Interview with Industry Canada

August 2003

Terry McQuay, Nymity's president, spoke with Richard Simpson, Director General of Industry Canada - Electronic Commerce . Industry Canada mandate, through its programs and services, is help build a dynamic and innovative economy where all Canadians have the opportunity to benefit from more and better paying jobs, stronger business growth, and a marketplace that is fair, efficient and competitive. Industry Canada is responsible for sixty-three Acts of which eight are consumer related, including PIPEDA, The Protection of Personal Information and Electronic Documents Act.

Nymity: Richard, please provide our subscribers with some of your background and an overview of your role at Industry Canada.

Simpson: I have been the Director General responsible for electronic commerce in Industry Canada for about five years now. Before that time, I was the Executive Director for the Information Highway Advisory Council, a private sector body, which in the mid 1990's played a key role in the development of Canada's policies on the information economy, including policies for the protection of privacy.

As the DG for e-commerce, I am now responsible for policies and strategies to promote the growth of electronic commerce and e-business in Canada. This includes the laws and policies which apply to privacy protection, specifically the implementation of the PIPEDA, digital signatures and electronic authentication, e-commerce security and cryptography, and spam. We also work closely with the private sector; for example with the Canadian e-Business Initiative (CeBI) on strategies to encourage rapid and more effective adoption of e-commerce by Canadian businesses, especially SME's.

Nymity: Please explain the role of Industry Canada in relation to the PIPEDA and the protection of privacy and how this relates to the role of the Privacy Commissioner of Canada.

Simpson : The Department is responsible for supporting the Minister of Industry in fulfilling his responsibilities regarding the implementation of the PIPEDA. This requires the Department to be active on a number of fronts, both on the domestic and international scene. On the federal/provincial front, the Minister is responsible for advising Cabinet on the recognition of provincial privacy legislation to ensure a harmonized approach to privacy protection across the country. The Department is also involved in the preparation of regulations that allow certain private organizations to operate under the Act while continuing to conduct investigations related to fraudulent activities and breaches of agreement.

Industry Canada actively participates in international policy discussions aimed at harmonizing privacy protection approaches across borders. In addition to the formal alignment of the legal regimes for privacy protection of Canada and the EU, accomplished in December 2001, Canada's privacy regime is gaining international recognition in major international fora, such as the Asia Pacific Economic Cooperation (APEC).

Under PIPEDA, the Privacy Commissioner has oversight responsibilities, including general powers to receive and investigate complaints, and to resolve disputes. The Commissioner is given the powers needed for effective investigations so that he can compel witnesses and evidence, and conduct audits where he has reasonable cause to think something might be happening that is contrary to the law. Unresolved disputes can be taken to the Federal Court for final resolution. The court has a range of remedies, from ordering an organization to correct its practices or publish notices of its actions, to awarding damages.
The Commissioner also has a broad mandate to promote the purposes of the Act by conducting public education programs, undertaking research and encouraging organizations to develop privacy policies and practices.

Nymity: Industry Canada has over 150 Canadian programs, services and regulations. How does PIPEDA fit into Industry Canada's overall mandate?

Simpson: Industry Canada's mandate is to help make Canadians more productive and competitive in the knowledge-based economy. The Department's policies and programs contribute to the growth of the Canadian economy and help it provide more and better-paying jobs for Canadians; support stronger business growth through continued improvements in productivity and innovation performance; and give consumers, businesses and investors confidence that the marketplace is fair, efficient and competitive.

The PIPEDA is a key element in the government's efforts to build consumer and business confidence in the knowledge economy, in particular in the digital marketplace. Clear and consistent rules to protect personal data and ensure free flow of information-based services is essential to ensuring that Canadians can, with confidence, participate fully in today's networked economy.

Nymity: The act is meant to "support and promote electronic commerce". Was this the major motivator for Industry Canada to create PIPEDA? What part did international developments, such as the European Union's Data Protection Directive, play in the development of the legislation ?

Simpson: Industry Canada has a mandate to encourage the development of electronic commerce in Canada and the use of electronic networks and systems. To this end, its Electronic Commerce policy, aims to create an environment that is favourable to the growth and adoption of e-commerce, by building trust and confidence in the medium. With this in mind, The PIPEDA was enacted to help ensure that individuals can have confidence in that their privacy will be protected in the electronic world as well as in the traditional marketplace.

