STANDING COMMITTEE ON GENERAL GOVERNMENT
COMITÉ PERMANENT DES AFFAIRES GOUVERNEMENTALES
Monday 27 October 2008 Lundi 27 octobre 2008
Consideration of Bill 85, An Act to permit the issuance of photo cards to residents of Ontario and to make complementary amendments to the Highway Traffic Act / Projet de loi 85, Loi permettant la délivrance de cartes-photo aux résidents de l’Ontario et apportant des modifications complémentaires au Code de la route.
The reason for this amendment is that we believe that biometric information should be defined separate and apart from the term “information” as used in Bill 85. This definition is borrowed from the Ontario Works Act, 1997, and the Ontario Disability Support Program Act, 1997.
Separating biometric information from the term “information” is important to tailor the legislation to the purpose of the minister’s facial recognition program, which is to reduce fraud in obtaining a driver’s licence or other photo card.
Under sections 6 and 33, in combination with paragraph 7 of subsection 11(4) or paragraph 6 of subsection 205.0.1(4), at section 44 of Bill 85, the minister could disclose biometric information to all levels of government and others when an individual accesses benefits or services. As written, the legislation may well allow for biometric information to be used as a verification procedure at all levels of government, and this is outside the scope of the proposed program.
Mr. Michael A. Brown: The government believes this definition to be unnecessary. The government is proposing to limit disclosure, under subsection 11(2) of the act and the reflecting provision of the Highway Traffic Act, of the measurements derived from photo comparison technology, which amounts to biometric information, as the member knows. We think that speaks to the concerns the member has.
Mr. Frank Klees: I distinctly remember the minister, when he came forward to this committee, referring to the submissions of the privacy commissioner and expressing his desire and the government’s desire to take into consideration, seriously I assumed at the time, the privacy commissioner’s best advice. This amendment is taken from the privacy commissioner’s report, on page 12, which I’m sure the parliamentary assistant is familiar with. I would ask him, given the fact that this is a recommendation of the privacy commissioner, on what basis or why he feels we shouldn’t take the advice of the privacy commissioner in this particular case.
Mr. Michael A. Brown: We appreciate your concerns. We believe them to be addressed in subsection 11(2) of the bill. We are very cognizant of the suggestions that have been made by the Information and Privacy Commissioner. We appreciate her presentation to us. We are taking those issues seriously. We just believe this to be, at best, redundant and probably not helpful.
One of the things I think I should point out to the member is that these measurements, at least at this point in time, are not very valuable to anyone. Each jurisdiction uses its own technology to do this, and you cannot transfer the technology from one jurisdiction to another in any event. Nevertheless, we take this very seriously. We do not want to be passing that kind of information along. We understand there is a distinction between those two sorts of information—whether it’s biometric or general information. We appreciate this. We just cannot support this particular amendment. We hope to deal more with this later in the bill.
If I may, the rationale for this, again, goes back to the Information and Privacy Commissioner’s comments. We believe, after hearing from the Information and Privacy Commissioner, that there needs to be some tightening up of this bill. In terms of the protection of people’s information and in terms of the technology that the government wants to use, it is wide open to abuse. These definitions would, in our view, help to tighten up what we think is legislation that can be, and we believe likely will be, abused.
Mr. Michael A. Brown: Again, we share the view of the Information and Privacy Commissioner that these are serious issues and that we need to move forward with them. What the motion before us adds, in addition to the motion Mr. Klees has just put, is the notion of RFID technology. That, of course, is an operational concern, and something that is technical and feasible and that will be ongoing and ever-changing as we move forward, as technology changes. We as a government need the opportunity, as would any government, to respond to technological changes if they make good sense for the people of Ontario.
This is a technical amendment. We do not see this as being useful. As a matter of fact, we think the people of Ontario would want us to have the ability to move on with advances in technology as they appear.
Mr. Frank Klees: I agree with the parliamentary assistant. I think the people want us to move on with these things, but they want it done in a responsible way, and particularly, it is technology that we have to be very careful about it. Obviously I support this amendment for the reasons I gave on our previous amendment.
I’m just concerned that the government is being far too cavalier about this. I think that we have, at the base of this bill, a very good bill. It’s the right thing to do in terms of the principle behind it; we’ve expressed that. My concern is that we move forward cautiously and that we protect the privacy of the citizens of this province. I am concerned with the government’s attitude and, once again, the unwillingness of government to accept what are reasonable and straightforward amendments that would simply improve the legislation and provide safeguards.
There are really two issues, and again, we’re trying to help the government sort this out. There is a need for a basic photo ID card. All kinds of people need it. If you want to go to vote now, if you want to rent a movie or if you want access to banking services, it would be wise to have a basic photo ID card. We think it is well within the government’s operational possibility to have a basic photo ID card available for June 1, 2009. We think that some of the other issues that have attached to the bill, which we pointed out in our first amendment, are a lot stickier and deserve further consideration. But we think the government should and could have a basic photo ID card available that people could use. That would certainly help us on one front. As I said earlier, in my first amendment, we think some of the technology issues deserve greater scrutiny.
Mr. Michael A. Brown: As the member would know, the ministry is working very diligently to implement the basic photo card, as it is this entire bill. The member would know this is just a bill, and until this bill is proclaimed and in force, we obviously can’t do some of the things we need to do. The time available to the government, under this, to provide it by June 1, 2009, I respectfully submit, is impossible.
The second thing is that I don’t know of a bill that does have an implementation date in it and, while I appreciate that the member and I’m sure the government want to have this card available to Ontarians at the earliest possible date, I am not able to give the commitment that we could, as a government, meet those deadlines. Given the other concerns that are being raised about this bill, I think the member knows that some of these issues that we’re talking about today have to be incorporated.
The second thing I think we need to understand is that what we are doing here in Ontario requires working with partners. They would be other provinces, they would be other American jurisdictions, they would be the US government and they would be the government of Canada, so there are a number of partners that we have to work with and satisfy as we go forward. The idea that we could have an implementation date that wouldn’t take into account the consultations we may be involved in with other governments, while maybe laudable, I think is overly ambitious.
“5.1 The minister shall ensure that each photo card contains a distinguishing physical feature such that an individual, particularly a visually impaired individual, can readily locate the card and distinguish it from other cards that the individual may be carrying.”
Once again, we talk about the issue of basic photo ID. It is becoming increasingly important in our society, and if the government wants to proceed down this road, we think now is a good time to ensure that this card has a distinguishing physical feature so someone who is visually impaired will immediately be able to know, “This is my photo ID card.” This amendment would ensure that that happens. It would ensure that, in terms of this project moving forward, people who may be visually impaired and others will have their concerns, indeed, their human rights, addressed.
We had a presenter—at least one last week—at public hearings that presented asking for this to be implemented. The ministry is working very hard, in conversation with stakeholders, to make sure that this is a part of the card when it becomes available. We are presently working with the vendor to see that this happens, but as the member would know from the public hearings, there were at least two suggestions within the presentation on how this could be done. Given that we are in conversation, this will happen. I don’t think it requires an amendment to the bill to have that happen.
Mr. Frank Klees: I just want to support this amendment. It is in response to a very practical request that we heard during the public hearings. The parliamentary assistant has already committed that this would be done; what remains to be seen is exactly how. We understand that. Mr. Brown has been around this place a long time, and what he would know is that the more precise we can be as legislators in giving direction, the more assurance we have that things will be carried out as anticipated. So I would just like to know, if the government is already committed to doing it, why there would be an objection on the part of the government to allowing this amendment to be included in the legislation. What is the reason that government members would vote this amendment down?
Mr. Michael A. Brown: I would just suggest to the member, knowing that it’s going to happen anyway, it seems redundant. These kinds of detail are seldom, if ever, put into legislation. I’m sure that the government would hear loud and clear from members of the government side, members of the official opposition and members of the third party if we failed to keep this commitment. I believe this is a commitment that all of us agree with and that we will move forward. It is just unnecessary to put it in the legislation.
Mr. Howard Hampton: The section is very generally worded. It doesn’t prescribe a certain way; it doesn’t describe or prescribe a particular method. It simply makes sure that this is part of the legislation. I would argue that one of the reasons that we don’t have these measures in place already is because they haven’t been put in legislation, and therefore when it comes down to the administrative or operational details, it’s too easy to ignore them. This is something that I think should be almost boilerplate in legislation that we pass; that the needs of those who may be visually impaired or handicapped are also going to be attended to.
Mr. Michael A. Brown: We would just argue that there are a number of acts that provide for the kinds of measures that Mr. Hampton has generously suggested we put into each and every piece of legislation. I don’t think that is necessary. We have made the commitment. We’re moving forward with this. It will be part of the implementation.
Mr. Frank Klees: I really don’t want to prolong the discussion, but I think that the parliamentary assistant has it clear when he says, “We simply want to argue.” This is an opportunity. With an amendment like this, it really would be an opportunity for the government to at least appear to take this process seriously. We will come to the end of this clause-by-clause sitting of this committee and Mr. Hampton, myself and Mr. Bailey, as members of the opposition who have worked diligently to prepare what we consider to be meaningful amendments—all of which have come from submissions from stakeholders, be it the privacy commissioner or others who have come forward—well-meaning amendments that in no way interfere with the intent of the legislation, intended only to improve it, to make it more precise, to help do what the government indicated it wants to do. Yet, I predict that we will be, at the end of this session, with none of the opposition amendments having been accepted or voted upon by the government as accepting. What it shows, unfortunately, is that this committee process, which really in my opinion is probably the most important aspect of the legislative process, where we as members of the Legislature have an opportunity to take into consideration points that have been raised during second reading debate, input from stakeholders and constituents, input from officers of the Legislature, and apply our best efforts to improve legislation and then, in the culmination of all of that process, this clause-by-clause sitting of this committee takes into consideration all of that and, quite frankly, should be the opportunity for the public to observe that their Legislature functions. Instead, what we’ll have is an affirmation that so much of this process is nothing but a sham; that the input of the public is not welcome unless the government decides, in their wisdom, that all of their amendments are the only amendments that make sense. So if for no other reason but perception, if I was the minister, which I’m not—
Mr. Frank Klees: Which I was. If I was the minister—and I believe if he were here, actually, he would say to his parliamentary assistant, “You know, I think this is a good amendment. Let’s accept it,” if for no other reason but to legitimize the process. There’s nothing to lose by accepting it, and it would only enhance the legislation. However, I rest my case.
Mr. Michael A. Brown: I have been moved by the arguments from the other side of the floor, this very cogent argument by Mr. Klees and Mr. Hampton and, by extension, Mr. Bailey. I’m pleased to indicate that the government will accept this amendment and we will be voting in favour.
Mr. Frank Klees: Madam Chair, before you take the vote: This is a historic event in the life of this government. I think we should give the parliamentary assistant an opportunity to recess, gather his thoughts and ensure that this is really what he wants to do.
