Information & Ethics committee  Actually, the provincial legislation creates a comprehensive standard for protecting privacy across private and public sectors in those provinces. It really strengthens privacy protection in a way that either the federal law on its own or individual provincial laws could not do.

Information & Ethics committee  PIPEDA would not protect all elements of personal information. There are elements that are outside of the federal government's constitutional authority under trade and commerce—

Information & Ethics committee  They're national?

Information & Ethics committee  We have a list. We can make that available to the clerk.

Information & Ethics committee  That's correct. This was more the personal element to that. On one side of this argument was the doctor making the prescription, and his name was there. As I understand it, the key issue was whether that was personal information and should be protected or whether it was a work product, because this is in his capacity as a physician.

Information & Ethics committee  Yes, there are.

Information & Ethics committee  We work very closely with the Office of the Privacy Commissioner in a number of areas, including the Governor in Council's responsibilities that were just mentioned. If you look at the policies for considering laws as substantially similar, the Office of the Privacy Commissioner has a specific role in terms of her point of view on those issues, as well as on investigative bodies.

Information & Ethics committee  Yes, we have. As we mentioned earlier, there are really two points of view on the question of order-making powers or the Privacy Commissioner as a quasi-judicial body. By the way, I'm sure you'll hear from the Privacy Commissioner herself on this issue. I think that should be the first point of contact about whether the powers are—

Information & Ethics committee  The organization that provided your personal information—

Information & Ethics committee  The way PIPEDA works now under an accountability arrangement, as they call it, is that the Privacy Commissioner will investigate that situation from the point of view of the Canadian organization that first allowed your information to leave the country. So what—

Information & Ethics committee  Well, if you're talking about Manitoba Data Services, that's a little more difficult as an example because that's governed by a provincial privacy act. If we can take a private sector organization, though, that would have personal information that it collected from you, with your consent, for a particular purpose, the obligation on that organization, no matter how it decides to process that information and use it in the conduct of its business, which you have consented that it could do, is to protect that information in contractual form with any other organization that has access to it.

Information & Ethics committee  It's an obligation that is transferred from the Canadian organization that is following PIPEDA and the principles under PIPEDA to make sure that a third party, no matter where that third party is located, must, by contract and therefore by law, respect the same principles as are in PIPEDA.

Information & Ethics committee  I can jump in. You probably can complain right now to the Privacy Commissioner if you have reason to believe your personal information was somehow accessed by someone without your knowledge or consent, even if it was purely accidental or an act of someone with deliberate intention to subvert an information system.

Information & Ethics committee  Not really, because the standards that we have adopted are based on the CSA Model Code and they are the same as the ones adopted by European countries. We are almost at the same level.

Information & Ethics committee  We have an agreement with the Europeans. An international standard has been set based on OECD-approved guidelines. This standard provides us with a level of privacy protection comparable to that of European countries. I'm not familiar with all of the studies that have been carried out, such as the one done by Privacy International.