Personal Health
Information Privacy Act, 2000, Bill 159, Mrs
Witmer/ Loi de 2000 sur la confidentialité des
renseignements personnels sur la santé, projet de
loi 159, Mme Witmer
Privacy Commissioner of
Canada
Mr George Radwanski
STANDING COMMITTEE ON
GENERAL GOVERNMENT
Chair /
Président
Mr Steve Gilchrist (Scarborough East / -Est PC)
Vice-Chair / Vice-Présidente
Mrs Julia Munro (York North / -Nord PC)
Mr Toby Barrett (Norfolk PC)
Mrs Marie Bountrogianni (Hamilton Mountain L)
Mr Ted Chudleigh (Halton PC)
Mr Garfield Dunlop (Simcoe North / -Nord PC)
Mr Steve Gilchrist (Scarborough East / -Est PC)
Mr Dave Levac (Brant L)
Mr Rosario Marchese (Trinity-Spadina ND)
Mrs Julia Munro (York North / -Nord PC)
Substitutions / Membres remplaçants
Ms Frances Lankin (Beaches-East York ND)
Mrs Lyn McLeod (Thunder Bay-Atikokan L)
Mr John O'Toole (Durham PC)
Mrs Sandra Pupatello (Windsor West / -Ouest L)
Mr Bob Wood (London West / -Ouest PC)
Clerk / Greffière
Ms Anne Stokes
Staff / Personnel
Ms Susan Swift, research officer, Research and Information
Services
The committee met at
1110 in committee room 1.
PERSONAL HEALTH INFORMATION PRIVACY ACT, 2000 / LOI
DE 2000 SUR LA CONFIDENTIALITÉ DES RENSEIGNEMENTS PERSONNELS
SUR LA SANTÉ
Consideration of Bill 159, An
Act respecting personal health information and related matters /
Projet de loi 159, Loi concernant les renseignements personnels
sur la santé et traitant de questions connexes.
PRIVACY COMMISSIONER OF CANADA
The Chair (Mr Steve
Gilchrist): I call the committee to order. My thanks to
all who have indulged the late starting time. Our first order of
business today is to hear from the office of the Privacy
Commissioner of Canada, Mr George Radwanski.
Mr Radwanski, if you'd like
to come up to the witness table there. Thank you for coming all
the way in from Ottawa and congratulations for planning far
enough in advance that you weren't held up.
Mr George
Radwanski: Thank you, Mr Chairman. Honourable members,
good morning. I'd like to start by expressing my appreciation for
the invitation to speak to you today. I'd like to make a
substantive statement and, following that, I'll be happy to take
your questions. I understand that notwithstanding the
vicissitudes of the weather, we have two hours, and I am entirely
at your disposal.
Privacy is an issue of
importance to all Canadians, and your invitation is, in my view,
an example of excellent co-operation across levels of government.
This legislation is a very serious matter. I regretfully find
that, in its current form, it is an assault on health privacy
rights, not a defence of them. The legislation appears designed,
in fact, to ensure that the government of Ontario and a virtually
unlimited range of other organizations and individuals could have
unrestricted access to the most private health information of
every Ontarian.
I have very serious concerns
about this and I'm grateful for the opportunity to bring these
concerns to you and to the people of Ontario in this forum. I
know that you heard yesterday from the Ontario Information and
Privacy Commissioner, Dr Cavoukian, and that she expressed many
of the same concerns I will be sharing with you today. But in
those instances where it may sound like we're covering the same
ground, I trust that you will regard that as not merely
repeating, but reinforcing a message that very much deserves
reinforcement.
I know that you will also be
hearing from representatives of many interest groups, and that
there are some who might consider privacy advocates to be just
another such group, but if that's true, then it's a very, very
large interest group. All of us, when it comes to our own lives,
are advocates for privacy. None of us wants to go through life
feeling that at any moment someone may be, either metaphorically
or even quite literally, looking over our shoulder. If we have to
weigh every action, every purchase, every statement, wondering
who might find out about it, misconstrue it, judge it or somehow
use it to our detriment, we are not truly free. That is why
privacy is a fundamental human right, recognized in the United
Nations Universal Declaration of Human Rights, and no aspect of
privacy is more fundamental than the privacy of our health
information, information about the state of our own bodies and
minds.
In the 1920s, Justice Louis
Brandeis of the United States Supreme Court defined privacy as
"the right to be let alone." But today we may think we are alone
while our privacy is being invaded from a distance by ever more
sophisticated methods of surveillance and information gathering.
So I would define privacy as the right to control access to one's
person and to information about oneself.
In an age when information
crosses oceans and continents at the click of a button, when
information-personal information-has itself become a commodity,
that right to privacy is under threat as never before.
I have said many times since
I assumed this position a few months ago, and I will say it again
today, that I believe privacy will be the defining issue of this
new decade. That's because we are at a crossroads. The choices we
make now, the paths we follow over the next few months and years
will to a very large extent define the type of society we leave
to our children.
Until relatively recently,
privacy was protected pretty much by default. As long as
information about us was in paper records scattered over many
locations, someone would have to go to a great deal of trouble to
compile a detailed dossier on any particular individual. But now
the move to electronic
record-keeping is eating away at the barriers of time, distance
and cost that once guarded our privacy from all but the most
determined of snoops.
We are also under almost
constant surveillance. Cameras record us at the bank machine, at
the corner store and at the casino, and biometric recognition
technologies can rob us of our anonymity. Computers record every
time we use an electronic pass card to enter or leave our
workplace, for instance, or our parking garage. The personal
information that is being collected about every one of us just as
a matter of routine is mind-boggling: debit card records, credit
card records, telephone records, the movies we rent, the books we
borrow, the Web sites we access-you name it. The surveillance is
so pervasive, the data banks so diverse and the computer networks
so efficient that individuals have no idea who has what personal
information about them, let alone what's being done with it.
This is why we now have the
federal government's new Personal Information Protection and
Electronic Documents Act, in effect since January, to give
Canadians clear privacy rights in their dealings with the private
sector, and it is why we have a federal Privacy Commissioner, who
has been given the mandate to see that the law is respected. It's
what civilized societies do: recognize certain fundamental rights
and do what they can to keep them from being abused.
So I appear before you today
as the Privacy Commissioner of Canada, an officer of Parliament
appointed to be the guardian and champion of Canadians' right to
privacy. The Privacy Commissioner of Canada does not work for or
report to the government. The Privacy Commissioner works for and
reports directly to the people of Canada through our national
Parliament. It is my responsibility as the Privacy Commissioner
of Canada to stand up for the privacy rights of all Canadians.
The right to privacy is not divisible. It cannot be respected
federally and violated provincially. It cannot be respected in
one part of the country and violated in another. The door to our
personal information is either closed or open. If it is open, it
makes little practical difference which level of government has
done the opening; our privacy is lost.
This is made very clear in
the federal Personal Information Protection and Electronic
Documents Act. In jurisdictions that do not have substantially
similar legislation in place by the beginning of 2004, the
federal act will apply to the entire commercial sector. To that
end, the Privacy Commissioner of Canada is mandated under this
act to report to Parliament on the extent to which provincial
governments have passed legislation that is substantially
similar.
I believe it is therefore
very appropriate and very necessary for me to take this earliest
possible opportunity to tell you that it is my considered opinion
that the proposed legislation you are examining would fall
fundamentally short of meeting this test. It is not substantially
similar. It is radically different in content, in spirit and in
apparent intent.
It is worth pointing out
here, I think, that the new federal privacy law does not qualify
as groundbreaking legislation. It does not set Canada apart, and
it does not impose any kind of regulation that our trading
partners are not prepared to implement or have not implemented
already. The federal act is based on a set of internationally
recognized principles of fair information practices, principles
that have been refined to suit the Canadian reality through
several years of consultation with Canadian business, consumer,
and other groups. There is no doubt that the federal legislation
represents a significant step forward for privacy in Canada, but
it really does no more than bring us up to the minimum
international standard. It recognizes the fundamental values of
allowing individuals to retain some control over their personal
information, and provides them with certain legal remedies and
protections when they feel their privacy rights have been
violated.
1120
These protections are all the
more critical when the privacy and confidentiality of our
personal medical information is involved. I can think of few
other areas of our lives where we would want greater control than
over our health information. When we talk about confidentiality,
we are talking about trust. When we take someone into our
confidence and share something personal about ourselves, we do so
in the belief that we can trust that person not to divulge the
secret to anyone else. This concept of trust is at the very heart
of the doctor-patient relationship. As far back as the days when
the Hippocratic oath was first conceived, it was understood that
there can be no effective physician-patient relationship unless
patients can feel free to be totally open and candid about their
symptoms, habits, lifestyles and concerns. Doctors cannot provide
good diagnosis and treatment without full information, and people
are not likely to surrender full information if they fear that it
might somehow be used against them. Even though we may not know
our physicians especially well on a personal level, we do know
that they have taken an oath to respect our privacy. We trust
them to respect that oath. We tell our doctors things about
ourselves we might not share even with our spouses, let alone our
employers, our bankers, casual acquaintances or the
government.
This privacy of personal
health information is not only a fundamental human right, it is
also a very important social good. We all have a stake in
ensuring that our society as a whole is as healthy as possible.
We all benefit when health care costs are kept down through early
diagnosis, treatment and prevention programs, when contagious
ailments are identified as early as possible, and when people
with conditions that might cause accidents in the workplace or on
the roads have them diagnosed and treated before harm is done.
Yet it is no exaggeration to fear that lack of confidence in the
privacy of health information could lead people to avoid seeking
treatment. If someone is feeling severely stressed and angry at
work, is that person likely to share this with their doctor and
get psychological help if there is even a chance that word might immediately get back to
his employer? Is someone more or less likely to get a recommended
blood test if all the details of the results might become known
by an endless array of unknown third parties? Those choices are
likely to be shaped by the realization that a violation of health
care privacy can be catastrophic for the individual. It could
change your entire life and deny you a whole range of
opportunities.
Suppose, for instance, that
your genetic profile were revealed to an especially interested
third party. Your entire family could be stigmatized for
generations to come. If you think this is far-fetched, I would
draw to your attention that this week the newspaper the
Independent in London reported that the Council for Responsible
Genetics in the United States has identified more than 200 cases
of genetic discrimination in employment, and these are cases
where individuals lost or were denied employment even though the
statistical risk of a debilitating condition arising was small,
where the condition would not arise until much later in life, or
where the condition could be treated. So these are not
hypothetical concerns.
As with so many other aspects
of our privacy, the security of this most personal of trust
relationships, the relationship between patients and health care
providers, is threatened. There is a powerful and steadily
increasing demand for our personal health information from any
number of secondary users. Much of the time we don't even know
who they are.
The Canadian Medical
Association has recognized the threat and has responded with its
excellent health information privacy code. But with legislation
like you are examining today, we are staring at the possibility
of a user fee that no one could have imagined. We cannot allow
our privacy to become the price of admission to our health care
system.
