In this past year, with the addition of the temporary funding the office resolved 2,245 complaints; however, the total number of open complaints at the close of the year still stood at more than 2,800, a reduction from the beginning of the fiscal year but nonetheless quite a significant number. This number will undoubtedly grow, under the current resource levels.

    Without additional funding, the OIC does not have the capacity to absorb the expected increase in complaints and related workload. This is especially problematic as I continue to see complaints that demonstrate a culture of delay across the system and of exemptions applied in an overbroad manner.

    I have put in place a plan to continue to safeguard the right of access under these circumstances. This is especially important given that the Office of the Information Commissioner will soon be in a period of transition as my mandate comes to an end. This plan will ensure corporate stability and transfer of knowledge.

    For the coming year, I have the following key priorities.

    First, we will continue to capitalize on the momentum gained last year as part of our simplified investigation process and interest-based negotiation. We will also continue to review the inventory of complaints to develop strategies for grouping complaints by subject matter or institution to maximize efficiencies. For example, we began a strategy last year that deals with complaints against Canada Post.

    Second, we will leverage IT tools to enhance efficiencies. Examples of these tools include an online complaint form, optical character recognition software to ease searching through voluminous records, and the use of dashboards for investigation and litigation files.

    Third, we will continue to hold the government to account on its promise to be open by default, and particularly to amend the Access to Information Act. I note that the government was recently elected to the steering committee of the Open Government Partnership. I'm hopeful that this will encourage the government to lead by example and take bold action on openness and transparency, including transforming the outdated Access to Information Act into a model law for other countries to follow.

    Finally, I am in discussions with the government for another round of supplemental funding so that the successes of 2016-17 will not be lost in the year to come.

    Fiscal year 2017-18 is shaping up to be one of change and challenge. Additional funding is necessary so the office can meet the challenges that are coming. However, if supplementary funding is not forthcoming, I know the Office of the Information Commissioner will do its best to provide exemplary service to Canadians under the current resourcing levels.

    Thank you, Mr. Chair.

    We are ready to answer your questions.

    Thank you, Madame Legault.

    We'll now proceed to our first round of questions, for up to seven minutes, and we'll start with Mr. Saini.

    Good afternoon, Madam Commissioner. It's always a pleasure to have you here.

    While we're looking through your departmental plan, I wonder about your mentioning that you would be completing your security audit in the upcoming year. Can you give us a little information about the security audit, what is behind it, and what sorts of changes you're thinking about making going forward as a result of it?

    Yes. As you know, we have an audit and verification committee at the OIC. We are following the government's policies on audit and evaluation, and this past year was the time for us to do an IT audit.

    We did one on two fronts. We did the security of our systems, but we also did the security of our information management of high-security information holdings. Madame Michaud led that exercise, so she can give you some details about it, but the audit was completed.

    There were some changes recommended, particularly around governance, concerning policy instruments and matters such as that. But the actual IT systems, the security systems, the management of information of high-security information holdings were all in very good order. It was mostly around governance—the policy documents—which is not unusual for small organizations.

    Perhaps Ms. Michaud would like to add something.

    Actually, it was a very good audit. We were very pleased with the results. We began to implement the recommendations right away.

    As Commissioner Legault said, it was mainly about governance. For example, policies were in place but were not signed. Policies were in place but were not approved by the executive committee. Almost all the problems are fixed now.

    If the committee wishes, we're more than happy to share the actual audit, the results and the action plan that we've put in place. We have no difficulty doing that.

    That's great.

    I also wanted to talk to you about providing an update to the committee on the backlog of cases you were working on. I know that we provided temporary funding as a committee. Can you give us some background in terms of how many you were able to clear, how many are left over? How did that work? Was it enough money? Did we give you too much?

    We got around $3 million. The objective we had to fulfill was to close 2,361 files. By March 31 we had closed 2,245—a gap of 116.

    We haven't finished all of the calculations, because the fiscal year is not quite closed, but we're looking at a lapse of about $400,000 out of the $3 million that we were not able to spend and that will go back into the system. As of today, we have closed an additional 113 files.

    We achieved 95% of our results by March 31, even though we received the funding extremely late. It was extremely labour intensive, I must say, to manage all that—the extra volume, those extra files, the extra funding, the extra hiring, the extra managing, the training, and so on.

    We had a very busy year, so we were a little bit short on the total. We were able to keep some of the consultants, and now we're three short, four weeks after.