The rationale for this is, we have need of a basic photo ID card. Let me say, the people who will probably have to access this the most will be low-income people. To get almost any service, they’ll be asked to produce—because this will become the standard photo ID, and they’ll be asked to produce it, and if you can’t afford it, then you are cut off from many of the basic services in society. So I think there’s an onus on us to ensure that this is affordable. A $10 fee to have this basic photo ID card, I think, is reasonable. If it gets much beyond that, you’re talking about a whole lot of people who can’t afford it. For somebody who has to rely on Ontario Works or the Ontario disability support program, I think the fee should be nothing. We need to recognize that this is going to become, very quickly, standard ID. It will be the card that is asked for if you go to vote, if you want to use the public library, if you want banking services, if you want to rent a movie, and if we don’t set a fee level for it, then I think what we’re saying to a whole lot of people is, “Too bad, so sad,” because they won’t be able to afford it.
The act already, in clause 7(b), permits the minister to charge different groups different fees for different cards. As you know, this legislation deals with four different types of identifications. We fully understand the argument that the member is making that there are people in society who may have difficulty paying for some of these cards. That’s why the minister will be given the discretion to exempt certain groups and the minister will be working with his colleagues within the ministry to work to find a solution to what the member is suggesting.
I think the people of Ontario also want us to have a reasonable cost to this card that would reflect, to some extent, the cost recovery that will be involved with providing any kind of government service. We have to balance that as a government—the costs of providing the particular card against the affordability of that card—and the member can be assured we will be doing that and the specialized needs of specific groups will be taken into account. Therefore, we will not be supporting this particular amendment.
The proposed technology under Bill 85 would utilize a facial recognition software application that, as we understand it, will convert a photograph as has appeared for some time on our drivers’ licences into a biometric template which allows comparisons within the ministry’s database of driver photos. Although the digital photograph that the ministry currently holds may be considered, in some respects, a biometric, it’s the conversion of these photographs into biometric templates that will allow the ministry then to perform the facial recognition comparisons.
The government, we believe, should make assurance that any biometric collected, even one that has been collected for some time, maybe on file, only be used internally for the sole purpose of identifying the identity of the cardholder. If the facial biometric is lost or stolen, it can’t simply be replaced, such as a PIN number. The biometric information must be kept securely and provisions relating to photo comparison technology should be made transparent. Again this is an issue that was raised by the privacy commissioner, and we would ask the government to give consideration to approving this proposed amendment.
Mr. Michael A. Brown: What does this motion do? Well, what it does is, it limits the use of biometric information to internal ministry purposes and excludes it from the information that can be collected and disclosed by the minister under the Photo Card Act and the reflecting provision of the Highway Traffic Act. The government is already proposing to limit the disclosure, under section 11(2) of the act and the reflecting provision of the Highway Traffic Act, of the measurements derived from photo comparison technology, which amounts to biometric information, and speaks to some of the concerns that the member is suggesting in his motion. I will tell you, though, that limiting the use of the biometric data to the internal use in the manner proposed could impede otherwise permissible disclosure of this information for law enforcement purposes, as permitted under section 42(1)(g) of the Freedom of Information and Protection of Privacy Act. So legitimate sharing with law enforcement would be prohibited, even though it is already permitted under the Freedom of Information and Protection of Privacy Act. So we would find that problematic.
Mr. Frank Klees: In response to that, there would clearly be exceptions that would be made, and that’s addressed in other parts of the legislation. What we’re concerned about is that this is very broad. We have too many examples already of information that is within Ministry of Transportation responsibility that is already being made available to organizations outside of government, even, and it’s a concern. That’s an issue we still have to address, and in some respect is unrelated to this legislation. But what we want to ensure is that this in fact is only for internal Ministry of Transportation use, and we want to err on the side of caution. So that is the rationale for this amendment, and again I would ask the parliamentary assistant and his colleagues to consider that this is not something that I’m recommending; this is something that the privacy commissioner has recommended, the same privacy commissioner that the minister, when he was here, said he would take seriously, in terms of recommendations that she might have, to improve this legislation.
Mr. Michael A. Brown: I just remind the member that this particular amendment, as it is drafted, would make the sharing of this information with legitimate law enforcement agencies impossible. I don’t think that is what even the member intends, and I’m certain that’s not what the Information and Privacy Commissioner would have recommended either, because it is permitted under clause 42(1)(g) of the act.
Mr. Howard Hampton: Because the NDP amendment is so similar to the amendment that my colleague Mr. Klees has put forward—I think that the information and privacy commissioner says it very clearly on page 17 of her report: “The purpose identification and limitation privacy principle requires the body collecting personal information to identify the purposes for which the information is collected and to use or disclose the information only for those purposes.” What the government’s got here is a section that is wide open. I think we have a real onus to protect the privacy of Ontario citizens who apply for this card. I think the government’s approach here is far too wide open and will be open to abuse.
Mr. Michael A. Brown: I would just suggest to the member that he look at subsection 11(2) of the legislation, which significantly limits the disclosure that is permitted by the ministry or the minister. So we believe that this has already been addressed and that the provisions of the Freedom of Information and Protection of Privacy Act also need to be followed.
Having read the next motion, I believe the motion to be substantially the same as the previous motion, as Mr. Hampton mentioned, so I’m going to rule that out of order. Mr. Hampton, I think that you need to read it into the record, though. Then I’ll be ruling it out of order.
This amendment confirms the principle of collection limitation or data minimization. This means, as we heard from the privacy commissioner, that the collection of personal information must be limited to only that which is necessary for special purposes, and that the amount of personal information collected must be kept to a strict minimum. This is embodied in the Freedom of Information and Protection of Privacy Act, subsection 38(2), which states, “No person shall collect personal information on behalf of an institution unless the collection is expressly authorized by statute, used for the purposes of law enforcement or necessary to the proper administration of a lawfully authorized activity.” It is expressly stated.
The Ontario Court of Appeal has also affirmed that underlying all three criteria is the requirement that government “attempt to restrict personal-data-gathering activity to that which appears to be necessary to meet legitimate social objectives.” As the bill is written, personal information collected by the ministry could in fact lead to the possibility of basic, enhanced and combined photo cards containing, for example, race, religion, sexual orientation, marital status or even blood type information, and the ministry could, the way the legislation is written now, be allowed to potentially disclose all matter of personal information to a wide variety of levels of government, and even private individuals and companies, including unspecified persons and entities to be prescribed by regulation.
We don’t believe that that is the intent of the government, but what we want to ensure is that the government is precluded from doing so. The only way that we do that is by ensuring that the legislation is specific to this issue. This is really the heart of the concern, which has been expressed by not only the privacy commissioner but numerous representations to the standing committee when it comes to this issue.
Once again, it’s a straightforward amendment that is there for the protection of Ontarians. I’m going to assume that the parliamentary assistant will offer his assurances that what we are requesting will in fact be done and was in fact the intention of the government, but what we’re asking is that we legislate to ensure that privacy will not be compromised.
Mr. Michael A. Brown: I want to assure the member that we agree that the intent is to do exactly as he says. We are just not convinced that this amendment does that. The bill already restricts the minister’s collection to what the minister considers to be necessary for the listed purposes. Accordingly, his or her power in this section is limited in the sense that it is subject to the standard of reasonableness, and what is reasonable would be determined within the framework of the purposes set out in subsection 11(4) of the bill and the specific facts of any particular situation. I think the member should agree that his strongly felt interest in protecting the privacy of individuals is already in the legislation and that his particular amendment does not move that forward.
We believe that this section of the bill needs to be much more prescriptive and not leave anything to the imagination. I accept that the government has good intentions; however, it’s only one government, and ministers and governments come and go. What we want to do here is ensure, regardless of who is the government, who is the minister, who is the parliamentary assistant, regardless of who the civil service is, regardless of what the mood of the province may be at any given time, that this legislation prescribes what information can be collected. It’s not a safeguard for the government; it’s a safeguard for the people of Ontario.
Mr. Michael A. Brown: Our only disagreement is that we believe the bill already does that. I have some real difficulty in understanding how “objectively necessary,” which are the words that are used in the amendment, furthers the cause at all, when the minister is restricted to working within the framework of 11(4).
Mr. Frank Klees: I refer the parliamentary assistant to page 24 of the privacy commissioner’s report on this matter, which happens to agree with me and this amendment, and not the parliamentary assistant.
The first is, the government seems to be adopting a “trust us” attitude. I may trust the current government or I may not, but I don’t know to what degree I can trust governments that may come in the future. I don’t know anything about them. Everything I’ve read on information and privacy says that the “trust us” attitude is something that should be subjected to a lot of doubt.
The second point is the whole issue of data minimization. Information and privacy commissioners over and over again, not just in Ontario, but outside of Ontario and outside of Canada, have said that one of the fundamental principles is minimization of data. Governments should get the data that they need to do the job, not anything more. If you provide anything more and you provide a very loose set-up whereby that information can be exchanged, it’s open to abuse.
The third issue, I think, one that we all ought to be concerned about, is accountability and transparency. I think, as I read the legislation as it is now, there is not accountability and transparency. It is too wide open. For that reason, I think, the Conservatives have put forward their amendment and I’ve put forward my amendment. They’re very similar. There needs to be greater protection of the public; there needs to be greater protection of the information. That’s why I think this is an important amendment.
Mr. Michael A. Brown: We do not think this to be wide open at all. We believe that the language of the act, as it stands, restricts what the government can do and what the minister can do and what the ministry can do to a level that should satisfy other members.
We just don’t see how the particular amendment that my honourable friend puts forward furthers any of the arguments. We won’t be supporting this because we don’t think that it provides any value added to the act.
Mr. Howard Hampton: Just this: I’ll draw attention to our amendment, which is amendment number 9. I’m not trying to skip ahead, but I’m trying to illustrate the difference in the objective test. If you read the legislation as it stands now, “the minister may disclose information to any public body or related government, as he or she considers appropriate”—the test is pretty subjective. What we’re proposing is, the minister is permitted to request to collect information from any public or related government only as objectively necessary. It’s a tighter test, and we think we ought to have a tighter test when it comes to this kind of information. If the minister considers it necessary is a much looser test than “objectively necessary.”
Mr. Frank Klees: I would just ask the parliamentary assistant to help us understand what it is about the term “objectively necessary” that he objects to or that the government objects to. I hear what he’s saying, that there’s no intention of gathering information that would be of a personal nature and that the objective of the government is in fact to do as the amendment indicates, but there must be a reason for objecting to what is simply a further clarification and a very strong message to whoever would go about collecting information. There must be a reason why the government does not want to put that additional clarification into legislation, and I would be interested to know what that reason is.
Mr. Michael A. Brown: I, myself, don’t know what “objectively necessary” actually means. “Objective to who?” would be the question. I’ve just taken the opportunity to quickly read section 11 in its entirety, especially subsection (4). I think that very specifically states what the framework is that the minister will use in releasing or disclosing information.