Patients have a right to
expect and be entirely confident that health information about
them will not be collected beyond what is necessary for their
care. They must be confident that the information will not be
used for any purpose other than their care, or disclosed for any
reason other than their care. Certainly they must be confident it
will not be put to any use that could do them harm.
In my view, the proposed
Personal Health Information Privacy Act falls desperately short
of meeting that standard in a number of critical areas. It
permits far too many people to access, collect, use and disclose
personal information, often without regard to whether it is
necessary for the care of the individual. It gives the Minister
of Health-that is to say, the government of Ontario-broad powers
to access and disclose personal health information at will
through regulation. It permits the collection, use and disclosure
of personal health information without the consent of the
individual in far too broad a range of circumstances. It denies
individuals ready and assured access to their personal health
information, as well as the means to correct it. It fails to
provide the powers of oversight needed to ensure that privacy
rights are respected, and effective means of redress when these
rights are violated.
Let me turn now to the
specifics. But I have to begin by telling you that this
legislation is so extraordinarily convoluted that one would have
to go through it clause by clause to parse all the exceptions,
loopholes and openings for regulation that make most key
provisions mean something quite different than what might at
first appear. That would probably take all day, not the limited,
though generous, time I am accorded this morning. So even though
this is meant to be a technical briefing, I'm going to have to
provide a somewhat broader and more schematic, less technically
detailed overview than might be ideal.
That being said, the first
major flaw of the bill is a lack of effective restriction on how
and by whom personal health information may be accessed,
collected, used and disclosed. This problem begins in section 2
with the almost absurdly broad listing of who qualifies as a
health information custodian, that is, a person who can lawfully
have custody or control of your health information. This list
includes obvious health care providers such as doctors,
hospitals, pharmacies and laboratories, and that's only normal.
But it also includes many others that a patient would not be
likely to see as having any legitimate business accessing such
deeply private information, including the minister, members of
district health councils and absolutely anyone else the cabinet
decides to designate by regulation.
In my view, there is
something fundamentally wrong right from the very outset with
legislation that says that the Minister of Health has exactly the
same right to hold your personal health information as your own
doctor.
Although section 12 would
appear to set some limits on the collection, use and disclosure
of personal health information, the wording of the section is
often vague, and even where limits are clear, they are often
qualified by statements such as "more than reasonably necessary"
and "to the extent reasonably possible."
The limits on collecting,
using and disclosing personal health information are made weaker
still by the fact that they would not apply to most of the people
who do these things. As long as information was being collected
or disclosed "for the purpose of providing or assisting in
providing health care to an individual," then doctors, hospitals,
pharmacists, nursing homes and laboratories, and others, would
not be bound by these limits. There is no explanation why, for
example, these custodians should be allowed to collect more
information than they need to meet a specific purpose-a standard
test under fair, accepted information practices.
1130
Cancer Care Ontario and
registries of various diseases and conditions are also exempted
from the limits on collection, use and disclosure, although it is
not at all clear why. By including these organizations, the
proposed legislation stretches the definition of "providing, or
assisting in providing, health care to an individual" beyond what
most would consider reasonable.
If Bill 159 provides few meaningful limits on the
collection of personal health information, there are even fewer
limits on disclosure. Subsection 12(9) and sections 29, 30, 31,
32 and 36 together allow for the disclosure of personal health
information in a wide range of situations with few limits. With
very few exceptions, these sections would allow anyone from a
hospital administrator to a graduate student researcher to have
access to your personal health information without your
permission, without your knowledge and without regard to whether
it is necessary for your health care.
That is a brief overview of
problems related, in general, to collection, access and
disclosure.
The second major failing of
this act is the broad discretionary power it gives the Minister
of Health to override its provisions. Section 30 allows health
care custodians to disclose personal health information to the
minister for a variety of reasons. This section also allows the
minister to disclose personal health information to anyone the
minister designates by regulation, and the next section allows
the minister to order disclosure of an individual's personal
health information.
These disclosures of personal
health information to and by the minister can take place with
virtually no accountability. There are provisions for review by
the commissioner, but the conditions for review are so narrow
that these arbitrary disclosures would rarely if ever require
justification. It is in fact a distinguishing characteristic of
this bill that it would allow the minister and the government
virtually total power over the personal health information of
everyone in Ontario.
They can decide by regulation
that anyone they want is designated to be a custodian of health
information, they can access anyone's health information by
having the minister direct disclosure to himself or herself, and
they can then disclose that information, in turn, to anyone
designated by regulation. How that can be called a privacy bill
is very frankly beyond me. In fact, to allow those in a position
of political power the latitude to invade the privacy of
individuals in this way would be extraordinary and simply
unacceptable in a free society.
A third major failing of the
proposed legislation is in the area of consent. Consent and
privacy cannot be separated. If privacy is a right to control
access to one's person and to personal information about oneself,
as I indicated earlier, then it is the very essence of privacy
that you cannot obtain, use or share my personal information
without my permission. There is no control without the right of
consent, and there is no privacy without control. It follows that
the requirement for consent must be at the heart of any good
privacy law. The collection, use and disclosure of personal
information without the individual's consent should occur only in
the most exceptional of circumstances, but this act would allow
all three in a variety of circumstances.
Section 22, for example,
offers a list of situations in which an individual's personal
health information could be collected from a third party. Several
of these would allow someone's personal information to be
collected from some other source without either knowledge or
consent.
Section 27 details numerous
ways an individual's personal health information can be used
without their consent. In one instance, the legislation would
allow someone's information to be used without consent for "a
purpose that is directly related to the use for which it was
collected." This is a variation on a phrase that has been used in
some privacy laws in the past. I say "in the past" because it was
found to be too open to interpretation and allowed a lot of
secondary uses for personal information that bore only a very
remote connection to the original use.
The principles of fair
information practices require that personal information cannot be
put to a second use, related or otherwise, without the consent of
the person from whom the information was collected. Many of the
secondary uses that would be allowed under this legislation also
involve disclosure of personal health information without
consent, another violation of the basic principles of fair
information practices.
I have already discussed the
many ways sections 29, 30, 31, 32 and 36 would allow disclosure
without either the knowledge or consent of the individual. I find
the allowance for disclosure of personal information for research
purposes to be a particular affront to the notion of consent.
Section 32 says that a custodian can disclose personal health
information to a researcher provided a research ethics review
board has approved the researcher's project. Not only is the
right of individuals to give or withhold consent denied, but
someone else would have the power to exercise that right for
them. Further, there is no assurance in the legislation that an
ethics review board would include anyone with an interest in
patients' rights, let alone patients' privacy rights.
I turn now to the fourth
major failing of this act. The fundamental principles of fair
information practices which I have said are considered the
minimum standard for the protection of privacy state that an
individual has a right to access their personal information and
to make corrections to that information if there are
inaccuracies. And yet, section 44 of the legislation says that
patients have no right of access whatsoever to several categories
of their personal health information, including personal health
information exempted from access by whatever regulations the
government chooses to pass.
Section 48 would allow a
custodian to refuse a person access to their information if it
could be expected to result in harm to the treatment or the
recovery of the individual. This is stated broadly enough that a
person with no medical training could use this provision to deny
access.
Custodians would charge a fee
to allow people to see their personal health information. Since
the fee would be set by regulation, we have no way of knowing
whether this would present yet another barrier to access.
Individuals could ask the
custodian of their personal health information to correct errors
or omissions in the record, but the custodian can refuse. If the
custodian did refuse but added a statement of disagreement to the
individual's file, that would be the end of it. The individual
would lose any right to complain to the Information and Privacy
Commissioner. This is important because obviously a finding by
the commissioner that the record is wrong would carry a lot more
weight than a simple statement of disagreement from an
individual.
This mention of the
commissioner brings me to the fifth major failing of the proposed
Personal Health Information Privacy Act. It permits neither
sufficiently effective oversight to ensure that privacy rights
will be respected, nor sufficiently strong means of redress when
these rights have been violated.
Section 68 allows individuals
to file a complaint with the Information and Privacy
Commissioner, but they must pay a fee to do it. The fee would be
set, not by the commissioner but by the regulations. This
extremely unusual provision raises the possibility that your
ability to exercise your right to privacy would be determined by
your ability to pay for the privilege.
Section 68 also provides that
the commissioner would have to conduct the review of any
complaints in accordance with procedures to be set out by the
government in regulations. I must say that, given the skill,
knowledge and experience of the commissioner's staff, I fail to
understand how or why the government would try to improve the
procedures already in place. But it's clear that telling the
commissioner how to do her job would be the very opposite of
independent, arm's-length oversight.
I am equally troubled by the
distinction between the right of review under section 68 and the
power of inquiry under section 69. The power of inquiry allows
the commissioner to investigate a complaint by demanding the
production of documents, entering premises to obtain them, and
summoning the witnesses to testify under oath if any of these are
necessary. The Privacy Commissioner of Canada has those powers
with regard to investigating any complaint or conducting any
audit. The right of review, on the other hand, comes without any
power. The Ontario commissioner can ask for information or
documents, but if the request is denied, she's out of luck and
that's the end of it.
1140
Under section 68, the
commissioner would have only the right of review with regard to
any complaints about the collection, use or disclosure of
personal health information. People would have to pay to have
their complaints considered, the commissioner's activities would
be potentially restricted by regulations, and then she wouldn't
necessarily even be able to obtain any documents or information
to assess the merits of the complaints. With all respect, that
would be a travesty of oversight.
The commissioner would have
the power of inquiry under section 69 only with regard to the
right of individuals to see their personal information and to
have a statement of disagreement attached.
There are also important gaps
in the provisions for redress. If the commissioner reviewed a
complaint and found that personal health information was being
collected in contravention of the act, section 68 enables her to
issue an order to cease such collection and to destroy the
improperly collected information. But there is no corresponding
power to stop the unlawful use or disclosure of personal health
information. The commissioner could neither issue a direct order
to end the wrongdoing nor ask a court to do so. All she could do
is make comments or recommendations.
I'm at a loss to understand
this lack of symmetry. All I can speculate is that the provisions
regarding collection are so broad that it would be hard to find
any collection unlawful, that the drafters of this bill didn't
want to take even the slightest chance of having restrictions
imposed on the use or disclosure of health information.
In the case of complaints
about the rights of individuals to access their own information,
the commissioner can order a custodian to let the person see his
or her personal health information. When the accuracy of the
information is in dispute, the commissioner can order the
custodian to attach a statement of disagreement to a person's
file. Orders made by the commissioner could be appealed to the
Divisional Court, whose decision would be final, but there is no
general right to appeal the failure of a health information
custodian to follow the requirements of the law.
Those are what I would
classify as the most major failings of the proposed legislation.
It is by no means a complete listing of my concerns.
Computer matching of personal
health information, for instance, is a big concern because of the
exceptions in section 14. Only rarely would the commissioner be
able to review and comment on any proposed matching before it
took place. In essence, computer matching is another disclosure
without consent.
