PERSONAL HEALTH INFORMATION PRIVACY ACT, 2000 / LOI DE 2000 SUR LA CONFIDENTIALITÉ DES RENSEIGNEMENTS PERSONNELS SUR LA SANTÉ

PRIVACY COMMISSIONER OF CANADA

CONTENTS

Thursday 8 February 2001

Personal Health Information Privacy Act, 2000, Bill 159, Mrs Witmer / Loi de 2000 sur la confidentialité des renseignements personnels sur la santé, projet de loi 159, M^me Witmer

Privacy Commissioner of Canada
Mr George Radwanski

STANDING COMMITTEE ON GENERAL GOVERNMENT

Chair / Président
Mr Steve Gilchrist (Scarborough East / -Est PC)

Vice-Chair / Vice-Présidente
Mrs Julia Munro (York North / -Nord PC)

Mr Toby Barrett (Norfolk PC)
Mrs Marie Bountrogianni (Hamilton Mountain L)
Mr Ted Chudleigh (Halton PC)
Mr Garfield Dunlop (Simcoe North / -Nord PC)
Mr Steve Gilchrist (Scarborough East / -Est PC)
Mr Dave Levac (Brant L)
Mr Rosario Marchese (Trinity-Spadina ND)
Mrs Julia Munro (York North / -Nord PC)

Substitutions / Membres remplaçants
Ms Frances Lankin (Beaches-East York ND)
Mrs Lyn McLeod (Thunder Bay-Atikokan L)
Mr John O'Toole (Durham PC)
Mrs Sandra Pupatello (Windsor West / -Ouest L)
Mr Bob Wood (London West / -Ouest PC)

Clerk / Greffière
Ms Anne Stokes

Staff / Personnel
Ms Susan Swift, research officer, Research and Information Services

The committee met at 1110 in committee room 1.

PERSONAL HEALTH INFORMATION PRIVACY ACT, 2000 / LOI DE 2000 SUR LA CONFIDENTIALITÉ DES RENSEIGNEMENTS PERSONNELS SUR LA SANTÉ

Consideration of Bill 159, An Act respecting personal health information and related matters / Projet de loi 159, Loi concernant les renseignements personnels sur la santé et traitant de questions connexes.

PRIVACY COMMISSIONER OF CANADA

The Chair (Mr Steve Gilchrist): I call the committee to order. My thanks to all who have indulged the late starting time. Our first order of business today is to hear from the office of the Privacy Commissioner of Canada, Mr George Radwanski.

Mr Radwanski, if you'd like to come up to the witness table there. Thank you for coming all the way in from Ottawa and congratulations for planning far enough in advance that you weren't held up.

Mr George Radwanski: Thank you, Mr Chairman. Honourable members, good morning. I'd like to start by expressing my appreciation for the invitation to speak to you today. I'd like to make a substantive statement and, following that, I'll be happy to take your questions. I understand that notwithstanding the vicissitudes of the weather, we have two hours, and I am entirely at your disposal.

Privacy is an issue of importance to all Canadians, and your invitation is, in my view, an example of excellent co-operation across levels of government. This legislation is a very serious matter. I regretfully find that, in its current form, it is an assault on health privacy rights, not a defence of them. The legislation appears designed, in fact, to ensure that the government of Ontario and a virtually unlimited range of other organizations and individuals could have unrestricted access to the most private health information of every Ontarian.

I have very serious concerns about this and I'm grateful for the opportunity to bring these concerns to you and to the people of Ontario in this forum. I know that you heard yesterday from the Ontario Information and Privacy Commissioner, Dr Cavoukian, and that she expressed many of the same concerns I will be sharing with you today. But in those instances where it may sound like we're covering the same ground, I trust that you will regard that as not merely repeating, but reinforcing a message that very much deserves reinforcement.

I know that you will also be hearing from representatives of many interest groups, and that there are some who might consider privacy advocates to be just another such group, but if that's true, then it's a very, very large interest group. All of us, when it comes to our own lives, are advocates for privacy. None of us wants to go through life feeling that at any moment someone may be, either metaphorically or even quite literally, looking over our shoulder. If we have to weigh every action, every purchase, every statement, wondering who might find out about it, misconstrue it, judge it or somehow use it to our detriment, we are not truly free. That is why privacy is a fundamental human right, recognized in the United Nations Universal Declaration of Human Rights, and no aspect of privacy is more fundamental than the privacy of our health information, information about the state of our own bodies and minds.

In the 1920s, Justice Louis Brandeis of the United States Supreme Court defined privacy as "the right to be let alone." But today we may think we are alone while our privacy is being invaded from a distance by ever more sophisticated methods of surveillance and information gathering. So I would define privacy as the right to control access to one's person and to information about oneself.

In an age when information crosses oceans and continents at the click of a button, when information-personal information-has itself become a commodity, that right to privacy is under threat as never before.

I have said many times since I assumed this position a few months ago, and I will say it again today, that I believe privacy will be the defining issue of this new decade. That's because we are at a crossroads. The choices we make now, the paths we follow over the next few months and years will to a very large extent define the type of society we leave to our children.

Until relatively recently, privacy was protected pretty much by default. As long as information about us was in paper records scattered over many locations, someone would have to go to a great deal of trouble to compile a detailed dossier on any particular individual. But now the move to electronic record-keeping is eating away at the barriers of time, distance and cost that once guarded our privacy from all but the most determined of snoops.

We are also under almost constant surveillance. Cameras record us at the bank machine, at the corner store and at the casino, and biometric recognition technologies can rob us of our anonymity. Computers record every time we use an electronic pass card to enter or leave our workplace, for instance, or our parking garage. The personal information that is being collected about every one of us just as a matter of routine is mind-boggling: debit card records, credit card records, telephone records, the movies we rent, the books we borrow, the Web sites we access-you name it. The surveillance is so pervasive, the data banks so diverse and the computer networks so efficient that individuals have no idea who has what personal information about them, let alone what's being done with it.

This is why we now have the federal government's new Personal Information Protection and Electronic Documents Act, in effect since January, to give Canadians clear privacy rights in their dealings with the private sector, and it is why we have a federal Privacy Commissioner, who has been given the mandate to see that the law is respected. It's what civilized societies do: recognize certain fundamental rights and do what they can to keep them from being abused.

So I appear before you today as the Privacy Commissioner of Canada, an officer of Parliament appointed to be the guardian and champion of Canadians' right to privacy. The Privacy Commissioner of Canada does not work for or report to the government. The Privacy Commissioner works for and reports directly to the people of Canada through our national Parliament. It is my responsibility as the Privacy Commissioner of Canada to stand up for the privacy rights of all Canadians. The right to privacy is not divisible. It cannot be respected federally and violated provincially. It cannot be respected in one part of the country and violated in another. The door to our personal information is either closed or open. If it is open, it makes little practical difference which level of government has done the opening; our privacy is lost.

This is made very clear in the federal Personal Information Protection and Electronic Documents Act. In jurisdictions that do not have substantially similar legislation in place by the beginning of 2004, the federal act will apply to the entire commercial sector. To that end, the Privacy Commissioner of Canada is mandated under this act to report to Parliament on the extent to which provincial governments have passed legislation that is substantially similar.

I believe it is therefore very appropriate and very necessary for me to take this earliest possible opportunity to tell you that it is my considered opinion that the proposed legislation you are examining would fall fundamentally short of meeting this test. It is not substantially similar. It is radically different in content, in spirit and in apparent intent.

It is worth pointing out here, I think, that the new federal privacy law does not qualify as groundbreaking legislation. It does not set Canada apart, and it does not impose any kind of regulation that our trading partners are not prepared to implement or have not implemented already. The federal act is based on a set of internationally recognized principles of fair information practices, principles that have been refined to suit the Canadian reality through several years of consultation with Canadian business, consumer, and other groups. There is no doubt that the federal legislation represents a significant step forward for privacy in Canada, but it really does no more than bring us up to the minimum international standard. It recognizes the fundamental values of allowing individuals to retain some control over their personal information, and provides them with certain legal remedies and protections when they feel their privacy rights have been violated.

1120

These protections are all the more critical when the privacy and confidentiality of our personal medical information is involved. I can think of few other areas of our lives where we would want greater control than over our health information. When we talk about confidentiality, we are talking about trust. When we take someone into our confidence and share something personal about ourselves, we do so in the belief that we can trust that person not to divulge the secret to anyone else. This concept of trust is at the very heart of the doctor-patient relationship. As far back as the days when the Hippocratic oath was first conceived, it was understood that there can be no effective physician-patient relationship unless patients can feel free to be totally open and candid about their symptoms, habits, lifestyles and concerns. Doctors cannot provide good diagnosis and treatment without full information, and people are not likely to surrender full information if they fear that it might somehow be used against them. Even though we may not know our physicians especially well on a personal level, we do know that they have taken an oath to respect our privacy. We trust them to respect that oath. We tell our doctors things about ourselves we might not share even with our spouses, let alone our employers, our bankers, casual acquaintances or the government.

This privacy of personal health information is not only a fundamental human right, it is also a very important social good. We all have a stake in ensuring that our society as a whole is as healthy as possible. We all benefit when health care costs are kept down through early diagnosis, treatment and prevention programs, when contagious ailments are identified as early as possible, and when people with conditions that might cause accidents in the workplace or on the roads have them diagnosed and treated before harm is done. Yet it is no exaggeration to fear that lack of confidence in the privacy of health information could lead people to avoid seeking treatment. If someone is feeling severely stressed and angry at work, is that person likely to share this with their doctor and get psychological help if there is even a chance that word might immediately get back to his employer? Is someone more or less likely to get a recommended blood test if all the details of the results might become known by an endless array of unknown third parties? Those choices are likely to be shaped by the realization that a violation of health care privacy can be catastrophic for the individual. It could change your entire life and deny you a whole range of opportunities.

Suppose, for instance, that your genetic profile were revealed to an especially interested third party. Your entire family could be stigmatized for generations to come. If you think this is far-fetched, I would draw to your attention that this week the newspaper the Independent in London reported that the Council for Responsible Genetics in the United States has identified more than 200 cases of genetic discrimination in employment, and these are cases where individuals lost or were denied employment even though the statistical risk of a debilitating condition arising was small, where the condition would not arise until much later in life, or where the condition could be treated. So these are not hypothetical concerns.

As with so many other aspects of our privacy, the security of this most personal of trust relationships, the relationship between patients and health care providers, is threatened. There is a powerful and steadily increasing demand for our personal health information from any number of secondary users. Much of the time we don't even know who they are.

