The Nova Scotia Legislature

The House resumed on:
September 21, 2017.

Human Resources Committee - Committee Room 1 (1532)














Tuesday, February 24, 2015







Freedom of Information and Protection of Privacy Review Office Overview


Appointments to Agencies, Boards and Commissions





Printed and Published by Nova Scotia Hansard Reporting Services










Mr. Bill Horne (Chairman)

Ms. Joyce Treen

Mr. Ben Jessome

Ms. Margaret Miller

Mr. Iain Rankin

Mr. Eddie Orrell

Ms. Karla MacFarlane

Hon. Maureen MacDonald

Hon. Denise Peterson-Rafuse


[Ms. Margaret Miller was replaced by Mr. Terry Farrell]



In Attendance:


Ms. Kim Langille

Legislative Committee Clerk


Mr. Gordon Hebb

Chief Legislative Counsel







Freedom of Information and Protection of Privacy Review Office


Ms. Catherine Tully

FOIPOP Review Officer


Ms. Carmen Stuart

Director of Investigation and Mediation









10:00 A.M.



Mr. Bill Horne



MR. CHAIRMAN: I’d like to call this meeting to order. This is the Standing Committee on Human Resources. I’d like to ask each member to introduce themselves.


[The committee members introduced themselves.]


MR. CHAIRMAN: Thank you for coming today. I’d like to have our presenters introduce themselves. We’re going to be talking about the FOIPOP procedures and how it operates. I’ll turn it over to you, Catherine.


MS. CATHERINE TULLY: Good morning, I am Catherine Tully, Nova Scotia’s Freedom of Information and Protection of Privacy Review Officer. With me is Carmen Stuart, who is the Director of Investigation and Mediation in my office.


Thank you all very much for the invitation to appear today. It’s a pleasure to be here and it’s a pleasure to be in Nova Scotia actually. I’ve been here for six months now and I was telling Mr. Horne that I love the job. I love Nova Scotia, I’ve got to travel quite a bit and it has really been quite enjoyable.


My plan this morning, I understand I’ll take about 15 minutes to introduce myself a little bit and talk about the mandate of the office. Then I welcome your questions on access and privacy, a favourite topic of mine.


I’d like to say about myself that I am both idealistic and practical. I am idealistic because I do believe deeply in the purpose of access and privacy legislation and that access and privacy legislation is essential for the health of our democracy. Our Freedom of Information and Protection of Privacy Act highlights those purposes in Section 2 of the Act where it talks about facilitating informed public participation in policy formulation, ensuring fairness in government decision making, and permitting the airing and reconciliation of divergent views. Privacy is also a prerequisite to individual security, self-fulfilment and autonomy, as well as to the maintenance of a thriving democratic society.


I believe these things, I think perhaps that makes me a bit idealistic but I am practical in the sense of how I do my job. I view the job of oversight bodies is to make these types of Acts work well for the citizens of the province and to do so in a meaningful way. For example, I see my role as building knowledge among citizens, contributing to the capacity of public bodies, municipalities, health custodians, to perform their duties under these Acts, and to find meaningful resolutions to disputes in as timely a fashion as possible.


My background is that I am in my 15th year of working exclusively in the area of access and privacy law. I started years ago, in British Columbia actually, as an analyst - so the person who actually with a pink highlighter goes through the records. I did that for about six months before I became the Director of Access, Privacy and Records Management for three ministries in British Columbia - the Ministry of Attorney General, the Ministry of Solicitor General, and the Ministry of Aboriginal Relations.


In that capacity my shop of about 20 people processed 2,000 requests a year. The difference between Nova Scotia is that the whole of the Nova Scotia Government processes less than 2,000 requests a year but my ministries alone processed 2,000 a year back when I was the director. There’s a higher population and there’s a greater use of access and privacy legislation in British Columbia.


The other thing I did as director was we were very active in completing privacy impact assessments so I personally wrote several hundred privacy impact assessments evaluating the privacy impacts of programs, projects, legislation, systems. I did that for six years and then I moved to the Office of the Information Privacy Commissioner. I began as a senior investigator, investigating privacy breaches, privacy complaints and mediating access reviews, requests relating to severing, complaints relating to severing. Then I became the Manager of Investigations and finally I was the Assistant Commissioner responsible for investigations for the Information Privacy Commissioner. In that capacity I had about 20 investigators, mediators, and intake officers that I supervised. We investigated about 1,500 complaints and reviews per year, compared to similar kinds of cases here in Nova Scotia, closer to 200.