I also have extremely serious
misgivings about section 76, dealing with the regulations. This
section would grant discretionary powers to the Lieutenant
Governor in Council-the cabinet, in other words-to change by
decree many, if not most, of the key provisions and definitions
in the act.
All of this brings me back to
the point I raised earlier about the extent to which this act
could meet the test of being substantially similar to the federal
privacy legislation. This is an important test. As you know, in
provinces that do not have substantially similar laws in place by
2004, the federal Personal Information Protection and Electronic
Documents Act will apply. In the health care field, that would
mean that key parts of the sector, including doctors' offices,
laboratories, some clinics and pharmacies would fall under the
jurisdiction of the federal act.
In applying this test and
reporting my findings to Parliament, I will interpret
"substantially similar" as meaning equal or superior to the
federal law in the degree and quality of privacy protection
provided. The federal law is a threshold or floor. A provincial
privacy law must be at
least as good or it is not substantially similar. I regard
substantial similarity as involving all the 10 principles in the
CSA code of privacy protection, but as having four particularly
key components: consent, access and correction rights, oversight
and redress.
In every speech and interview
I have given and in the information materials issued by my
office, I have stressed that these are the main features of the
new federal law. Except in very limited and specific
circumstances, no organization can collect, use or disclose
personal information about you without your consent, and they can
collect, use or disclose it only for the purpose for which you
gave consent.
You have the right to see the
personal information an organization has about you and to have it
corrected if it is wrong. If you believe that your privacy rights
have been violated or that the law is not being respected, you
can complain to the privacy commissioner, who has full oversight
power to investigate your complaint. If the commissioner finds
your complaint well-founded but is unable to negotiate a
satisfactory resolution, there are two forms of redress: he can
bring pressure to bear on the organization by making his findings
public and he can ask the federal court to order the organization
to comply with the law, as well as to award damages to the
complainant. You can also apply to the federal court yourself for
these remedies. The decision of the federal court can be appealed
to the Supreme Court of Canada.
I don't want to belabour the
obvious by pointing out in any great detail how far the proposed
Ontario legislation falls short of being similar to these
provisions. The federal law says that consent must be informed
and that any collection, use or disclosure of personal
information without consent must have a clear and compelling
rationale. The legislation we are discussing today recognizes
consent, but too often does not require it. This legislation not
only allows disclosure without consent, it requires custodians to
release personal information to the minister, regardless of
patient consent or knowledge.
On access and correction
rights, the federal law is clear and open. The Ontario
legislation is restrictive and not transparent. Under Bill 159,
people would be denied any access to whole categories of personal
information, including some categories yet to be defined under
the regulations. When access is granted, a fee is required to see
it. If access is denied, a fee is required to lodge a complaint.
If your information is incorrect or incomplete, the custodian can
end the matter by attaching your statement of disagreement to the
file. You have no other recourse under the legislation. The
federal law allows the individual to challenge the accuracy of
the information and to have it amended as appropriate.
With regard to oversight,
under the federal act, the Privacy Commissioner of Canada is a
fully independent ombudsman with a mandate to resolve privacy
complaints through investigation, mediation, conciliation and
recommendation. If necessary, the Privacy Commissioner of Canada
can use broad and unhindered powers of investigation. He can
seize documents, enter premises and compel testimony. He can also
initiate audits of an organization's privacy practices. Bill 159,
in contrast, does not give the Ontario commissioner the
appropriate tools to carry out investigations of complaints,
other than complaints about denial of access.
As for redress, the federal
act allows the commissioner or individual to apply for a hearing
in the federal court of Canada. Based on that hearing, the court
may order an organization to correct its information-handling
practices and make public the steps it has taken to do so. The
court can also award damages for the complainant. Decisions of
the federal court can be appealed to the Supreme Court of Canada.
Bill 159 does not provide for similarly broad access to the
courts. It makes no reference to damage awards, and if a
custodian succeeds in having an order of the commissioner
reversed by the divisional court, the decision is final; the
complainant has no right of appeal.
I am sure you will understand
that if Bill 159 were to pass in anything resembling its current
form, I would have no choice but to report to Parliament that it
is not substantially similar. The final decision would be up to
the Governor in Council, but I frankly don't see how anyone could
say that legislation that violates or ignores fundamental privacy
rights at every turn is substantially similar to the federal law
or, for that matter, to meaningful privacy law anywhere in the
world.
1150
I'm painfully aware that I've
given you a very scathing and critical view of this bill. In the
spirit of wanting to be constructive, I would very much like to
find some positive things to say about it, but in all truth,
looking for good in a privacy bill that violates fundamental
privacy rights does not strike me as a particularly constructive
exercise.
I am sure that some people
would say this bill is at least a start, that even if it were to
pass with some of its many flaws uncorrected, the government can
be counted on to do the right things over time. To me, that would
be the wrong way to approach such vitally important legislation,
even under the very best of circumstances. Laws should not be
enacted until and unless they can be expected to achieve the
purposes they purport to serve. And laws that leave the most
important powers up for grabs by regulation are among the worst
laws of all, because they defy the requirement for transparency
and accountability. But what is even more troubling is that with
regard to privacy, it is particularly difficult to assume that
this government would in fact do the right things.
This government's record on
privacy to date is, I regret to say, far from reassuring. It
wants to subject welfare recipients to the privacy invasion of
mandatory drug testing. It has twice announced the names of young
offenders in the Legislature. It gave the names, addresses and
bank balances of 50,000 of its citizens to a polling company. It
tried to use personal information to discredit an individual when
a staff member offered confidential information about a doctor's
income to a reporter. It has sold personal information for profit
in the form of names and
addresses from drivers' licences. It appears enthusiastic about
introducing smart cards with the possibility of province-wide
fingerprinting or retina scanning.
I would like to believe that
these are the results of a lack of understanding of privacy
issues or a lack of sufficient attention to them, rather than of
a deliberate willingness to attack the privacy rights of
Canadians in Ontario. I very, very much hope that is the case. If
so, these hearings on Bill 159 and the public interest I am sure
they will generate can perhaps be the occasion for a new focus by
the government on the importance of privacy rights and for a
rededication to ensuring that they are truly and fully respected
in law and in practice.
As for Bill 159, I don't
believe a law that is so fundamentally flawed in virtually every
provision can readily be fixed. The government would have to
rework nearly every section, reverse nearly every policy thrust
and rethink nearly every assumption, which would be a massive
task with so complex a piece of legislation. My suggestion would
be to scrap it and start afresh in a new spirit. I believe the
people of Ontario deserve nothing less.
Privacy is not a partisan
issue nor a political one. It is not an issue of left or right,
of federal versus provincial or of business versus government. It
is an issue that goes to the core of our shared values as
Canadians and of our fundamental rights as individuals. Privacy
is an issue that should unite us, not divide us, and the privacy
of health information, that most fundamental of fundamental
privacy rights, is not only an issue but an opportunity. It is an
opportunity for Ontario to be a model for the rest of the country
and for this government to show it is coming to understand the
importance of privacy as the defining issue of this new decade.
So in keeping with my responsibilities as a Parliament-appointed
guardian of the privacy rights of all Canadians, it is my
privilege and my duty to recommend that this flawed legislation
be withdrawn and that a fresh start be made.
Thank you very much for your
kind attention. I'd be happy to answer questions or engage in a
discussion.
The Chair:
Thank you very much. First question, Mrs McLeod.
Mrs Lyn McLeod
(Thunder Bay-Atikokan): I appreciate the fact you have
raised a number of concerns and also that there are other
specific concerns about the bill which you would raise. In the
event that your last recommendation of simply scrapping-
Mr
Radwanski: Forgive me, I'm having trouble hearing you
with the crosstalk.
Mrs McLeod:
You have given us, as you said, a broader overview of some of the
technical concerns with the bill. In the event of not acting on
your last suggestion and scrapping it and starting fresh, it
would certainly be helpful, if possible, to get the further
technical outline of concerns you have with the bill. But I want
to lead off our discussion with some more general areas-I guess
it falls under the question, "What next?"
If I can elaborate just a
little on "What next?" in two respects: first of all, if this
bill goes forward without the kinds of changes you've discussed
today, and your recommendation to Parliament is that this is not
compatible with federal legislation, my question of "What next?"
stands there. What happens then to the Ontario bill? What is the
position of the Ontario bill legally if it is not compatible with
the federal bill?
The second part of my "What
next?" question is, if the Ontario bill doesn't go forward
because of non-compatibility, then where are we in Ontario left
in terms of health privacy legislation? I raise this concern in
the context of having heard yesterday the plea from the
provincial privacy commissioner that we not be left without
health privacy legislation, and I think that's a very real
concern.
As I understand it, the
federal bill really just deals with commercial transactions. It
may deal with privacy issues related to health in commercial and
private situations, but it would still leave the issue of health
privacy, in terms of any exchange of information within the
publicly funded and administered health system, without any
rules. One of the things we heard yesterday was that there are no
rules now governing the collection, use and disclosure of
personal health information among those who hold it as public
administrators and deliverers of health care.
So my questions are: What
next in terms of compatibility? What happens to this bill if it's
not compatible? Where does Ontario go because Bill C-54 doesn't
solve the problems of health privacy protection?
Mr
Radwanski: Those are, I think, very pertinent questions
indeed.
On your first question-What
happens?-let me take you through the steps. First of all, in due
course, I am mandated to report to Parliament on the extent to
which provinces have passed legislation that is substantially
similar. In this instance, when that time came, if this law
passed, let's say, in its current form or anything similar, I
would have to report that Ontario, certainly with regard to
health care, would not be among the jurisdictions that had passed
substantially similar legislation.
The determination to exempt a
sector or the entire private sector in a province from the
federal legislation is ultimately not up to the commissioner but
up to order in council. But obviously that would be guided to
some significant extent by the report of the commissioner, and in
an instance like this, although one can never presume to speak
for the political process, I think it would be extraordinarily
difficult for anyone to say with a straight face that legislation
like this is substantially similar. So I doubt that would occur,
though I cannot presume to predict.
If we were in that situation,
I guess part of the answer to your question is that nothing
happens to the provincial law, in that it is not disallowed or
set aside or anything of that nature. It stands as a provincial
law. But what happens is that in the areas covered by the federal
law, at the point where it extends to the entire private sector
in 2004, federal law takes
precedence. So what you have is a reasonably messy situation
where there is a provincial law which says that people can or
must do certain things, but if they did them, they would be in
violation of the federal law and would be subject obviously to
the overview of the commissioner, but would also be subject to
enforcement even in the courts under the legislation. So for all
practical purposes, the standard that would have to obtain would
be the federal law. But you would have a situation that is
obviously not comfortable, that is not neat and that can best be
avoided by having laws across Canada that are substantially
similar, which is simply to say laws that genuinely respect the
privacy rights of individuals.
1200
Substantial similarity, as I
said in my earlier remarks, does not involve meeting some
extraordinary standard by any stretch of the imagination. It
simply involves showing the minimal necessary record of respect
for privacy rights. So that's the first part of my answer.