The Canadian Medical Association has recognized the threat and has responded with its excellent health information privacy code. But with legislation like you are examining today, we are staring at the possibility of a user fee that no one could have imagined. We cannot allow our privacy to become the price of admission to our health care system.

Patients have a right to expect and be entirely confident that health information about them will not be collected beyond what is necessary for their care. They must be confident that the information will not be used for any purpose other than their care, or disclosed for any reason other than their care. Certainly they must be confident it will not be put to any use that could do them harm.

In my view, the proposed Personal Health Information Privacy Act falls desperately short of meeting that standard in a number of critical areas. It permits far too many people to access, collect, use and disclose personal information, often without regard to whether it is necessary for the care of the individual. It gives the Minister of Health-that is to say, the government of Ontario-broad powers to access and disclose personal health information at will through regulation. It permits the collection, use and disclosure of personal health information without the consent of the individual in far too broad a range of circumstances. It denies individuals ready and assured access to their personal health information, as well as the means to correct it. It fails to provide the powers of oversight needed to ensure that privacy rights are respected, and effective means of redress when these rights are violated.

Let me turn now to the specifics. But I have to begin by telling you that this legislation is so extraordinarily convoluted that one would have to go through it clause by clause to parse all the exceptions, loopholes and openings for regulation that make most key provisions mean something quite different than what might at first appear. That would probably take all day, not the limited, though generous, time I am accorded this morning. So even though this is meant to be a technical briefing, I'm going to have to provide a somewhat broader and more schematic, less technically detailed overview than might be ideal.

That being said, the first major flaw of the bill is a lack of effective restriction on how and by whom personal health information may be accessed, collected, used and disclosed. This problem begins in section 2 with the almost absurdly broad listing of who qualifies as a health information custodian, that is, a person who can lawfully have custody or control of your health information. This list includes obvious health care providers such as doctors, hospitals, pharmacies and laboratories, and that's only normal. But it also includes many others that a patient would not be likely to see as having any legitimate business accessing such deeply private information, including the minister, members of district health councils and absolutely anyone else the cabinet decides to designate by regulation.

In my view, there is something fundamentally wrong right from the very outset with legislation that says that the Minister of Health has exactly the same right to hold your personal health information as your own doctor.

Although section 12 would appear to set some limits on the collection, use and disclosure of personal health information, the wording of the section is often vague, and even where limits are clear, they are often qualified by statements such as "more than reasonably necessary" and "to the extent reasonably possible."

The limits on collecting, using and disclosing personal health information are made weaker still by the fact that they would not apply to most of the people who do these things. As long as information was being collected or disclosed "for the purpose of providing or assisting in providing health care to an individual," then doctors, hospitals, pharmacists, nursing homes and laboratories, and others, would not be bound by these limits. There is no explanation why, for example, these custodians should be allowed to collect more information than they need to meet a specific purpose-a standard test under fair, accepted information practices.

1130

Cancer Care Ontario and registries of various diseases and conditions are also exempted from the limits on collection, use and disclosure, although it is not at all clear why. By including these organizations, the proposed legislation stretches the definition of "providing, or assisting in providing, health care to an individual" beyond what most would consider reasonable.

If Bill 159 provides few meaningful limits on the collection of personal health information, there are even fewer limits on disclosure. Subsection 12(9) and sections 29, 30, 31, 32 and 36 together allow for the disclosure of personal health information in a wide range of situations with few limits. With very few exceptions, these sections would allow anyone from a hospital administrator to a graduate student researcher to have access to your personal health information without your permission, without your knowledge and without regard to whether it is necessary for your health care.

That is a brief overview of problems related, in general, to collection, access and disclosure.

The second major failing of this act is the broad discretionary power it gives the Minister of Health to override its provisions. Section 30 allows health care custodians to disclose personal health information to the minister for a variety of reasons. This section also allows the minister to disclose personal health information to anyone the minister designates by regulation, and the next section allows the minister to order disclosure of an individual's personal health information.

These disclosures of personal health information to and by the minister can take place with virtually no accountability. There are provisions for review by the commissioner, but the conditions for review are so narrow that these arbitrary disclosures would rarely if ever require justification. It is in fact a distinguishing characteristic of this bill that it would allow the minister and the government virtually total power over the personal health information of everyone in Ontario.

They can decide by regulation that anyone they want is designated to be a custodian of health information, they can access anyone's health information by having the minister direct disclosure to himself or herself, and they can then disclose that information, in turn, to anyone designated by regulation. How that can be called a privacy bill is very frankly beyond me. In fact, to allow those in a position of political power the latitude to invade the privacy of individuals in this way would be extraordinary and simply unacceptable in a free society.

A third major failing of the proposed legislation is in the area of consent. Consent and privacy cannot be separated. If privacy is a right to control access to one's person and to personal information about oneself, as I indicated earlier, then it is the very essence of privacy that you cannot obtain, use or share my personal information without my permission. There is no control without the right of consent, and there is no privacy without control. It follows that the requirement for consent must be at the heart of any good privacy law. The collection, use and disclosure of personal information without the individual's consent should occur only in the most exceptional of circumstances, but this act would allow all three in a variety of circumstances.

Section 22, for example, offers a list of situations in which an individual's personal health information could be collected from a third party. Several of these would allow someone's personal information to be collected from some other source without either knowledge or consent.

Section 27 details numerous ways an individual's personal health information can be used without their consent. In one instance, the legislation would allow someone's information to be used without consent for "a purpose that is directly related to the use for which it was collected." This is a variation on a phrase that has been used in some privacy laws in the past. I say "in the past" because it was found to be too open to interpretation and allowed a lot of secondary uses for personal information that bore only a very remote connection to the original use.

The principles of fair information practices require that personal information cannot be put to a second use, related or otherwise, without the consent of the person from whom the information was collected. Many of the secondary uses that would be allowed under this legislation also involve disclosure of personal health information without consent, another violation of the basic principles of fair information practices.

I have already discussed the many ways sections 29, 30, 31, 32 and 36 would allow disclosure without either the knowledge or consent of the individual. I find the allowance for disclosure of personal information for research purposes to be a particular affront to the notion of consent. Section 32 says that a custodian can disclose personal health information to a researcher provided a research ethics review board has approved the researcher's project. Not only is the right of individuals to give or withhold consent denied, but someone else would have the power to exercise that right for them. Further, there is no assurance in the legislation that an ethics review board would include anyone with an interest in patients' rights, let alone patients' privacy rights.

I turn now to the fourth major failing of this act. The fundamental principles of fair information practices which I have said are considered the minimum standard for the protection of privacy state that an individual has a right to access their personal information and to make corrections to that information if there are inaccuracies. And yet, section 44 of the legislation says that patients have no right of access whatsoever to several categories of their personal health information, including personal health information exempted from access by whatever regulations the government chooses to pass.

Section 48 would allow a custodian to refuse a person access to their information if it could be expected to result in harm to the treatment or the recovery of the individual. This is stated broadly enough that a person with no medical training could use this provision to deny access.

Custodians would charge a fee to allow people to see their personal health information. Since the fee would be set by regulation, we have no way of knowing whether this would present yet another barrier to access.

Individuals could ask the custodian of their personal health information to correct errors or omissions in the record, but the custodian can refuse. If the custodian did refuse but added a statement of disagreement to the individual's file, that would be the end of it. The individual would lose any right to complain to the Information and Privacy Commissioner. This is important because obviously a finding by the commissioner that the record is wrong would carry a lot more weight than a simple statement of disagreement from an individual.

This mention of the commissioner brings me to the fifth major failing of the proposed Personal Health Information Privacy Act. It permits neither sufficiently effective oversight to ensure that privacy rights will be respected, nor sufficiently strong means of redress when these rights have been violated.

Section 68 allows individuals to file a complaint with the Information and Privacy Commissioner, but they must pay a fee to do it. The fee would be set, not by the commissioner but by the regulations. This extremely unusual provision raises the possibility that your ability to exercise your right to privacy would be determined by your ability to pay for the privilege.

Section 68 also provides that the commissioner would have to conduct the review of any complaints in accordance with procedures to be set out by the government in regulations. I must say that, given the skill, knowledge and experience of the commissioner's staff, I fail to understand how or why the government would try to improve the procedures already in place. But it's clear that telling the commissioner how to do her job would be the very opposite of independent, arm's-length oversight.

I am equally troubled by the distinction between the right of review under section 68 and the power of inquiry under section 69. The power of inquiry allows the commissioner to investigate a complaint by demanding the production of documents, entering premises to obtain them, and summoning the witnesses to testify under oath if any of these are necessary. The Privacy Commissioner of Canada has those powers with regard to investigating any complaint or conducting any audit. The right of review, on the other hand, comes without any power. The Ontario commissioner can ask for information or documents, but if the request is denied, she's out of luck and that's the end of it.

1140

Under section 68, the commissioner would have only the right of review with regard to any complaints about the collection, use or disclosure of personal health information. People would have to pay to have their complaints considered, the commissioner's activities would be potentially restricted by regulations, and then she wouldn't necessarily even be able to obtain any documents or information to assess the merits of the complaints. With all respect, that would be a travesty of oversight.

The commissioner would have the power of inquiry under section 69 only with regard to the right of individuals to see their personal information and to have a statement of disagreement attached.

There are also important gaps in the provisions for redress. If the commissioner reviewed a complaint and found that personal health information was being collected in contravention of the act, section 68 enables her to issue an order to cease such collection and to destroy the improperly collected information. But there is no corresponding power to stop the unlawful use or disclosure of personal health information. The commissioner could neither issue a direct order to end the wrongdoing nor ask a court to do so. All she could do is make comments or recommendations.

I'm at a loss to understand this lack of symmetry. All I can speculate is that the provisions regarding collection are so broad that it would be hard to find any collection unlawful, that the drafters of this bill didn't want to take even the slightest chance of having restrictions imposed on the use or disclosure of health information.

In the case of complaints about the rights of individuals to access their own information, the commissioner can order a custodian to let the person see his or her personal health information. When the accuracy of the information is in dispute, the commissioner can order the custodian to attach a statement of disagreement to a person's file. Orders made by the commissioner could be appealed to the Divisional Court, whose decision would be final, but there is no general right to appeal the failure of a health information custodian to follow the requirements of the law.

Those are what I would classify as the most major failings of the proposed legislation. It is by no means a complete listing of my concerns.