I’ve personally investigated hundreds of privacy breaches and complaints and I’ve seen all manner of possible mistakes that can be made with respect to personal information. I’ve mediated all manner of complaints about access requests. What you’ll find across Canada is that the standards and the rules with respect to access and privacy are very similar in each jurisdiction. There isn’t a lot of difference. Nova Scotia has a few unique parts to its Act, but it’s pretty similar to what British Columbia has, to what the federal government has, even though the federal legislation is quite old.


For the last two years after I left British Columbia, I worked first as the Manager of Privacy and Access for Canada Post and then as the Director of Access and Privacy for Canada Post. Those were an interesting couple of years. Canada Post, as you may know, has 72,000 employees so the scope for privacy breaches is quite broad. It is very interesting to work in corporate Canada and understand how well they manage privacy. I had the opportunity of meeting with chief privacy officers from across Canada in telcos and insurance companies, and their strategies are very advanced so it was a really good education to come from a province to go federally. Also, Canada Post is subject to federal regulation so I also interacted with the federal regulators, including the Information Commissioner of Canada and the Privacy Commissioner.


Let’s talk a bit about the Freedom of Information and Protection of Privacy Review Office here in Nova Scotia. In essence, this office is Nova Scotia’s information and privacy commission and that’s what we’re known as outside of Nova Scotia. The office came into existence in 1994. Privacy was added as an oversight responsibility in 2009 and then personal health information was added as a responsibility in 2013.


There have been five previous review officers, including Carmen who acted as the review officer through the Spring and summer of 2014. This position is not an Officer of the Legislature but has some independence including a set term of office for five to seven years appointment, and removal is via resolution of the House. Annual report is delivered to the House so there are some elements. There are five staff in the office, including the director. There are three investigator mediators, we call them, and one manager of intake. Our budget is $565,000 per year.


The scope of the oversight responsibilities - my office has responsibility under four Statutes: the Freedom of Information and Protection of Privacy Act, which I think you are all familiar with; the Privacy Review Officer Act; the Municipal Government Act Part XX; and the Personal Health Information Act. There are about 400 government departments, agencies, boards, commissions, municipalities, police, library boards, school boards, et cetera that are subject to the combination of the Freedom of Information and Protection of Privacy Act, and the Municipal Government Act, but only about 200 seem to regularly receive requests according to the government statistic reports.


There are over 26,000 health care professionals potentially subject to the rules under the Personal Health Information Act. That gives you a sense of the scope of who we have oversight over.


So what are my responsibilities under these Acts? They include the responsibility to hear and decide requests for review of decisions of public bodies, health care custodians, and municipal bodies with respect to access requests. I also have the responsibility to hear and decide privacy complaints, but not for any bodies covered by the Municipal Government Act. I can monitor privacy provisions in the Freedom of Information and Protection of Privacy Act, initiate privacy investigations - again, only under the Freedom of Information and Protection of Privacy Act. I can undertake research and inform the public about privacy rules; I can provide advice and comment on privacy to public bodies.


Under the Personal Health Information Act, I have a series of responsibilities to receive reports regarding breaches and research requests. I have the power to require production of documents, and I have the power to enter and inspect the premises of a public body.


To give you a sense of the scope of our work, we had 2,400 matters last year, of which 200 were file matters. Three hundred and eighty-three were personal health information reports, and the rest were telephone call inquiries, so quick answers to questions. We attended meetings, developed tools and did trainings.


The primary issues under review for us - more than half - about 55 per cent are complaints relating to a refusal to disclose or severing of a record, not surprisingly. Time extensions and deemed refusals - so complaints about time are only about 8 per cent of our files, and about 5 per cent relate to fees.


I want to tell you a little bit about our progress since I arrived in September. When I arrived, we had a backlog of 230 files dating from 2009 - so files were six years old. We organized the way that we did our work. We assigned duties, and as a result of that we have resolved 101 files since September; 85 per cent of those were informally resolved, only 4 per cent proceeded to formal review, and the remaining 11 files were discontinued because we couldn’t reach the applicant because the files were too old. It’s disappointing that that happened, but honestly I was a bit surprised that the number was so low given how old the files were. What we have managed to accomplish is that all files from 2009, 2010, and 2011 have been assigned or resolved, and our backlog has been reduced from 231 to 119 files.