The parliamentary assistant states that he does not know what “objectively necessary” means. “Objectively necessary” is the opposite of “subjectively necessary”; I put it that way. “Subjectively” means that the minister is not going to be entrusted—not that we don’t trust the current minister or the parliamentary assistant, but we’re not going to trust that an individual is going to make the decision about what kind of information to collect. We want that to be measurable and we want the kind of information that will be collected to be clearly defined so that the minister or the deputy minister or whoever it might be can go to a place to determine what kind of information, specifically, can be collected, as opposed to determining one day that because he or she may feel that it’s appropriate, given the circumstances of that day, to collect a certain type of information, the edict will be given that that information be collected. That’s why we refer to the term “objectively necessary.”
I’d ask the parliamentary assistant again to help me understand why there would be an objection on the part of the government to simply including this line in the legislation that would make it clear and protect everyone in the province.
Mr. Michael A. Brown: I guess the argument is, quite clearly, we don’t think it does make it clear. We don’t think it provides any additional value added, as I said, to the way the act reads at the moment. When you introduce a term that is not clearly understandable—and that would be “objectively necessary.” I don’t think I know of other legislation that uses those specific words; maybe they do somewhere, but as far as I know, they don’t. It just does not help the process.
I think we’re on the same page in terms of protecting the information. We think section 11 does that. If the member could point out where he doesn’t think it does, specifically, then I would be interested, because I find it pretty clear in terms of what is permissible.
Mr. Frank Klees: I have to do this, only because the parliamentary assistant asked the question. There are at least three people in this room—I’d include my colleague Mr. Bailey, so that will make it four—who know what “objectively necessary” means. There is one other person who is an officer of the Legislature who also knows what it means. So I draw his attention to page 25 of the privacy commissioner’s submission to this committee. Under recommendation 18, and I will quote, “Sections 11(1) and (3) of Bill 85 should be amended to provide that only collections, uses and disclosures that are objectively necessary to accomplish the purposes set out in the section are permitted.”
“(3) Upon receipt of a request for information from the minister under subsection (1), a public body shall disclose to the minister any information from their records that is objectively necessary in assisting the minister with a purpose set out in subsection (4).”
I think I have a problem here, Madam Chair, given that the parliamentary assistant doesn’t understand what the term “objectively necessary” means. The fact that that term is used in this amendment means I can probably assume that this amendment will also be voted down. However, for the record, I’d like to give the parliamentary assistant and his colleagues on the government side an explanation as to why we believe this is important.
This amendment will make it incumbent on any public body to disclose to the minister upon receipt of a request for information from the minister any information from their records that, as I said, is objectively necessary to assist the minister as outlined in subsection (4). It is an extension of the principle that we’ve referred to previously of data minimization within the limited internal purposes of the ministry only.
As this bill is written now, it allows any public body to decide subjectively what information may assist the minister and disclose that information to him or her. The current provisions give the ministry and public bodies overtly broad discretion to disclose personal information, which we happen to believe is dangerous. It is not perhaps the intention of the ministry, but it leaves the legislation open to allowing that to happen.
Mr. Michael A. Brown: What this amendment really does is provide that public bodies receiving a request for information from the minister shall disclose that information when it is objectively necessary to assist the minister with one of the listed purposes that are set out. He noted already the difficulty that we on this side have with understanding what “objectively necessary” means. Secondly, we don’t think we should put a public body in the position of having to subjectively decide what “objectively necessary” means and not respond to the minister with a reasonable request that the ministry would make under the framework of section 11, which, as I pointed out many times before, is very narrow in what it permits to be done. So we could have a situation where a public body would feel they would be subjectively imperilled by making the determination of his famous “objectively necessary.”
Mr. Howard Hampton: What it comes down to again is, the wording the government has chosen provides very broad discretion in the minister: “Well, yeah, I think this falls—therefore I’ll provide the information,” or “We think this generally is within the ambit; therefore, we’ll provide the information.”
“Objectively necessary” is much tighter. Courts have often considered the meaning of “objectively necessary.” I think another way of putting it would be the reasonable-person test: Does a reasonable person think that this, based upon objective criteria, is necessary? One protects privacy much more than the other. I think courts would be much happier dealing with the issue of “objectively necessary” than dealing with the issue of what the minister may or may not subjectively think is important.
The Chair (Mrs. Linda Jeffrey): It’s 12R. Does everybody have it in the front of their desks? It’s a separate package that should be on your desk. It should say “12R” in the far right-hand corner. Who’s reading it? Mr. Brown, are you reading it into the record?
I think that’s obvious. The government is moving forward to take into consideration what my honourable colleagues on the other side have suggested, in that the measurements from photographs should not be disclosed to other jurisdictions.
Mr. Frank Klees: We have a previous amendment to the same section that had different wording, and I wonder if the parliamentary assistant could explain to us why there was a change in that wording from the original amendment.
“(3.1) The minister may not disclose under subsection (2) the measurements derived from the use of photo-comparison technology under section 6 to compare the photographs of applicants for or holders of a photo card or driver’s licence.”
There was no intention to change the meaning of the provision. It was simply to track the language used in section 6, which refers to “photo-comparison technology.” The previous version used the term “derived from the use of photo-comparison technology,” and this basically says “the measurements used for comparison of photographs.” So basically it’s just repeating back the language of section 6.
This amendment defines the limited purpose of a collection of information and records for authenticating photo cards and nothing else. Again, it’s in the interest of limiting the application. There’s a problem posed by combining all proposed cards into the term “photo card” despite different purposes for the cards. Section 11(4)6 permits the ministry to provide a potentially wide variety of personal information to two federal government entities for unspecified purposes. It permits disclosure to the Canada Border Services Agency and to Citizenship and Immigration Canada. It’s unlikely that these two departments would need the information for the same purposes. The lack of specificity could lead to a questionable scenario, and again, it’s simply in the interest of clarifying that this amendment is proposed.
Mr. Michael A. Brown: I appreciate the amendment. What it does is it restricts the purpose set out in paragraph 6 of section 11(4) to authenticating a photo card by the Canada Border Services Agency or the Department of Citizenship and Immigration. The member would know that the Canada Border Services Agency and the Department of Citizenship and Immigration will not be authenticating the photo cards. CBSA must be provided with information about the issuance, renewal and cancellation of EDLs and enhanced photo cards, as they, in turn, will be requested to confirm the validity of these cards by the US when presented by the cardholder at the US land and water border crossings.
The CIC has an oversight and quality assurance role in the enhanced card program. This amendment would restrict the minister’s ability to disclose the transactional information that CIC requires from MTO. MTO will confirm with CBSA and CIC if MTO can make available the memorandum of understanding between the province and the federal organizations. In other words, there will be an audit by the federal authorities—the CBSA and citizenship and immigration—to see that the province is issuing these cards in an appropriate way, because they are providing us with some information and we are sharing that information. It is therefore a quality control mechanism where they will need to have access to this information. Your amendment would stop that. Essentially, this is just to determine the validity of our systems.
Mr. Frank Klees: Just to clarify, if I might, the parliamentary assistant has it wrong. This amendment would not stop any verification of information; what this amendment simply does is ensure that any information that is disclosed would be for the sole purpose of authenticating a photo card. So there’s no interference with the process; it is doing simply what I’ve heard repeatedly from the parliamentary assistant in that it would be strictly for limited purposes. Again, it’s a matter of clarification, not in any way to interfere with the process.
Mr. Howard Hampton: I have a question on this. Surely when somebody approaches the border, it seems to me the question that the card is designed to answer is that it’s authentic identification; it’s not fraudulent.
With respect to the role of the Canada Border Services Agency and Citizenship and Immigration Canada, they’re not playing an authentication role; they’re playing a data stewardship role. We’re issuing cards based on documentary evidence that’s provided by the applicant to the province. Based on that documentary evidence, our examination of that documentation and the questioning of the applicant, we will issue a card.
The Canada Border Services Agency is the interface between the various provinces’ data and the border. They’re not authenticating the card when they receive the data; they’re simply holding the data and making it available when someone comes to the border. When somebody comes to the border with a card, the border agent who’s there will retrieve information from the CBSA database, which will contain a subset of our driver information, and they will then make a determination at that point whether they let this person in or not. It’s the same with a passport. At the border, they’re not authenticating the passport; they’re simply accepting or not accepting the document that’s tendered as being legitimate.
So there’s not an authentication role that the federal government is being asked to play. The closest it comes is in the quality assurance of the program, doing a small subset of transactions to ensure that the issuance of these documents is consistent with what their practices would be, were they issuing these documents themselves.
Mr. Howard Hampton: I want to go back and use the words you used. Whether the passport is legitimate or not legitimate, it seems to me on a passport that’s not authentic, right away you’d say it’s not legitimate, right? No more questions.
Mr. Howard Hampton: So part of the reason Ontario is collecting information is so that Ontario can have some faith in the authenticity of cards that you provide people with. Yes, I accept that border services may have all kinds of other issues based upon their database, but it seems to me that their interface with Ontario is: Is this an authentic ID or not? If it’s an authentic ID, they can do all the stuff that they’re approved to do under their legislation. It shouldn’t involve Ontario at all; that’s a different issue. If somebody presents an ID card that’s not authentic, then that’s it, right? You don’t pass. So it would just seem to me that Ontario’s sole test here is the authenticity of the card.
Mr. Steve Burnett: That would certainly be Ontario’s—not so much the authenticity of the card, Madam Chair. The province would be in the position of verifying that the information provided by the applicant was consistent with who we understand this applicant to be. They’ll come, they’ll produce the records that we expect them to produce, the documentation that we expect them to have that complies with the legislation. At that point, based on the determination and the questioning at the point of service, we’ll issue a card to that applicant. At that point, they receive a card. We have satisfied ourselves that they are who they say they are and that they are entitled to this card. Based on that determination, we then provide that information to CBSA. They don’t open up the file and review that and say, “Is this authentic or not?” It sits in their system.
So to say that we’re providing information for the sole purpose of authenticating a photo card to CBSA, that isn’t actually what we’re doing at all. They’re simply the data stewards and the conduit through which the border protection services in the States actually access the information. So the whole notion of authentication is actually problematic in this motion.
Mr. Howard Hampton: Right away, we’re back into the troubling issues that we were into originally. This bill has all kinds of subjectivity to it. You’re saying that it’s not just the card that is of interest at the border, it’s the information that’s been collected on the person in the background.
Mr. Steve Burnett: The card itself is the means by which that information is accessed. That’s the whole premise of the program, that when someone comes to the border, the RFID tag is read by a reader at the border and it then accesses the system in Ottawa and pulls that information forward to the border agent, so that when the car arrives there, the information’s there too.
