I am very pleased to have the opportunity to speak to you on Bill C-6 — the Personal Information Protection and Electronic Documents Act. This Bill deals with two important components of the government's electronic commerce strategy.
A 1998 study by Ekos found that 94 per cent of Canadians believe that it is increasingly important to have safeguards for personal information on the Internet.
Canadians, moreover, are becoming much more knowledgeable about privacy issues. A more recent Ekos study found that there was a marked shift from a general unease to specific concerns about the privacy of their information.
Part 1 of the Bill incorporates, and makes law, 10 fair information principles established in the CSA Standard for the Protection of Personal Information. This CSA Standard is a Canadian first — we are the first country in the world to develop a standard to manage personal information, in a consensus process with stakeholders from business, consumers, governments and organizations all at the table. We started public consultations on the need for privacy legislation in 1994; we announced our intent to legislate in 1996 and we sought public comment on proposals for the legislation in 1998. These consultations overwhelmingly supported the use of the CSA Standard as a basis for private sector privacy legislation.
Part 1 also establishes the Privacy Commissioner as the oversight mechanism and empowers the Commissioner to receive complaints, conduct investigations and attempt to resolve such complaints.
Parts 2 to 5 of Bill C-6 will put electronic transactions governed by federal laws on the same footing as paper ones. It will assure business and citizens that an electronic document and an electronic signature have legal standing and will be recognized, enforced and accepted by government and the courts.
We know that government itself must take up technology as a model user and facilitate dealings with citizens and business. Canadians want convenience and ease in electronic dealings with government coupled with privacy protection — they want to be able to trust the new ways of doing business. Our goal is to be responsive to their needs and efficient in our dealings.
The potential benefits of being a world leader in the knowledge-based economy and electronic commerce are huge.
But Canada will become a leader in electronic commerce only if consumers and business are comfortable with the new technologies and with the impact that these new technologies will have on their lives. Trust is crucial. That's why the government developed a strategy which the Prime Minister announced in October 1998. This strategy, designed to establish Canada as a global leader in the development and use of electronic commerce, was built around what we call the seven "firsts" in the areas of:
- consumer protection
- tax neutrality
- cryptography policy
- standards
- secure electronic commerce or public key infrastructure
- digital signatures, and
- privacy
I am proud to report that, with the passage of this Bill, we will have achieved the final two. We have a single policy goal — to build trust in electronic commerce. And we have one Bill to achieve this goal.
The protection of personal information has been recognized as a fundamental pillar of the global information society. For example, the European Union issued a directive in 1998 that requires member states to block the flow of personal information to countries without adequate data protection. They are looking for the same elements that we have included in Bill C-6: a basic set of fair information practices to govern the collection, processing and disclosure of information, and independent oversight by a data protection authority. The principles recognize the fundamental right of free speech in an exemption for journalistic, artistic and literary expression, and the fundamental importance of protecting such sensitive data as medical information.
Right now, personal information is a commodity that can be bought, sold and traded. We have, in Canada, what the federal Privacy Commissioner has described as a "patchwork" of laws, regulations and codes. Personal information crosses all boundaries: provincial, territorial and national. Most industries are not subject to any rules concerning the collection, use and disclosure of personal information. Only Quebec has broad legislation for the private sector operating within the province.
Bill C-6 shows leadership. It uses the trade and commerce powers to create a framework for coast-to-coast protection of personal information that aims at a harmonized approach for all provincial private-sector privacy legislation. After coming into effect, this Bill will apply until provinces act to protect personal information within their own borders. It will continue to apply where there is no privacy protection, and it will apply to transborder flows of information.
But the basis of the trade and commerce power is commercial activity and we need the provinces to act because they have jurisdiction over some of the most sensitive information Canadians want protected, including most health, education and employee records. Only when the provinces act will we have the sort of complete coverage that Canadians expect and that will give us a competitive advantage in the knowledge-based economy.
Canadian business has called for legislation that would create one market, define a single set of rules and establish a level playing field where the same rules apply to all. The direct marketing industry, information technology companies, the telecommunications companies and the banks realize that we need a clear federal legislative privacy framework. And they realize that flexible, but effective, legislation will help customers accept electronic ways of doing business and will be less expensive for them than self-regulation alone. The hidden cost of self-regulation is the high price of earning confidence and winning trust.
We are living in a knowledge-based economy and personal information is being gathered increasingly to provide better service and more specific and targeted marketing. In the medical field, we have the opportunity to build on our unique Canadian medicare system and produce the best patient care with transportability of records and innovative research. But, if we are to realize these benefits, we must build privacy into the ground floor of each of these information structures.