    Between 2014-15 and 2015-16, the median turnaround time for refusal cases went up from 128 days to 163 days. Is there a reason for that?

    We've managed to reduce the turnaround times significantly year over year. Investigations are not a perfect science.

    I can assure you that when we did the long gun registry case or the political interference cases, it took us more than a year to do them. We have some files that we close in just a few days. It's not a perfect science, but we measure the turnaround times.

    You were asking about the progress with the funding this year. The progress on the median turnaround time is quite significant. Last year the median turnaround time, once the case had been assigned, was 48 days. Now it's 36. For refusals, it was 163. This year, with the additional funding, we were at 70 days to complete a file.

    Okay, that's fine.

    But here, for 2018, you've increased the average time to nine months, or 270 days. Was that to put in a buffer?

    I'm just going to go through the departmental plan to see what you're looking at.

    Where it says, “Median turnaround...for refusal cases”, your target is nine months, but your average is 163 days.

    Overall, we consider that a refusal file lasts about nine months, but we've been trying to reduce that all the time. That's the median turnaround time. You're going to have outliers on each side. That's why.

    These were our performance targets, 90 days and nine months, which was about the average. You can see that we're quite below that on the median. But we will have cases that will take a lot longer than nine months.

    I have a quick question. Just on the capital assets, it seems like last year there were more purchases of capital assets compared to this year. What did that comprise?

    Layla, you can look at that. I know we did some computer purchases this year, but the numbers you're looking at are amalgamated between the Office of the Privacy Commissioner and our office. Our purchases are nowhere near the scale of the Privacy Commissioner's Office. We were about $86,000. They are about $600,000, and it's mostly computers.

    Okay, that's fine. Thank you very much.

    Mr. Kelly, please.

    Thanks for the presentation, but there are some elements of this that are somewhat troubling. I noted your discussion of a declining performance of institutions. That's very disappointing for me to hear for a number of reasons.

    The President of the Treasury Board recently announced that his review of the act would not happen by spring 2017, which is coming and going now. How is the delay in phase one going to affect your budget and doing something about the root causes of the ever-growing number of complaints in your office?

    The funding that we're getting is temporary funding, and the funding we got last year was temporary funding—

    Indeed.

    —waiting for amendments to the act. This year we're in the same situation because we haven't seen the amendments to the act yet, and of course, we're not dealing with the root causes of problems with the Access to Information Act. But there is a reality. The reality is that for a reason unknown to me, and it may be just an increased awareness of citizens, or a lack of satisfaction with the disclosure of information on a proactive basis, the access to information requests are going up exponentially.

    You said that there was declining performance of institutions, so that's beyond just citizens being aware of what their complaining options are. You are singling out or identifying the non-performance of our government's institutions to deal with access to information requests.

    They know order making has been recommended by this committee. That power has been recommended. We have had promises from the President of the Treasury Board to act on these recommendations, and those promises are not being kept so far. I don't think we want to come back each year to discuss and approve temporary, one-time band-aids to give you more money so you can try to keep treading water on complaints. We want to get on with creating a better access system.

    I'm not sure if there's much you can say to this. Were you disappointed to find out we weren't going to get the review that we were promised?

    I'm extremely disappointed. I've said that publicly before. This is something I really believe in. At the same time, I really do believe that Canada has everything that is possible to really become a truly outstanding world leader in this field. This is because we have very well-established democratic institutions. We have a good system of access to information embedded in our institutions, and yet we have a completely outdated law. It's the one single piece that is missing to really make Canada a true leader in the world. In this particular time, it is of the utmost importance. I truly believe that. My disappointment is not just for the OIC and for Canada, but I really believe it would have an impact around the world. For that, I'm greatly disappointed.

    Have you had any reaction directly from the President of the Treasury Board? Has he explained to you why there is the delay?

    I've had no other explanation besides the explanation I've given in the public domain.

    When we reviewed the act and discussed one-time supplemental funding for the backlog a year ago, it was your belief then that order making power was the answer. If you had order making power, that would end what has been described as the culture of secrecy within institutions. It would actually lead to fewer complaints and demands on your office, and would get away from this continual treadmill of having to apply for extra money to deal with the backlog of complaints. Do you agree still that if we actually can get there with order making power, that would be the result?

    I don't think that order making power on its own will make that much difference in terms of complaints and levels or requests and whatnot.

    My proposals were 85 recommendations—

    Yes, indeed.