In addition to that, I focused some time on outreach and education. I have had over 50 consultation meetings with administrators from public bodies, health care professionals, regulatory bodies, applicants, and public interest groups. I’ve travelled around the province and met with groups of interested people from the Bridgewater Police Service; Cape Breton Regional Municipality; Pictou County Health Authority; Workers’ Compensation Board; Canadian Bar Association, National Privacy and Access Law Section; College of Physicians and Surgeons of Nova Scotia; Acadia University; and Kings Transit Authority - all manner of public bodies, small and large. I will talk to anybody who wants to talk to me. The idea was, I wanted to hear how things were working, what were their issues, what were their concerns and also, what did they need from my office, what could I do to make access and privacy work better for Nova Scotia?


They have been very interesting and useful conversations, and certainly some issues and patterns have arisen. As a result, in part from those conversations, I’ve been working hard at producing some public education material, including some of the materials - I gave you three samples at Tab 2 and I actually added a bonus one. The first one I created for this meeting, just to give you a really quick overview of the typical life cycle of an access request. The other things I’ve created are things like the privacy and management framework at a glance; privacy tips for Christmas shoppers; key steps for responding to privacy breaches; FOIPOP rules at a glance, which I gave you a copy of; and MGA rules at a glance.


What I’m finding, and the reason I’m producing these at-a-glance documents, especially with the smaller public bodies, is they don’t get very many access requests and every time they get one it’s brand new, they can’t remember the rules, so they need a place to start. I’m trying to create documents where they can go, okay that’s it, and it tells them what section to look at and they can go and look, so it gets them started because a lot of them don’t even know where to start.


We’re doing a refresh on our public guidance documents - pamphlets that we issue for the public. I wrote an editorial for The Chronicle Herald that was in the paper on January 31st. I’ve developed a privacy impact assessment template for municipalities so that they can evaluate the privacy impact of new projects and programs. We just wrote to all of the police forces in Nova Scotia last week with guidance on how to evaluate the privacy impacts of body-worn cameras, just as an example. As a bonus I threw in the privacy impact assessment template for municipalities that they could use to evaluate any other new project or program they might have.


I’ve also done some work around open government which I have a keen interest in. I’ve had some conversations again with these types of groups and also with the provincial government around some ideas I have about making open government effective.


The other thing we’ve been up to in the last six months is trying to take advantage of national and international resources. As I said, the access and privacy standards are really quite common in Canada, but with privacy in particular the standards are quite common around the world. It’s good for business to know what the standards are internationally and nationally; it’s good for Nova Scotia.


Just last week we joined the Global Privacy Enforcement Network which provides free resources to my office that other regulators have developed to assist in managing privacy issues associated with high-tech matters among other things. We’ve joined the Common Thread Network which is a Commonwealth oversight agency network initiated by the new Privacy Commissioner of Canada, Daniel Therrien. Again, it’s a resource with monthly phone calls where we can hear from other Commonwealth nations’ oversight agencies. The whole idea is, let’s get whatever is out there that’s free and useful to Nova Scotians, so we’re taking advantage of that.


My final comment is about what’s next. Initially I set three goals back in September - three six-month goals is what I had set. One was we really needed to tackle the backlog, and we’ve had the success I’ve described to you; I wanted to do some education around open government and some ideas around open government, and I’ve done that in a number of places; and I wanted to develop some privacy materials, which I’ve listed for you.


We are now in a planning phase to develop goals, strategies, and measures for the coming years. There’s no doubt that we’re going to focus on the backlog until it’s done. It’s not meaningful oversight to have to wait six years for the results of your review. I want to take my office out of the time equation; I want to be timely - when people file reviews I want it to be done in weeks, not years.


As a result of my meetings there has been a very big interest in training, particularly the small public bodies. So we’re now working with municipalities on developing some privacy and access training. We also have heard from a lot of the health custodians that there’s a need for some basic privacy training under the Personal Health Information Act, which is quite complicated. So we’re working on training - we can go around Nova Scotia, gather groups together, and give them some training on that.


