Question Period Note: OFFICE OF THE PRIVACY COMMISSIONER’S 2019-20 REPORT

The Office of the Privacy Commissioner tabled their annual report in Parliament on October 8, 2020.

• The Government of Canada takes the privacy rights of Canadians seriously and is continuously adopting measures to safeguard their personal information that is held by government institutions.
• The Government values the Privacy Commissioner’s feedback on these important matters.
• We thank the Privacy Commissioner for his work and observations on how the Government can continue to improve the protection of Canadians’ privacy rights and look forward to our ongoing collaboration.
If asked about privacy breaches:
• The Government’s Privacy Breach Action Plan continues to be a priority and we will continue to work with our partners, along with the Privacy Commissioner, to strengthen the management of privacy breaches across government in a timely manner.
If asked on the Interim Policy on Privacy Protection:
• The Government issued the Interim Policy on Privacy Protection and related Directives in response to the need to move quickly to implement measures to protect the health, safety and economic well-being of Canadians in the context of the COVID-19 pandemic.

• While the Interim Policy and related Directives provide the discretion for institutions to undertake a more streamlined, analysis of privacy considerations, they are still rigorous and ensure privacy is protected in the implementation of urgent COVID-19 initiatives.

• The Report’s key message is the emergency response to the COVID-19 pandemic highlights the importance of protecting rights and ensuring trust. The Commissioner stresses that the pandemic underlines the need for redesigned private and public sector privacy laws. They should be rights-based, recognizing privacy as a human right.
• To support the Government’s commitment to privacy protection while implementing urgent COVID-19 initiatives, the Treasury Board of Canada Secretariat issued an Interim Policy on Privacy Protection, Interim Directive on Privacy Practices and Interim Directive on Privacy Impact Assessment in June 2020. They will remain in effect until March 2021.
• The Report was critical of TBS’ Interim Directive on Privacy Impact Assessment for the Office of the Privacy Commissioner felt it “relaxed existing requirements and didn’t offer an adequate replacement”. They asked that TBS include a policy statement related to “the government’s commitment to privacy as a fundamental, quasi-constitutional human right”.
• Given that the government is consulting on modernization of the Privacy Act, the policy recommendation that were offered by the Office of the Privacy Commissioner will be considered in that context
• With respect to oversight of the Privacy Act, the Commissioner notes:
o ESDC: Clear policies need to be in place to ensure video surveillance is not used inappropriately and individuals should be informed when they are being captured on video surveillance and the purpose of this surveillance.
o CATSA: Collection and disclosure of cannabis volumes to local police should be restricted to when the amount in the traveler’s possession is “clearly illegal”.
o Privacy breach reporting. The report recommends TBS urgently advance the strengthening of its policies, guidance and tools regarding privacy breaches.
o GAC: Committed to implement procedures to prevent a recurrence of the breach in which a ship’s manifest, including personal information of the passengers, was sent to all the Canadians onboard. The individuals affected have been offered credit monitoring and new passports.

• The Privacy Commissioner tabled his Annual Report in relation to oversight of the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA) on October 8, 2020.
• The President of the Treasury Board has primary responsibility for the administration of the Privacy Act across government. The Minister of Justice is leading a review of the Privacy Act. The Minister of Innovation, Science and Economic Development is responsible for PIPEDA, which establishes private sector privacy requirements.