    —and they do stand together. This committee made 32 recommendations, and these too stand together as well.

    Order making power is a key component. I firmly believe in that, but the review of the exemptions and the exclusions in the act is also a key component—a public interest override and so on—and many of the recommendations that this committee made all stand together. If the first phase of review is delayed, I'm still hopeful that maybe we will get a more comprehensive review in a one-time proposal before the next election.

    Okay.

    To what do you attribute your observation of the declining performance of institutions?

    Every year the government publishes statistics. The detailed statistics were a result of recommendations we made some years ago. Every year, I review all the government statistics and we do an analysis of those. This year, I'll publish that in my annual report, but what we've seen is that there has been a decline in the number of files that are responded to within 30 days.

    I'm sorry. I wasn't doubting you. It was more that I was wondering to what you attribute this declining performance.

    I think the institutions are overwhelmed with the increases, for sure. I'll give you an example.

    We met with the Canada Revenue Agency's executive committee on a couple of occasions, because they're in serious difficulty. It's one of the institutions that receive the most requests, and very complex requests. The recommendation I made to them is that they needed to have people in order to answer the level of requests they were getting. In terms of the level of requests, the number is one thing. The other two things that are really important is that the government really does make an incredible number of redactions on the records and we see that in our complaints.

    We know that very well. Yes.

    Therefore, that is extremely labour-intensive. There is a lot to be said for really moving from a culture of secrecy to a culture of openness. I think there are good intentions from the government in that respect. I've certainly been at the table with deputy ministers this past year. I hadn't before. I think there is a good intention, but I don't think that it has really made its way through the various levels of the government.

    Thank you, Madam Legault.

    Madam Trudel, please, for seven minutes.

    Ms. Legault and Ms. Michaud, thank you very much for your presentation.

    Ms. Legault, since your term is drawing to a close, I would like to congratulate you on everything you have accomplished over all these years.

    In answering a question earlier, you mentioned a drop in the performance of our institutions. In your presentation, you said you have begun a strategy to manage the complaints against Canada Post.

    I would like to hear more about this drop in institutional performance, including Canada Post, and would like to hear your thoughts on that. Please elaborate also on the strategy to manage the complaints filed against Canada Post.

    Regarding the institutions, the 2015-16 data indicate that there really was a decrease in their performance as to disclosure in 30 days, that is to say the number of files for which a reply was provided in 30 days. That drop was not very big, but there was one. We did, in parallel, see an increase of 10% in complaints regarding delays. We can't predict the number of complaints. However, we do this analysis to get a sense of what is coming. That would be a partial answer to your question.

    Another part of the answer concerns the files, that is the access to information requests where all of the documents were disclosed without redaction. That number also decreased. Among the most important institutions, we observed that some were experiencing difficulties. In the course of the year we will have to work with them as much as possible, because we noted that there really are some issues. These institutions are really in trouble, and that will have an effect on general performance. They are large departments: National Defence, RCMP, Health Canada, Transport Canada, and others.

    Regarding Canada Post, that is a particular situation. The Federal Accountability Act came into effect in 2006-07. There is a provision in that act that applies to Canada Post only. There was also one for CBC/Radio-Canada. In the end, to process CBC/Radio-Canada files, we had to go to Federal Court to obtain an interpretation of that provision.

    We are working on the files with Canada Post. Without an interpretation of that provision of the act, both we and Canada Post have trouble processing the disclosure of files. In light of that situation, we decided to work on the files in a particular and organized manner. This will allow us to arrive at an agreement, or a decision from the Federal Court if that proves necessary.

    Was the situation the same with respect to the Phoenix pay system?

    In the case of the Phoenix pay system, we were warned that there were a lot of access to information requests from employees. Normally we receive the complaints later. This time we were warned that there could be many complaints related to access information requests about the Phoenix pay system.

    When you are advised that there will be an increase in the number of complaints, does that require an increase in the budget and staff in your organization? At this time, is your current staff able to absorb that increase?

    The way it works is that the staff that is in place absorbs the increase. Every year there is always an event, an incident or complaints related to a given topic that come to the fore.

    For instance, following the railway accident at Lac-Mégantic, there were a lot of complaints related to that event. It was the same thing when there was an issue with listeriosis. In that case, we had a lot of complaints about the Canadian Food Inspection Agency.

    As soon as there are events like that that happen in government, there are often access to information requests. We receive the complaints and we do what we can with the resources we have.

    Thank you.