Bill C-6 is designed to protect personal information of all individuals who, in their everyday activities, don't separate their personal information into health or other categories. For this reason, the Bill's broad scope covers all personal information collected, used or disclosed in the course of commercial activity. All commercial activity in the healthcare sector is covered; what is not commercial is outside the scope of the Bill.
C-6 establishes transparency and consent — Canadians can depend on these principles in determining how their information is used. I have been following the discussions about this Bill within the health care community with great interest. I want to assure the honourable members of this committee that it is clearly not the intention of this government to have this Bill act as an impediment to the modernization of the health care system.
We built Bill C-6 on the CSA Model Code which can be tailored to the needs of all sectors. The CSA Standard provides a generic set of principles for protecting personal information, applicable to all kinds of information, including health information. The Insurance Bureau of Canada, the Canadian Marketing Association and the Canadian Medical Association have developed tailored codes. These tailored codes should be viewed as additional, complementary guidelines that are built on the floor created by C-6.
Some in the health sector have suggested they need more time, perhaps two years. The Bill gives them this time, in fact, it gives them four years. The Bill will not apply to the vast majority of transactions in the commercial health care sector for four years unless those organizations are trading in personal information for consideration across provincial and national borders. I introduced an amendment to section 30 to make this crystal clear. There is already lots of time to act.
During those initial four years, a province can pass its own legislation. Once a province brings in "substantially similar" legislation, C-6 will not apply to organizations covered by the provincial law. "Substantially similar legislation" is legislation that provides a basic set of fair information practices which are consistent with the CSA Standard, oversight by an independent body and redress for those who are aggrieved.
Bill C-6 will not impede the flow of information necessary for the protection of the health of Canadians, for the improvement of the administration of health care and for the conduct of research. Information and communications technologies offer opportunities to improve the level of health care. The rapid application of these technologies for this purpose relies on the assured protection of personal health and medical information.
Organizations, in the course of commercial activities, collect, use and disclose health information to conduct research, track drug use and perform valuable health-related services. These are legitimate activities and the Bill contains exceptions for study, research and accountability.
Information can be used and disclosed without consent for research purposes by notifying the Privacy Commissioner. When anonymous information is used for research, it will fall outside of the scope of the Bill. We also made an amendment to allow public sector bodies to collect personal information from the private sector for accountability purposes.
Honourable Senators, right now we have very limited data protection in the health field and almost none in the private sector. This year, the Health Advisory Council published a report on the future Health Infoway. The Advisory Council warned that, without privacy protection, without the consent of the individual, the potential of information technology for tremendous gains in the efficiency of the health care system, as well as vastly improved results from research, would not be realized.
Some members of the health sector have stated that the Bill will require them to obtain express consent from their clients, a process which they fear will be onerous and costly. Senators, in our view, this is simply not true. Bill C-6 doesn't impose onerous duties on service providers, it merely requires consent where commercial use is to be made of personal information. In many circumstances, common sense will imply consent.
Following the CSA Standard, express consent is not required where an individual would reasonably expect a collection, use or disclosure of their personal information to be part of a transaction. For example when patients request a pharmacy service, they are implicitly consenting to collection, use or disclosure of their personal information, as necessary to render that service. It is only for secondary uses and disclosures, not reasonably expected by patients in the context of the transaction, that express consent is required. Consent doesn't have to be given at each step and each time for the same purpose, and there are a variety of ways to obtain it. But the Standard insists on the knowledge and consent of the individual.
This Bill is a strong foundation. Gaylen Duncan of ITAC, and John Gustavson of the Canadian Marketing Association, both spoke before this committee of the lengthy negotiations and the delicate balance that was achieved during the crafting of the Canadian Standard. This Bill creates a legal basis for the standard, and it represents an important beginning. For most organizations, coverage will only begin in four years, and we will review and make corrections to the legislation if necessary every five years.
But we must remember that Bill C-6 covers all types of personal information. This Bill must meet the needs of all stakeholders including: bankers, historians, journalists, writers, insurance companies, direct marketers, Internet service providers, telecommunications companies, accountants, credit bureaus, consumer advocates and civil liberties organizations, and that's a tall order!
In summary, the overarching goal of Bill C-6 is to establish in law a right to privacy without: placing an undue burden on business; intruding on the right of freedom of expression; or destroying our historical memory by interfering with the preservation of documents.
But time is of the essence. As Bruce Phillips said about the Bill: "It is no magic bullet … But we must begin by doing something and doing it quickly. If we fiddle in the face of lobbying and jurisdictional disputes, Canadians' privacy and the business opportunities on-line will burn."
Thank you.