Computer matching of personal health information, for instance, is a big concern because of the exceptions in section 14. Only rarely would the commissioner be able to review and comment on any proposed matching before it took place. In essence, computer matching is another disclosure without consent.

I also have extremely serious misgivings about section 76, dealing with the regulations. This section would grant discretionary powers to the Lieutenant Governor in Council-the cabinet, in other words-to change by decree many, if not most, of the key provisions and definitions in the act.

All of this brings me back to the point I raised earlier about the extent to which this act could meet the test of being substantially similar to the federal privacy legislation. This is an important test. As you know, in provinces that do not have substantially similar laws in place by 2004, the federal Personal Information Protection and Electronic Documents Act will apply. In the health care field, that would mean that key parts of the sector, including doctors' offices, laboratories, some clinics and pharmacies would fall under the jurisdiction of the federal act.

In applying this test and reporting my findings to Parliament, I will interpret "substantially similar" as meaning equal or superior to the federal law in the degree and quality of privacy protection provided. The federal law is a threshold or floor. A provincial privacy law must be at least as good or it is not substantially similar. I regard substantial similarity as involving all the 10 principles in the CSA code of privacy protection, but as having four particularly key components: consent, access and correction rights, oversight and redress.

In every speech and interview I have given and in the information materials issued by my office, I have stressed that these are the main features of the new federal law. Except in very limited and specific circumstances, no organization can collect, use or disclose personal information about you without your consent, and they can collect, use or disclose it only for the purpose for which you gave consent.

You have the right to see the personal information an organization has about you and to have it corrected if it is wrong. If you believe that your privacy rights have been violated or that the law is not being respected, you can complain to the privacy commissioner, who has full oversight power to investigate your complaint. If the commissioner finds your complaint well-founded but is unable to negotiate a satisfactory resolution, there are two forms of redress: he can bring pressure to bear on the organization by making his findings public and he can ask the federal court to order the organization to comply with the law, as well as to award damages to the complainant. You can also apply to the federal court yourself for these remedies. The decision of the federal court can be appealed to the Supreme Court of Canada.

I don't want to belabour the obvious by pointing out in any great detail how far the proposed Ontario legislation falls short of being similar to these provisions. The federal law says that consent must be informed and that any collection, use or disclosure of personal information without consent must have a clear and compelling rationale. The legislation we are discussing today recognizes consent, but too often does not require it. This legislation not only allows disclosure without consent, it requires custodians to release personal information to the minister, regardless of patient consent or knowledge.

On access and correction rights, the federal law is clear and open. The Ontario legislation is restrictive and not transparent. Under Bill 159, people would be denied any access to whole categories of personal information, including some categories yet to be defined under the regulations. When access is granted, a fee is required to see it. If access is denied, a fee is required to lodge a complaint. If your information is incorrect or incomplete, the custodian can end the matter by attaching your statement of disagreement to the file. You have no other recourse under the legislation. The federal law allows the individual to challenge the accuracy of the information and to have it amended as appropriate.

With regard to oversight, under the federal act, the Privacy Commissioner of Canada is a fully independent ombudsman with a mandate to resolve privacy complaints through investigation, mediation, conciliation and recommendation. If necessary, the Privacy Commissioner of Canada can use broad and unhindered powers of investigation. He can seize documents, enter premises and compel testimony. He can also initiate audits of an organization's privacy practices. Bill 159, in contrast, does not give the Ontario commissioner the appropriate tools to carry out investigations of complaints, other than complaints about denial of access.

As for redress, the federal act allows the commissioner or individual to apply for a hearing in the federal court of Canada. Based on that hearing, the court may order an organization to correct its information-handling practices and make public the steps it has taken to do so. The court can also award damages for the complainant. Decisions of the federal court can be appealed to the Supreme Court of Canada. Bill 159 does not provide for similarly broad access to the courts. It makes no reference to damage awards, and if a custodian succeeds in having an order of the commissioner reversed by the divisional court, the decision is final; the complainant has no right of appeal.

I am sure you will understand that if Bill 159 were to pass in anything resembling its current form, I would have no choice but to report to Parliament that it is not substantially similar. The final decision would be up to the Governor in Council, but I frankly don't see how anyone could say that legislation that violates or ignores fundamental privacy rights at every turn is substantially similar to the federal law or, for that matter, to meaningful privacy law anywhere in the world.

1150

I'm painfully aware that I've given you a very scathing and critical view of this bill. In the spirit of wanting to be constructive, I would very much like to find some positive things to say about it, but in all truth, looking for good in a privacy bill that violates fundamental privacy rights does not strike me as a particularly constructive exercise.

I am sure that some people would say this bill is at least a start, that even if it were to pass with some of its many flaws uncorrected, the government can be counted on to do the right things over time. To me, that would be the wrong way to approach such vitally important legislation, even under the very best of circumstances. Laws should not be enacted until and unless they can be expected to achieve the purposes they purport to serve. And laws that leave the most important powers up for grabs by regulation are among the worst laws of all, because they defy the requirement for transparency and accountability. But what is even more troubling is that with regard to privacy, it is particularly difficult to assume that this government would in fact do the right things.

This government's record on privacy to date is, I regret to say, far from reassuring. It wants to subject welfare recipients to the privacy invasion of mandatory drug testing. It has twice announced the names of young offenders in the Legislature. It gave the names, addresses and bank balances of 50,000 of its citizens to a polling company. It tried to use personal information to discredit an individual when a staff member offered confidential information about a doctor's income to a reporter. It has sold personal information for profit in the form of names and addresses from drivers' licences. It appears enthusiastic about introducing smart cards with the possibility of province-wide fingerprinting or retina scanning.

I would like to believe that these are the results of a lack of understanding of privacy issues or a lack of sufficient attention to them, rather than of a deliberate willingness to attack the privacy rights of Canadians in Ontario. I very, very much hope that is the case. If so, these hearings on Bill 159 and the public interest I am sure they will generate can perhaps be the occasion for a new focus by the government on the importance of privacy rights and for a rededication to ensuring that they are truly and fully respected in law and in practice.

As for Bill 159, I don't believe a law that is so fundamentally flawed in virtually every provision can readily be fixed. The government would have to rework nearly every section, reverse nearly every policy thrust and rethink nearly every assumption, which would be a massive task with so complex a piece of legislation. My suggestion would be to scrap it and start afresh in a new spirit. I believe the people of Ontario deserve nothing less.

Privacy is not a partisan issue nor a political one. It is not an issue of left or right, of federal versus provincial or of business versus government. It is an issue that goes to the core of our shared values as Canadians and of our fundamental rights as individuals. Privacy is an issue that should unite us, not divide us, and the privacy of health information, that most fundamental of fundamental privacy rights, is not only an issue but an opportunity. It is an opportunity for Ontario to be a model for the rest of the country and for this government to show it is coming to understand the importance of privacy as the defining issue of this new decade. So in keeping with my responsibilities as a Parliament-appointed guardian of the privacy rights of all Canadians, it is my privilege and my duty to recommend that this flawed legislation be withdrawn and that a fresh start be made.

Thank you very much for your kind attention. I'd be happy to answer questions or engage in a discussion.

The Chair: Thank you very much. First question, Mrs McLeod.

Mrs Lyn McLeod (Thunder Bay-Atikokan): I appreciate the fact you have raised a number of concerns and also that there are other specific concerns about the bill which you would raise. In the event that your last recommendation of simply scrapping-

Mr Radwanski: Forgive me, I'm having trouble hearing you with the crosstalk.

Mrs McLeod: You have given us, as you said, a broader overview of some of the technical concerns with the bill. In the event of not acting on your last suggestion and scrapping it and starting fresh, it would certainly be helpful, if possible, to get the further technical outline of concerns you have with the bill. But I want to lead off our discussion with some more general areas-I guess it falls under the question, "What next?"

If I can elaborate just a little on "What next?" in two respects: first of all, if this bill goes forward without the kinds of changes you've discussed today, and your recommendation to Parliament is that this is not compatible with federal legislation, my question of "What next?" stands there. What happens then to the Ontario bill? What is the position of the Ontario bill legally if it is not compatible with the federal bill?

The second part of my "What next?" question is, if the Ontario bill doesn't go forward because of non-compatibility, then where are we in Ontario left in terms of health privacy legislation? I raise this concern in the context of having heard yesterday the plea from the provincial privacy commissioner that we not be left without health privacy legislation, and I think that's a very real concern.

As I understand it, the federal bill really just deals with commercial transactions. It may deal with privacy issues related to health in commercial and private situations, but it would still leave the issue of health privacy, in terms of any exchange of information within the publicly funded and administered health system, without any rules. One of the things we heard yesterday was that there are no rules now governing the collection, use and disclosure of personal health information among those who hold it as public administrators and deliverers of health care.

So my questions are: What next in terms of compatibility? What happens to this bill if it's not compatible? Where does Ontario go because Bill C-54 doesn't solve the problems of health privacy protection?

Mr Radwanski: Those are, I think, very pertinent questions indeed.

On your first question-What happens?-let me take you through the steps. First of all, in due course, I am mandated to report to Parliament on the extent to which provinces have passed legislation that is substantially similar. In this instance, when that time came, if this law passed, let's say, in its current form or anything similar, I would have to report that Ontario, certainly with regard to health care, would not be among the jurisdictions that had passed substantially similar legislation.

The determination to exempt a sector or the entire private sector in a province from the federal legislation is ultimately not up to the commissioner but up to order in council. But obviously that would be guided to some significant extent by the report of the commissioner, and in an instance like this, although one can never presume to speak for the political process, I think it would be extraordinarily difficult for anyone to say with a straight face that legislation like this is substantially similar. So I doubt that would occur, though I cannot presume to predict.

If we were in that situation, I guess part of the answer to your question is that nothing happens to the provincial law, in that it is not disallowed or set aside or anything of that nature. It stands as a provincial law. But what happens is that in the areas covered by the federal law, at the point where it extends to the entire private sector in 2004, federal law takes precedence. So what you have is a reasonably messy situation where there is a provincial law which says that people can or must do certain things, but if they did them, they would be in violation of the federal law and would be subject obviously to the overview of the commissioner, but would also be subject to enforcement even in the courts under the legislation. So for all practical purposes, the standard that would have to obtain would be the federal law. But you would have a situation that is obviously not comfortable, that is not neat and that can best be avoided by having laws across Canada that are substantially similar, which is simply to say laws that genuinely respect the privacy rights of individuals.