    That's all for me.

    Thank you very much.

    We'll now go to Mr. Erskine-Smith, please.

    First, thank you, Commissioner.

    I have to say, I share your concerns about the delay with respect to the implementation of, at the very least, phase one.

    Assume an imperfect world where we don't have any changes. You have a little over $11 million in funding here. There is not only a backlog, but that backlog will grow with your current state of funding. You state that it's an insufficient amount.

    What's a sufficient amount?

    In terms of a sufficient amount to actually work on the inventory and the incoming complaints, the $3 million we had this past year was as much as we can absorb as an organization right now, because we didn't increase our internal services or our executive cadre. We were able to absorb the additional number of files we went through. That's a good sign.

    Our office and the government institutions could not close 5,000 complaints of the OIC in one year. Even if we were to get a lot of additional funding, the system couldn't absorb it. I couldn't go to the Canada Revenue Agency and say, “I'm coming in and we're solving your 400 files all at once.”

    So there's a substantial increase in requests; I think you said 81% since 2010-11. Have the complaints increased on a pro rata basis?

    No, it's not pro-rated, actually, so that's a good sign.

    On that note, there's a significant backlog. You had an additional $3 million in funding on a supplemental basis. How successfully did you tackle the backlog with that additional funding? I know there are 2,844 files outstanding, but how successful were you?

    I think we were very successful. I can show you. We made a small, simple graph. Michael has copies of it; we could distribute it to the committee. It shows for each year we had in the backlog how many files we closed for each year. Of the files from previous years, we closed almost 1,400 cases. Those were old cases out of the backlog. That number was pretty significant.

    If you were to receive the additional supplemental funding this year, would you foresee tackling the new year's crop of complaints and maybe cutting that 2,800 in half? Would that be the idea?

    If we got the same amount of ongoing funding for next year, we would probably reduce it to a fairly small number for another year.

    It would reduce by 800.

    —by 800 per year.

    We get about 2,100 new files now, for the last few years, and we have 2,800 in the backlog. We can tackle about 800 or 900 more overall in the system.

    So you're still looking at a number of years at $15 million before you complete the backlog. From there, what's a sustainable level of funding?

    I think the sustainable level of funding is about $15 million. It's about that. I noticed your asking my colleague what comparatives have been looked at. The Ontario office, which is a provincial office that doesn't have the same kinds of files that we do, has a budget of about $15 million.

    So the provincial office that deals ultimately with a smaller population has more money than you have.

    Yes. They have order making power and are responsible for privacy as well, so they have a joint office. They don't, however, have the national security files and don't have the Canada Revenue Agency files. They therefore have different levels of complexity.

    What about comparable offices? Do you look just domestically, or do you look internationally as well?

    I tend to look domestically, because, first of all, we're the only jurisdiction with split mandates at the federal level, and we don't all have the same legislation. It's difficult to compare my office, which has recommendation power, with an order making power model like the U.K.'s, and so comparatives are difficult. It's easier to do it working from the number of complaints and seeing how many efficiencies you can build in; then at some point it's just a numbers game in terms of the number of files.

    On that point about efficiencies, you mentioned a couple. You mentioned IT efficiencies, your grouping strategy, and Canada Post as an example. Are those strategies sufficient?

    I'll put it in a different way. With the efficiencies you're finding, are you still going to need the $11.2 million of supplemental funding regardless of these efficiencies?

    Yes. We've been on a continuous cycle of improvement, certainly for as long as I've been there. Just to give you a sense, when I became commissioner we had just gotten the Internet in the office, and that was 2009-10. I was the one, as assistant commissioner, who made that come into the office. The Office of the Information Commissioner of Canada has come an extremely long way in the last eight years. In terms of efficiencies, now we're looking at software to go through our 10,000-page records so that we can do word searches and such.

    On that point, to what extent would proactive disclosure and, where individuals make access to information requests and the information is provided to them, to what extent would providing that information in an easily accessible way online resolve some of the backlog in complaints and in requests?

    We have a few complaints about the records not being provided in the appropriate format, but it's not a large percentage. It would be fewer than five or 10 a year.

    My last question is this. If no changes are made by 2019 and the delay continues, in your words how much of a failure will that be?

    I think it will be a tremendous failure if there are no changes to this legislation. I'm at the point where I think it's completely unacceptable for a modern democracy.

    Thanks very much.

    Mr. Lobb, we will move to the five-minute round now.