The Act was also developed in response to increasing international pressure for the protection of personal information in the course of international trade. The European Commission's recognition of PIPEDA as providing adequate data protection for the purposes of the EU Data Protection will allow for the continued flow of personal information from the European Union to Canada. The adequacy finding establishes confidence in Canada's and the EU's respective privacy regimes and provides a strong basis for the future growth of electronic commerce conducted by both Canadian and European businesses.

Nymity: What would you say are Industry Canada's major responsibilities right now in regards to PIPEDA?

Simpson: On the federal/provincial front, the Department is responsible for supporting the Minister in his advisory role with Cabinet respecting the recognition of provincial privacy legislation to ensure a harmonized approach to privacy protection across the country. The Department is also involved in preparing regulations that allow certain private organizations to conduct investigations related to fraudulent activities and breaches of agreement and still remain compliant with the Act.

The PIPEDA is scheduled for review in 2006. In this regard, the Department has been monitoring issues respecting the application of the Act since it came into force on January 1, 2001, so that these may be further examined, and possibly addressed as part of the upcoming review.

Nymity: What services does Industry Canada provide to the private sector to help organizations comply?

Simpson: To promote a better awareness by SMEs of the PIPEDA's requirements, Industry Canada is developing a website that will provide small businesses with information and guidance on how to comply with the Act.

The Privacy Commissioner of Canada has been mandated to educate the public on the Act's provisions and requirements.

Nymity: What is Industry Canada's position on provincial legislation, for example the proposed Alberta and BC privacy legislation?

Simpson: PIPEDA was designed to encourage the development of provincial and territorial privacy laws, so that individuals and business could benefit from a harmonized set of privacy rules across Canada, which would apply across jurisdictions. Under the Act, organizations that are subject to provincial or territorial laws that have been deemed substantially similar to the PIPEDA are exempt from the federal law.
Privacy laws will be recognized as substantially similar to the extent that they offer a level of privacy protection that is equivalent to that of the PIPEDA. Substantially similar laws will be expected to incorporate the PIPEDA's ten privacy principles, along with independent oversight and redress.

All of this means that we can establish a common set of standards and a "level playing field for all businesses" which will apply under both federal and provincial law, as well as avoid "two-tier" or double regulation.

Nymity: What is the process for Industry Canada to establish if BC and Alberta's privacy legislation are substantially similar?

Simpson : Alberta and British Columbia have tabled privacy legislation that is expected to clear the legislative process late this Fall. The latter two Bills will be reviewed for substantially similar as soon as possible after they have passed into law.

Nymity: Part of Industry Canada's mandate is consumer education. With regards to PIPEDA, what consumer privacy education programs are planned for 2004 and 2005?

Simpson: Industry Canada has published Privacytown, an online guide to protecting consumer privacy and personal information in the online world. This tool, which can be accessed at the following URL: http://strategis.ic.gc.ca/SSG/ca01298e.html , has a broader focus than the protection offered by the PIPEDA. As mentioned above, the Privacy Commissioner of Canada has been mandated to educate the public on the protection offered by the PIPEDA. His Office has published a guide for consumers, which can be accessed on his website at www.privcom.gc.ca

Nymity: How does PIPEDA impact the health care industry? Hospitals?

Simpson: The PIPEDA will have an impact on healthcare sector organizations to the extent that they are engaged in commercial activity. However, the Act is flexible and allows organizations, including those in the healthcare sector, to tailor their application of the Act's principles to their own needs and circumstances.

Nymity: Health Canada's legislative renewal proposal includes 2 sections of note with respect to privacy*: (Subscribers - detail are below). Would this replace PIPEDA for health care?

Simpson: The PIPEDA has primacy over any future legislation, unless specifically noted in the other Act. In the event that Health Canada's legislative renewal does include privacy provisions, the federal government will work collaboratively to ensure that the personal health information of Canadians continues to receive adequate protection.

Nymity: In closing, do you have any words of advice for the Canadian private sector?

Simpson: Remember that consumers will favour those businesses that protect their personal information. Protecting privacy makes good business sense.

HEALTH SURVEILLANCE AND RESEARCH: The Act would clarify the authority of Health Canada to conduct health surveillance and research activities in cooperation with other governments and organizations.

* INFORMATION: The Act would strike a balance between the need to collect, use and disclose health information to protect the health of Canadians, and the need to safeguard privacy and commercial confidentiality.