The second: I'm aware of
Commissioner Cavoukian's comments yesterday. I respectfully have
a different view. I don't see how the health privacy rights of
individuals are assisted by enacting into law privacy legislation
that violates those health privacy rights. In fact, the effect
would be to legitimize and enshrine in law the right to invade
the privacy of individuals in Ontario with regard to their health
information.
To me, giving cover of
right and of law to what from a privacy perspective is wrongdoing
is not progress. It's possible, though I certainly wouldn't want
to give a legal opinion, that in some respects it might actually
reduce the rights of people to have that kind of deficient law,
because at present, if your health privacy rights were
egregiously violated and you suffered some serious detriment as a
result, in the absence of any law that permits that kind of
egregious violation, it is possible that an individual could go
to court and obtain damages simply for general violations under
tort law. Obviously if it were under cover of right, under cover
of law, that would not be the case. So I can't make the argument
that badly flawed legislation is better than no legislation.
I believe it is possible,
without having to spend another umpteen years, to craft privacy
legislation that is substantially similar to, in fact consistent
with, the federal law. Past a certain point, quite honestly-it is
not even such new ground that it can't be brought forward. A lot
of research and work have obviously been done. But I don't
believe that anything as badly flawed as this can be fixed by a
process of amendment, because you will literally have to go
through every clause and in many cases reverse its purpose,
reverse its wording.
I would use the example of
looking to buy a car in which the engine is shot, the
transmission is busted, the body is rusted out and full of holes,
and the tires are worn. Yes, maybe it's possible to put in a new
engine, replace or rebuild the transmission, reconstruct the body
and buy new tires, but if you told someone you were considering
getting that car and doing that, I think most sane people would
tell you, "Don't do that. Go get another car and avoid all these
problems."
I think that's the kind of
problem you face with legislation that from start to finish is
riddled with deficiencies of this sort. I don't know if that
fully answers your question.
Mrs
McLeod: Just to comment, governments find this very
difficult legislation to bring forward, and this is the first
time we've had a health privacy bill come forward and make it
this far. It hasn't made it to second reading yet, but it's the
first time it's come this far. Suppose the government just says,
"Forget it. It's too tough. Let's just scrap the whole thing." I
think that's the fear Ms Cavoukian was expressing yesterday. What
are we left with? Bill C-54 doesn't speak to much of the area
where we need health privacy protection; at least that's my
understanding of C-54. Perhaps you could just comment on whether
C-54 serves the purpose that needs very much to be met.
Mr
Radwanski: It doesn't meet all purposes, obviously. If
there were no law, it would cover certain segments, which is
somewhat broader than one might think. Obviously, a lot of this
will be open to interpretation by the commissioner and maybe
eventually the courts. But my view, for instance, is that
doctors' practices would be covered by the federal law
because-
Mrs
McLeod: Would they?
Mr
Radwanski: Yes, because a doctor's office is a private
sector activity that is for-profit. From whom the profit is
received is a secondary concern, so doctors' offices would be
covered, laboratories would be covered, a range of clinics would
be covered, pharmacies would be covered. That's a large chunk.
Hospitals most likely would not be covered, though there are some
arguments that could be made. I don't want to make a
pronouncement on that, but I would not include them among the
ones that definitely would be covered.
You would have gaps, no
question. A large chunk of the sector would be covered by law
that provides meaningful protection but really is built on the
right information practices and that, other than in exceptional
circumstances, requires the right of consent, provides redress
and so forth. For the rest, you'd have a gap, as you do now.
But frankly, there is one
other element to factor in, and that is, when I say that privacy
will be the defining issue of this decade, one of the things I am
talking about is the degree to which public awareness of the
importance of privacy is very much on the rise. You need only
look at the media to see there are stories every second day in
the media on this. A very important part of my own mandate under
the new federal legislation is public education, which means
raising the level of awareness in the country, which I am doing
in a variety of ways, including things like being here today, and
will be doing a lot of over the time ahead. Commissioner
Cavoukian and her office also have a role in raising public
awareness. The media are on the case.
So my answer to your question is, rather than put
in a bad law, don't worry; public opinion will require a good
law, and before very long. I don't think we need worry that the
public, once it becomes aware of the degree to which personal
health information is up for grabs-because I think many people
still believe that information that goes from them to their
doctor stays there and don't know all the secondary uses, all the
ways it goes around. When people know this, I think the issue
will be self-limiting and that there will be a climate in which
good privacy law can be passed. Frankly, that's better than
creating a law that may appear to be doing good things, and it's
only, as one goes through experience with it-you know, nobody can
read this law and understand what it says.
Let me just add, I have a
degree in law and I've spent most of my adult life dealing in one
capacity or another with issues that involved reading bills. I
have spent hours reading this thing and I have to draw charts. I
have to track: "Well, it seems to mean this, so-and-so is covered
by this, except there is this other provision where they're not
covered." But of course none of this matters, because a
regulation may do something yet different. Having a law like
that, I would argue we should not be afraid to see it done
right.
Ms Frances Lankin
(Beaches-East York): Commissioner, I'm tempted to ask
you to tell us what you really think.
I guess I want to place on
the record that there are a lot of people who will feel reassured
by your commitment to the protection of Canadian's privacy and
that there is a champion and watchdog in the federal
commissioner's position who will do that. Mrs McLeod raised the
preliminary question I had as well in terms of, if not this,
what? I hear what you're saying clearly.
I feel saddened by that in
a sense because I'm well aware of the history of the attempt of
many fine people in the bureaucracy of the province of Ontario
who have worked to try and bring forward health privacy
legislation through at least three governments, several terms of
governments and many ministers of health, myself included. And
what's interesting about your comments is that you see a change
in the political landscape led by public opinion that will make
this more of a priority legislative activity for a government. In
days of polarized politics and ideological swings in politics,
it's not often that a non-ideological bill can find its way on to
a government's priority agenda and find its way to a committee
for serious work. We're at that moment in time, in a sense.
1210
I've got lots of thoughts
about why the government is bereft of ideas at this point in time
and how this made it, but it's here and it is a moment in time
where members of both opposition parties, Ms McLeod and myself as
health critics for our respective parties, have indicated a real
interest in working to bring about health privacy legislation, a
framework for this province. While we see significant problems
with the bill, we were willing to, through this process of
hearings, take this to a working table where we sit down and
seriously work through consensual amendments to build a good
piece of legislation with tripartite support.
I think that's what our
Ontario commissioner was urging us to do. I believe I'm in
substantial agreement with you about the nature of the job, how
big a job that would be, but I would genuinely hate to see this
bill pulled from the public agenda at this point in time as a
result of your urging, and hope that among things like a cabinet
shuffle happening today, a new minister-although I can see some
of the political staff of the outgoing minister probably feeling
a little bit like there's a silver lining in this move that they
hadn't thought of before, not having to deal with the fallout of
today. A new minister, a potential House-proroguing-there are a
lot of issues that could really just set this whole initiative
back two or three years at this point in time, despite what
you're saying, that there's growing public pressure.
I guess I still, in the
context of our work, hope that we can work to fix the very many
problems-substantial problems. As I listen to you, I hear the
problems listed, if I can summarize and you can perhaps tell me
if I've got it right. There is not enough protection in terms of
collection of information, what we collect; there is too much
directed disclosure; there is too much discretion in terms of
what the minister can do after the fact through regulation; there
is not enough guarantee of access to one's own information; there
is not sufficient oversight and accountability through the
commission; and there's not adequate redress for individuals.
Wrap it all up in a very complex bill that's not very transparent
and you've got a big problem.
I would be interested in,
first of all, your comments in those areas. Do I understand what
you're saying clearly? Are those the key problems? If we had an
undertaking of the three parties to move to some kind of working
process here to reconstruct the bill rather than scrap it-because
I give you my political caution that it won't be back in a couple
of months, it will take much longer than that-can we count on a
dialogue being opened, as we have with our Ontario commissioner,
with your office in which the legislative drafters have an
opportunity to seek your input on the issue of substantial
similarity? I think one of the things that's been difficult for
the Ontario policy developers and legislative drafters was for
them to know what standards would be used for judging substantial
similarity. I think you've made that much clearer today. Perhaps
if we could have a line of communication established with you as
we engage in this project and the people within the ministry who
will be doing much of the work of rewriting, that might move us
quicker than your suggestion of actually pulling this off the
table and starting again.
Mr
Radwanski: I hear what you're saying. Let me try to
respond.
Ms Lankin:
And remember, this is an opposition member speaking here.
Mr Radwanski: It's not my job to
take that into account one way or the other. In fact, I was just
going to say that it's not for me to comment on the politics of
this one way or another.
I guess in one way what you
are describing in terms of the work of this committee-if you are
saying in effect that this committee could rewrite this bill more
or less from start to finish and produce a good privacy law,
obviously what matters is the outcome. If your committee can
basically change every provision and in effect start from scratch
and write a meaningful privacy law, then I suppose it wouldn't
much matter if the desired end was achieved by your committee
doing that rewriting or if the bill is withdrawn and another
process produces a good privacy bill. So in that sense, whether
it's withdrawn or rewritten here or anywhere else is not the
crucial issue.
My concern is that what
normally happens in this kind of process is there is some
amendment, some improvement. A lot, in the case of a bill like
this, of really unfortunate features would still remain. Then it
gets put through under the guise of being much-improved
legislation and you end up with a law which still falls far short
and which leaves privacy rights very badly at risk. That would be
a very unattractive outcome. That is really my concern, and
frankly, when one looks at rewriting and fixing this bill,
wherever it's done, it's a Herculean task and it would be an
unusual task for a committee to be able to achieve, in my view.
I'll put it that way.
Again, I won't argue
against it. If it can be done, more power to you. But if this
weren't called a privacy bill, if the name of this were the
Widest Possible Access to Personal Health Information Act, I
don't know if one would still be saying, "We can fix it with a
few amendments here and there," because that, in its essence, is
what it is. So one is talking not about changing a word here or
there, modifying a clause; one is talking about, as I've said,
reversing the policy thrust of most provisions, removing a huge
host of exceptions. You end up with a new bill. If it can be done
in committee, that would be a marvellous achievement for a
committee, but it's what matters at the end of the day that is
critical.
On your second question,
we're into virgin territory here, of course; this is all new. The
law is new; the issues this province is trying to pass
legislation in compliance with are new. Certainly I'm open to an
ongoing dialogue with myself and my office and would be glad to
be helpful in whatever way I can. I guess the only caveats are
that my office too does not have unlimited resources-far from
it-and there may be a lot of provinces with a lot of legislation
in a similar boat, so it's a question of degree as to what's
feasible on one hand in terms of analysis and resources. Also,
obviously, it is not for me to write provincial laws; far from
it. But to the extent that an ongoing dialogue with a committee
or with a government-ie, an ongoing, in no way partisan
dialogue-is invited, it's certainly my job to try to advance the
cause of privacy in any way I can, and that would certainly be a
large part of it.