    Thanks very much.

    I find your comments about the Internet interesting. I was on the veterans affairs committee many years ago, at about the same time you were just coming into your office, and I used to joke that Veterans Affairs was just getting rid of their typewriters back then. I think they have the Internet in their office now too.

    Forgive me if I'm repeating here, or if you have to repeat, but for this year's budget, did you put forward another $3-million request to be built into your overall budget this year?

    We did make a request to be in the budget, but we are not in the budget. We're now pursuing the same avenue that we did last year, and that's the management reserve.

    We're asking for less money this year. Last year we had to equip everyone with information technology. We had to bring the lines for the computers to a different floor. All of that is done now, so there's less money required. Plus, we're not going to get the money now—if we get the money—so there's a reduction for that.

    Yes. You know, you never can be amazed in politics, because that's just the way it is, but....

    I'll grant you that $2 million to $3 million is a lot of money for a regular person, but when you put it up against the entirety of the budget, it's a very small number. Based on the results you had last year, it's amazing that it didn't get in this year. Really, to do it the way that you're going to have to do it is not good practice anyway, but you have to do what you have to do, right?

    There's one thing I'm wondering about in terms of some your recommendations—forgive me if I have this wrong—and that's when a document is deemed to be “cabinet confidential”. Can you report to us on how many times last year it came back as cabinet confidential?

    I have about 85 complaints that are cabinet confidences. I don't have the number of requests for cabinet confidences that are applied. There is a wrinkle there, though. Requesters often will make a request and say, “Do not include cabinet confidences”, so there is a self-discipline and a self-censorship occurring in terms of the requests. I reported on that a couple of years ago in my annual report. People are basically excluding that from their requests.

    What happens is that we can't see the records. Even without seeing the records, we find that in about 10% to 15% of the cases the cabinet confidence exclusion was misapplied. That's even without seeing the records. That's always been a concern, not just for me but for all previous commissioners.

    This is not the committee that I normally sit on, so you'll have to forgive me if I'm not completely up to speed on all of this. If it comes back “cabinet confidentiality”, you have no ability to compel the department to let you look at the documents that they deem to be confidential to determine in your own professional opinion whether it should have been deemed that way or not. It's up to the pleasure of the department. Is that correct?

    That's correct. We don't see the records. We see a description or schedule. Based on that, sometimes we push back, and sometimes additional disclosure is made.

    Do you go to court, then? Is that the next step, that you take the department to court?

    Cabinet confidences are excluded from the application of the act. So we could go—there have been cases in the past done under the Canada Evidence Act—but under our legislation it's very difficult to go to Federal Court challenging something that we haven't seen.

    Yes, I can see that. That's obviously in your recommendations overall, to open that up.

    I'll just give you my own edification here as well. We put in a couple of requests, not too many, to the Minister of Environment in August. We received the information in February. The information we received was disgraceful, as far as I'm concerned, for the honest questions that we asked. Again, it's a lot of excuses, but if it could be more open, for me, or if you have the ability to kick the tires and see, it would be much more reasonable.

    Now, in regard to that one item of cabinet confidentiality, if this actually happened, how would you, or I guess your successor, peg that in terms of a budgetary item as far as extra staffing is concerned? Would that be four or five people, for instance, doing that full time?

    I don't think that would require additional people. What is required is for us to see the records so we can determine whether cabinet confidence has been properly applied. Unless cabinet confidence exclusion becomes an exemption under the act and that generates more requests of documents where that is applied, then I can't really foresee it. In the last 30-some years, it has been the situation. I don't know if that would generate more requests or more complaints.

    Thank you.

    We have to move on now. It's time for Mr. Ehsassi to have his five minutes.

    Thank you.

    I'd like to join my colleagues in thanking you for your leadership over the course of the past seven years.

    It was very interesting; it was palpable how passionate you are about this issue, how it's high time we become a leader in this area, and that it's imperative we make the necessary changes.

    Out of curiosity, given that this is an estimates meeting, have you ever had an opportunity to compare the resources that we set aside for your office to similar mechanisms or offices that exist in other OECD countries? From that perspective, how do you view it?

    We haven't done that comparison. As I said, it's difficult to compare. We would even almost have to do a joint comparison with the Privacy Commissioner's office, because in other countries these institutions are mostly joined.

