Industry committee  The thing is, if political parties are encompassed within federal legislation, that would then provide a mechanism for Canadians to take whatever concerns or complaints they might have presumably to the federal Privacy Commissioner for adjudication. Again, and I can't express this strongly enough, that would substantially enhance the confidence and trust that Canadians have in having that dialogue with their parties.

Industry committee  Far be it for me, as an impartial officer of the legislature of British Columbia, to be giving you political advice about how things should proceed. What I would say in general terms is that the bill represents an advance for the privacy rights of Canadians. Is it perfect? No. I think Commissioner Dufresne has articulately expressed this view that there are improvements that need to be made, but there are advances here, and it's important to acknowledge those.

Industry committee  I guess the answer would be, “it depends”. I think you're quite right to say that, in many instances, the provinces have been ahead of the federal government. I think an order-making power is one. The federal government brought in legislation first on the privacy front, before British Columbia, but when British Columbia brought its in, it actually advanced the case and brought in order-making authority.

Industry committee  Let me start with one area where British Columbia, in my view, is behind. It is behind federally. That is on the issue of mandatory breach notification. There is no obligation on private sector companies in this province to report to my office when there is a breach that would cause a real risk of significant harm.

Industry committee  It is a very important part, and just one part of the tool box that we have as regulators. Commissioner McLeod and Commissioner Poitras have talked about our role as educators, because that's kind of where things begin. Almost all organizations that we encounter want to do the right thing, and so part of our responsibility is to ensure that they understand their legal obligations, and once understood, businesses comply.

Industry committee  Sorry, Chair, perhaps for a point of clarification, I should note that in British Columbia there is no doubt that the Personal Information Protection Act applies to B.C.'s provincial political parties. A ruling of our office held that federal political parties operating in British Columbia were also covered by the legislation.

Industry committee  First, I should say, that obviously I have to be very careful in terms of what I say about this case because it is before the courts now. I would say that the case was initiated because of complaints that we received from individuals who were seeking information. I'm just trying to recall off the top of my head; it may have been multiple political parties seeking certain information, and they didn't receive that, and so therefore they complained to our office, and that's what we were looking at.

Industry committee  My understanding right now is that the British Columbia government is reviewing the principles by which it will deal with issues of artificial intelligence. I should say that, on the regulation side of things, I have, along with the ombudsperson in British Columbia—as you note—set out some guidance that we think should apply.

Industry committee  That's not terminology we have used in British Columbia. Any time you're looking at a system that attempts to, first of all, gather large amounts of data used to predict or profile people and involved in making decisions about people.... I'm not sure how you scale that. To me, anything involved in using data to make those kinds of decisions about people impacts them.

Industry committee  On the point of the public sector being covered, in British Columbia, the public sector is covered. That's everything from the Crown corporations, which you talked about, to school boards, municipalities—all the functions, basically, of the public sector. The British Columbia government recently made changes to our Freedom of Information and Protection of Privacy Act that require public bodies now to produce privacy management programs, the thing that we just talked about in the private sector.

Industry committee  Maybe I could start on that one, if I may. It happens that British Columbia.... It is not the only jurisdiction—because there's some application of the law in Quebec, which Ms. Poitras can talk about—but essentially, the full application of our Personal Information Protection Act applies to political parties, and we've utilized that aspect of the law to review political parties in this province and to collect, use and disclose information about voters, which we think is really important.

Industry committee  I think you're quite right. In some instances, it would be seen as a licence to continue doing what companies are doing. I think the most effective remedy that the government can provide in legislation for its regulator is order-making power. The three of us here today have the power to say to a company or an organization, "Stop doing what you're doing", which is a far more effective remedy in some instances where that action or conduct on the part of an organization may be harming a Quebecer, a British Columbian, Albertans or Canadians.

Industry committee  Yes, I would just second what Commissioner Poitras has said. In British Columbia, we have a similar provision that requires organizations to develop and follow policies and practices that ensure they are consistent with our legal framework. We describe that requirement and obligation as being scalable.

Industry committee  Thank you, Chair and members of the committee. I'd first like to acknowledge that I'm presenting to you today from the traditional territories of the Lekwungen-speaking people of the Songhees and the Esquimalt first nations. Given my brief time this afternoon, I want to focus my comments on the practical matter of how the privacy rights of Canadians ought to be considered and, where events dictate, enforced.