There’s a great deal of interest in how to build a privacy management framework. We did a lot of work on that in British Columbia so I’m just borrowing, stealing, and adapting material that’s out there for Nova Scotia, so no doubt there will be work on that.


My final comment is that I would certainly welcome any ideas from this committee about how you think we should be spending our time at the review office, what you think our priorities should be, where our focus should be. I’m happy to hear that and it certainly will be incorporated into our planning. We need to have our goals, objectives and measures done for April 1st so we’re on track to do that.


That is the end of my prepared comments and I’m happy to answer any questions you have.


MR. CHAIRMAN: Thank you very much; a very intense amount of information. Mr. Orrell.


MR. EDDIE ORRELL: Thank you very much for your presentation and thanks for coming to speak with us today so we could learn a little bit more about your office and what you do. We seem to have had a little difficulty getting you here, partially because of the new position, and for other reasons I’m sure.


I guess the couple of questions I have are just around the former Freedom of Information Officer, Ms. McCallum, who expressed the need to make the office completely independent of government, to become an Officer of the Legislature - not necessarily a position like it is now. Ms. McCallum was very open to say that it should be an Officer of the Legislature. I’m wondering if you had any discussions with the government to make this change happen and if you agree with that type of position of Ms. McCallum.


MS. TULLY: I do agree that it would be appropriate for this position to be an Officer of the Legislature. It’s consistent with the oversight responsibilities and in every other jurisdiction in Canada - except for Quebec - this position is an Officer of the Legislature. I think it would support the work, it would increase the visibility, it’s consistent with independence and accountability, and it’s a bit selfish also because I would very much appreciate the opportunity to appear before committees like this and get feedback from the Legislature that would inform my work. So yes, I agree.


MR. ORRELL: Have you had any conversations with the government about this happening or how this could happen or what the procedure would be to make this happen?


MS. TULLY: I have expressed this opinion to the government, yes. I haven’t discussed with them how or when this would happen, I just expressed to them that I support this office becoming an Officer of the Legislature.


MR. ORRELL: Have they given any indication that this may happen or it’s something they are considering?


MS. TULLY: I guess you would have to ask them.


MR. ORRELL: I guess the question I have now is about who gets to know what requests are being made. In the Fall the minister responsible for the office said that we were submitting FOIPOP applications as a type of fishing expedition. He kind of indicated at that time that he was required to go through his expenses to comply with the request for a freedom of information request.


I guess I’d like to know who gets to know who is being investigated if a FOIPOP is put in place, and who gets to compile that information? Do we get to compile our own information, if that’s the case, or is that something that you guys go through?


I guess my big question is, does the minister know when a request comes in who the request comes from or who it’s against?


MS. TULLY: I would not know the answer to that question, because as the independent oversight body, I’m not involved in the actual processing of requests. I would only see it as a complaint or a request for review. What I can say is that the minister is the head, for the purposes of the Act, and would typically delegate some of that authority but never loses the authority to manage access requests.


The identity of an applicant for access to information is considered personal information so the sharing of that information would have to be in accordance with the Freedom of Information and Protection of Privacy Act. The disclosure of the identity of the applicant would be if necessary for the performance of the duties of whatever individual.


Now in terms of who gathers the records, it depends on who has them. Typically it depends on how you manage your records. Speaking from my experience of having been a director in a ministry in British Columbia, depending on how, say, expense claims were handled, it may be that the person that actually has them, nobody is managing the expense claims, so in order to get the records, you have to go to them and say give me your expense records. That is within the realm of possibility but I can’t speak to any specific example here, I’m not involved in the process.


MR. ORRELL: I can come back.


MR. CHAIRMAN: Okay. Ms. MacFarlane.


MS. KARLA MACFARLANE: Thank you so much for your presentation. I know you mentioned there are a lot of initiatives that you’ve taken on since you’ve been hired. I applaud you for that and it looks like you’ve been very busy increasing files and certainly clearing up the backlog.


I’m curious to know within that if your budget had to increase, or manpower within your office, in order to conduct and ensure that this work is complete.


MS. TULLY: There has been no change in my budget.


MS. MACFARLANE: My other question, if I may. Last Fall, our caucus received a fee that was nearly $15,000, for a request that we submitted for information about the Nova Star ferry. At the same time, though, The Chronicle Herald had submitted a very similar request and their fee was $175. I’m just wondering if you can help us understand what the protocol is for charging.


