Media Centre

Supporting Transparency and Safeguarding Privacy

Conference for the Access to Information and Privacy Community

April 1, 2004
Ottawa, Ontario

Jennifer Stoddart
Privacy Commissioner of Canada

Good morning. It's a pleasure to have the opportunity to address front-line ATIP people. Many of you will know that in my previous incarnation I was responsible for both privacy and access to information issues. That gave me an insight into how challenging your jobs are. You are confronted every day with the need to reconcile two competing public goods: the right to privacy and the right to open, transparent government. It is one of the most difficult of balancing acts.

I was reminded of this when I recently read a biography of the great British public administrator and bon vivant, Samuel Pepys. Pepys is best known for the diary he kept from 1660 to 1669. The diary, which is now held at Cambridge University, is one of the great treasures of the English historical record, giving us a vivid picture not just of Pepys but of the age in which he lived.

Pepys wrote his diary in shorthand to hide it from casually prying eyes, and he wrote many of the particularly delicate passages in a code of his own devising. He had good reason to do so. The diary was extraordinarily revealing, of all sorts of very personal information, not just about him, but about his wife, and about other people as well. It contained accounts of his many intimate personal relationships. It contained medical information about him and about his wife. It contained his political thoughts — a dangerous proposition in an unsettled time. It recorded, for example, that he had rejoiced at the execution of Charles I — not exactly something he wanted known after the restoration of Charles II.

So Pepys wrote in code, to protect his privacy. But he also instructed that his diary, along with a guide to the code that he had used, would at a certain time after his death be made available to Cambridge University.

Pepys recognized that his life was part of British history. He had, after all, been a Member of Parliament, the Secretary of the Admiralty, and the President of the Royal Society; he had witnessed the English Revolution; he had been present at the coronation of Charles II; he had seen the Great Fire of London and interviewed the man believed to have started it; he had been instrumental in the development of the modern English navy. As intimate and personal as his diary was, it also was, or would be one day, a historical record, the importance of which outweighed whatever his privacy interests might be by that time. Just as Pepys in many ways straddled the transition to the modern humanist age, so the record of his life straddled the distance separating the private life from the public record.

Pepys's approach to his diary has, I suspect, a lot of lessons for us about the social interests in privacy and in open governmental records, and I hope that in some way it can serve us as a model, at least to stimulate our thinking about how to balance the two, for example in looking at census data.

If we are going to balance these rights, it is critical that the Privacy Act protect the right to an individual's personal information as robustly as the Access to Information Act should protect the right to public records. I have some concerns on that front.

The Privacy Act dates from 1983. Parliament intended that it would be reviewed periodically, but the last time it was comprehensively reviewed was in 1986. While that process led to many recommendations for improving the Act, none of them has been passed into law.

The need for review is more compelling now. When the Act was passed, computer databases were in their adolescence. The Internet was unheard of, outside narrow technical circles. Technologies confronting us now with their extraordinary surveillance potential — digital video cameras, biometrics, genetic testing, event data recorders — were more or less science fiction when this law was drafted. The privacy implications of these things — not to mention Government On-Line, data matching, and data mining — may be beyond the reach of the Privacy Act. We deal with them as best we can with policies and creative application of the Act, but it remains the case that a thorough review of the Act is needed.

It's instructive to compare the Privacy Act with its counterpart law for the private sector, the Personal Information Protection and Electronic Documents Act, or PIPEDA as we call it. PIPEDA was drafted with the benefit of ten years of experience with the Privacy Act, so it's not surprising that Parliament came up with a stronger law.

Let me give you just a few examples.

First, PIPEDA has primacy over any subsequently enacted legislation, unless Parliament expressly declares otherwise. This is appropriate for a statute protecting a fundamental right. The Privacy Act has no such primacy. In my Office's view, it should.

Next, the Privacy Act also restricts the definition of personal information to information "recorded in any form." This is problematic, in that privacy can be infringed in many ways without actually producing a record. Real-time video monitoring is an example. PIPEDA's definition of personal information is not restricted in this way.

