Information & Ethics committee  As I mentioned in my opening remarks, there's quite an array. You have the U.K., where the fines go up to 250,000 pounds. You have France, where it goes to 300,000 euros.

Information & Ethics committee  The civil remedies are there. In fact, Maître Gratton, Richard Dickson, Gary Dickson and I were just talking about how class actions are proliferating. That is there, that is used, and that is big money at stake. We've seen Casino Rama. There's been a big settlement. We've seen some that are in the works right now with big numbers attached to them.

Information & Ethics committee  In fact, earlier on, Gary Dickson mentioned the work we did together on guidelines that are applicable to the Internet posting of administrative tribunals, which goes exactly to your point. We wanted the privacy of the parties to be protected, but we also wanted judicial transparency to survive for the reason you say, because there is a public interest in getting the information.

Information & Ethics committee  First of all, just to clarify, on fines PIPEDA only applies in the context of commercial activities, so there is always a revenue attached to the personal information. Secondly, using a percentage, in my view, would be precisely the proportionate and, therefore, fair manner to impose equivalent penalties to all organizations.

Information & Ethics committee  There are no civil remedies right now.

Information & Ethics committee  Well, you go to the OPC, and then you can go to court.

Information & Ethics committee  Yes.

Information & Ethics committee  As you've seen, I've framed it very tightly because the charter challenge could be about the curtailment of freedom of expression in an excessive manner, which would therefore violate the charter. I believe the right to erasure—and I understand PIAC to be of the same view—can be framed in such a manner that it would protect privacy without infringing upon freedom of expression, as, in fact, in my view, the Protecting Canadians from Online Crime Act does as well.

Information & Ethics committee  Nova Scotia preceded the federal government in regard to Rehtaeh Parsons's suicide, and we followed. The Nova Scotia legislation goes further and did indeed run into a constitutional challenge. The other legislation I mentioned is that in the four common law provinces, it is an actionable tort to violate privacy.

Information & Ethics committee  That's only in Europe. A person applies, say, to Google because Google was the one platform that was protecting it anyway. The European court went quite far out on a limb. You could see that they wanted to have the right to be forgotten recognized. Some could say that they stretched the law a little for that.

Information & Ethics committee  Perhaps I can give you a bit of a history of how we've evolved at the OPC. The first investigation that dealt with OBA, online behavioural advertising, was of Facebook in 2009, when the OPC said that since you get Facebook for free, you should expect advertising because that's the only way they can live.

Information & Ethics committee  Actually, if we follow the European model, it is annual revenues. The Chair was speaking about divergent views, but I think there's some congruence here between us. Ms. Gratton said that we have to make sure that we take into account the circumstances of the organization. Gary Dickson spoke of SMEs and how they are more sensitive to fines.

Information & Ethics committee  Absolutely. One investigation that pops to mind was of a new start-up selling widgets on the net. They were clearly very excited about their new business and didn't think about privacy. What they were focused on was being a nice start-up on the internet, until one of their customers said, I've been defrauded of so many thousands of dollars.

Information & Ethics committee  The only way we can protect them is to work now at making sure that by the time our adequacy status comes under review in Europe, we have shored up our privacy protections to that level. It doesn't mean that they're exactly the same, but that the Europeans will find them adequate.

Information & Ethics committee  Unfortunately, it will take legislative measures. I say “unfortunately”, because legislative measures require the most effort. As Ms. Gratton mentioned, the new European regulation recognizes the right to erasure, whereas the Canadian act makes no mention of it. The new European regulation also recognizes data portability, in other words, a consumer will have the right to request that their personal information held by an organization be transferred if that person wishes to work for another organization or become the client or consumer of another company.