MS. TULLY: The Act sets out the rules around the charging of fees. There’s a $5 application fee, followed by a $30-per-hour fee, followed by two free hours, and then there’s a per-page fee. So the calculation would typically depend on the scope of the request and the response of records identified. The difference in the fees is hard to comment on. I can only assume that the various public bodies found a different scope of records responsive.


Now one of the things that doesn’t seem to happen too much in Nova Scotia, and I would certainly encourage people to consider, is that there is a provision for a request for a fee waiver in the public interest. So you make that request to the public body and if they deny that, or if you’re unhappy with the fee, you can file a review to our office.


I believe that perhaps because we have been so slow, we were part of the problem, that people weren’t coming to us with fee complaints so that’s why the percentage is so low. I’m hoping that in the future, more will come to us and we’ll look at the actual fee and review whether it’s permitted under the Act, whether a fee waiver is authorized or not.


In my experience in British Columbia, for example, when we had a fee waiver review we would go and have a look at the records. It wasn’t unusual to say, you know a portion of the records were actually in the public interest and a portion weren’t, so that would often be a resolution to a fee waiver request. You must start by asking the public body if they’re prepared to waive the fee and you need to make an argument under the Act for why you should get a fee waiver.


MS. MACFARLANE: Thank you very much.


MR. CHAIRMAN: Ms. Treen.


MS. JOYCE TREEN: Interesting presentation, learning a lot. You mentioned that you went around the province talking to different groups and people about what you do and what the position holds and stuff. What were the main themes that you got from people about what they would like in the future, what their understanding was - how did those conversations go?


MS. TULLY: The conversations out in the small towns, I would say the municipalities are really - actually, universally, the people I talked to want to do a good job. They believe in the legislation, they want to do a good job but they feel they haven’t got enough training, they’re pressed for time in terms of how much time they can commit to it. When they get a new access request most of the time it’s starting fresh.


A lot of the municipalities talked about wanting to have some training for the local politicians to understand the privacy and access rules so that came up a fair bit. They were very keen on us helping them out with that and I’m very keen on doing that thing.


I like to devote privacy or training where when I’m done with you, you walk away and you can go to your job the next day and you can actually do something different, that you’ve learned something that you can do practically. I’m not much for theory, I’m very much more for practice. So we have a bunch of municipalities that volunteer to help us design the training so we actually answer questions they want answered. So that’s the plan on the access side.

On the privacy side, this idea of privacy management framework, which I’ve been talking about all around the province and that is that we really need to build capacity to manage personal information and prevent breaches in public bodies and municipalities. There are a series of processes and policies that you can develop that will help your organization do that. So they’re interested in that and maybe a little scared because it sounds fairly advanced.


One of the things I took from the meetings is that I need to pare that down. I need to make it something that they could build a little at a time because if I say you have to do it all, it just won’t happen. They need to - okay, what are the first three things you need to do right now, and then next year let’s try this, so trying to be practical and realistic about what can be accomplished. Those are the sorts of things they seem most interested in. Some of them come with lists of like 15 questions they want answered, so we’re gathering all of these for the training.


MR. CHAIRMAN: Mr. Jessome.


MR. BEN JESSOME: Mr. Chairman, through you, I have a question for Ms. Tully. I’m wondering if you can elaborate on your work with respect to open government.


MS. TULLY: I can. The federal government has been involved in the Open Government project for a number of years and they’ve joined an international organization that requires them to be subjected to an independent audit. So last year a professor from Carleton University completed that audit and she came up with a few ideas about how to do Open Government well. She happened to attend a meeting of information and privacy commissioners in the Fall, so I stole a bunch of her ideas. Those are the ideas that I’ve been informing anybody who is interested in open government, so here are some of them.


One is that open government is actually two things: open data and open information. Open data is what gets most of the attention because it’s cool and interesting, and there is a lot of possibility for new business. It’s putting data sets up, and letting people manipulate them and use them to create business ideas. It’s good stuff.