1200

Substantial similarity, as I said in my earlier remarks, does not involve meeting some extraordinary standard by any stretch of the imagination. It simply involves showing the minimal necessary record of respect for privacy rights. So that's the first part of my answer.

The second: I'm aware of Commissioner Cavoukian's comments yesterday. I respectfully have a different view. I don't see how the health privacy rights of individuals are assisted by enacting into law privacy legislation that violates those health privacy rights. In fact, the effect would be to legitimize and enshrine in law the right to invade the privacy of individuals in Ontario with regard to their health information.

To me, giving cover of right and of law to what from a privacy perspective is wrongdoing is not progress. It's possible, though I certainly wouldn't want to give a legal opinion, that in some respects it might actually reduce the rights of people to have that kind of deficient law, because at present, if your health privacy rights were egregiously violated and you suffered some serious detriment as a result, in the absence of any law that permits that kind of egregious violation, it is possible that an individual could go to court and obtain damages simply for general violations under tort law. Obviously if it were under cover of right, under cover of law, that would not be the case. So I can't make the argument that badly flawed legislation is better than no legislation.

I believe it is possible, without having to spend another umpteen years, to craft privacy legislation that is substantially similar to, in fact consistent with, the federal law. Past a certain point, quite honestly-it is not even such new ground that it can't be brought forward. A lot of research and work have obviously been done. But I don't believe that anything as badly flawed as this can be fixed by a process of amendment, because you will literally have to go through every clause and in many cases reverse its purpose, reverse its wording.

I would use the example of looking to buy a car in which the engine is shot, the transmission is busted, the body is rusted out and full of holes, and the tires are worn. Yes, maybe it's possible to put in a new engine, replace or rebuild the transmission, reconstruct the body and buy new tires, but if you told someone you were considering getting that car and doing that, I think most sane people would tell you, "Don't do that. Go get another car and avoid all these problems."

I think that's the kind of problem you face with legislation that from start to finish is riddled with deficiencies of this sort. I don't know if that fully answers your question.

Mrs McLeod: Just to comment, governments find this very difficult legislation to bring forward, and this is the first time we've had a health privacy bill come forward and make it this far. It hasn't made it to second reading yet, but it's the first time it's come this far. Suppose the government just says, "Forget it. It's too tough. Let's just scrap the whole thing." I think that's the fear Ms Cavoukian was expressing yesterday. What are we left with? Bill C-54 doesn't speak to much of the area where we need health privacy protection; at least that's my understanding of C-54. Perhaps you could just comment on whether C-54 serves the purpose that needs very much to be met.

Mr Radwanski: It doesn't meet all purposes, obviously. If there were no law, it would cover certain segments, which is somewhat broader than one might think. Obviously, a lot of this will be open to interpretation by the commissioner and maybe eventually the courts. But my view, for instance, is that doctors' practices would be covered by the federal law because-

Mrs McLeod: Would they?

Mr Radwanski: Yes, because a doctor's office is a private sector activity that is for-profit. From whom the profit is received is a secondary concern, so doctors' offices would be covered, laboratories would be covered, a range of clinics would be covered, pharmacies would be covered. That's a large chunk. Hospitals most likely would not be covered, though there are some arguments that could be made. I don't want to make a pronouncement on that, but I would not include them among the ones that definitely would be covered.

You would have gaps, no question. A large chunk of the sector would be covered by law that provides meaningful protection but really is built on the right information practices and that, other than in exceptional circumstances, requires the right of consent, provides redress and so forth. For the rest, you'd have a gap, as you do now.

But frankly, there is one other element to factor in, and that is, when I say that privacy will be the defining issue of this decade, one of the things I am talking about is the degree to which public awareness of the importance of privacy is very much on the rise. You need only look at the media to see there are stories every second day in the media on this. A very important part of my own mandate under the new federal legislation is public education, which means raising the level of awareness in the country, which I am doing in a variety of ways, including things like being here today, and will be doing a lot of over the time ahead. Commissioner Cavoukian and her office also have a role in raising public awareness. The media are on the case.

So my answer to your question is, rather than put in a bad law, don't worry; public opinion will require a good law, and before very long. I don't think we need worry that the public, once it becomes aware of the degree to which personal health information is up for grabs-because I think many people still believe that information that goes from them to their doctor stays there and don't know all the secondary uses, all the ways it goes around. When people know this, I think the issue will be self-limiting and that there will be a climate in which good privacy law can be passed. Frankly, that's better than creating a law that may appear to be doing good things, and it's only, as one goes through experience with it-you know, nobody can read this law and understand what it says.

Let me just add, I have a degree in law and I've spent most of my adult life dealing in one capacity or another with issues that involved reading bills. I have spent hours reading this thing and I have to draw charts. I have to track: "Well, it seems to mean this, so-and-so is covered by this, except there is this other provision where they're not covered." But of course none of this matters, because a regulation may do something yet different. Having a law like that, I would argue we should not be afraid to see it done right.

Ms Frances Lankin (Beaches-East York): Commissioner, I'm tempted to ask you to tell us what you really think.

I guess I want to place on the record that there are a lot of people who will feel reassured by your commitment to the protection of Canadian's privacy and that there is a champion and watchdog in the federal commissioner's position who will do that. Mrs McLeod raised the preliminary question I had as well in terms of, if not this, what? I hear what you're saying clearly.

I feel saddened by that in a sense because I'm well aware of the history of the attempt of many fine people in the bureaucracy of the province of Ontario who have worked to try and bring forward health privacy legislation through at least three governments, several terms of governments and many ministers of health, myself included. And what's interesting about your comments is that you see a change in the political landscape led by public opinion that will make this more of a priority legislative activity for a government. In days of polarized politics and ideological swings in politics, it's not often that a non-ideological bill can find its way on to a government's priority agenda and find its way to a committee for serious work. We're at that moment in time, in a sense.

1210

I've got lots of thoughts about why the government is bereft of ideas at this point in time and how this made it, but it's here and it is a moment in time where members of both opposition parties, Ms McLeod and myself as health critics for our respective parties, have indicated a real interest in working to bring about health privacy legislation, a framework for this province. While we see significant problems with the bill, we were willing to, through this process of hearings, take this to a working table where we sit down and seriously work through consensual amendments to build a good piece of legislation with tripartite support.

I think that's what our Ontario commissioner was urging us to do. I believe I'm in substantial agreement with you about the nature of the job, how big a job that would be, but I would genuinely hate to see this bill pulled from the public agenda at this point in time as a result of your urging, and hope that among things like a cabinet shuffle happening today, a new minister-although I can see some of the political staff of the outgoing minister probably feeling a little bit like there's a silver lining in this move that they hadn't thought of before, not having to deal with the fallout of today. A new minister, a potential House-proroguing-there are a lot of issues that could really just set this whole initiative back two or three years at this point in time, despite what you're saying, that there's growing public pressure.

I guess I still, in the context of our work, hope that we can work to fix the very many problems-substantial problems. As I listen to you, I hear the problems listed, if I can summarize and you can perhaps tell me if I've got it right. There is not enough protection in terms of collection of information, what we collect; there is too much directed disclosure; there is too much discretion in terms of what the minister can do after the fact through regulation; there is not enough guarantee of access to one's own information; there is not sufficient oversight and accountability through the commission; and there's not adequate redress for individuals. Wrap it all up in a very complex bill that's not very transparent and you've got a big problem.

I would be interested in, first of all, your comments in those areas. Do I understand what you're saying clearly? Are those the key problems? If we had an undertaking of the three parties to move to some kind of working process here to reconstruct the bill rather than scrap it-because I give you my political caution that it won't be back in a couple of months, it will take much longer than that-can we count on a dialogue being opened, as we have with our Ontario commissioner, with your office in which the legislative drafters have an opportunity to seek your input on the issue of substantial similarity? I think one of the things that's been difficult for the Ontario policy developers and legislative drafters was for them to know what standards would be used for judging substantial similarity. I think you've made that much clearer today. Perhaps if we could have a line of communication established with you as we engage in this project and the people within the ministry who will be doing much of the work of rewriting, that might move us quicker than your suggestion of actually pulling this off the table and starting again.

Mr Radwanski: I hear what you're saying. Let me try to respond.

Ms Lankin: And remember, this is an opposition member speaking here.

Mr Radwanski: It's not my job to take that into account one way or the other. In fact, I was just going to say that it's not for me to comment on the politics of this one way or another.

I guess in one way what you are describing in terms of the work of this committee-if you are saying in effect that this committee could rewrite this bill more or less from start to finish and produce a good privacy law, obviously what matters is the outcome. If your committee can basically change every provision and in effect start from scratch and write a meaningful privacy law, then I suppose it wouldn't much matter if the desired end was achieved by your committee doing that rewriting or if the bill is withdrawn and another process produces a good privacy bill. So in that sense, whether it's withdrawn or rewritten here or anywhere else is not the crucial issue.

My concern is that what normally happens in this kind of process is there is some amendment, some improvement. A lot, in the case of a bill like this, of really unfortunate features would still remain. Then it gets put through under the guise of being much-improved legislation and you end up with a law which still falls far short and which leaves privacy rights very badly at risk. That would be a very unattractive outcome. That is really my concern, and frankly, when one looks at rewriting and fixing this bill, wherever it's done, it's a Herculean task and it would be an unusual task for a committee to be able to achieve, in my view. I'll put it that way.

Again, I won't argue against it. If it can be done, more power to you. But if this weren't called a privacy bill, if the name of this were the Widest Possible Access to Personal Health Information Act, I don't know if one would still be saying, "We can fix it with a few amendments here and there," because that, in its essence, is what it is. So one is talking not about changing a word here or there, modifying a clause; one is talking about, as I've said, reversing the policy thrust of most provisions, removing a huge host of exceptions. You end up with a new bill. If it can be done in committee, that would be a marvellous achievement for a committee, but it's what matters at the end of the day that is critical.

On your second question, we're into virgin territory here, of course; this is all new. The law is new; the issues this province is trying to pass legislation in compliance with are new. Certainly I'm open to an ongoing dialogue with myself and my office and would be glad to be helpful in whatever way I can. I guess the only caveats are that my office too does not have unlimited resources-far from it-and there may be a lot of provinces with a lot of legislation in a similar boat, so it's a question of degree as to what's feasible on one hand in terms of analysis and resources. Also, obviously, it is not for me to write provincial laws; far from it. But to the extent that an ongoing dialogue with a committee or with a government-ie, an ongoing, in no way partisan dialogue-is invited, it's certainly my job to try to advance the cause of privacy in any way I can, and that would certainly be a large part of it.