The disposition, I should
add, as witness my presence here today, is not to keep people in
suspense, let provinces or provincial governments pass
legislation of one kind or another and then pop down at the end
of the day and say, "Uh-uh, you fail. That doesn't meet the
standard," or whatever. I'd much rather be able to make a
positive contribution to people understanding what the criteria
are, what "substantially similar" means, in helping them to get
there. So yes, if I can help with that, I'd be delighted.
Ms Lankin:
I suspect that your presentation today will aid in your other
mandate of public education. I also suspect that the new minister
tomorrow morning will have a very important issue on his desk to
deal with, leading from the headlines in the paper.
I don't have any other
questions. Thank you.
1220
Mr Toby Barrett
(Haldimand-Norfolk-Brant): Thank you, Mr Radwanski, for
your presentation.
I want to raise an issue I
raised yesterday with our Ontario privacy commissioner with
respect to the firearms owner's licence application form, which
many, many of us filled in by the deadline, the end of last year.
On that form, I know there were a number of questions or boxes to
check off, one relating to an applicant's mental health history.
It's my understanding that in the province of Ontario our
community mental health centres really have very few barriers for
clients' mental health information to be disseminated, perhaps to
a lawyer or a spouse around a custody battle. These are things
that are reported to me in my riding, but with respect to this
application form, I'm assuming once someone checks off that box
that they do have a mental health history-I know there's a
follow-up; at minimum, there could be a telephone follow-up. I'm
not clear about how detailed the investigation is, whether they
would, as police can do, access our Ontario community mental
health centres for this information.
With respect to the
application form-you mentioned the importance of the media, and
there are people in my riding who follow some of your work in the
media in respect to this what many consider a privacy issue.
Under the current rules, gun owners or potential owners are
required to state on the form whether in the past five years they
have-and I can quote several of the issues-"threatened or
attempted suicide," "been diagnosed or treated by a medical
practitioner for: depression, alcohol, drug or substance abuse,
behavioural problems, or emotional problems," and in addition, to
quote further, "experienced a divorce, breakdown of a significant
relationship, job loss or bankruptcy."
I represent a rural riding.
Most farmers are gun owners, for example. Many have a .22 in the
barn to shoot raccoons and things like this that kill chickens.
Many farmers are on the verge of bankruptcy and are being
encouraged by the Ontario government to go for stress
counselling, and I fully encourage that in my farm community. If
they were telling the truth, they would check off this box, and
I'm unclear where this lies. Could you comment on that issue with respect to
privacy? I understand you've done a bit of work on this.
Mr
Radwanski: Sure. I'll be glad to comment, even though
it's a little outside the scope of our discussion today. I'm
happy to comment, in any event.
Mr
Barrett: And I couch it in terms of our mental health
system. As I understand it, in Ontario, community mental health
centres are pretty open as far as passing out clients'
information. I'm aware of clients who don't come back for
counselling any more once their spouse or their spouse's lawyer
gets that information. That's part of my concern.
Mr
Radwanski: On that point, you're touching on one of the
reasons why good health privacy law is very important, because
you're exactly describing what can happen if privacy rights are
violated. That's the point I was making, that if people can't be
confident that their health information is private, they may not
seek the kind of care they need, and that can be devastating not
only for them but for society. So I think we're very much in
agreement on that.
On the gun law, that falls
very much under my jurisdiction under the federal privacy act. As
you know, there are two separate pieces of legislation. The one
I've been referring to today, C-6, is the new law that pertains
to the private sector. There has been in effect, as you know, a
federal privacy act pertaining to areas of the federal
government, federal institutions, for many years, and the gun
registration aspects fall under that. So they do fall under my
office.
We have been conducting an
informal review of many aspects of the application of a gun law
and so forth. The office, under my predecessor, expressed
concerns about many of the questions that were being asked on the
forms. Some modifications were made as a result of those concerns
in the early stages of preparing this law. On some of the
questions about which you were asking, a number of experts were
brought in and presented to my predecessor, making the arguments
why these things might be important indicators of potential
violence by people if they acquired guns, and my predecessor was
persuaded.
To be very honest with you,
I'm not fully persuaded that all those questions are appropriate
or necessary in the circumstance and in this process. That is why
I have initiated a review of those questions. For instance, to be
candid with you, some of the questions in my mind are: does there
need to be a distinction between what you would want to ask
someone seeking to acquire a firearm for the first time and
someone who may have had one or several for the last 20 years? If
someone has just lost a job or is in the midst of an imminent
marriage breakup and develops a sudden urge to own firearms, that
could be an indicator that is worth considering, but if someone
has had firearms for 20 years and went through a divorce three
years ago, what has that got to do with anything?
These are the kinds of
questions I am going to look at. I won't prejudge it by telling
you what my finding would be, because I don't know. I will have
to hear the arguments afresh on some of those points. Obviously
the protection of the public and the public interest are
paramount considerations, but the principle is that only
information that is truly necessary to achieve the purpose should
be sought, and I will have to be persuaded that that in fact is
the case in this instance. So you raise a legitimate concern and
one that I will try to have a response to at the earliest
time.
Mr
Barrett: Beyond the form, I understand that if a person
does check one of the boxes there is a follow-up by the firearms
officer, or they may delegate that responsibility to local
police. As I understand, it's done by telephone. Whoever picks up
the phone, or it may be the person who is listed on the form as a
reference, is also asked a number of questions. As I understand
it, this is just done on the phone, that nobody signs anything;
it's merely a telephone interview in many cases. The questions
that are coming in by phone are, has the applicant acted in a
manner that suggests they are disturbed or distraught or suicidal
or may be suffering from a personality disorder, or are known to
have a history of mental illness, or are they under any financial
pressures?
It seems so vague to be
doing this by telephone. I don't know how whoever answers the
phone is identified as being the reference or the spouse. It
seems like an awfully vague way of following up on this, as I
understand it. How is it verified? These may be technical
issues.
Mr
Radwanski: You're raising questions that deserve
responses. I would have to say in a broad sense that one area
that is exempted, generally speaking, is the right of the police
to conduct investigations, to conduct inquiries, for whatever
reasons. They are allowed to ask questions. So the extent to
which the questions or the research processes would be in
violation is a technical question that I would not presume to
answer off the top like this. But you are raising questions that
merit consideration and, as I said, are part of what I and my
office are going to be reviewing and are reviewing as we speak.
The best I can tell you is that those kinds of questions are not
foreign to me. They are under advisement and it is part of my
responsibility to ensure that privacy principles and the privacy
law are being respected in this field as in every other.
Certainly when we reach findings, whatever they are, they will
not be kept secret, so you will know what I conclude. But I
appreciate the question.
1230
Mrs Sandra
Pupatello (Windsor West): Thanks so much for your
presentation today. Could you clarify what you think the
process-
Mr
Radwanski: Sorry, again I'm having-I guess it's the
translation. Could you speak up a bit? I'm having trouble hearing
you.
Mrs
Pupatello: I never have trouble being heard. I'm
enjoying this.
The Chair:
Forgive me, Mrs Pupatello. In fact, Hansard has been saying they
are having trouble hearing, so could the members lean closer to the
microphones. Thank you.
Mrs
Pupatello: Thank you so much for your presentation
today. Could you walk me through the steps: if this bill is
passed and an individual's rights are violated in terms of
information being forwarded that is in accordance with the
Ontario law but in contravention of the federal law, tell me what
an individual would have to do to be aware this has happened,
which in itself, as you have described, is a major item because
they may not know-we don't tend to know now what are the
secondary uses of information. But in describing the limited
authority of the Ontario privacy commissioner-of investigation,
of audit, even of frankly being at the whim of somebody's mood as
to whether they can access information for an investigation-tell
me what would happen with an individual going forward with a
complaint.
Mr
Radwanski: Very simply, the provincial law would be in
place, but for my purposes what it permits or not would not be
relevant. An individual would complain to my office that they had
reason to believe a privacy right under the federal law had been
violated. They would be put in touch with an investigator, they
would be asked to state their complaint in writing, and then we
would investigate. As I said, we have extensive powers of
investigation, full powers. I am happy to say that in the case of
the public sector law, the federal Privacy Act, we have never
once had to use those powers under any of my predecessors because
we have always been able to get voluntary compliance, voluntary
co-operation. But I am quite sure we've only had voluntary
co-operation because those powers were in reserve. There is not
much point in saying, "No, you can't see this," if we can turn
around and say, "We're invoking our powers. We will see it."
In the private sector area
we would have full power to investigate. An investigator would go
and follow the chain of what appears to be an inappropriate
disclosure or collection or whatnot, and find out what had
transpired. The complaint may be valid or it may not, but we can
see any document, ask any question, and get to the bottom of a
complaint. I am very fortunate in that I've inherited an
excellent office in that regard, with very well trained
investigators, and we are expanding our resources to meet the
challenges of the new private sector law as well. So the
investigation would be carried out.
If there is a problem-if
it's an ongoing pattern, for instance-one tries to resolve these
things in an amicable way, as an ombudsman function. I am an
ombudsman. One tries, first of all, to persuade the organization
or entity with whom the issue arises-the complaint-to cease and
desist from doing whatever is inappropriate and to remedy a
situation in whatever way is possible.
Mrs
Pupatello: In that case, correct?
Mr
Radwanski: Yes, but also more broadly if there is a
systemic pattern. For instance, if somebody is systemically
collecting or disclosing information they have no business
doing-
Mrs
Pupatello: Would you need to have several cases come
before you in order to determine the systemic nature of that?
Mr
Radwanski: It might become clear in the course of
investigating one case. If somebody says, "My information got to
so-and-so," and you investigate and find it got to so-and-so
because this entity has a process whereby information is provided
to whomever, you don't have to have umpteen cases to say, "You
can't do that. Stop doing it right now."
Mrs
Pupatello: At what point and in what way do you have the
authority to have the Ontario law struck down?
Mr
Radwanski: I don't. There is no issue of striking it
down. But the point is that the federal law takes precedence.
Mrs
Pupatello: So do you continue-
Mr
Radwanski: I understand what's confusing you. There is
an Ontario law on the books that says you must provide your
information to such and such and there is a federal law on the
books that says, in effect, you cannot be providing information
over there because you can't justify it and there is no basis for
it and you don't have consent. That's what you're asking. What
happens then?
What happens then is, I
exercise my responsibilities to say that cannot be done. Let's
say hypothetically-and we are in the realm of hypothesis-but
let's say that the provincial government tried to enforce its law
and that ended up in court. It is an established principle of
Canadian law that where there is a conflict, federal law takes
precedence where there is a legitimate law.
So the fact is that,
without presuming to speak for the courts, the logical outcome is
that the finding would then be that the federal law prevails,
that the person or the organization must cease and desist from
what is in violation of the federal law and that therefore they
are in a sense exempt from any penalty under the provincial law,
because if one law takes precedence over the other, then in that
sense, where there is a conflict, the other law does not obtain.
Do you follow?
Mrs
Pupatello: Yes. The reason given that the Ontario
government went forward with concerns over federal law was that
they were going to be very restrictive in moving forward on the
integration of health services.