Open information is about publishing existing information, so Word documents, Excel documents, things that non-techies can read and use. Her advice is don’t neglect open information - it’s a really important part of open government. I already believe that anyway from my experience in B.C. and the truth is, Nova Scotia has a lot of information available - it’s not that easy to find. So what I’ve been saying is, get a good librarian, honestly - a good librarian, organize your data, make it have a good catalogue so people can find the information that’s already scattered out there. That’s a good step towards open information as a part of open government.


The other thing she talks about - open data - is something that requires a technical ability, so if you’re going to promote it, you need to build capacity so these things called hack-a-thons where you teach people how to use open data so that you get the most for your money in terms of producing these data sets.


The final big piece of information she had was that a lot of the data sets are very geo-locational based. Those are the easy data sets, but there are many more kinds of data - so just health information data that should be produced. So don’t get distracted by geo-locational - branch out.


The final, actually, and the most important thing is talk to the public first; find out what they want. Don’t produce data sets you want to produce - find out what they’re interested in and try to produce those data sets. So that’s the sort of thing I’ve been saying to folks who are interested in open government.


MR. CHAIRMAN: Mr. Rankin.


MR. IAIN RANKIN: I just have a question around the efficiency and effectiveness. I see that the backlog - impressive numbers of how many files you’re getting through - are there any processes that have changed in terms of when you’ve come on? Can you explain the different steps that are taken now when a file comes to your desk? How is it different than your predecessor in terms of improving on that efficiency?


MS. TULLY: What I did was - we were attacking the file pile by doing it almost strictly chronologically. There was some variation in what files were advanced in the process.


I’ll talk about the backlog and then I’ll talk about new files. With respect to the backlog, we began by assigning files - the oldest files first. I changed the responsibilities of my investigators so that files were assigned to them. They have a caseload of up to 30 files and they’ve been given 60 days. In that time they need to attempt to informally resolve the matter.


We did some training so that we’re all of one mind on the meaning of the exceptions to disclosure. It’s very important to me to recognize that we are a creature of Statute so their first job is to identify the issue in terms of what is the statutory provision.

We’ve all read and reread the cases in Nova Scotia, so we know what the test is. Their job then is to identify the issues to the parties, everybody knows what the issue is, everybody knows what the test is, gather the evidence to support the application or non-application of the exception and then communicate an informal opinion to the parties to see if that can resolve the matter and they’ve got 60 days. If it’s not resolved in 60 days, in my experience of having done thousands of these, if you don’t make momentum in 60 days you’re probably not going to make momentum. When 60 days are over if there’s nothing happening it comes to me and I will just write the final report, that’s it.


What is interesting is that only four have come to me of the many that we’ve assigned and I think it’s in part because they’re assigned, it’s their responsibility, they’re being very clear, you can understand the logic behind what they’re saying to the parties, it’s giving the parties confidence that they’re speaking to somebody who knows what they’re talking about, the parties are interested in resolving these matters. Honestly, the older files are probably easier to resolve because people are a little farther away from the issue. I think it may become more difficult as we get to the newer files.


As long as they’re making progress we are extending the 60-day timeline, so some of the older files that are still open relate to third parties. The major change in the backlog is that they’re actually assigned to individuals, there’s a 60-day timeline, and they have a clear mandate to informally resolve.


Every new file that comes in gets assigned to our intake manager and she attempts to do a very early initial resolution if she can. Those would typically be somebody who is trying to get the name of a third party that they would not let their party witness, for example, that the case was quite clear they are not going to get that or any other issue that’s pretty clear that she can find a quick resolution. If she doesn’t then it goes into the pile and it will eventually be assigned to an investigator.


What I’m hoping is that we will get through what’s left of the backlog by next Fall, depending on what the incoming file load is like. We’ve had an extraordinary high number of new files so I’m not sure we’ll manage and also, the Personal Health Information Act, last year we only had maybe 60 reports, but this year it’s almost 400 so that’s going to have an effect on our ability to manage the backlog, but I’m still optimistic that we can make our way through.


MR. RANKIN: Okay, you answered a couple more of my questions there, it was very comprehensive. Just one other question before I go to the next person. You have your expenditures listed here and obviously there’s revenue coming in from the inquiries so do you have an estimate of what kind of figure we do get from revenues, just order of magnitude?


MS. TULLY: We don’t have any revenues.


MR. RANKIN: That money goes to the general fund, it’s not showing?


MS. TULLY: There is no charge for filing a request for review with my office. There used to be, but there isn’t anymore.