Mr. Howard Hampton: Well, except the technical stuff is very related to the policy, and really related to the substance. I’ve heard government members say that information is adequately protected, but what I see is—I show up at the border with my card, and it’s not just a question of, is this ID card authentic? It is all the information that is behind this card. I don’t think there’s adequate protection in this legislation for all the information that is behind that card.
Mr. Bill Mauro: So anybody in Ontario who goes forward and applies for one of these cards will be doing so voluntarily. They’re not forced to do this, and if they choose to do that, what information will they have to submit to achieve and receive an EDL that is different from what they would have to provide to achieve and receive a passport?
Mr. Steve Burnett: There’s not a significant difference in the information that’s required. In terms of the information required to apply for an enhanced driver’s licence, the requirements are the same as for the driver’s licence today. There’s an approved document list that we will use and collect information on.
Mr. Steve Burnett: There’s a difference in the way a couple of the documents would be used. For example, the citizenship and immigration card and the birth certificate would no longer simply be used to establish legal name. It would also be used to establish citizenship. So there would be a difference in the use of these documents, but the documents—
Mr. Howard Hampton: Something that Mr. Mauro said set off something for me. To describe these as “voluntary” in the society that we now live in, do you really think these are just going to be voluntary cards and maybe a few of us will get them?
Mr. Michael A. Brown: I agree. They are clearly voluntary. Whether the public chooses to have one or does not choose to have one is solely the responsibility of an individual. They may be seen by the public, by and large, to be something that is very good to have, but it is clearly not necessary that they have it. It may be convenient for them to have it. If you want to leave Canada and travel to the US by either water or land, you might prefer to have a passport. That would be the alternative, Mr. Hampton. People would have the opportunity to choose between those two if they wish to cross the border.
Mr. Michael A. Brown: I would just point out that we are talking about four specific cards, all of which are voluntary. You may have a photo ID. You may have a photo ID card that identifies your citizenship. You may have a driver’s licence, or you may have a driver’s licence that indicates your citizenship. In our society, all of those are voluntary. It may be convenient to have them, but one of them is all you’d be permitted. It is clearly not something that the government is saying you must have, and it will be one, I’m sure, that some people choose not to have. But I’m sure that a large number of Ontarians will find it useful to have some kind of photo identification as most Ontarians or the vast majority of adult Ontarians have drivers’ licences.
Mr. Frank Klees: Just a question to the parliamentary assistant: Is there an assumption that the ministry has made as to the number of these cards that would in fact be processed? I’m assuming that for the purposes of the RFPs and if someone’s going to be bidding on this contract, there must be some assumptions that have been made in terms of how many cards we expect would be processed.
Mr. Michael A. Brown: I would say to the member that we recognize the challenge of providing these cards, particularly in response to the American government’s insistence that travellers to the US have a document that is either a passport or a document that provides citizenship information in a form that they believe to be adequate. I believe there will be significant take-up amongst Ontarians. The ministry understands that, and the ministry understands the challenge of that. I don’t think the ministry knows at this point—I could be wrong on this; I might defer—how many may choose to do this, but I know we intend to move forward with pilot projects because it would be literally impossible, as we know from the federal experience with passports, to ramp this up so that every Ontarian overnight could access this card immediately on proclamation of this act. There is a staged implementation, and we will be targeting various places in the province that in all likelihood would have the highest need for the card and roll that out.
I think the member is right: This will be a considerable technical challenge for the ministry to deal with. We do think there will be a fair number of people that do it. I don’t think the ministry knows exactly how many would apply. Maybe you could help us with that.
Mr. Steve Burnett: Steve Burnett, Ministry of Transportation. We’re relying on some analysis that had been done by Ipsos Reid and also the findings of other jurisdictions that were involved in other EDL activity. We’re estimating slightly under half a million cards over the five years of the program, with a lot of that front-ended in the first two years. That’s the estimate we have: approximately half a million. That’s a fairly conservative update based on the driver population.
Mr. Steve Burnett: We expect that there’ll be demand in the target areas right at the beginning. We’ll put a process in place with Service Ontario to manage the demand and ensure that people aren’t waiting (a) a long time, or (b) that we’re not creating lineups. There’ll be an appointment process for people coming into offices and going through the application process.
We have the capacity to expand fairly quickly if we find that demand is higher than anticipated, but at the moment, and based on what we’re seeing for example in New York state, who implemented last month, our demand numbers are pretty consistent.
“6. To provide the Canada Border Services Agency or the Department of Citizenship and Immigration, or the successor to either of them, with information and records regarding the issuance, renewal or cancellation of an enhanced photo card or a combined photo card.”
Mr. Michael A. Brown: This is a relatively simple and straightforward amendment. It just takes into account the potential that in a reorganization of the federal government or departments thereof we will be able to maintain the relationship that is suggested in this bill.
“6. To provide the Canada Border Services Agency with information and records regarding the issuance, renewal or cancellation of an enhanced photo card or a combined photo card for the sole purpose of authenticating the photo cards.
This flows directly from the Information and Privacy Commissioner’s discussion and recommendation, where the Information and Privacy Commissioner recommended that this subsection should be divided into two separate clauses, one dealing with the disclosure to the Canada Border Services Agency and one dealing with the disclosure to Citizenship and Immigration Canada and amended to specify the types of information, and purposes for which, the border service agency and Citizenship and Immigration Canada respectively may be provided with.
Mr. Michael A. Brown: The member is correct: It does divide the two departments. The problem here is that the province does not have a list of Canadian citizens that would need to be verified by the Department of Citizenship and Immigration. CIC has an oversight and quality assurance role in the enhanced card program, and this amendment would restrict the ministry’s ability to disclose the transactional information that CIC may require from MTO. MTO will confirm with the CBSA and CIC if MTO can make available the memorandum of understanding between the province and the federal organizations.
We believe that paragraph 7 should be deleted because once again, it allows the ministry to widely disclose information for a purpose unrelated to the original purpose of collecting information when an individual presents a photo card, driver’s licence or even vehicle permit in obtaining apparently federal, provincial or even municipal services and benefits.
Repeatedly, we’ve been advised by the parliamentary assistant that there are no intentions of having the use of this card broadened beyond the scope of its original intent. Yet when we read paragraph 7, it states specifically: “To provide a public body or related government with the information that the minister believes is necessary to assist it with a purpose similar to a purpose set out in paragraph 1, 2, 3 or 4 if the holder of a photo card”—and here’s the interesting thing and why we’re so concerned about this—“has presented his or her photo card in order to obtain a benefit or service under a legislatively authorized program or service administered or provided by that public body or related government.”
Whether someone is going to the library and uses their photo card for identification or for any other service provided—apparently, the way this is worded—by any other level of government, this information is now available. We believe that that is inappropriate, we believe it’s wrong and it goes beyond the scope of what the government indicated that the purpose of this card would be. So we’re hopeful that the government members will approve this amendment. What are the chances?
Mr. Michael A. Brown: The disclosure under this provision is limited to purposes such as verifying the accuracy of information, detecting false statements, authenticating documents, and preventing improper use of photo cards only where a photo card has been presented to a public body or related government in order to obtain a benefit or a service.
Mr. Frank Klees: So now the purpose of this photo card is to help other governments deal with anti-fraud issues. That was never stated when this photo card was brought forward. This was brought forward as a border-crossing identification. Now, when someone is asked to present a card, what comes to bear is an anti-fraud screening, if you will. Did I hear you correctly?
Mr. Michael A. Brown: The member, I think, is misunderstanding. As he knows, there are four cards available under the photo card identification. One of the purposes is so that Frank Klees can identify himself as Frank Klees. I presume that is one of the things that someone would want to do.
We want to be able—and you would want yourself to be able to have your identification known. If you’ve made a false statement, if you have presented documents which aren’t authentic, the government obviously needs the ability to check those documents. That’s what we’re talking about here, authenticating identification that may be presented to us so that the person seeing your photo ID card, whichever one it happens to be, knows that you are the person indicated on the card. That requires some sharing of information, as you might expect.
Mr. Frank Klees: I hear the parliamentary assistant’s explanation. It concerns me, because it is a departure from what we’ve heard the sole purpose of this card would be. That’s why we’ve asked for the deletion of this paragraph, because we think that this paragraph is inconsistent with the purpose for which the original information was stated would be collected.
I think that all of our concerns for privacy and for carefully guarding the information that is collected, and for very clearly defining for what purpose information is being collected, are underlined now by the parliamentary assistant’s response to this very question. I would ask him once again to give consideration to the originally stated purpose of this bill, let alone the card itself and the technology that’s being used, and agree that we eliminate this very broad scope of application that’s anticipated under paragraph 7.
Mr. Michael A. Brown: The reason for sharing information would be to verify the accuracy of the information that an applicant has provided to the ministry. I don’t know how we could avoid doing that. We need to be able to, as a ministry—and as a government, for that matter—identify any individual as that individual. Therefore, we would have to be able to, for example, authenticate a birth certificate, if that was something that we needed to authenticate. I think the member would understand that you would have to share information between government agencies, as you do now. If you apply for a passport from the government of Canada, they have the ability to authenticate other documents. You must have that or you cannot issue the identification with any kind of certainty. I understand the privacy concerns, but I do not understand how you can issue any kind of a document without being able to verify the authenticity of the supporting documents for it. So any document the province issues must have the confidence that it is authentic, and it can only be authentic if the underlying identification is authentic.
Mr. Frank Klees: It’s not a matter of authenticating information, it’s a matter of disclosing information. That’s what’s at the heart here. What we’re simply saying is, it’s one thing to have the information available to you; it’s another question of what you do with it. That is why we are calling on paragraph 7 to be deleted, because it goes beyond the scope of what is intended with this bill.
I rest my case, but I will point out to the parliamentary assistant again that we are not alone in calling for this. The privacy commissioner, on page 21 of her submission and in her recommendation number 14, shares our concern. We want to support her in requesting a very logical amendment that is consistent with the government’s original intent of this legislation.
Mr. Howard Hampton: If I can, the privacy commissioner was very clear: “Subsections 11(4)7 ... which allow the ministry to widely disclose information for a purpose unrelated to the original collection when an individual presents a photo card, driver’s licence, or vehicle permit in obtaining federal, provincial and municipal services and benefits, should be deleted....”
It seems to me the government’s confusing two things here. You collect information from an individual, so you can assess whether or not they should get this ID card, right? Once you present them with the ID card, if they use that, they should be able to use that ID card without having all of their information disclosed to question them again. It seems to me, if the ID card is worth anything at all, if this whole exercise is worth anything at all, you should be able to present the card without having to have all of your personal information disclosed again.