    The other big consideration is that it's important to understand that the field of access to information is different from the field of privacy around the world. If you look at OECD countries, privacy commissioners' offices are at least quite well funded. If you go anywhere else around the world, access to information offices are scrambling for resources. Not surprisingly, it's quite an underfunded pillar of democracy around the world because it is usually a thorn in the government's side. It's a very different function in many respects, and so in many respects most unpopular with governments most of the time.

    I haven't done the comparative. As I said, the closest I could see is the operations of the Ontario commissioner in volume, amount of work, and so on. They do have order making powers so they don't have a backlog in looking at the volume. Their financing is about $50 million. That's the best comparison I could find. I couldn't even compare our office to the U.K. commissioner's office because they have privacy and access, order making power, and most of those institutions have education and audit mandates, which we don't have. It's difficult to compare.

    Thank you for that.

    The second issue you raised was, in your opinion, the need to update access to information and a regulatory tool kit, if you will. What are the most significant or imperative changes that you would like to see?

    When I appeared before this committee, we did have a list of quick fixes, so to speak, for the first phase. That goes through quite significant amendments, a review of some of the key exemptions: advice and recommendations, the order making model, and public interest override. Those recommendations are before the committee.

    In all honesty, I know one always says that you have to pick your battles, you have to pick four, five, 10, 32, or 85. The bottom line is that it's difficult to pick at this legislation, just do one piece and not do it as a whole, because one piece may impact another and so on.

    My recommendation is something that I think is completely within the realm of possible actions by the government, and that is to do a comprehensive review of the act. I think it's possible; the complexities can be resolved, the policy work has been substantially done, and it is very much the time to do this.

    Given your interest in this, what would you say your model jurisdiction is in terms of legislation?

    It has to be Canada. It is the model that can be the best model.

    In Canada, I would say that if you're looking at an order making model, we definitely should look at the British Columbia model. The Ontario model is instructive, but the British Columbia model has been amended more regularly over the years, and in my view it is a more progressive piece of legislation. I've always said that what we really need to do is to take our Canadian legislation and get inspired by the best international models, which is what I did in my modernization report, because you can have a better model in one jurisdiction for a particular area and a better model in another jurisdiction for another area. That's why we built it that way.

    The models are there. There are over 100 pieces of legislation around the world right now, and the most progressive norms are contained in legislation that are post year 2000. That's where you will find the most progressive norms, and understandably so, because those pieces of legislation are basically inspired and modelled on not only the successes but also the faults of the other legislation. They've basically built better models since then. That's what we have to look at.

    Thank you very much.

    We have about 10 minutes left in the scheduled meeting time and we have two people left in the five-minute round, so if we do it right, we'll be finishing just on time.

    Mr. Kelly, go ahead, please.

    Has the Treasury Board consulted you regarding the budgetary implications of the eventual implementation of reform?

    No.

    That's despite mentioning in budget 2016 the anticipation of moving to an order making model.

    That is correct.

    That's disappointing.

    Well, let's move on. We've been through much of this already, and I share your frustration and disappointment over the broken promise on reform. With the 32 recommendations, which substantially embody the 85 that you made, having been handed to the government with approval from all parties here, that is disappointing.

    I'm going to move to a topic that we haven't brought up today, and that is successor planning. You are approaching the end of your time as commissioner.

    Yes.

    What successor planning has taken place so far, if any?

    First of all, I did make it clear to the government that if it needs me to stay until it finds someone else, I'm prepared to do that, so that's fine. I'm expecting that will happen, so I think we're looking at that being until at least December. The notice for my position has not been posted yet, but I'm expecting it to be planned soon. Essentially I think the situation is that we have a few months ahead of us.

    Second, the OIC is now, I would say, a very stable organization. As I said, when I arrived, we had no Internet; we had no financial systems; we had none of this governance in place. Now all of that is in place, so that's very stable. The senior management team, under Layla Michaud, has been there for several years now, along with my senior counsel, who couldn't be here today, so that's very well anchored.

    Now we are doing a couple of things to ensure ongoing stability in terms of investigations. One thing I had delayed doing, because I was waiting for amendments, was a code of procedure for the investigative function, which would act as an anchor for the organization, but also for institutions dealing with our offices. It would provide some streamlining of the investigative process and anchor all the blocks that we've built over the years into one single document for the OIC and for the institutions.

    Do you have critical files that will be awkward to hand over to your successor?

    Well, I have 2,844 files, and at this point 60% of those are assigned to people. Those will be going through. There are a couple of investigations that I'm planning to complete. The long-gun registry issue is not finalized. It's still before the court. I also have the investigation of the muzzling of scientists. Those two are the biggies, and those are coming to an end, I would say.