The disposition, I should add, as witness my presence here today, is not to keep people in suspense, let provinces or provincial governments pass legislation of one kind or another and then pop down at the end of the day and say, "Uh-uh, you fail. That doesn't meet the standard," or whatever. I'd much rather be able to make a positive contribution to people understanding what the criteria are, what "substantially similar" means, in helping them to get there. So yes, if I can help with that, I'd be delighted.

Ms Lankin: I suspect that your presentation today will aid in your other mandate of public education. I also suspect that the new minister tomorrow morning will have a very important issue on his desk to deal with, leading from the headlines in the paper.

I don't have any other questions. Thank you.

1220

Mr Toby Barrett (Haldimand-Norfolk-Brant): Thank you, Mr Radwanski, for your presentation.

I want to raise an issue I raised yesterday with our Ontario privacy commissioner with respect to the firearms owner's licence application form, which many, many of us filled in by the deadline, the end of last year. On that form, I know there were a number of questions or boxes to check off, one relating to an applicant's mental health history. It's my understanding that in the province of Ontario our community mental health centres really have very few barriers for clients' mental health information to be disseminated, perhaps to a lawyer or a spouse around a custody battle. These are things that are reported to me in my riding, but with respect to this application form, I'm assuming once someone checks off that box that they do have a mental health history-I know there's a follow-up; at minimum, there could be a telephone follow-up. I'm not clear about how detailed the investigation is, whether they would, as police can do, access our Ontario community mental health centres for this information.

With respect to the application form-you mentioned the importance of the media, and there are people in my riding who follow some of your work in the media in respect to this what many consider a privacy issue. Under the current rules, gun owners or potential owners are required to state on the form whether in the past five years they have-and I can quote several of the issues-"threatened or attempted suicide," "been diagnosed or treated by a medical practitioner for: depression, alcohol, drug or substance abuse, behavioural problems, or emotional problems," and in addition, to quote further, "experienced a divorce, breakdown of a significant relationship, job loss or bankruptcy."

I represent a rural riding. Most farmers are gun owners, for example. Many have a .22 in the barn to shoot raccoons and things like this that kill chickens. Many farmers are on the verge of bankruptcy and are being encouraged by the Ontario government to go for stress counselling, and I fully encourage that in my farm community. If they were telling the truth, they would check off this box, and I'm unclear where this lies. Could you comment on that issue with respect to privacy? I understand you've done a bit of work on this.

Mr Radwanski: Sure. I'll be glad to comment, even though it's a little outside the scope of our discussion today. I'm happy to comment, in any event.

Mr Barrett: And I couch it in terms of our mental health system. As I understand it, in Ontario, community mental health centres are pretty open as far as passing out clients' information. I'm aware of clients who don't come back for counselling any more once their spouse or their spouse's lawyer gets that information. That's part of my concern.

Mr Radwanski: On that point, you're touching on one of the reasons why good health privacy law is very important, because you're exactly describing what can happen if privacy rights are violated. That's the point I was making, that if people can't be confident that their health information is private, they may not seek the kind of care they need, and that can be devastating not only for them but for society. So I think we're very much in agreement on that.

On the gun law, that falls very much under my jurisdiction under the federal privacy act. As you know, there are two separate pieces of legislation. The one I've been referring to today, C-6, is the new law that pertains to the private sector. There has been in effect, as you know, a federal privacy act pertaining to areas of the federal government, federal institutions, for many years, and the gun registration aspects fall under that. So they do fall under my office.

We have been conducting an informal review of many aspects of the application of a gun law and so forth. The office, under my predecessor, expressed concerns about many of the questions that were being asked on the forms. Some modifications were made as a result of those concerns in the early stages of preparing this law. On some of the questions about which you were asking, a number of experts were brought in and presented to my predecessor, making the arguments why these things might be important indicators of potential violence by people if they acquired guns, and my predecessor was persuaded.

To be very honest with you, I'm not fully persuaded that all those questions are appropriate or necessary in the circumstance and in this process. That is why I have initiated a review of those questions. For instance, to be candid with you, some of the questions in my mind are: does there need to be a distinction between what you would want to ask someone seeking to acquire a firearm for the first time and someone who may have had one or several for the last 20 years? If someone has just lost a job or is in the midst of an imminent marriage breakup and develops a sudden urge to own firearms, that could be an indicator that is worth considering, but if someone has had firearms for 20 years and went through a divorce three years ago, what has that got to do with anything?

These are the kinds of questions I am going to look at. I won't prejudge it by telling you what my finding would be, because I don't know. I will have to hear the arguments afresh on some of those points. Obviously the protection of the public and the public interest are paramount considerations, but the principle is that only information that is truly necessary to achieve the purpose should be sought, and I will have to be persuaded that that in fact is the case in this instance. So you raise a legitimate concern and one that I will try to have a response to at the earliest time.

Mr Barrett: Beyond the form, I understand that if a person does check one of the boxes there is a follow-up by the firearms officer, or they may delegate that responsibility to local police. As I understand, it's done by telephone. Whoever picks up the phone, or it may be the person who is listed on the form as a reference, is also asked a number of questions. As I understand it, this is just done on the phone, that nobody signs anything; it's merely a telephone interview in many cases. The questions that are coming in by phone are, has the applicant acted in a manner that suggests they are disturbed or distraught or suicidal or may be suffering from a personality disorder, or are known to have a history of mental illness, or are they under any financial pressures?

It seems so vague to be doing this by telephone. I don't know how whoever answers the phone is identified as being the reference or the spouse. It seems like an awfully vague way of following up on this, as I understand it. How is it verified? These may be technical issues.

Mr Radwanski: You're raising questions that deserve responses. I would have to say in a broad sense that one area that is exempted, generally speaking, is the right of the police to conduct investigations, to conduct inquiries, for whatever reasons. They are allowed to ask questions. So the extent to which the questions or the research processes would be in violation is a technical question that I would not presume to answer off the top like this. But you are raising questions that merit consideration and, as I said, are part of what I and my office are going to be reviewing and are reviewing as we speak. The best I can tell you is that those kinds of questions are not foreign to me. They are under advisement and it is part of my responsibility to ensure that privacy principles and the privacy law are being respected in this field as in every other. Certainly when we reach findings, whatever they are, they will not be kept secret, so you will know what I conclude. But I appreciate the question.

1230

Mrs Sandra Pupatello (Windsor West): Thanks so much for your presentation today. Could you clarify what you think the process-

Mr Radwanski: Sorry, again I'm having-I guess it's the translation. Could you speak up a bit? I'm having trouble hearing you.

Mrs Pupatello: I never have trouble being heard. I'm enjoying this.

The Chair: Forgive me, Mrs Pupatello. In fact, Hansard has been saying they are having trouble hearing, so could the members lean closer to the microphones. Thank you.

Mrs Pupatello: Thank you so much for your presentation today. Could you walk me through the steps: if this bill is passed and an individual's rights are violated in terms of information being forwarded that is in accordance with the Ontario law but in contravention of the federal law, tell me what an individual would have to do to be aware this has happened, which in itself, as you have described, is a major item because they may not know-we don't tend to know now what are the secondary uses of information. But in describing the limited authority of the Ontario privacy commissioner-of investigation, of audit, even of frankly being at the whim of somebody's mood as to whether they can access information for an investigation-tell me what would happen with an individual going forward with a complaint.

Mr Radwanski: Very simply, the provincial law would be in place, but for my purposes what it permits or not would not be relevant. An individual would complain to my office that they had reason to believe a privacy right under the federal law had been violated. They would be put in touch with an investigator, they would be asked to state their complaint in writing, and then we would investigate. As I said, we have extensive powers of investigation, full powers. I am happy to say that in the case of the public sector law, the federal Privacy Act, we have never once had to use those powers under any of my predecessors because we have always been able to get voluntary compliance, voluntary co-operation. But I am quite sure we've only had voluntary co-operation because those powers were in reserve. There is not much point in saying, "No, you can't see this," if we can turn around and say, "We're invoking our powers. We will see it."

In the private sector area we would have full power to investigate. An investigator would go and follow the chain of what appears to be an inappropriate disclosure or collection or whatnot, and find out what had transpired. The complaint may be valid or it may not, but we can see any document, ask any question, and get to the bottom of a complaint. I am very fortunate in that I've inherited an excellent office in that regard, with very well trained investigators, and we are expanding our resources to meet the challenges of the new private sector law as well. So the investigation would be carried out.

If there is a problem-if it's an ongoing pattern, for instance-one tries to resolve these things in an amicable way, as an ombudsman function. I am an ombudsman. One tries, first of all, to persuade the organization or entity with whom the issue arises-the complaint-to cease and desist from doing whatever is inappropriate and to remedy a situation in whatever way is possible.

Mrs Pupatello: In that case, correct?

Mr Radwanski: Yes, but also more broadly if there is a systemic pattern. For instance, if somebody is systemically collecting or disclosing information they have no business doing-

Mrs Pupatello: Would you need to have several cases come before you in order to determine the systemic nature of that?

Mr Radwanski: It might become clear in the course of investigating one case. If somebody says, "My information got to so-and-so," and you investigate and find it got to so-and-so because this entity has a process whereby information is provided to whomever, you don't have to have umpteen cases to say, "You can't do that. Stop doing it right now."

Mrs Pupatello: At what point and in what way do you have the authority to have the Ontario law struck down?

Mr Radwanski: I don't. There is no issue of striking it down. But the point is that the federal law takes precedence.

Mrs Pupatello: So do you continue-

Mr Radwanski: I understand what's confusing you. There is an Ontario law on the books that says you must provide your information to such and such and there is a federal law on the books that says, in effect, you cannot be providing information over there because you can't justify it and there is no basis for it and you don't have consent. That's what you're asking. What happens then?

What happens then is, I exercise my responsibilities to say that cannot be done. Let's say hypothetically-and we are in the realm of hypothesis-but let's say that the provincial government tried to enforce its law and that ended up in court. It is an established principle of Canadian law that where there is a conflict, federal law takes precedence where there is a legitimate law.

So the fact is that, without presuming to speak for the courts, the logical outcome is that the finding would then be that the federal law prevails, that the person or the organization must cease and desist from what is in violation of the federal law and that therefore they are in a sense exempt from any penalty under the provincial law, because if one law takes precedence over the other, then in that sense, where there is a conflict, the other law does not obtain. Do you follow?