“(d) where disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and where disclosure is necessary and proper in the discharge of the institution’s functions;
“(g) where disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;
“(h) in compelling circumstances affecting the health or safety of an individual if upon disclosure notification thereof is mailed to the last known address of the individual to whom the information relates;
“(j) to a member of the Legislative Assembly who has been authorized by a constituent to whom the information relates to make an inquiry on the constituent’s behalf or, where the constituent is incapacitated, has been authorized by the spouse, a close relative or the legal representative of the constituent;
“(k) to a member of the bargaining agent who has been authorized by an employee to whom the information relates to make an inquiry on the employee’s behalf or, where the employee is incapacitated, has been authorized by the spouse, a close relative or the legal representative of the employee;
Our opinion is that the legislation authorizing the transfers of personal information to these other jurisdictions requires that these transfers only be made subject to agreements to ensure confidentiality and security of that said information. Bill 85, in our opinion, fails to provide for such agreements. It actually contains provisions, such as subsection 11(5), that do away with any requirement to enter into such agreements. This, in our opinion, impedes the rights of those individuals to control the disclosure of their personal information and represents a serious infringement on the privacy rights of individuals, and was so indicated in the Information and Privacy Commissioner’s report on page 12, paragraph three.
The current provisions of Bill 85 override and frustrate the objectives of the Freedom of Information and Protection of Privacy Act to allow those individuals to exercise control over the disclosure of their personal information by government institution. This amendment applies to section 42 of the freedom of information and privacy act, to disclosures of that information, as so indicated on page 12 of that report.
Mr. Michael A. Brown: Subsection 11(5) is clearly not unique in Ontario legislation. Similar provisions exist in a number of other statutes: the Regulatory Modernization Act, 2007, section 8; Christopher’s Law (Sex Offender Registry), 2000; the Ministry of Correctional Services Act; the Occupational Health and Safety Act; the Police Services Act; the Vital Statistics Act; the Land Titles Act; the Employment Standards Act; and the Financial Administration Act.
The minister is given a permissive authority under subsection 205.0.1(2) to disclose information, including personal information. The Information and Privacy Commissioner has held that a permissive authority such as that provided under subsection 205.0.1(2) does not satisfy the requirements of clause 42(1)(e) of the Freedom of Information and Protection of Privacy Act, under which disclosure can only be made where the institution disclosing the information is required by the relevant-to-disclose personal information.
It is also possible and likely that the minister’s disclosure under subsection 11(2) will fall under other Freedom of Information and Protection of Privacy Act disclosure authorities, such as FIPPA’s clause 42(1)(c), disclosure for the purpose for which information was collected “or for a consistent purpose,” but it may not always be the case. So it is recommended that subsection 11(5) remain as it is.
“Any disclosure of information under this section is deemed to be in compliance with clause 42(1)(e) of the Freedom of Information and Protection of Privacy Act and clause 32(e) of the Municipal Freedom of Information and Protection of Privacy Act.”
The concern, Madam Chair, and to members of the government, is with the word “deemed.” The parliamentary assistant made reference on a number of occasions to providing assurance that the government would be compliant with the provisions of the Freedom of Information and Protection of Privacy Act. His justification for turning down a number of our amendments and voting against them was because they would be adhering to the Freedom of Information and Protection of Privacy Act. What this clause does, however, doesn’t require them at all to comply. What it tells us is that we should once again trust the government, because at the outset we’re being told that regardless of what the government does, they are deemed to be in compliance. Frankly, it doesn’t matter how many other pieces of legislation have this same clause; we happen to believe it’s not appropriate, specifically in this legislation, which deals with the very issues of privacy.
The member referred to the privacy commissioner in justifying turning this amendment down, if I heard you correctly. Let me read you what the privacy commissioner said to us here regarding these deeming provisions:
“These deeming provisions also defeat the independent oversight of the collection, use and disclosure of personal information by government, which is entrusted to my office. Moreover, these provisions are inconsistent with section 43 of the Freedom of Information and Protection of Privacy Act and section 33 of MFIPPA, which state that personal information can only be used or disclosed for a consistent purpose if the individual might reasonably have expected such a use or disclosure.”
It gets us back again—and I fail to understand. the principle of this bill and what they’re trying to achieve. What we cannot understand is why they are consistently resisting the advice of an officer of this Legislature and why they insist on a clause that is so questionable in terms of whether or not the minister and the government are truly on the side of individual citizens in this province and their right to personal privacy.
Why would you consider inserting this clause into this legislation rather than saying, “Any disclosure of information under this section must be in compliance”? Can the parliamentary assistant simply tell me why they wouldn’t say that, as opposed to saying, “is deemed to be in compliance”?
Mr. Todd Milton: The intention behind this provision was to deal with a situation whereby a permissive authority to disclose personal information is given under a particular statute. If the institution discloses information in accordance with a permissive authority and then there’s a privacy complaint in regard to that disclosure, the privacy commissioner has basically interpreted 42(1)(e) of FIPPA to mean that the authority you’ve been granted in the statute that you’re citing is a mandatory authority, that you must disclose the information. A permissive authority to disclose is not considered sufficient to meet that test, so that was why this provision was put in there. The authority given to the minister is permissive, and in order to protect it from a privacy complaint, this particular language was used.
I, for one, would not want to be party to this clause. I say to members of the government, I don’t understand how this got by the minister. I understand that it’s very, very creative crafting, but what I don’t understand is how, as legislators, we can allow this to stand. As I say, our job here is not to make it easy; it’s to make it right. It’s not to make it as simple as possible to deal with privacy concerns; it’s to ensure that privacy concerns are in fact respected. To hear the justification for this clause to be that it gets around the privacy commissioner’s opinion gives me great concern.
I know the government is under direction in terms of this issue, but I also can’t believe, based on the information that we have, that any member of this committee would be willing to allow this clause to stand, knowing what we’ve heard. So, Chair, I would simply ask this: If it takes a recess for the parliamentary assistant to sit with his advisers, I would ask that they do that, because I cannot believe that, in good conscience, members of this committee would, based on the technical explanation we’ve had for this, want this to stand.
Mr. Howard Hampton: I’m going through what the Information and Privacy Commissioner said again, and she’s very clear in saying disclosure of information to other bodies should only be by means of agreements that are carefully and strictly drafted. That would provide some protection in terms of people’s information, but when you include this section, it means that those agreements are useless. As I said before, this legislation is wide open and when you put in clauses like this, it makes it even more wide open. It’s just really hard to see how someone’s private information is going to be protected by means of a clause like this. I appreciate that you may find these clauses in some other pieces of legislation, but we’re not dealing with other pieces of legislation. We’re dealing with legislation here that carries all kinds of a person’s private information.
Mr. Todd Milton: I don’t think I can add too much, just that, as I say, if a statute gives you an authority to disclose information, it may not be sufficient in the event of a privacy complaint to deal with that particular disclosure, which is why this type of wording has been—
Mr. Howard Hampton: Our motion number 19 raises a similar concern to that raised in 18, specifically that the Information and Privacy Commissioner has it right: You don’t need this section. This section—
Our feeling on this is that this amendment affirms that the disclosure of personal information under this act is to be limited to the purposes specified in the act—a necessary follow-up amendment following the amendments that limit how the minister may use personal information under the act as reported in the report to the committee, page 22, section 3.2.3.
Mr. Michael A. Brown: What this motion does is limit the collection, use and disclosure of information under the act to the purposes set out by the act. The collection and disclosure is already limited to the purposes set out under subsection 11(4) of the act and also it includes the pre-existing collection and disclosure authority, for example, as provided in the Freedom of Information and Protection of Privacy Act preserved by subsection 11(6). The purposes for which information can be used would track the purposes for which it can be collected and disclosed.
“(5.1) Any collection by a public body of personal information, as defined in the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, disclosed to the public body under this section is exempt from the application of subsection 39(2) of the Freedom of Information and Protection of Privacy Act and subsection 29(2) of the Municipal Freedom of Information and Protection of Privacy Act.”
What this motion does is where a public body collects personal information disclosed to it by the minister, the public body does not have to provide a notice of collection as required by the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act. This is just really a technical amendment to deal with the fact that the provincial privacy legislation requires that a notice of collection be given even in circumstances where personal information is collected indirectly by the public body in question. Public bodies to which FIPPA or the Municipal Freedom of Information and Protection of Privacy Act apply, and which collect personal information under this provision, would be vulnerable to privacy complaints if they do not give notice of collection. So it is recommended that they be exempt from this notice requirement.
“(6.1) Despite subsection (1), nothing in this act shall be taken to presume that the government of Ontario may create any additional collection or retention of personal information that already exists in the data files of the government of Canada.”
Our background and opinion on this is that this amendment addresses the problems associated with database duplication in the privacy commissioner’s report, on page 4. In our opinion, to create a mirror database of citizenship information that is already in the hands of the federal government could serve to propagate identity theft and lead to a potential of unintended consequences of error and inaccuracies that could arise in the process of recreating the existing citizenship information.
This is from paragraph 4, page 4, of the privacy commissioner’s report: “The federal government already has” the capacity to “verify the citizenship of naturalized Canadians, and securely provide that information to a province ... upon request. This would ... be a more privacy-protective and cost-effective model....”
Mr. Michael A. Brown: This intended amendment limits Ontario’s ability to collect and retain personal information existing in Canada’s data files. The ministry does not intend to create a database of citizenship information, but it requires an authority to collect citizenship information in order to verify citizenship for the purposes of our enhanced cards. This could include information that resides in the Canadian government databases. The proposed approach requires that applicants provide documentary evidence, including evidence of citizenship, from an approved list of acceptable documents already established under the Canadian driver licence agreement—e.g., birth certificates or a Canadian immigration certificate. MTO already keeps copies of those tendered documents for audit purposes.
Mr. Michael A. Brown: The bill already restricts the minister’s disclosure authority to what the minister considers to be necessary for the listed purposes, and that of public bodies is limited to that which the public body believes would assist the minister for these purposes.
Accordingly, the disclosure authority in this section is limited in the sense that it is subject to the standard of reasonableness, and what is reasonable would be determined within the framework of purposes set out in subsection 11(4) of the act and the specific facts of any particular situation. Therefore, we cannot support this amendment.
“(6.2) The use and disclosure of personal information by the minister and by public bodies and related governments shall be limited to that which is objectively necessary to establish a person’s eligibility for a photo card.”
As set out in the Information and Privacy Commissioner’s report on pages 24 and 25, Bill 85, as currently written, could allow the ministry to “disclose personal information ... that may be only peripherally related, if at all, to the original purposes for which this information was collected.”
Mr. Michael A. Brown: The bill already restricts the minister’s disclosure authority to what the minister considers to be necessary for the listed purposes, and that of public bodies is limited to that which the public body believes would assist the minister for these purposes.
Accordingly, the disclosure authority in this section is limited in the sense that it is subject to the standard of reasonableness, and what is reasonable would be determined within the framework of the purposes set out in subsection 11(4) and the specific facts of any particular situation.
“11.1(1) The government of Ontario shall conduct an independent privacy audit and end-to-end threat risk assessment that adequately identifies and addresses privacy and security issues pertaining to the protection of personal information and identity as a result of the implementation of a radio-frequency identification technology system.