    Aside from that, with regard to the investigations, whether I am there or not, everything goes through the directors and the senior management team.

    The new position has not been posted, so to speak. You have not been asked to remain, but do you expect to be asked?

    I think that there will be confirmation in a very short period of time. I think the notice for the position will be up very soon—that's what I'm hearing—maybe as soon as next week. For my position, as you know, it has to be an order in council for any extension on an interim basis. That has to be made official and published. We're expecting that to be done in very short order, so I think that we do have some stability. From my perspective, in terms of investigation and so on, my motto in terms of managing anything is not to make myself indispensable, but quite the opposite, to make myself disposable. I'm coming to the point where I think I'm becoming disposable. I'm quite confident the office will move to a very smooth transition.

    Thank you very much, Mr. Kelly.

    Mr. Dubourg for five minutes, please.

    Thank you, Mr. Chair.

    It's my turn to greet you, ladies, and to thank you for being here.

    Ms. Legault, I first wanted to congratulate you briefly. My colleague said seven years, but I'm told that you have been at the helm of the Office of the Privacy Commissioner for eight years. With your leadership, you have put your particular imprint on the organization. Can you tell us in a few words what you are satisfied with in the work you have done in your organization, and what you will be leaving your successor.

    I am not gone yet.

    Oh, oh! No. Let's not push you toward the door, either.

    Thank you very much for your positive comments. I appreciated them greatly.

    Seriously, I am most proud of having worked with absolutely exceptional people over the years. It is a working environment where all of the employees, my colleagues in management, and those at the provincial and territorial levels, are extremely passionate. They work so hard and always give their utmost, in spite of sometimes very difficult moments.

    I am very proud of having joined an organization which was perhaps not in the Stone Age, but in the Middle Ages, and which is now a modern, well-functioning organization. I am pleased to have the opportunity to put a few last pieces in place. I still hope to see a reform of the act in the next few months.

    Fine. Thank you.

    That would be the last element in work I would be proud of.

    Very well. We have heard your message clearly.

    For the aftermath, if you had the opportunity of meeting your successor, what recommendation would you make to him?

    In my opinion, the most important quality for a Privacy Commissioner is resilience. It doesn't apply to a particular task or a specific objective; it's a state of mind. You have to remain resilient in spite of everything, because there are some extremely difficult moments for a Privacy Commissioner. It requires sustained energy over the years.

    That resilience is important for the people around you at the Office of the Commissioner, because the nature of our work is to resolve citizens' complaints. It's not always easy for the people who work with us. We deal with these people, and when they call us it is because they are disappointed, at the very least, or upset, or are trying to obtain something. Sometimes this is difficult for all kinds of reasons. So I think that resilience is the most important thing.

    We have to continue to work to advance the cause of access to information, transparency, because ultimately it is the cause of democracy. It is fundamental for Canadians.

    There you go.

    Thank you very, very much, and I wish you success in your future endeavours.

    Thank you very much.

    Thank you very much, colleagues.

    Madam Legault, this is the third time this week I've had the pleasure of offering sincere gratitude on behalf of the committee members who are here, and all members who have come before whom you've dealt with in your years of service. Every time you've come and talked, about the estimates in particular, the struggles that you've had, your office, through your leadership, has always recommended making things more efficient rather than simply asking for more money. I want to highlight that and commend that approach in particular.

    Thank you for your candour and your straightforward approach in dealing with members of Parliament, and obviously helping us do our job here in making our country a better place. We wish you all of the best as you go on.

    Thank you very much.

    I know that this committee loves to hear the candour from past commissioners, because sometimes it's easier to speak about things when you're not in the role anymore. We look forward at some point to inviting you back to continue to guide our country on these particular issues.

    Thank you very much.

    Thank you very much.

    Colleagues, before we go, we have to decide whether we're actually going to give the commissioners any more money and continue on with the main estimates.

    If it pleases you, we're going to go for some votes.

    (Vote 1 agreed to)

    (Vote 1 agreed to)

    (Vote 1 agreed to)

    (Votes 1 and 5 agreed to)

    The Chair: Shall I report the main estimates, less the amounts voted in interim supply, to the House?

    Some hon. members: Agreed.

    The Chair: So done.

    Thank you very much, colleagues. We'll see you next week.

    The meeting is adjourned.