Finally, there is a certain difference in the limitation on the collection of personal information. The Privacy Act restricts government institutions to collecting information that is directly related to their operating programs. "Directly related" is not the same as "necessary." PIPEDA, in contrast, requires that organizations collect personal information only "for purposes that a reasonable person would consider appropriate in the circumstances." That, in our view, is a much stronger affirmation of a fundamental right of privacy.

The Privacy Act also holds the government to a very low standard in terms of its collection of citizens' personal information. It places the onus on the citizen to check upon what personal information the government holds on him or her. It does not require, as a matter of law, that the protection of personal information be considered in the design of new programs. Finally, in the Charter era, privacy as a named right is conspicuously absent from our constitutional Charter. The Privacy Act is erroneously thought by many members of the public to afford a wide protection for privacy concerns when it fact it focuses on data protection — something more evident in the French version than in the English version.

It doesn't really make sense that Canadians have more privacy rights and better privacy protection in the private sector than they do in the federal public sector. One of my predecessors, Bruce Phillips, pointed this out nearly five years ago, when PIPEDA was passed. He called for the Privacy Act to be brought up to the standard of PIPEDA, saying that a comprehensive review was "both urgent and unavoidable." That review hasn't happened, but I don't think Mr. Phillips was wrong — it was avoidable but it will not be so indefinitely. But I agree with him that the need for it is urgent.

Under the Privacy Act, as you know, views or opinions about me expressed by another person are my personal information. The Pirie case involved access to the identities of witnesses in a government department's internal administrative inquiry. In the Pirie case and as a result of the particular facts of this case, the Federal Court of Appeal observed that the identity of the person expressing the view or opinion is also that person's personal information, since it would reveal information about him or her.

That can give rise to the problem of two people having a personal interest in the same information. In the Pirie case, the court had to balance these competing claims.

The court concluded that the information can be personal to both parties, but that one interest has to prevail. In this case, the prevailing interest was that of the person about whom the statement was made, Mr. Pirie. He had a right, both under natural justice and under subsection 12(2) of the Privacy Act, to clear his name in the department's records. The interest of the person who made the statement, the court ruled, did not outweigh that right.

The court added that it is not enough to consider the individual privacy interests, but also the competing public interests in disclosure and non-disclosure. It concluded that in this case the significant public interest in ensuring fairness in administrative inquiries was considerable, and was served by disclosure.

This issue of the public, social value of privacy is important, and I'm gratified that the court addressed it. Privacy is too often considered a purely selfish individual right. That puts it a virtually automatic disadvantage when we try to balance it with the right to openness of government records, which is a more obviously "social" right. Whether or not you agree with the outcome of the court's balancing, it is significant in that it focused on the social interests served by privacy rights.

I want to conclude with a brief nod to the decision last week of the Federal Court, affirming the authority of the Information Commissioner to examine records in order to make decisions on requests under the Access to Information Act.

I think it is significant and a cause for celebration that the Information Commissioner's position on the exercise of his responsibilities was upheld by the court.

This is an important decision for privacy, too. Because of the obvious parallels between the Access to Information Act and the Privacy Act and the powers of the Commissioners under their respective Acts, we welcome this judgment which invites deference to a Commissioner's decision, where he or she has acted within his or her jurisdiction and for a purpose enshrined in the applicable legislation.

It reinforces the concept that, in case of conflict, an objective opinion, such as that of a parliamentary watchdog, must come into play to determine how information held by the government should be qualified.

There was never, in my view, any reason for this case to be a contest between privacy and access rights. It should be self-evident that we need to be able to examine records, and assess the relative aspects of the right to privacy and the right to openness, in order to perform this most difficult of balancing acts.

Every time I think about balancing, I'm reminded of a story about Rita Hayworth, who had a habit of tearing up her mail, unopened. She knew that she was tearing up cheques, but she was also tearing up bills; her theory was that they balanced each other out.

I will admit that this has a certain elegance, but I'm sure that we can do better. I look forward to working with you in the coming years in contributing to this very important balancing of social and personal interests.