How do you respond to that
concern? It seems to me that your law federally does cover the
private sector, and the concern in Ontario is that further
integration may well mean further privatization and their access
to personal information for a whole variety of reasons.
How do you explain then
that your law was not extensive enough to deal with integrated
systems which every province in Canada is dealing with? Does
every province have to come up with a health privacy bill because
your federal law did not widen its scope enough for it and, if
so, why didn't you?
Mr
Radwanski: It's not why didn't I, to be clear. I had
nothing to do with passing the law and I'm not part of the
government of Canada. I am at arm's length.
Mrs Pupatello: Why didn't they?
They went to all that trouble. Apparently every province is
dealing with the same issues of health delivery as Ontario, and
Ontario doubly so.
Mr
Radwanski: But what the federal government cannot do is
pass laws that govern a provincial government. What is directly
under a part of a provincial government activity, that sector
cannot be regulated by federal law.
The federal law can only
apply to areas where, under various constitutional powers,
federal jurisdiction can extend. I don't want to get into the
constitutional argument under any circumstances here, but it can
extend to the sectors I've described. It cannot extend to sectors
that are a public sector of a provincial government.
Is it imperfect in that
sense? Yes. But it extends as far as it is possible for the
federal law to extend and, frankly, I would imagine the hope in
drafting this legislation is that all governments would agree on
the fundamental importance of privacy, the desirability of
protecting the privacy rights of Canadians and that all provinces
will in fact avoid the kind of complexities that we've been
discussing today by passing laws that are at least of the same
quality, in terms of their privacy protection, as the federal
law, which civilized jurisdictions around the world are doing. So
it was not seen as a particularly far-fetched assumption that the
provinces would want to step up to the plate.
There is also the
possibility regarding the private sector that some provinces,
particularly the smaller ones, might choose not to have to get
into the challenges of oversight and so forth that would be
involved in overseeing the private sector and might quite simply
prefer in the private sector to have the federal law apply and
have my office have the oversight in the same way that some
provinces, for instance, don't have their own provincial police
but use the RCMP. There's that aspect as well.
1240
Mrs
Pupatello: Do you think then with the Ontario law, given
what may happen if it's implemented and the chaos or
misunderstandings that may occur in the private sector
involvement in health care-given the two levels of law being so
different-that we're actually creating a larger hurdle in
integrating health care if we pass the bill than if we scrap
it?
Mr
Radwanski: You're getting there into areas that really
aren't for me to say. What I will say is that passing a bill that
is not substantially similar to the federal law is going to cause
problems and confusion and it is going to subject, certainly in
any area where the supply is, elements that are covered by such a
provincial law to a great deal of confusion, and it's just not an
ideal outcome to end up with a conflict of laws. That's
clear.
Is that worrisome? If I
understand your question, it is a bigger problem if you pass a
law that will end up creating confusion and be in conflict than
if there is a void there and the federal law simply applies
without having to have that contest and the conflicts and people
being whipsawed by conflicting provisions, yes. I'm not going to
comment on the integration aspects, but certainly in terms of
the-
Mrs
Pupatello: It was the one significant reason apparently
that the Ontario government was asking for that window to create
their own, because they felt it would be such a barrier to
integrating health services.
Mr
Radwanski: Well, it's good if they create their own, but
it should be a law that protects privacy.
Ms Lankin:
My understanding is slightly different in terms of the
integration issue. The concern on the part of the province of
Ontario is not that there would be federal legislation governing
one section of health and nothing governing the other-that in
fact would be problematic, there's no doubt about that-and
another level beyond that. The goal of health reform, which I'm
not asking you to comment on, by many governments of many
different political stripes-and we may debate how we go about it,
but many people have agreed on some of the principles-sees
systems integration in terms of treating the patient at the
centre of it and the services being well-informed in terms of
good decision-making for the patient.
I guess in a sense it comes
down to the issue of consent, though. The way to get around all
that is to have the patient's consent. There are other issues,
however, that governments are concerned about with respect to
management of a very complex health care system, and this is
where I would like your comment, because certainly there are
decisions: how many hospital beds you're going to have, how many
appendectomies you're going to staff for, what kind of in-patient
versus outpatient, what type of epidemiological outcomes there
are of certain kinds of procedures, what kind of rate of
caesarean sections we are experiencing in Kingston versus London
and why, and how we effect medical doctors' practices for best
outcomes.
There are a lot of very
good and important social health goals, and there must be a way
for us to do that without violating individual privacy, because I
don't want my individual health privacy violated. I'm not asking
you to comment on this legislation, because I think the problems
that you've identified are clear there, but I'm asking you to
envision how you draft provisions that allow the kind of research
or systems management issues to be addressed. Is it always going
to be anonymous information? Is it always going to be coded with
steps in between? What are the protections for privacy that can
be put in place that still allow these other goals to be met?
Mr
Radwanski: I don't mean to suggest that you are raising
it that way, but this whole question of management of the health
system as regards personal information is a bit of a red herring
in this sense: in the examples you're giving, to plan what the
needs of the system are regionally, province-wide, whatever, yes,
you may need to know how many appendectomies are being performed
or what the trend line is, for example, what the demand would be.
So you ask the hospitals or you ask the surgeons, "How many
appendectomies did you perform?" You don't need to ask, "Let's see the
names of the people on whom you performed them." That simply
makes no sense. The kind of management information we're talking
about has nothing to do with-
Ms Lankin:
Perhaps I didn't give you good enough examples, because I think
that's a bit of a simplistic-
Mr
Radwanski: I'm responding simplistically to make the
point that most management issues with regard to the health care
system don't require the wide circulation of the personal health
information of any individual. There are systemic questions,
there are statistical questions, and you're talking quantities,
rates, incidence and so on. You're not talking about needing to
put the personal facts of an individual into play. There can be
exceptions, but that's why one talks about exceptions having to
be justified and carefully circumscribed, not simply documented
but explained, circumscribed and so forth on a real need basis.
But there's no need for information to be whizzing all over the
place under some vague rubric of management, not that kind of
information. So that's really the answer to your question.
Coming back to consent-I
just want to pick up on that first part-yes, consent is the key,
but it's also critical that it be, first of all, obviously,
informed consent, that you understand what you're consenting to,
that it be specific consent, and that it be free consent. It's
one of the principles that access to a service should not be
denied as a consequence of declining consent to a use of
information or a disclosure of information that is not
intrinsically crucial for the provision of that service in a
direct sense. In other words, it would be fundamentally wrong to
say in effect, yes, consent, but we'll make it a condition of
having your costs reimbursed by OHIP or we'll make it a condition
of admission to this institution that you must sign a consent
form that permits X, Y, Z forms of circulating your information.
That would not be good consent. I don't know if I've fully
answered your question or not.
Ms Lankin:
I think you have. I do think it would be useful to explore the
issue of-for example, the Ontario commissioner talked about some
circumstances like epidemiological research. There's longitudinal
research being done where it's important to track back what's
happened to individuals, and yet it's being done on a population
health basis. So a certain part of the population exempting
itself from that study creates problems in terms of the quality
of the outcome. She actually said that was a circumstance where
she felt there was a possible reason for exception to
privacy.
Mr
Radwanski: It might be. I would have to say I've heard
that argument made and I've heard a lot of anecdotal evidence
that not having the full sample somehow badly skews
epidemiological research. Not to say it is not out there, but I
have not seen the persuasive evidence that this is in fact the
case. I have not had somebody point to, "The following studies
that were of real importance turned out to be badly flawed
because...," for instance.
Ms Lankin:
The question is, how would we know yet? I lot of this stuff's
ongoing.
Mr
Radwanski: You can make arguments for violating privacy
in that general sense: "Something bad will happen if...."
Ms Lankin:
I agree with you.
Mr
Radwanski: You can go across the board on issues and
make that kind of hypothetical argument, but there has to be real
evidence that that would be a problem, and even for that kind of
research, my broad view is that Canadians are a very co-operative
people in a lot of ways-and I've said this-in a lot of senses,
and they are a sensible people. If you ask for consent for a
limited specific purpose, you satisfy them that it will not be
used for any other purpose and that it is a good purpose, the
great majority of Canadians will give their consent. So does
violating privacy rights stand as a precondition of good
research? I don't believe it.
1250
Ms Lankin:
I think it'll be important for the committee to examine some of
those arguments that are put forth. Maybe we need to look beyond
the assertions and look at debunking some of that and
understanding it better. There is a lot of language that gets
thrown around and, if you're not working in the field, it's hard
to assess. I appreciate your comments on that.
Mr
Radwanski: I should add that some of the arguments for
research-research covers a multitude of forms of activity and
some of that cloak of research is wrapped around activities that
are quite simply commercial and for-profit, and yet they are
enveloped in a cloak of public interest which, again, in looking
at the fundamental privacy rights of Canadians, anyone entrusted
with these areas should look at very, very closely.
Ms Lankin:
I'm going to take you back into the realm of the hypothetical
again. There is a piece of legislation that was passed in the
province of Ontario called Brian's Law and it provided amendments
to the Mental Health Act to do a number of things with respect to
the involuntary commission of people to psychiatric hospitals. It
created a new regime, a new system, called community treatment
orders. In the section with respect to community treatment
orders-I'm sorry I don't have it in front of me-there was a
provision, in a sense, for directed disclosure about people's
personal health information that had to do with a certain number
of individuals-doctors, family and community people-who would be
involved in the creation of the order and the maintenance, the
servicing of the order, so the care plan for the individual.
At the time, there was a
concern in committee that there was no protection for this
information that was being shared. Some of the groups in the
community aren't under any government ministries so they weren't
covered by freedom of information and privacy, so there was no
protection. We did a little clause in committee which probably
isn't sufficient enough, but tried to cap that. But I'm wondering
whether that whole area is a problem now. If in a community one
of the partners in the
delivery of the services under a community treatment order
happens to be a private, for-profit addictions service, and if we
don't have health privacy legislation in Ontario-or even if we do
and there's a conflict; if they're under Brian's Law, they're
directed to be part of this-your law, the federal law, takes
effect and we could have situations where a person might actually
come to appeal to your office that there's been a violation of
their privacy rights under the federal law. We're into this
already in terms of the problems, hypothetically, do you
think?
Mr
Radwanski: Well, your last sentence touched on what was
flashing through my mind as you said this, which is that because
hypothetically someone might come to my office with that kind of
a complaint-
Ms Lankin:
You'd better not comment on it.
Mr
Radwanski: -I cannot comment on it because the one thing
I cannot do is basically prejudge issues that might come before
me for adjudication.
Ms Lankin:
Fair enough. I'm thinking this complex area is becoming more
complex as the day goes on.
Mr Chair, I'm not sure when
we're going to wrap up the questioning.
The Chair:
Two more questions.
Ms Lankin:
I do have questions and/or recommendations for the parliamentary
assistant. I actually feel that before we talk about whether the
committee proceeds with public hearings and those sorts of
things, given that we have been told clearly on the record the
federal commissioner's recommendation is one that there is not
substantial similarity, there's a preliminary question for us to
deal with.