“(2) Any use of radio-frequency identification technology by the government of Ontario shall comply with the radio-frequency identification technology guidelines developed by the Office of the Information and Privacy Commissioner.
As set out in the privacy commissioner’s report on page 6: “There are well-known privacy and security vulnerabilities associated with” radio frequency identification technology, otherwise referred to as RFID. An unauthorized individual may intercept that data while an authorized RFID reader is reading the data. Skimming can occur when this individual with an unauthorized RFID reader gathers that information from a chip without the cardholder’s knowledge. Cloning may then occur when the original RFID chip and its data are duplicated.
These vulnerabilities could lead to a host of undesirable consequences, such as identity theft, unauthorized identification and covert tracking and surveillance of individuals. As set out in the Information and Privacy Commissioner’s report on page 7, the first paragraph, a radio frequency identification number “points to real, personally identifiable information. A social insurance number, a passport number or a driver’s licence number ... when linked to personally identifiable information ... can be misused ... or used for unintended purposes that may cause real harm to real people. Identity theft is a case in point. It is ... the fastest-growing form of consumer fraud in North America.”
Mr. Michael A. Brown: This is clearly not something that should be legislated. The threat risk assessment and the privacy impact assessment have already been built into the government approval checkpoints and have already been conducted. The government is already subject to audit scrutiny through the internal audit service and the Provincial Auditor.
A guideline should not be given the force of legislation—I think, respectfully, that’s what you were trying to do here. Neither does the Information and Privacy Commissioner approve government programs. The language proposed here requires that the government pursue but not implement. The availability of an application of specific privacy enhancing technologies for RFID chips in the enhanced drivers’ licences will be explored. However, the government cannot commit to their successful implementation.
We had some information last week that it was possible, commercially available and reliable—on/off switches on the RFIDs. We have done some investigation, we being the ministry. According to our vendor, they are not available at this time in a commercial sense or with any sense of reliability. We have been doing checking; we take this seriously. We believe that this could be a good idea, but we need to know that the technology we adopt is presently working and reliable. To date, the ministry is not convinced that is the case.
“1. Before the end of the phasing-in period, the minister must order an independent, third party privacy audit to identify outstanding privacy and security issues. The Office of the Information and Privacy Commissioner must approve the terms of the audit. The audit must be tabled in the Legislature before the end of the phasing-in period.
“(2) No person, other than a representative of the Canadian or American border authorities or a representative of a prescribed agency, shall knowingly access information on a radio frequency identification technology chip on a combined photo card or enhanced photo card.
Once again, this comes straight out of the Information and Privacy Commissioner’s concerns: (1) about the technology, and (2) about the legislation which is—I think I can paraphrase here—overly loose in the face of technology that, as the parliamentary assistant says, there is some uncertainty about.
Mr. Michael A. Brown: The motion is predicated on, “If the Minister decides to use radio frequency identification technology.” The member would know that it is not an optional feature of the program. Enhanced driver’s licence programs can only be implemented if an RFID solution is included. The government is already subject to audit scrutiny through the internal audit service and the Provincial Auditor. A guideline should not be given the force of legislation. Neither does the Information and Privacy Commissioner approve government programs.
The language requires that the government implement. As I said, the availability of the application of any specific privacy-enhancing technologies for RFID chips in enhanced driver’s licences will be explored. The government is working with the privacy commissioner on this front and will continue to work with her. However, the government cannot commit to the successful implementation of a particular technology. The minister is, as I said, already subject to internal audit through the internal audit service and the Provincial Auditor.
Mr. Frank Klees: GS1 Canada made a presentation to our committee, and I had asked a specific question relating to the commercialization of an on/off switch. We received a follow-up from GS1, and I think all members of the committee have that. I have just had a chance to review this, and in GS1’s submission they state this:
“GS1 Canada, Paratech and the Information and Privacy Commissioner, Ontario, have formed a partnership to develop a prototype Vicinity-RFID card in collaboration with a card provider to be identified, using this on/off switch technology and conforming to GS1 standards. A timeline for this prototype will be determined by early November 2008.”
My question to the parliamentary assistant—and he may need assistance from staff on this—is whether or not the company referred to here by GS1, namely Paratech out of the UK, has already been contacted by the ministry and if the ministry has an opinion in terms of the technology. And second, given that the privacy commissioner and Paratech and GS1 report that they’ve formed a partnership, is the ministry also involved in that partnership, and are they prepared to work proactively with the partnership to determine the feasibility of this technology?
Mr. Steve Burnett: Subsequent to the hearing of the standing committee last week, we followed up with our vendor. We did investigate the Peratech solution. They are aware of Peratech. They don’t, at this stage, see a commercially viable application of that technology. Their vice-president of global technologies—we were in contact with him—doesn’t see that as a viable solution yet. That’s consistent with GS1’s position, which is that they will develop a prototype and come up with a timeline for a prototype in November. We’re certainly interested in working with our vendor, G&D. We wouldn’t deal directly with Peratech, we would go through our vendor as part of our contract. We actually think it’s a great idea, and if we can make this work, we will be looking for ways to make it happen. But at this point, we can’t commit contractually in legislation to doing this until we see something viable.
Mr. Steve Burnett: We would be careful in directing our vendor in R&D development. We would specify requirements that we look for technologies that will enhance the privacy of the enhanced driver’s licence. We would be cautious about directing a commercial venture in R&D toward a specific end without knowing about the commercial application of that. But we certainly will work—and they’re aware of the work—and will certainly have the requirement that we will enhance the privacy profile, if you will, of the RFID.
Mr. Frank Klees: I understand what you can’t do, but what you also don’t want to have happen is that if in fact there is a technology that would serve our purposes, because a vendor may have another focus, you wouldn’t want to miss out on an opportunity to have that technology serve us well. I’m looking for that assurance, and I’m sure that your relationship with your vendor is such that if your request is made in a non-directive sense, but by way of a request in the public interest, they would certainly be willing to work co-operatively with this group.
Mr. Steve Burnett: I wouldn’t see that being a particular challenge. The main concern we had was the implementation timeline and any expectation that we would implement any new technology by April, which is our timeline. But certainly, as we look at the evolution of the enhanced driver’s licence, that will certainly be part of it, absolutely.
Mr. Steve Burnett: There are two data fields that we’re using on the RFID. There’s a tag identification number, which is essentially its serial number, and then there’s a product identification number, which is essentially the unique identifier for that card linking it with that serial number.
Mr. Bill Mauro: So if I had one of these cards and you illegally scanned me, you would have a serial number that did not identify that number with me by the name Bill Mauro. It would not identify me as to where I lived or anything. You would simply have a serial number on a card.
Mr. Bill Mauro: So while the on/off technology might be intriguing and interesting going forward, currently the information that someone could gather by illegally scanning that card is a serial number.
“‘Government of the United States’ includes the government of any state of the United States and any agency, board, commission or official of the government of the United States or of any state of the United States;
“Accountability requires that when personal information is disclosed to others, the public should have the assurance that appropriate agreements will be put in place to protect their privacy and security.
“Under Bill 85, the ministry will have direct responsibility for ensuring the privacy and security of the personal information collected, used and disclosed for the photo card programs.... the ministry should be required by Bill 85 to seek equivalent privacy protection through contractual or other means when disclosing or transferring personal information to third parties. This principle is reflected in section 21, 42 and 65.1 of FIPPA” and in other statutes “but not in Bill 85.”
Ontarians may only have protection and security of their personal information by means of disclosure agreements as noted in the amendments, and this is recorded on page 11 of the Information and Privacy Commissioner’s report.
Mr. Michael A. Brown: Again, there is no intention to disclose personal information to governments outside of Canada. With the exception of disclosures contemplated to the Canada Border Service Agency or Citizenship and Immigration Canada, the disclosures by the minister referred to in section 11 do not lend themselves to agreements dealing with information being disclosed.
For example, disclosures to verify the authenticity of a document or the accuracy of information do not involve significant disclosures of personal information to the recipient organization. With respect to disclosures to the CBSA, the Information and Privacy Commissioner noted before the committee that the ministry is intending to enter into a memorandum of understanding with that organization, for the personal information collected by CBSA and CIC is protected under the federal Privacy Act. By contrast, the provisions in FIPPA referred to in the IPC’s submission to the committee concerned disclosures of highly sensitive personal health information to auditors or potential successor health information custodians—entities that would not necessarily be expected to have a significant experience in the management of personal information under the statutory framework. So we will not be supporting this amendment.
“11.2(1) Despite subsection 11(2), the minister may only disclose information to a public body or related government so the information may be used for a purpose set out in subsection 11(4) if the public body or related government first enters into an agreement with the minister to keep the information confidential and secure and to retain the information no longer than is necessary for the purpose set out in subsection 11(4).
“(5) If the minister enters into an agreement to share information with the Canada Border Services Agency or the Department of Citizenship and Immigration, the minister shall ensure that the agreement restricts the information subsequently shared by Canadian authorities with United States border authorities to no more than that which is required information taken from a passport.
Again, this gets at the very specific recommendation of the Information and Privacy Commissioner that, if we’re going to adequately protect people’s information, information should only be disclosed to other government bodies, subject to carefully written agreements.
Mr. Michael A. Brown: With the exception of the disclosures contemplated to the Canada Border Services Agency and the Department of Citizenship and Immigration, the disclosures by the ministry you refer to in section 11 do not lend themselves to agreements dealing with the information being disclosed. For example, disclosures to verify the authenticity of a document or the accuracy of the information do not involve significant disclosures of personal information to the recipient organizations. Further, the wide range of receiving organizations involved would make the agreement requirement unduly cumbersome for the ministry to administer.
Further, personal information collected by CBSA and CIC is protected under the federal privacy act. By contrast, the provisions in FIPPA referred to in the IPC’s submission to the committee concerned disclosures of highly sensitive personal health information to auditors or potential successor health information custodians, entities that would not necessarily be expected to have significant expertise in the management of personal information under a statutory framework.
Data disclosure agreements between the government of Canada and the government of the United States are detailed in a memorandum of understating executed by these two parties. Agreements between the province and the government of Canada are made in the context of that agreement between the government of Canada and the government of the United States.
Our background on this is that the amendment ensures that the crown in right of Ontario is not immune from liability when Ontarians become victims of government negligence in the handling of their personal information under the various photo card programs. This is referred to in the Information and Privacy Commissioner’s report on page 13.
Mr. Michael A. Brown: I appreciate the amendment. We will not be supporting it, but if you look at our amendment 35, we intend to achieve the same result. So we appreciate the amendment. We find that a little bit more extensive—it’s just a difference in wording, but it essentially achieves the same result. So thank you for the amendment. We won’t be supporting this particular one.
