Comment on Privacy Commissioner's suggestion about levying fines

Earlier today, I posted about a very interesting development: the Privacy Commissioner of Canada is looking to have PIPEDA amended to permit the imposition of significant fines for privacy breaches (see: Canadian Privacy Law Blog: Canadian Privacy Commissioner calls for power to levy fines against corporations).

We're now hearing interesting statements from the OPC suggesting that the ombudsman model is no longer satisfactory. It began with the release of the report prepared by France Houle and Lorne Sossin entitled Powers and Functions of the Ombudsman in the Personal Information Protection and Electronic Documents Act: An Effectiveness Study, which called for a re-examination of whether the Commissioner should have order-making powers. Now, the Commissioner herself is suggesting that she should be able to levy fines to ensure compliance.

This is a very significant change in tone and one that needs very, very careful consideration. As said in the Commissioner's release, "The Privacy Commissioner of Canada is mandated by Parliament to act as an ombudsman and guardian of privacy in Canada." The Commissioner is -- quite rightly -- an advocate for privacy, an educator about privacy and an officer of parliament with a mandate to resolve privacy issues.

If the Commissioner were granted order making powers or the ability to levy fines against organizations, her many roles would need to be closely examined in light of basic principles of procedural fairness and natural justice. One should not lightly give one person or officer (however well-intentioned he or she may be) the powers of an educational authority, an investigator, a prosecutor and a judge. These functions are generally separated and are separated for a reason. It's an inherent conflict of interest to have the same person identify the bad guys, prosecute them and then punish them. Currently, if an aggrieved party wants a remedy or an order against a company to stop doing something, they complain to the Commissioner and then go to the Federal Court, where an impartial and disinterested judge hears the whole matter from the beginning and makes a decision.

Before we abandon the current model and consolidate the roles of privacy police, prosecutor and judge, we need to have a thorough debate. I agree wholeheartedly with the Commissioner's final comments:

As you can see, the information and communications revolution is giving us plenty to think about in terms of how to ensure that Canada maintains its tradition of leadership in privacy protection.

The next few years promise to be extremely interesting.

Thank you – I am looking forward to a thought-provoking dialogue on these and other issues.