Mrs Pupatello: Yes. The reason given that the Ontario government went forward with concerns over federal law was that they were going to be very restrictive in moving forward on the integration of health services.

How do you respond to that concern? It seems to me that your law federally does cover the private sector, and the concern in Ontario is that further integration may well mean further privatization and their access to personal information for a whole variety of reasons.

How do you explain then that your law was not extensive enough to deal with integrated systems which every province in Canada is dealing with? Does every province have to come up with a health privacy bill because your federal law did not widen its scope enough for it and, if so, why didn't you?

Mr Radwanski: It's not why didn't I, to be clear. I had nothing to do with passing the law and I'm not part of the government of Canada. I am at arm's length.

Mrs Pupatello: Why didn't they? They went to all that trouble. Apparently every province is dealing with the same issues of health delivery as Ontario, and Ontario doubly so.

Mr Radwanski: But what the federal government cannot do is pass laws that govern a provincial government. What is directly under a part of a provincial government activity, that sector cannot be regulated by federal law.

The federal law can only apply to areas where, under various constitutional powers, federal jurisdiction can extend. I don't want to get into the constitutional argument under any circumstances here, but it can extend to the sectors I've described. It cannot extend to sectors that are a public sector of a provincial government.

Is it imperfect in that sense? Yes. But it extends as far as it is possible for the federal law to extend and, frankly, I would imagine the hope in drafting this legislation is that all governments would agree on the fundamental importance of privacy, the desirability of protecting the privacy rights of Canadians and that all provinces will in fact avoid the kind of complexities that we've been discussing today by passing laws that are at least of the same quality, in terms of their privacy protection, as the federal law, which civilized jurisdictions around the world are doing. So it was not seen as a particularly far-fetched assumption that the provinces would want to step up to the plate.

There is also the possibility regarding the private sector that some provinces, particularly the smaller ones, might choose not to have to get into the challenges of oversight and so forth that would be involved in overseeing the private sector and might quite simply prefer in the private sector to have the federal law apply and have my office have the oversight in the same way that some provinces, for instance, don't have their own provincial police but use the RCMP. There's that aspect as well.

1240

Mrs Pupatello: Do you think then with the Ontario law, given what may happen if it's implemented and the chaos or misunderstandings that may occur in the private sector involvement in health care-given the two levels of law being so different-that we're actually creating a larger hurdle in integrating health care if we pass the bill than if we scrap it?

Mr Radwanski: You're getting there into areas that really aren't for me to say. What I will say is that passing a bill that is not substantially similar to the federal law is going to cause problems and confusion and it is going to subject, certainly in any area where the supply is, elements that are covered by such a provincial law to a great deal of confusion, and it's just not an ideal outcome to end up with a conflict of laws. That's clear.

Is that worrisome? If I understand your question, it is a bigger problem if you pass a law that will end up creating confusion and be in conflict than if there is a void there and the federal law simply applies without having to have that contest and the conflicts and people being whipsawed by conflicting provisions, yes. I'm not going to comment on the integration aspects, but certainly in terms of the-

Mrs Pupatello: It was the one significant reason apparently that the Ontario government was asking for that window to create their own, because they felt it would be such a barrier to integrating health services.

Mr Radwanski: Well, it's good if they create their own, but it should be a law that protects privacy.

Ms Lankin: My understanding is slightly different in terms of the integration issue. The concern on the part of the province of Ontario is not that there would be federal legislation governing one section of health and nothing governing the other-that in fact would be problematic, there's no doubt about that-and another level beyond that. The goal of health reform, which I'm not asking you to comment on, by many governments of many different political stripes-and we may debate how we go about it, but many people have agreed on some of the principles-sees systems integration in terms of treating the patient at the centre of it and the services being well-informed in terms of good decision-making for the patient.

I guess in a sense it comes down to the issue of consent, though. The way to get around all that is to have the patient's consent. There are other issues, however, that governments are concerned about with respect to management of a very complex health care system, and this is where I would like your comment, because certainly there are decisions: how many hospital beds you're going to have, how many appendectomies you're going to staff for, what kind of in-patient versus outpatient, what type of epidemiological outcomes there are of certain kinds of procedures, what kind of rate of caesarean sections we are experiencing in Kingston versus London and why, and how we effect medical doctors' practices for best outcomes.

There are a lot of very good and important social health goals, and there must be a way for us to do that without violating individual privacy, because I don't want my individual health privacy violated. I'm not asking you to comment on this legislation, because I think the problems that you've identified are clear there, but I'm asking you to envision how you draft provisions that allow the kind of research or systems management issues to be addressed. Is it always going to be anonymous information? Is it always going to be coded with steps in between? What are the protections for privacy that can be put in place that still allow these other goals to be met?

Mr Radwanski: I don't mean to suggest that you are raising it that way, but this whole question of management of the health system as regards personal information is a bit of a red herring in this sense: in the examples you're giving, to plan what the needs of the system are regionally, province-wide, whatever, yes, you may need to know how many appendectomies are being performed or what the trend line is, for example, what the demand would be. So you ask the hospitals or you ask the surgeons, "How many appendectomies did you perform?" You don't need to ask, "Let's see the names of the people on whom you performed them." That simply makes no sense. The kind of management information we're talking about has nothing to do with-

Ms Lankin: Perhaps I didn't give you good enough examples, because I think that's a bit of a simplistic-

Mr Radwanski: I'm responding simplistically to make the point that most management issues with regard to the health care system don't require the wide circulation of the personal health information of any individual. There are systemic questions, there are statistical questions, and you're talking quantities, rates, incidence and so on. You're not talking about needing to put the personal facts of an individual into play. There can be exceptions, but that's why one talks about exceptions having to be justified and carefully circumscribed, not simply documented but explained, circumscribed and so forth on a real need basis. But there's no need for information to be whizzing all over the place under some vague rubric of management, not that kind of information. So that's really the answer to your question.

Coming back to consent-I just want to pick up on that first part-yes, consent is the key, but it's also critical that it be, first of all, obviously, informed consent, that you understand what you're consenting to, that it be specific consent, and that it be free consent. It's one of the principles that access to a service should not be denied as a consequence of declining consent to a use of information or a disclosure of information that is not intrinsically crucial for the provision of that service in a direct sense. In other words, it would be fundamentally wrong to say in effect, yes, consent, but we'll make it a condition of having your costs reimbursed by OHIP or we'll make it a condition of admission to this institution that you must sign a consent form that permits X, Y, Z forms of circulating your information. That would not be good consent. I don't know if I've fully answered your question or not.

Ms Lankin: I think you have. I do think it would be useful to explore the issue of-for example, the Ontario commissioner talked about some circumstances like epidemiological research. There's longitudinal research being done where it's important to track back what's happened to individuals, and yet it's being done on a population health basis. So a certain part of the population exempting itself from that study creates problems in terms of the quality of the outcome. She actually said that was a circumstance where she felt there was a possible reason for exception to privacy.

Mr Radwanski: It might be. I would have to say I've heard that argument made and I've heard a lot of anecdotal evidence that not having the full sample somehow badly skews epidemiological research. Not to say it is not out there, but I have not seen the persuasive evidence that this is in fact the case. I have not had somebody point to, "The following studies that were of real importance turned out to be badly flawed because...," for instance.

Ms Lankin: The question is, how would we know yet? I lot of this stuff's ongoing.

Mr Radwanski: You can make arguments for violating privacy in that general sense: "Something bad will happen if...."

Ms Lankin: I agree with you.

Mr Radwanski: You can go across the board on issues and make that kind of hypothetical argument, but there has to be real evidence that that would be a problem, and even for that kind of research, my broad view is that Canadians are a very co-operative people in a lot of ways-and I've said this-in a lot of senses, and they are a sensible people. If you ask for consent for a limited specific purpose, you satisfy them that it will not be used for any other purpose and that it is a good purpose, the great majority of Canadians will give their consent. So does violating privacy rights stand as a precondition of good research? I don't believe it.

1250

Ms Lankin: I think it'll be important for the committee to examine some of those arguments that are put forth. Maybe we need to look beyond the assertions and look at debunking some of that and understanding it better. There is a lot of language that gets thrown around and, if you're not working in the field, it's hard to assess. I appreciate your comments on that.

Mr Radwanski: I should add that some of the arguments for research-research covers a multitude of forms of activity and some of that cloak of research is wrapped around activities that are quite simply commercial and for-profit, and yet they are enveloped in a cloak of public interest which, again, in looking at the fundamental privacy rights of Canadians, anyone entrusted with these areas should look at very, very closely.

Ms Lankin: I'm going to take you back into the realm of the hypothetical again. There is a piece of legislation that was passed in the province of Ontario called Brian's Law and it provided amendments to the Mental Health Act to do a number of things with respect to the involuntary commission of people to psychiatric hospitals. It created a new regime, a new system, called community treatment orders. In the section with respect to community treatment orders-I'm sorry I don't have it in front of me-there was a provision, in a sense, for directed disclosure about people's personal health information that had to do with a certain number of individuals-doctors, family and community people-who would be involved in the creation of the order and the maintenance, the servicing of the order, so the care plan for the individual.

At the time, there was a concern in committee that there was no protection for this information that was being shared. Some of the groups in the community aren't under any government ministries so they weren't covered by freedom of information and privacy, so there was no protection. We did a little clause in committee which probably isn't sufficient enough, but tried to cap that. But I'm wondering whether that whole area is a problem now. If in a community one of the partners in the delivery of the services under a community treatment order happens to be a private, for-profit addictions service, and if we don't have health privacy legislation in Ontario-or even if we do and there's a conflict; if they're under Brian's Law, they're directed to be part of this-your law, the federal law, takes effect and we could have situations where a person might actually come to appeal to your office that there's been a violation of their privacy rights under the federal law. We're into this already in terms of the problems, hypothetically, do you think?

Mr Radwanski: Well, your last sentence touched on what was flashing through my mind as you said this, which is that because hypothetically someone might come to my office with that kind of a complaint-

Ms Lankin: You'd better not comment on it.

Mr Radwanski: -I cannot comment on it because the one thing I cannot do is basically prejudge issues that might come before me for adjudication.

Ms Lankin: Fair enough. I'm thinking this complex area is becoming more complex as the day goes on.

Mr Chair, I'm not sure when we're going to wrap up the questioning.

The Chair: Two more questions.