“(2) No action or other proceeding for damages shall be instituted against the minister, the registrar of motor vehicles, a public servant, a delegate or agent of the minister or any other person for doing anything in good faith that is authorized or required to be done under this act arising from the use of a photo card or of any photograph or information on a photo card or in a record kept by the ministry under this act.”
Our background on this is, as set out in the Information and Privacy Commissioner’s report on page 13, this section should be amended to include a standard of good faith for the immunity to be effective as contained in subsection 21(1).
Mr. Michael A. Brown: We do not believe this amendment to be appropriate because the use of the card or a record provided by the minister under the act, once it is issued, is beyond the control of the crown. The good-faith requirement with respect to the performance of a power or duty under the act by a public servant, the registrar or the minister with respect to the protection from liability is already dealt with in subsection 21(1), so it is unnecessary to include it here. We will not be supporting this amendment.
“(3) Despite subsections 5(2) and (4) of the Proceedings Against the Crown Act, subsections (1) and (2) do not relieve the crown of liability in respect of a tort committed by a person mentioned in subsection (1) or (2) to which it would otherwise be subject.”
Our opinion on this is that, as set out on page 13 of the Information and Privacy Commissioner’s report, the immunity to the government is drafted too broadly in Bill 85 and does not provide appropriate protection for Ontarians who become the victims of government negligence in the handling of their personal information under the various photo card programs. This amendment would remedy that.
Mr. Michael A. Brown: The government motion achieves the same result. There’s no need to proceed with this motion. The government motion made more robust amendments to section 21, which include permitting recovery against the crown.
“21(1) No action or other proceeding for damages shall be instituted against the minister, the registrar of motor vehicles, a public servant, a delegate or agent of the minister or any other person authorized or required to do anything under this act for anything done in good faith in the performance or intended performance of a duty under this act or in the exercise or intended exercise of a power under this act or any neglect or default in the performance or exercise in good faith of such duty or power.
“(2) No action or other proceeding for damages shall be instituted against the crown in right of Ontario, the minister, the registrar of motor vehicles, a public servant, a delegate or agent of the minister or any other person authorized or required to do anything under this act arising from,
“(3) Despite subsections 5(2) and (4) of the Proceedings Against the Crown Act, subsection (1) does not relieve the crown of liability in respect of a tort committed by a person mentioned in subsection (1) to which it would otherwise be subject.”
Mr. Michael A. Brown: This amendment to subsection (1) and the inclusion of subsection (3) allow an innocent person to seek from the crown recovery of his or her damages suffered if they occur as a result of the good faith performance of a power or duty of a public servant, the minister or registrar under this act.
The amendment to subsection (2) clarifies the types of uses by persons of the photo card information in a record provided by the crown for which it is protected. The crown is protected from liability in this subsection, because the use of the card or a record provided by the minister under this act, once it is issued, is beyond the control of the crown.
The good faith requirement with respect to the performance of a power or duty under the act by a public servant, the registrar or the minister with respect to protection from liability is already dealt with in subsection (1), so it is unnecessary to include it in this section. As well, applying a good faith requirement with respect to uses of this card that are beyond the control of the crown isn’t appropriate.
Mr. Frank Klees: By way of information, could the parliamentary assistant or staff provide us with information as to what contractual consequences are there if in fact the vendor has responsibility for implementing this card, if in fact the vendor is found to be negligent in terms of the handling of this information?
If I may, the rationale for this is, the committee heard from Andrew Clement, a professor at the University of Toronto’s faculty of information. This was his specific recommendation: that it would require that an independent third party examine the economic cost benefits of the photo card before we proceed with what will likely be a multi-million dollar venture.
Mr. Michael A. Brown: This is totally consistent with the current practice. Legislation, however, would be contrary to agreement in internal trade, which prohibits geographic restrictions when procuring services. It would exclude vendors from future rounds of procurement. I would, however, note that the MTO is now in the second year of a 10-year contract with a Markham-based vendor. The contract will obviously then expire in 2017.
“(a) the minister has published a notice of the proposed regulation in the Ontario Gazette and given notice of the proposed regulation by all other means that the minister considers appropriate for the purpose of providing notice to the persons who may be affected by the proposed regulation;
“(d) the minister has considered whatever comments and submissions that members of the public have made on the proposed regulation in accordance with clause (2)(b) or (c) and has reported to the Lieutenant Governor in Council on what, if any, changes to the proposed regulation the minister considers appropriate.
“(b) a statement of the time period during which members of the public may submit written comments on the proposed regulation to the minister and the manner in which and the address to which the comments must be submitted;
“(c) a description of whatever other rights, in addition to the right described in clause (b), that members of the public have to make submissions on the proposed regulation and the manner in which and the time period during which those rights must be exercised;
“(3) The time period mentioned in clauses (2)(b) and (c) shall be at least 60 days after the minister gives the notice mentioned in clause (1)(a) unless the minister shortens the time period in accordance with subsection (4).
“(5) Upon receiving the minister’s report mentioned in clause (1)(d), the Lieutenant Governor in Council, without further notice under subsection (1), may make the proposed regulation with the changes that the Lieutenant Governor in Council considers appropriate, whether or not those changes are mentioned in the minister’s report.
“(6) The minister may decide that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 22 if, in the minister’s opinion, the urgency of the situation requires it.
“(10) If the minister decides that subsections (1) to (5) should not apply to the power of the Lieutenant Governor in Council to make a regulation under section 22 because the minister is of the opinion that the urgency of the situation requires it, the regulation shall,
This is from recommendation 10 of the Information and Privacy Commissioner’s report, on page 14, and amends Bill 85 to provide for public consultation before regulations are enacted: “Openness and transparency are key to government accountability, especially when the government serves as custodian of a significant amount of personal information on its citizens. Bill 85 leaves crucial matters affecting the privacy and security of Ontarians either to the discretion of government officials or to be later prescribed by regulation, without any requirement for public notice or comment”; for example, the information to be contained on this photo card, the security features on a photo card that may allow it to be used for travel, and the contents of information-sharing agreements. This is indicated in the Information and Privacy Commissioner’s report on page 13, in the last paragraph.
Madam Chair, “for transparency and accountability to be achieved, the regulation-making powers in Bill 85 must allow for public consultation before a regulation is enacted.” This amendment outlines a process for enacting that public consultation. Thank you.
Mr. Michael A. Brown: The ministry generally consults, during the passing of regulations, and the ministry will commit to using the regulatory registry and post a general overview of the proposed photo card regulations on the Internet site, and will receive public comments.
In seriousness, what is proposed under this amendment is, I believe, what every citizen of this province would expect that the process involves in any event, and it’s simply a matter of ensuring that the regulations that are implemented under this bill are properly vetted and that there is transparency. For that reason, I fail to understand why the government would turn this down.
Mr. Frank Klees: Not one PC amendment and only one NDP amendment has been accepted by the government, and we are starting to feel rather redundant in this process. Having said that, I’d like to give the parliamentary assistant one last opportunity to show leadership and give some direction to his colleagues to accept this amendment.
Mr. Michael A. Brown: Thank you. I appreciate the opportunity. I will reiterate that the government is serious about having a conversation about these regulations and will consult widely. We will post them on the Internet site; people will be able to let the government and the ministry know of their feelings about the regulations as they’re put forward. We believe we have an open and transparent system to make sure that the public is able to comment on the regulatory process.
The amendment takes into account the concerns raised during public hearings about the disclosure of biometric information. This amendment would prevent sharing the biometric template that the photo comparison technology produces. I want to thank all members for making this point in a number of amendments earlier on.
Mr. Howard Hampton: We’d be interested in having the Information and Privacy Commissioner appear before the committee to comment on whether this amendment has gone far enough and whether, for example, the use of the term “measurement” will impose tough enough restrictions on the sharing of biometric information.
Mr. Michael A. Brown: Well, we’re in clause-by-clause at the moment. We are here to make decisions, and we intend to go forward at this point. I should point out, though, that when the Information and Privacy Commissioner was here before us, one of the things she noted was that she had had an ongoing dialogue with the ministry about these issues, as we went forward, and intends to continue to have what she described—I’m not quoting her but I think the gist of this is correct—as a productive and interesting exchange with the ministry as we try to sort out these very difficult privacy issues. We in the ministry can commit to continue doing that.
Mr. Frank Klees: The parliamentary assistant correctly states that the privacy commissioner has had ongoing dialogue with the ministry, and the minister stated that he would listen to the privacy commissioner. What’s very clear, however, is that that’s all it was, a conversation with the ministry, because almost every amendment that has been put forward, either by the PC caucus or the NDP caucus, has come directly from the privacy commissioner, addressing her concerns. We’re down to the wire here. The record will show that none of these amendments has been accepted. So our concern is that while on the one hand there is this conversation going on, no one is listening, or the government isn’t listening. So to Mr. Hampton’s request I would say this: It’s predictable, obviously, that the government won’t have the privacy commissioner appear before this committee, but what I would ask is that at the very least we ask that the privacy commissioner be asked to provide her opinion in writing, and that that opinion be distributed to members of this committee at the earliest possible time so that we at least have that information in time for third reading debate in the Legislature.
The Chair (Mrs. Linda Jeffrey): Mr. Klees, we have to deal with the motion that’s before us on the floor right now. If at some point you want to bring that forward after we’ve dealt with this motion, then I can consider it, but right now I have to deal with what’s on the floor.
Mr. Frank Klees: I’d like to make my request by way of a motion to ask that the privacy commissioner be asked to submit her opinion in writing as to whether or not the government’s amendment addressed her concern.
The Chair (Mrs. Linda Jeffrey): No, I made that very clear. We were only voting on the motion that was on the floor and that I would consider Mr. Klees’s motion following that. So right now you’re listening to Mr. Klees’s motion to ask the commissioner to come back, I believe. Could you repeat that?
Mr. Frank Klees: I would ask that the privacy commissioner be asked to provide a written opinion as to whether or not the government’s amendment meets her requirements, as stated by the parliamentary assistant.
Mr. Frank Klees: Parliamentary Assistant, government members turned down Mr. Hampton’s request that the privacy commissioner be brought back to provide her opinion as to whether the government’s amendment that deals with the issue before us adequately addresses her concerns.
The Chair (Mrs. Linda Jeffrey): No, that wasn’t a motion. It was a government motion on the floor. Mr. Klees asked for something else. I told him we couldn’t deal with that issue. We dealt with the government motion which was on the floor, which was defeated.
The Chair (Mrs. Linda Jeffrey): Mr. Brown, before you begin, I have to deal with what’s on the floor first. I had the problem before. I need to deal with Mr. Klees’s motion first and when his motion is finished, if you want to come back for unanimous consent, you can.
The Chair (Mrs. Linda Jeffrey): I guess we’ll have to get to the end of the section, and I presume that the commissioner could comment on the bill as a whole if she felt there was a need. I think we’re splitting hairs, at this point.