Mr Bob Wood (London
West): I've got some questions I want to put-
Ms Lankin:
On that point?
Mr Wood:
Could we deal with that at the end, after we adjourn?
Ms Lankin:
Sure. Thanks.
Mr John O'Toole
(Durham): I have a couple of questions and I'm sure, if
time permits, Mr Wood will as well. I'm quite interested in
following up on the remark you made to Ms Pupatello. In a general
sense I'm wondering if you felt that we have to look at health
care in a national or potentially global setting, as in many
issues in the e-world. I think the United Nations provoked Bill
C-6 federally. My first question is, do you think Bill C-6
substantially went far enough? The shorter answer would be the
one I'd be looking for, like a yes or no.
Mr
Radwanski: Well, we're not in court and I won't be
restricted to yes or no, but I will say that I think it is an
extremely important step forward. Certainly there are additional
features one might wish for, but I believe it is a good privacy
law that is consistent with international standards of privacy
protection.
Mr
O'Toole: The reason I was asking is that I'm trying to
lead to some discussion about the comment you made about
"substantially similar," in other words, that drafted provincial
or subordinated legislation has to be substantially similar to
the provisions and guidance within the primacy of the federal
government in areas of jurisdiction. I wonder if you could tell
me what is the test for "substantially similar." Can you tell me
that the test involves the consent, the disclosure? That's
ultimately what I would like to understand. Is there a test or is
that still part of what the debate is about?
Mr
Radwanski: No. In large measure, the test is not spelled
out in the legislation. That's clear. However, the Privacy
Commissioner-in this case, myself-is required under the
legislation to report to Parliament on the extent to which
provinces have passed substantially similar legislation.
Therefore, part of my responsibility is to determine what is an
appropriate criterion for me to apply in determining whether
something is substantially similar.
The obvious criterion is
the privacy principles, the information-handling principles, that
are the international standard, that are the CSA code and that
are embedded in the legislation, in the schedule. For me,
although to be substantially similar it must be in accordance
with all those principles, the ones I regard as the particularly
important elements of the test are: first of all, consent-that
goes to the very heart of it; second, access and correction,
because your privacy is utterly violated if you can't find out
what information is held about you and if you can't do anything
about it if it's wrong; third, oversight-any privacy protection
regime is only as good as the mechanisms for knowing whether it
is in fact being followed; and finally, redress, because all the
good intentions in the world won't do you much good if you don't
have the means of ensuring that the law is in fact respected.
Mr
O'Toole: I appreciate that. I'm wondering if there has
been some test. Industry Canada declared that the Quebec privacy
legislation in 1999 was substantially similar. From what you've
said, they have made an assessment based on no prescriptive
formula for what "substantially similar" is. As you've described
it, you still haven't filed your report.
It does alarm me somewhat,
I might say, that somebody is telling me two things. When you
look at the CSA and other international standards, which I'm sure
you're constantly studying, can you give this committee some
guidance so we don't end up with some charter challenge, a very
expensive, convoluted process? Should you rule or should the
courts rule on this? Who has primacy, you or the courts? Is it
the Supreme Court that should rule on this?
1300
Mr
Radwanski: On what? To what are you referring?
Mr
O'Toole: "Substantially similar," and defining some
formula for the testing, whether it's on informed consent,
disclosure, redress-the number of elements you mentioned. I don't
disagree with any of them; I'm just saying in the context of
somebody saying the Quebec law was substantially similar-they
can't say that, because they have no test to say that. That's the
kind of logic I'm following.
How does it actually get
determined? First, I suspect the primacy should fall to you as an
independent commissioner-or does it fall to the Supreme
Court, which is another independent commission?
Mr
Radwanski: The legislation doesn't provide for any
recourse to the courts on this point.
Mr
O'Toole: No courts will decide this?
Mr
Radwanski: On this point, the legislation makes no
reference to that. Let me put it this way: I am required to
report to Parliament on the extent to which substantially similar
legislation has been passed. I am an officer of Parliament. I
don't believe there is any mechanism that can constrain my
freedom to report things as I see fit. Are you with me so far? Do
you agree so far?
Mr
O'Toole: Oh, yes, absolutely.
Mr
Radwanski: So I will report to Parliament, and obviously
I will have to use my best judgment as to what it is fair to
regard as criteria for "substantially similar." The recourse, I
suppose, is for someone to say, "This guy is an idiot. There's no
way it's reasonable to regard that as a criterion." But hopefully
I will be fair-minded and the criteria that I've described today
are appropriate ones. That is as far as my responsibility
goes.
The next thing that happens
is that the cabinet, by order in council under this law, may-not
"shall"; not "must," but "may"-exempt from the application of
this law sectors or the whole private sector in a province where
a provincial government has passed legislation that is
substantially similar. The logic of this is that they will base
themselves on my recommendation, at least to a significant
extent, because why else would that be in the law? But
technically speaking, through the order-in-council process,
cabinet can make any determination it wants. It is not bound.
There's nothing in the law that binds it to follow my
recommendation. The right of a cabinet to make its own
determination of what is substantially similar under this law,
again, I don't believe is appealable to a court, because that
isn't the prerogative of the cabinet to decide-it's a "may," so I
presume it can go either way, because it's not even a "must" or a
"shall."
My reading of it would be
that what's involved in this instance is not a judicial process.
That's one man's opinion; someone else might have a different
view. I can only give you my opinion.
Mr Chairman, I don't want
to cut this short, but I do have to express a concern that I had
assumed, in our original planning, that this would be from 10 to
12, for two hours. I'm happy to be here, but I have another
commitment.
The Chair:
I think, Mr Radwanski, we only have two quick questions left. If
you can accommodate those-
Mr
Radwanski: I'd be delighted.
The Chair:
Mr Wood and then Ms McLeod.
Mr
Radwanski: I'm under some pressure, because I have
another commitment that I've already pushed back, but please ask
what you need to ask. I'm here to be helpful.
Mr Wood:
Could you give the committee members a copy of your statement
today? Could you make that available now?
Mr
Radwanski: I don't know that we have enough with us to
do it now, but it will be up on the Web site later today, so you
can certainly get it that way.
The Chair:
The clerk will make copies, if you even have one copy.
Mr Wood:
Could you give us a complete list of your concerns by letter?
You've given us an overview of your concerns. You said you had
some detailed concerns that time did not permit you to address
today. Could you give us a letter outlining your concerns?
Mr
Radwanski: Part of what I said-I can certainly give you
a letter confirming these concerns, although my statement does.
What I said was that parsing this thing clause-by-clause would be
a Herculean task and frankly goes beyond my responsibilities or
the need for this purpose. Literally to itemize them
clause-by-clause, word by word, would be days of analytical work.
I was referring only to the time it would take to explain them
here. But I think I've given you directionally what the problem
is. It's not my place, nor do we have the resources, to get into
trying to detail every weakness in this comprehensive a bill.
That would be a huge task, and I think that's for your committee
to do, with the expertise it can command.
Mr Wood:
Do you agree that the test of "substantially similar" should be
applied in the same way to all the provinces?
Mr
Radwanski: Of course.
Mr Wood:
Would you consider Quebec's act to be based on a CSA code?
Mr
Radwanski: I'm not going to make a comment today on the
Quebec act. That is a piece of legislation that is in place. The
time will come when it is appropriate for me to make a report to
Parliament on that. I am here because I was invited to be here in
the spirit of being helpful at a time when legislation is being
considered, so I'm happy to give my take on it at the earliest
possible time. If the insights and comments I'm able to afford
are helpful to this committee, I'm glad to provide them. But I'm
not going to go into commenting on the legislation of any other
province at this point.
Mr Wood:
Did I correctly understand that you do not have a problem with
the use of information about patients as long as it doesn't
identify them, as long as it's anonymous?
Mr
Radwanski: No. I was referring before with Ms Lankin to
statistical information, which is distinct from anonymous
information; statistical certainly in the sense of saying that a
hospital performed, as an example I used, 800 appendectomies over
such and such a time period. That does not involve people's
rights.
Mr Wood:
You would not have a problem?
Mr
Radwanski: With that, no. Now, if you get into
anonymous, ie, here's information on patient X but it has been
anonymized, there's no name on it or something, you're into a
much more complex area because there has been a lot of research
done that shows that even supposedly anonymized information can
lead to the identification of individuals. In a small community,
for example, seemingly
anonymous information can very readily point to an identifiable
individual. So there's a big distinction between aggregated
statistical information and anonymized information.
Mr Wood:
You have no problem with the minister asking things like, "How
many appendectomies did the system do last year?"
Mr
Radwanski: No, because that's not personal health
information about any individual.
Mr Wood:
OK. Do you have a problem with information flowing through the
system in order to facilitate continuity of care; in other words,
information being transferred from emergency to hospital to
doctor?
Mr
Radwanski: It's impossible to answer that except on a
case-by-case basis of what kind of information, for what purpose,
with or without consent, with justified reason given for the
transfer or just by fiat. You've got a whole range of
circumstances and issues that are involved in that. That can't be
answered yes or no. Some information would be transferred by
consent; some information might be transferred in circumstances,
even in keeping with the federal law, where it's a natural and
necessary consequence or need to provide care. Other information
might be totally inappropriate to transfer. So that can't be
answered with a generalization.
Mr Wood:
For example, if someone arrives unconscious in an emergency room,
would you have a problem with the hospital accessing their
information without their consent because they couldn't give
it?
Mr
Radwanski: It depends on the information accessed, and
that's where we run into this issue you heard about yesterday
from Commissioner Cavoukian.
Mr Wood:
Surely they need all the information in those circumstances.
Mr
Radwanski: Not necessarily.
Mr Wood:
What would you withhold?
Mr
Radwanski: For example, if you arrive unconscious in a
hospital-not you; this is a gender-specific example-do they need
to know whether you had an abortion five years ago? I doubt it
very much.
Mr Wood:
How do you know that, unless you're the doctor?
Mr
Radwanski: Well, by that logic, everybody needs all
information about everybody.
Mr Wood:
This is a medical file that's being transferred.
Mr
Radwanski: Even if they're imperilling their own health,
quite frankly, people have the right to say, "I don't want
anybody to know this or the other thing about me."
1310
Mr Wood:
But suppose, if you could have gotten my consent, I wanted you to
have the whole file?
Mr
Radwanski: But you have a right to determine-that's
where the lockbox provision comes in that Commissioner Cavoukian
tried to explain to you, I believe, yesterday, which is that you
have a right to say beforehand, "Even in an emergency situation,
I do not want anybody except my designated caregiver to be given
the following information." It's your information. Part of this
debate that often is lost is that your health information belongs
to you and you have the right to determine who gets to see it,
for what reason, and in what circumstances. If you want to say
that you're prepared to take the risk, however infinitesimally
small it may be, as an individual that you might suffer some
detriment to your health by an emergency room physician not
knowing that you had an abortion five years ago or whatever else
it might be, that at some point in your past you were a drug
addict-you name it-that is your right as a human being. That is
your right as an individual. It's not for the system to say, "We
are going to substitute ourselves for your rights as a human
being and as an individual to say, `None of your business.'"