Ms Lankin: I do have questions and/or recommendations for the parliamentary assistant. I actually feel that before we talk about whether the committee proceeds with public hearings and those sorts of things, given that we have been told clearly on the record the federal commissioner's recommendation is one that there is not substantial similarity, there's a preliminary question for us to deal with.

Mr Bob Wood (London West): I've got some questions I want to put-

Ms Lankin: On that point?

Mr Wood: Could we deal with that at the end, after we adjourn?

Ms Lankin: Sure. Thanks.

Mr John O'Toole (Durham): I have a couple of questions and I'm sure, if time permits, Mr Wood will as well. I'm quite interested in following up on the remark you made to Ms Pupatello. In a general sense I'm wondering if you felt that we have to look at health care in a national or potentially global setting, as in many issues in the e-world. I think the United Nations provoked Bill C-6 federally. My first question is, do you think Bill C-6 substantially went far enough? The shorter answer would be the one I'd be looking for, like a yes or no.

Mr Radwanski: Well, we're not in court and I won't be restricted to yes or no, but I will say that I think it is an extremely important step forward. Certainly there are additional features one might wish for, but I believe it is a good privacy law that is consistent with international standards of privacy protection.

Mr O'Toole: The reason I was asking is that I'm trying to lead to some discussion about the comment you made about "substantially similar," in other words, that drafted provincial or subordinated legislation has to be substantially similar to the provisions and guidance within the primacy of the federal government in areas of jurisdiction. I wonder if you could tell me what is the test for "substantially similar." Can you tell me that the test involves the consent, the disclosure? That's ultimately what I would like to understand. Is there a test or is that still part of what the debate is about?

Mr Radwanski: No. In large measure, the test is not spelled out in the legislation. That's clear. However, the Privacy Commissioner-in this case, myself-is required under the legislation to report to Parliament on the extent to which provinces have passed substantially similar legislation. Therefore, part of my responsibility is to determine what is an appropriate criterion for me to apply in determining whether something is substantially similar.

The obvious criterion is the privacy principles, the information-handling principles, that are the international standard, that are the CSA code and that are embedded in the legislation, in the schedule. For me, although to be substantially similar it must be in accordance with all those principles, the ones I regard as the particularly important elements of the test are: first of all, consent-that goes to the very heart of it; second, access and correction, because your privacy is utterly violated if you can't find out what information is held about you and if you can't do anything about it if it's wrong; third, oversight-any privacy protection regime is only as good as the mechanisms for knowing whether it is in fact being followed; and finally, redress, because all the good intentions in the world won't do you much good if you don't have the means of ensuring that the law is in fact respected.

Mr O'Toole: I appreciate that. I'm wondering if there has been some test. Industry Canada declared that the Quebec privacy legislation in 1999 was substantially similar. From what you've said, they have made an assessment based on no prescriptive formula for what "substantially similar" is. As you've described it, you still haven't filed your report.

It does alarm me somewhat, I might say, that somebody is telling me two things. When you look at the CSA and other international standards, which I'm sure you're constantly studying, can you give this committee some guidance so we don't end up with some charter challenge, a very expensive, convoluted process? Should you rule or should the courts rule on this? Who has primacy, you or the courts? Is it the Supreme Court that should rule on this?

1300

Mr Radwanski: On what? To what are you referring?

Mr O'Toole: "Substantially similar," and defining some formula for the testing, whether it's on informed consent, disclosure, redress-the number of elements you mentioned. I don't disagree with any of them; I'm just saying in the context of somebody saying the Quebec law was substantially similar-they can't say that, because they have no test to say that. That's the kind of logic I'm following.

How does it actually get determined? First, I suspect the primacy should fall to you as an independent commissioner-or does it fall to the Supreme Court, which is another independent commission?

Mr Radwanski: The legislation doesn't provide for any recourse to the courts on this point.

Mr O'Toole: No courts will decide this?

Mr Radwanski: On this point, the legislation makes no reference to that. Let me put it this way: I am required to report to Parliament on the extent to which substantially similar legislation has been passed. I am an officer of Parliament. I don't believe there is any mechanism that can constrain my freedom to report things as I see fit. Are you with me so far? Do you agree so far?

Mr O'Toole: Oh, yes, absolutely.

Mr Radwanski: So I will report to Parliament, and obviously I will have to use my best judgment as to what it is fair to regard as criteria for "substantially similar." The recourse, I suppose, is for someone to say, "This guy is an idiot. There's no way it's reasonable to regard that as a criterion." But hopefully I will be fair-minded and the criteria that I've described today are appropriate ones. That is as far as my responsibility goes.

The next thing that happens is that the cabinet, by order in council under this law, may-not "shall"; not "must," but "may"-exempt from the application of this law sectors or the whole private sector in a province where a provincial government has passed legislation that is substantially similar. The logic of this is that they will base themselves on my recommendation, at least to a significant extent, because why else would that be in the law? But technically speaking, through the order-in-council process, cabinet can make any determination it wants. It is not bound. There's nothing in the law that binds it to follow my recommendation. The right of a cabinet to make its own determination of what is substantially similar under this law, again, I don't believe is appealable to a court, because that isn't the prerogative of the cabinet to decide-it's a "may," so I presume it can go either way, because it's not even a "must" or a "shall."

My reading of it would be that what's involved in this instance is not a judicial process. That's one man's opinion; someone else might have a different view. I can only give you my opinion.

Mr Chairman, I don't want to cut this short, but I do have to express a concern that I had assumed, in our original planning, that this would be from 10 to 12, for two hours. I'm happy to be here, but I have another commitment.

The Chair: I think, Mr Radwanski, we only have two quick questions left. If you can accommodate those-

Mr Radwanski: I'd be delighted.

The Chair: Mr Wood and then Ms McLeod.

Mr Radwanski: I'm under some pressure, because I have another commitment that I've already pushed back, but please ask what you need to ask. I'm here to be helpful.

Mr Wood: Could you give the committee members a copy of your statement today? Could you make that available now?

Mr Radwanski: I don't know that we have enough with us to do it now, but it will be up on the Web site later today, so you can certainly get it that way.

The Chair: The clerk will make copies, if you even have one copy.

Mr Wood: Could you give us a complete list of your concerns by letter? You've given us an overview of your concerns. You said you had some detailed concerns that time did not permit you to address today. Could you give us a letter outlining your concerns?

Mr Radwanski: Part of what I said-I can certainly give you a letter confirming these concerns, although my statement does. What I said was that parsing this thing clause-by-clause would be a Herculean task and frankly goes beyond my responsibilities or the need for this purpose. Literally to itemize them clause-by-clause, word by word, would be days of analytical work. I was referring only to the time it would take to explain them here. But I think I've given you directionally what the problem is. It's not my place, nor do we have the resources, to get into trying to detail every weakness in this comprehensive a bill. That would be a huge task, and I think that's for your committee to do, with the expertise it can command.

Mr Wood: Do you agree that the test of "substantially similar" should be applied in the same way to all the provinces?

Mr Radwanski: Of course.

Mr Wood: Would you consider Quebec's act to be based on a CSA code?

Mr Radwanski: I'm not going to make a comment today on the Quebec act. That is a piece of legislation that is in place. The time will come when it is appropriate for me to make a report to Parliament on that. I am here because I was invited to be here in the spirit of being helpful at a time when legislation is being considered, so I'm happy to give my take on it at the earliest possible time. If the insights and comments I'm able to afford are helpful to this committee, I'm glad to provide them. But I'm not going to go into commenting on the legislation of any other province at this point.

Mr Wood: Did I correctly understand that you do not have a problem with the use of information about patients as long as it doesn't identify them, as long as it's anonymous?

Mr Radwanski: No. I was referring before with Ms Lankin to statistical information, which is distinct from anonymous information; statistical certainly in the sense of saying that a hospital performed, as an example I used, 800 appendectomies over such and such a time period. That does not involve people's rights.

Mr Wood: You would not have a problem?

Mr Radwanski: With that, no. Now, if you get into anonymous, ie, here's information on patient X but it has been anonymized, there's no name on it or something, you're into a much more complex area because there has been a lot of research done that shows that even supposedly anonymized information can lead to the identification of individuals. In a small community, for example, seemingly anonymous information can very readily point to an identifiable individual. So there's a big distinction between aggregated statistical information and anonymized information.

Mr Wood: You have no problem with the minister asking things like, "How many appendectomies did the system do last year?"

Mr Radwanski: No, because that's not personal health information about any individual.

Mr Wood: OK. Do you have a problem with information flowing through the system in order to facilitate continuity of care; in other words, information being transferred from emergency to hospital to doctor?

Mr Radwanski: It's impossible to answer that except on a case-by-case basis of what kind of information, for what purpose, with or without consent, with justified reason given for the transfer or just by fiat. You've got a whole range of circumstances and issues that are involved in that. That can't be answered yes or no. Some information would be transferred by consent; some information might be transferred in circumstances, even in keeping with the federal law, where it's a natural and necessary consequence or need to provide care. Other information might be totally inappropriate to transfer. So that can't be answered with a generalization.

Mr Wood: For example, if someone arrives unconscious in an emergency room, would you have a problem with the hospital accessing their information without their consent because they couldn't give it?

Mr Radwanski: It depends on the information accessed, and that's where we run into this issue you heard about yesterday from Commissioner Cavoukian.

Mr Wood: Surely they need all the information in those circumstances.

Mr Radwanski: Not necessarily.

Mr Wood: What would you withhold?

Mr Radwanski: For example, if you arrive unconscious in a hospital-not you; this is a gender-specific example-do they need to know whether you had an abortion five years ago? I doubt it very much.

Mr Wood: How do you know that, unless you're the doctor?

Mr Radwanski: Well, by that logic, everybody needs all information about everybody.

Mr Wood: This is a medical file that's being transferred.

Mr Radwanski: Even if they're imperilling their own health, quite frankly, people have the right to say, "I don't want anybody to know this or the other thing about me."

1310

Mr Wood: But suppose, if you could have gotten my consent, I wanted you to have the whole file?

Mr Radwanski: But you have a right to determine-that's where the lockbox provision comes in that Commissioner Cavoukian tried to explain to you, I believe, yesterday, which is that you have a right to say beforehand, "Even in an emergency situation, I do not want anybody except my designated caregiver to be given the following information." It's your information. Part of this debate that often is lost is that your health information belongs to you and you have the right to determine who gets to see it, for what reason, and in what circumstances. If you want to say that you're prepared to take the risk, however infinitesimally small it may be, as an individual that you might suffer some detriment to your health by an emergency room physician not knowing that you had an abortion five years ago or whatever else it might be, that at some point in your past you were a drug addict-you name it-that is your right as a human being. That is your right as an individual. It's not for the system to say, "We are going to substitute ourselves for your rights as a human being and as an individual to say, `None of your business.'"