Mr. Frank Klees: Could I perhaps ask: If we give unanimous consent to this, is the government willing to give us unanimous consent to revisit a couple of our amendments that we think are ultimately important? I see the parliamentary assistant saying no.
The Chair (Mrs. Linda Jeffrey): Okay, thank you. We have unanimous consent to reopen the decision on 43R. The motion before us is 43R. All those in favour of that motion? All those opposed? That’s carried.
“Combined with the wide definition of ‘related government’ and ‘public body’ and the lack of definitions for the terms ‘information’ and ‘biometric information,’ Bill 85”—as currently written—“allows for the possibility that all personal information, including an individual’s biometric, driving history, citizenship data, etc., could be shared without restriction.... Individuals do not reasonably expect that when applying for a library card, the provincial government will disclose their biometric, citizenship information, or other information to the library.” Paragraph four, page 21, of the privacy commissioner’s report.
“Another challenge to the principle that purposes should be limited and relevant to the circumstances is the proposed amendments in to the Highway Traffic Act regarding driver’s licences and vehicle permits at s. 44 of Bill 85. It is clear that the ministry wishes to implement a border crossing document and that it is attempting to obtain authority to do so in Bill 85. However, the bill contains virtually identical provisions to amend the Highway Traffic Act and will allow the same broad collection and disclosure of personal information regarding driver’s licences and vehicle permits. Such broad collection and disclosure powers are for a completely different purpose not related to the original purposes described above.” This is from paragraph five, page 21 of that report.
Mr. Michael A. Brown: I’d first point out to the member that this is a voluntary card, and the disclosure under this provision is limited to purposes such as verifying the accuracy of information, detecting false statements, authenticating documents and preventing improper use of driver’s licences or vehicle permits, and only where a driver’s licence or a vehicle permit has been presented to the public body or related government in order to obtain a benefit or a service. This provision allows the minister to support anti-fraud measures of other governmental entities and should be kept in the bill.
“(d) if the disclosure is made to an officer, employee, consultant or agent of the institution who needs the record in the performance of their duties and if the disclosure is necessary and proper in the discharge of the institution’s functions;
“(g) if disclosure is to an institution or a law enforcement agency in Canada to aid an investigation undertaken with a view to a law enforcement proceeding or from which a law enforcement proceeding is likely to result;
As set out on page 12 the Information and Privacy Commissioner’s Report under “Deemed compliance provisions,” this amendment applies section 32 of the Municipal Freedom of Information and Protection of Privacy Act to Bill 85, to enhance the protection of the privacy rights of individuals and to allow them to exercise that control over the disclosure of their personal information by government institutions.
The Municipal Freedom of Information and Protection of Privacy Act states “that an institution shall not disclose personal information except for the purpose of complying with an act of the Legislature or an act of Parliament or a treaty, agreement or arrangement thereunder. Bill 85 exempts disclosures by and to the ministry from this requirement. In doing so, the ministry will be able to disclose information without the safeguard of an agreement.”
This is “inconsistent with section 43 of FIPPA and section 33 of MFIPPA, which state that personal information can only be used or disclosed for a consistent purpose if the individual might reasonably have expected such a use or disclosure. Canadian citizens in Ontario, who provide their personal information to the ministry for the purposes of expediting border crossing cannot reasonably expect all the unspecified uses and disclosures that may occur pursuant to Bill 85.”
Mr. Michael A. Brown: Subsection 205.0.1(5) is not unique in Ontario legislation. Similar provisions exist in a number of other statutes: the Regulatory Modernization Act, Christopher’s Law, the Ministry of Correctional Services Act, the Occupational Health and Safety Act, the Police Services Act, the Vital Statistics Act, the Land Titles Act, the Employment Standards Act, the Financial Administration Act. The purpose of this subsection is to protect the minister’s disclosure of personal information under 205.0.1(2) from being the subject of a privacy complaint made to the Information and Privacy Commissioner.
Paragraph 42(1)(e) of the Freedom of Information and Protection of Privacy Act reads as follows: “An institution shall not disclose personal information in its custody or under its control except ... for the purpose of complying with an act of the Legislature or an act of Parliament or a treaty, agreement or arrangement thereunder.”
The minister is given permissive authority under 205.0.1(2) to disclose information, including personal information. The Information and Privacy Commissioner has held that a permissive authority such as that provided under subsection 205.0.1(2) does not satisfy the requirements of subsection 42(1)(e) of FIPPA, under which disclosure can only be made where the institution disclosing the information is required by the relevant-to-disclose personal information.
It is also possible and likely that the minister’s disclosure under this section will fall under the FIPPA disclosure authority such as FIPPA’s 42(1)(c)—disclosure for the purpose for which information was collected for a consistent purpose—but this may not always be the case. So it is recommended that this subsection remain as is.
Bill 85 does not limit the use and disclosure of personal information to the purpose for which the information was collected. It allows any public body to decide subjectively what information may assist the minister and disclose it to him or her. It also allows the ministry to disclose to any public body or related government any information the ministry considers appropriate and subjectively believes necessary to assist them.
Mr. Michael A. Brown: The collection and disclosure is already limited to the purposes set out under subsection 205.0.1(4). It also includes the pre-existing collection and disclosure authority example as provided by the Freedom of Information and Protection of Privacy Act preserved by subsection 205.0.1(6). The purposes for which information can be used would track the purposes for which it can be collected and disclosed. Therefore, we will not be supporting this amendment.
“(5.1) Any collection by a public body of personal information, as defined in the Freedom of Information and Protection of Privacy Act and the Municipal Freedom of Information and Protection of Privacy Act, disclosed to the public body under this section is exempt from the application of subsection 39(2) of the Freedom of Information and Protection of Privacy Act and subsection 29(2) of the Municipal Freedom of Information and Protection of Privacy Act.”
This, of course, is just a technical amendment to deal with the fact that provincial privacy legislation requires that a notice of collection be given, even in the circumstances where personal information is collected indirectly by a public body in question. Public bodies to which the Freedom of Information and Protection of Privacy Act or the Municipal Freedom of Information and Protection and Privacy Act apply and that collect personal information under this provision could be vulnerable to privacy complaints if they do not give notice of collection, so it is recommended they be exempt from this notice requirement.
“(6.1) The use and disclosure of personal information by the minister and by public bodies and related governments under this section shall be limited to what is objectively necessary to establish a person’s eligibility for a driver’s licence or vehicle permit.”
As set out on page 26 of the privacy commissioner’s report, 3.4.2, this pertains to Bill 85’s complementary amendment of part XIV of the Highway Traffic Act to permit a wide variety of collections and disclosure of information by the ministry to and from a related government and public body, which is very widely defined and allows for disclosure to unspecified persons and entities. We’ve repeated this concern over the course of this day. We would ask one more time if the government would agree to consider limiting this very broad authority of Bill 85. That broad authority, together with the deeming provision that we continue to hear, could allow disclosures to entities that were not intended. This is simply for the protection of Ontario citizens and their privacy.
Mr. Michael A. Brown: The bill already restricts the minister’s disclosure authority to what the minister considers to be necessary for the listed purposes, and that of public bodies is limited to that which the public body believes would assist the minister for these purposes. Accordingly, the disclosure authority in this section is limited in the sense that it is subject to the standard of reasonableness, and what is reasonable would be determined within the framework of the purposes set out in subsection 205.0.1(4) and the specific facts of the particular situation. Further, limiting the use and disclosure to the purpose of establishing eligibility for a driver’s licence or vehicle permit is more restrictive than what is provided under the Freedom of Information and Protection of Privacy Act, section 42. Public bodies should not be made to guess whether their compliance with the duty imposed by the act would cause them subsequent difficulty if a privacy complaint is made in respect of their disclosure to the minister. Therefore, we will not be supporting the member’s amendment.
Mr. Frank Klees: Madam Chair, I have to believe that the reason the parliamentary assistant is resisting this amendment is because he’s still struggling with the definition of “objectively necessary.” Perhaps as a final attempt here, I would ask if ministry staff counsel, specifically who is familiar with these legal terms, could provide us with his definition of “objectively necessary”: first of all, whether he is familiar with the term, and if so, what in the vernacular that term means.
Mr. Todd Milton: Todd Milton, Ministry of Transportation counsel. My understanding I think would be that it’s what was referred to earlier, the reasonable person test as to what is objectively necessary. If a third party were to be adjudicating it, they would try to determine it on that basis. That’s my understanding.
Mr. Frank Klees: So could you be more specific, for the benefit especially of Mr. Brown? “Objectively necessary” as opposed to “subjectively necessary” in the context that the privacy commissioner uses those terms—what would differentiate something that is objectively necessary from something being subjectively necessary?
Mr. Todd Milton: Well, in the wording here, I think that the minister has discretion, but I think it’s a structured discretion as to what is necessary for those purposes. That’s why we think that it would be subject to a reasonableness standard. I’m talking about the reasonableness of the minister’s discretion, not the reasonable person standard that was referred to earlier. We view it as a structured discretion for the minister, so we would think that there are limitations on that discretion.
Mr. Todd Milton: As I say, in the context of a dispute over it, if someone were to be adjudicating the dispute, I think that the person attempting to settle the dispute would basically try to arrive at what most people would think would be objectively necessary under the circumstances.
The Chair (Mrs. Linda Jeffrey): I haven’t seen any signal that anybody else wants to add any more questions or comments on this motion. Seeing none, all those in favour of the motion? All those opposed? That’s lost.
Mr. Frank Klees: Thank you. I would very much appreciate if we could, along with the follow-up to the privacy commissioner, have every member of the committee provided with the following information: the number—I’m just interested in the number—of government amendments that were put forward and were voted on and accepted or rejected; the number of official opposition amendments that were proposed, voted on and accepted; and the number of amendments that were proposed by the NDP that were voted on and accepted.
Mr. Frank Klees: Actually, it isn’t. That’s why I’m asking. I have made that request in the past. It has not been made available. So, if you like, I’m happy to put it forward as a motion, and we’ll see what happens. It’s straightforward information. So consider it a motion.
The Chair (Mrs. Linda Jeffrey): A motion has been put on the floor that some additional information be provided to all members, along with the letter to the commissioner. All those in favour? That’s carried. It looks like it was unanimous.
Can I just put people on notice that I’m going to be calling some members about the subcommittee meeting. Bill 99 is the next issue that has been put forward, the Lake Simcoe Protection Act. So I’ll be in touch with subcommittee members to have a meeting.
Mr. Steve Burnett: Steve Burnett, Ministry of Transportation. Just in summary, three high-level provisions: one is that we have a $1-million letter of credit that we can immediately draw on in the instance of a privacy breach to cover any liability; the liability cap that we have in place does not apply to breaches with respect to personal information, so our vendors are responsible for the full extent of the liability with respect to breach; and we also have termination provisions within 30 days for breaches related to privacy. We also have some structural things with respect to agency agreements for protection of health information over and above driver licence information.