Mr Wood:
An oversight committee to consider research projects: are you
opposed in principle to that or are you opposed to the criteria
being too wide as to what they can allow access to? What do you
think about the principle of an oversight committee?
Mr
Radwanski: I think there should be oversight committees
to oversee research projects for many reasons: ethics, relevance,
you name it. I've got no opinion as commissioner on oversight
committees or ethics committees, but if you come to privacy, I
believe that access to your information for research purposes
should be contingent on your consent. I don't know about you, but
I don't want some unspecified committee deciding for me that this
is a really neat piece of research, and if my privacy is going to
be violated, so be it.
Mr Wood:
Are you an absolutist on this point?
Mr
Radwanski: I'm not an absolutist, sir, on any point. I
am simply-
Mr Wood:
In what way are you not absolute on this point?
Mr
Radwanski: There may be circumstances that would have to
be documented, justified, where there would be a compelling
public interest under very clear safeguards for that one
particular type of research purpose needing to have a broader
range of access. I would say that the proper authority to
determine whether such an exceptional circumstance exists is not
some unspecified ethics committee, but a duly mandated Privacy
Commissioner, in the same way that there are public interest
disclosures that may be made and the Privacy Commissioner may be
asked to pass comment on whether this is an appropriate instance
where there is an overriding public interest in disclosing
something.
So I am not an absolutist.
I think common sense has to apply. There are instances where the
public interest must take precedence, but there is a huge world
of difference between saying that and putting in mechanisms that
would make that the rule rather than the very, very narrow
exception.
Mr Wood:
Thank you for your indulgence.
Mr
Radwanski: My pleasure.
The Chair:
Mrs McLeod, you had a very quick question?
Mrs McLeod: It will be quick
because you may not be prepared to answer. I'm going to set aside
all the technical questions because I assume we can come back to
you should this ever get to a clause-by-clause consideration.
You spoke in your opening
remarks about the intent of this bill being very different from
the intent of federal legislation. As we've heard from the
Ministry of Health and as we look at some of the specifics that
are outlined in the bill in writing in terms of, "Why would the
minister have access? Why would there be disclosure?" it's always
for the purposes of managing the health care system, for
providing for the best care of the patient. I'm paraphrasing.
Those are the sorts of good-intent reasons that are put forward
for the collection, use and disclosure of the health
information.
You've raised the concern,
as Ms Cavoukian did, about the 30 areas in which any of this can
be overturned by regulation. What would be your fear? What could
be done? What would be the greatest danger of what could be
changed through regulation? It may be an unfair question, and if
it is I'll just leave it as a rhetorical question. What is the
fear of the unknown because of that ability to virtually change
any of this that's written down now?
Mr
Radwanski: It's everything. It's the same fear that
permeates one's reading of this legislation, which is that it is
open season on your personal health information. Regulation can
determine what is personal health information that is covered;
regulation can determine who's entitled to be a custodian in the
possession of it; regulation can determine to whom it must be
disclosed; regulation can determine if a government can turn
around and disclose it in turn; regulation can determine the
extent to which the commissioner has any powers at all. It
provides for setting out the procedures she must follow. Maybe
the procedure is not to ask anybody any questions for five years.
I don't know.
I'm being facetious, but
I'm saying it's a wide open universe, and I can give you a
worst-case scenario. The worst-case scenario is simply that your
personal health information that you have the right to control as
an individual in a free society can already under this law, but
even more under regulation, circulate absolutely anywhere without
your consent and without recourse by you to stop that from
happening or to protect your right to your integrity as an
individual. The regulation aspect only increases the degree to
which this is a law that says the government can do what it wants
with your personal health information.
Mrs
McLeod: I will not ask you to speculate on why any
government would want that kind of flexibility, because you won't
answer that question.
Mr
Radwanski: That wouldn't be my job.
The Chair:
Thank you. We've actually gone over the two hours by a few
minutes, but thank you very much again for your indulgence here
in our scheduling conundrum.
To the folks from the
Ministry of Health, I think we have a consensus among the
committee members that rather than impose on you today and on
those members who were going to come in for the afternoon
session, we instead reconvene to continue our clause-by-clause
discussion at 1:30 on February 19.
Ms Lankin:
I would like to just put on the record my concern about the
process of consideration of this bill from this point
forward.
One of the obvious
threshold questions for legislators in the province of Ontario,
where we know there is a federal law that is a superior law in
the sense that the provincial law must defer to it and when we
have the commissioner telling us that he is of the firm belief
that it will in no way meet the test of substantial similarity,
given that that's still a cabinet decision to make-I understand
that-I think it's important for a decision to be made about
whether we proceed through the process with this bill, committee
hearings and deputants, as a matter of course, or whether we ask
the parliamentary assistant to take some time with the new
minister and consider whether we as a committee work to try to
address some of the shortfalls in this bill or whether the
government chooses to do that without the committee, and that
that work be done before deputants are asked to come forward.
If we can assume-this may
be a big assumption, but I'm guessing, based on what I've heard
today, that the end shape of any bill that is going to be passed
is going to be dramatically different from the one that is before
us right now. I don't think it's fair to the public interests
that have asked to come forward to ask them to comment on a bill
that we probably all know, with basic common sense, is going to
be dramatically changed. I'd rather see that work done, given to
people, and a chance for them to respond based on the new
bill.
The Chair:
Thank you for those comments. I'm not going to entertain any
debate. The fact of-
Mr Wood:
Can I make a comment here?
The Chair:
Well, we're actually over our time. You can make a very brief
comment.
Mr Wood:
If you don't mind. I think that comment touches on a significant
point. What I'd like to do is take that back to the ministry.
There are two sides to that issue. One is, should we hear these
people and find out what they're saying on the issue, which is
important, or should indeed we say we're going to take a look at
a different bill, if indeed that's what we're going to do, and
defer it? It's a point that will be taken to the minister for
consideration.
1320
Mr
O'Toole: If I could just make one comment, with respect,
I'm not sure on what grounds, unless it's a generalized
presumption at this point of what's substantially similar and
consistent with, without the body of the points, the model of
what that means. So if there is one-you said you were going to
report to cabinet with respect to consistency and substantially
similar. I think we need your guidance, quite seriously, to
go forward. All of
this has, I'm sure, been broadly consulted; I'm sure our ministry
people have on two or three occasions that I'm aware of. So we
need that kind of guidance, otherwise we are spinning our wheels,
because we could just throw it in the garbage after six months of
consultations. We should listen to your sage advice.
Mrs
McLeod: Can I second what Mr O'Toole has just said in
one further respect? Ms Cavoukian undertook yesterday to do a
significant piece of work in terms of proposing amendments to
this bill. I'm not sure how to put these two things together, but
it would obviously be totally inappropriate for Ms Cavoukian to
be asked to do that kind of work for us if in fact this bill, as
it currently exists, is not going forward. I'm wondering if there
is a way of the federal office and the provincial office in some
way working together to produce the kind of model that Mr O'Toole
is talking about. It seems to me that essentially that's our only
hope for having a piece of legislation with which we can go
forward with the kind of consensual process we've been
discussing.
Mr Wood:
Could I make one other suggestion? I think if change is indicated
or considered, the subcommittee might deal with that. Simply, if
I receive word there's some interest in not proceeding with the
hearings, the subcommittee can deal with that. Is there any
objection to that?
The Chair:
That, I would argue, is the only mechanism to interfere with the
order of the House under which we are operating.
Ms Lankin:
Yes, but-
The Chair:
Ms Lankin, if I may-as I said, I didn't want to enter the
debate-the whole point of inviting the Ministry of Health back
was to hear their response to Ms Cavoukian and Mr Radwanski. I've
sat through a number of bills. It is not the practice of the
House to necessarily change direction on the basis of any one
submission. I think to do justice to this and to respect the
order of the House, it is incumbent on us to listen to all sides,
obviously. I've taken the suggestions from all three parties. I'd
be happy to have the subcommittee meet between now and the 19th,
if that is your wish, and we can debate this matter further. But
in the meantime, I think in order to be fair to the Ministry of
Health, they should at least be given some time frame in which to
prepare their response, not just to Mr Radwanski but to Ms
Cavoukian as well. That's all that we have done here today in
suggesting that the next meeting of the committee is the
19th.
Mr
Radwanski: Mr Chair, if I could make one comment on Ms
McLeod's point, to avoid any misunderstanding. While I'm happy to
provide the kind of input that I did in this setting, and would
be happy to provide if I'm asked questions as we go, I wouldn't
want there to be any sense that I've undertaken a process where
my office and the office of the Ontario commissioner would be
involved in somehow jointly trying to draft amendments to
provincial legislation. That would be-
Mrs
McLeod: But you could comment on the compatibility of
proposed amendments.
Mr
Radwanski: I can comment when something is put before
me-
Mrs
McLeod: Right. That's really all I meant.
Mr
Radwanski: -in total, whether it would be substantially
similar. But the office can't be involved in a joint process of
drafting amendments, because that would be completely
inappropriate.
Mrs
McLeod: My thinking was that any amendments that were
proposed by Ms Cavoukian could have already-it could have been
determined whether or not they met the test of compatibility,
which would enhance our comfort level with them proceeding.
Mr
Radwanski: If you show us a bill, we'll tell you whether
it meets the test, in my view, but I can't really go beyond that
in terms of amendments and how they would merge with other stuff
and so on. But I can provide any input that I can properly
provide.
Ms Lankin:
Just in response to you, Mr Chair, thank you for the lecture. It
wasn't required. My intent was to communicate with the
parliamentary assistant on the record that I think it was a
preliminary issue that should be discussed. He has undertaken to
do that. I'm quite satisfied with that. I think in terms of
fairness to the ministry, it's something I have a record of.
Again, I don't think a lecture is warranted.
I would like to say that
the comment or the suggestion that I think the parliamentary
assistant was making with respect to the subcommittee was also
seeking the committee's agreement that the subcommittee could
make a decision with respect to that, as opposed to a
recommendation to come back, should we choose to do it. It may be
just useful to have that motion on the record. It may not be of
any assistance to you, Mr Chair, I don't know.
The Chair:
It also would be out of order. The subcommittee can make
recommendations to this committee. Only the committee can approve
any change in direction. I would be happy to have the
subcommittee-
Ms Lankin:
The committee can give a certain decision to the subcommittee by
a motion here that the subcommittee can determine whether we
return on the 19th or not, for example. It has to be spelled
out.
Mr
Radwanski: Mr Chair, I express my thanks and take my
leave.
The Chair:
Absolutely, Mr Radwanski. Thank you very much.
Mr
Radwanski: It has been a great pleasure to have this
opportunity.
The Chair:
With that, the committee still stands adjourned until February 19
at 1:30.