Mr Wood: An oversight committee to consider research projects: are you opposed in principle to that or are you opposed to the criteria being too wide as to what they can allow access to? What do you think about the principle of an oversight committee?

Mr Radwanski: I think there should be oversight committees to oversee research projects for many reasons: ethics, relevance, you name it. I've got no opinion as commissioner on oversight committees or ethics committees, but if you come to privacy, I believe that access to your information for research purposes should be contingent on your consent. I don't know about you, but I don't want some unspecified committee deciding for me that this is a really neat piece of research, and if my privacy is going to be violated, so be it.

Mr Wood: Are you an absolutist on this point?

Mr Radwanski: I'm not an absolutist, sir, on any point. I am simply-

Mr Wood: In what way are you not absolute on this point?

Mr Radwanski: There may be circumstances that would have to be documented, justified, where there would be a compelling public interest under very clear safeguards for that one particular type of research purpose needing to have a broader range of access. I would say that the proper authority to determine whether such an exceptional circumstance exists is not some unspecified ethics committee, but a duly mandated Privacy Commissioner, in the same way that there are public interest disclosures that may be made and the Privacy Commissioner may be asked to pass comment on whether this is an appropriate instance where there is an overriding public interest in disclosing something.

So I am not an absolutist. I think common sense has to apply. There are instances where the public interest must take precedence, but there is a huge world of difference between saying that and putting in mechanisms that would make that the rule rather than the very, very narrow exception.

Mr Wood: Thank you for your indulgence.

Mr Radwanski: My pleasure.

The Chair: Mrs McLeod, you had a very quick question?

Mrs McLeod: It will be quick because you may not be prepared to answer. I'm going to set aside all the technical questions because I assume we can come back to you should this ever get to a clause-by-clause consideration.

You spoke in your opening remarks about the intent of this bill being very different from the intent of federal legislation. As we've heard from the Ministry of Health and as we look at some of the specifics that are outlined in the bill in writing in terms of, "Why would the minister have access? Why would there be disclosure?" it's always for the purposes of managing the health care system, for providing for the best care of the patient. I'm paraphrasing. Those are the sorts of good-intent reasons that are put forward for the collection, use and disclosure of the health information.

You've raised the concern, as Ms Cavoukian did, about the 30 areas in which any of this can be overturned by regulation. What would be your fear? What could be done? What would be the greatest danger of what could be changed through regulation? It may be an unfair question, and if it is I'll just leave it as a rhetorical question. What is the fear of the unknown because of that ability to virtually change any of this that's written down now?

Mr Radwanski: It's everything. It's the same fear that permeates one's reading of this legislation, which is that it is open season on your personal health information. Regulation can determine what is personal health information that is covered; regulation can determine who's entitled to be a custodian in the possession of it; regulation can determine to whom it must be disclosed; regulation can determine if a government can turn around and disclose it in turn; regulation can determine the extent to which the commissioner has any powers at all. It provides for setting out the procedures she must follow. Maybe the procedure is not to ask anybody any questions for five years. I don't know.

I'm being facetious, but I'm saying it's a wide open universe, and I can give you a worst-case scenario. The worst-case scenario is simply that your personal health information that you have the right to control as an individual in a free society can already under this law, but even more under regulation, circulate absolutely anywhere without your consent and without recourse by you to stop that from happening or to protect your right to your integrity as an individual. The regulation aspect only increases the degree to which this is a law that says the government can do what it wants with your personal health information.

Mrs McLeod: I will not ask you to speculate on why any government would want that kind of flexibility, because you won't answer that question.

Mr Radwanski: That wouldn't be my job.

The Chair: Thank you. We've actually gone over the two hours by a few minutes, but thank you very much again for your indulgence here in our scheduling conundrum.

To the folks from the Ministry of Health, I think we have a consensus among the committee members that rather than impose on you today and on those members who were going to come in for the afternoon session, we instead reconvene to continue our clause-by-clause discussion at 1:30 on February 19.

Ms Lankin: I would like to just put on the record my concern about the process of consideration of this bill from this point forward.

One of the obvious threshold questions for legislators in the province of Ontario, where we know there is a federal law that is a superior law in the sense that the provincial law must defer to it and when we have the commissioner telling us that he is of the firm belief that it will in no way meet the test of substantial similarity, given that that's still a cabinet decision to make-I understand that-I think it's important for a decision to be made about whether we proceed through the process with this bill, committee hearings and deputants, as a matter of course, or whether we ask the parliamentary assistant to take some time with the new minister and consider whether we as a committee work to try to address some of the shortfalls in this bill or whether the government chooses to do that without the committee, and that that work be done before deputants are asked to come forward.

If we can assume-this may be a big assumption, but I'm guessing, based on what I've heard today, that the end shape of any bill that is going to be passed is going to be dramatically different from the one that is before us right now. I don't think it's fair to the public interests that have asked to come forward to ask them to comment on a bill that we probably all know, with basic common sense, is going to be dramatically changed. I'd rather see that work done, given to people, and a chance for them to respond based on the new bill.

The Chair: Thank you for those comments. I'm not going to entertain any debate. The fact of-

Mr Wood: Can I make a comment here?

The Chair: Well, we're actually over our time. You can make a very brief comment.

Mr Wood: If you don't mind. I think that comment touches on a significant point. What I'd like to do is take that back to the ministry. There are two sides to that issue. One is, should we hear these people and find out what they're saying on the issue, which is important, or should indeed we say we're going to take a look at a different bill, if indeed that's what we're going to do, and defer it? It's a point that will be taken to the minister for consideration.

1320

Mr O'Toole: If I could just make one comment, with respect, I'm not sure on what grounds, unless it's a generalized presumption at this point of what's substantially similar and consistent with, without the body of the points, the model of what that means. So if there is one-you said you were going to report to cabinet with respect to consistency and substantially similar. I think we need your guidance, quite seriously, to go forward. All of this has, I'm sure, been broadly consulted; I'm sure our ministry people have on two or three occasions that I'm aware of. So we need that kind of guidance, otherwise we are spinning our wheels, because we could just throw it in the garbage after six months of consultations. We should listen to your sage advice.

Mrs McLeod: Can I second what Mr O'Toole has just said in one further respect? Ms Cavoukian undertook yesterday to do a significant piece of work in terms of proposing amendments to this bill. I'm not sure how to put these two things together, but it would obviously be totally inappropriate for Ms Cavoukian to be asked to do that kind of work for us if in fact this bill, as it currently exists, is not going forward. I'm wondering if there is a way of the federal office and the provincial office in some way working together to produce the kind of model that Mr O'Toole is talking about. It seems to me that essentially that's our only hope for having a piece of legislation with which we can go forward with the kind of consensual process we've been discussing.

Mr Wood: Could I make one other suggestion? I think if change is indicated or considered, the subcommittee might deal with that. Simply, if I receive word there's some interest in not proceeding with the hearings, the subcommittee can deal with that. Is there any objection to that?

The Chair: That, I would argue, is the only mechanism to interfere with the order of the House under which we are operating.

Ms Lankin: Yes, but-

The Chair: Ms Lankin, if I may-as I said, I didn't want to enter the debate-the whole point of inviting the Ministry of Health back was to hear their response to Ms Cavoukian and Mr Radwanski. I've sat through a number of bills. It is not the practice of the House to necessarily change direction on the basis of any one submission. I think to do justice to this and to respect the order of the House, it is incumbent on us to listen to all sides, obviously. I've taken the suggestions from all three parties. I'd be happy to have the subcommittee meet between now and the 19th, if that is your wish, and we can debate this matter further. But in the meantime, I think in order to be fair to the Ministry of Health, they should at least be given some time frame in which to prepare their response, not just to Mr Radwanski but to Ms Cavoukian as well. That's all that we have done here today in suggesting that the next meeting of the committee is the 19th.

Mr Radwanski: Mr Chair, if I could make one comment on Ms McLeod's point, to avoid any misunderstanding. While I'm happy to provide the kind of input that I did in this setting, and would be happy to provide if I'm asked questions as we go, I wouldn't want there to be any sense that I've undertaken a process where my office and the office of the Ontario commissioner would be involved in somehow jointly trying to draft amendments to provincial legislation. That would be-

Mrs McLeod: But you could comment on the compatibility of proposed amendments.

Mr Radwanski: I can comment when something is put before me-

Mrs McLeod: Right. That's really all I meant.

Mr Radwanski: -in total, whether it would be substantially similar. But the office can't be involved in a joint process of drafting amendments, because that would be completely inappropriate.

Mrs McLeod: My thinking was that any amendments that were proposed by Ms Cavoukian could have already-it could have been determined whether or not they met the test of compatibility, which would enhance our comfort level with them proceeding.

Mr Radwanski: If you show us a bill, we'll tell you whether it meets the test, in my view, but I can't really go beyond that in terms of amendments and how they would merge with other stuff and so on. But I can provide any input that I can properly provide.

Ms Lankin: Just in response to you, Mr Chair, thank you for the lecture. It wasn't required. My intent was to communicate with the parliamentary assistant on the record that I think it was a preliminary issue that should be discussed. He has undertaken to do that. I'm quite satisfied with that. I think in terms of fairness to the ministry, it's something I have a record of. Again, I don't think a lecture is warranted.

I would like to say that the comment or the suggestion that I think the parliamentary assistant was making with respect to the subcommittee was also seeking the committee's agreement that the subcommittee could make a decision with respect to that, as opposed to a recommendation to come back, should we choose to do it. It may be just useful to have that motion on the record. It may not be of any assistance to you, Mr Chair, I don't know.

The Chair: It also would be out of order. The subcommittee can make recommendations to this committee. Only the committee can approve any change in direction. I would be happy to have the subcommittee-

Ms Lankin: The committee can give a certain decision to the subcommittee by a motion here that the subcommittee can determine whether we return on the 19th or not, for example. It has to be spelled out.

Mr Radwanski: Mr Chair, I express my thanks and take my leave.

The Chair: Absolutely, Mr Radwanski. Thank you very much.

Mr Radwanski: It has been a great pleasure to have this opportunity.

The Chair: With that, the committee still stands adjourned until February 19 at 1:30.

The committee adjourned at 1325.