MS. CARMEN STUART: And when we did I think it went to general revenue.


MR. CHAIRMAN: Ms. Stuart, do you want to just elaborate on what you just said?


MS. STUART: I just said that when we did charge a fee it did go to the general revenue.


MR. CHAIRMAN: Thank you. Ms. MacDonald.


HON. MAUREEN MACDONALD: Thanks very much, it’s great to have you here. I’m wondering about the scope of our legislation and whether or not you might be able to give us some sense of that in relation to what’s done elsewhere and your views on this. In particular I’m interested in knowing about, I don’t know, bodies that aren’t necessarily government departments, they’re not Crown Corporations, but they are kind of quasi-governmental, I suppose, in some ways.


I know that health authorities and school boards are subject to freedom of information, but I’m thinking about, for example, the Association of School Boards, the Health Association of Nova Scotia - HANS. These are organizations whose funding is 100 per cent from the provincial government. The roles they perform are pretty much fundamental to the operating of public bodies but yet they’re not included in our legislation, these two for example, but I’m sure there are lots of others that we could point to.


What is the practice elsewhere in terms of the scope of legislation? What’s your view on this?


MS. TULLY: That’s a great question. This is something that other jurisdictions are actually considering. Most recently British Columbia issued a decision that the Association of Chiefs of Police should be covered by the Freedom of Information and Protection of Privacy Act, but the rules around when a public body is added are different in that legislation than in ours so I’m not sure that the decision would translate in Nova Scotia but it’s for the very similar reason.


The Association of Chiefs of Police - at least in British Columbia - actually sets a lot of policy on behalf of all the police forces. That was really the driving force for why the Information and Privacy Commissioner considered that issue.


You know for the very issues when it’s funded by taxpayers’ money, when it’s setting public policy, these are good reasons to consider why the Act should apply. I suspect - I haven’t dug into this in a great deal of detail in the Nova Scotia Act but I suspect that an amendment would be required to add them.


I would add that there are some public bodies and I’m trying to think who voluntarily subject themselves to the rules under the Freedom of Information and Protection of Privacy Act. Some of the colleges, for example, simply want to follow the privacy rules so even if they are not technically subject to the Act, they govern themselves accordingly. It’s interesting how once these standards are set, some bodies that aren’t even subject to the Act are guided by the rules.


I agree with you that it’s worth considering and it would, I suspect, require a change to the Statute.


MS. MACDONALD: Now I want to switch gears just a bit here; the Personal Health Information Act is a piece of legislation that I have some familiarity with, I was the minister when it was introduced. It’s a very complicated piece of legislation and it pulled together a number of other pieces of legislation and harmonized, I think, the rules more with what was happening on a federal level and across the country.


Did I hear you correctly in saying that there are more than 400 possible allegations of breaches under that Act?


MS. TULLY: In 2014 we actually received two types of reports, one is privacy breaches. Unfortunately I think of it as the upside-down breach reporting requirement; we are only told about minor breaches, not about serious breaches. I’m not quite sure how that happened but it’s inconsistent with other breach reporting requirements.


In 2014 we received under FIA, 158 minor breach reports and 204 reports of disclosures without consent to a researcher. So that’s a technical requirement that health authorities tell us when they’re disclosing to a researcher. That’s how we get 361 or so and then we had a series of questions, so really it’s the 204 plus the 158 in 2014.


MS. MACDONALD: Can you elaborate a bit more about no reporting of major breaches?


MS. TULLY: We actually don’t know how this happened. I was curious about why we would only be given reports of breaches that didn’t require notification to individuals. That turns out to be the one-off mis-sent facts or that oops, you gave the report to the wrong doctor in your own doctor’s office - these minor things that don’t actually require notification to an individual. I actually don’t know what the source of that is, and as I say, it’s inconsistent with Alberta’s report requirement, for example.


The new standard or the emerging standard is real risk of significant harm. Those breaches should be reported to my office. I have said to anybody who will listen that despite the fact there’s no legislative requirement, you really should report breaches to my office; we can help. I’ve produced the privacy breach reporting material and we can certainly provide advice and comment on how you manage the breach and how to prevent the breaches. I’m very much encouraging municipalities, police forces, and government departments to tell me about their breaches; we’re here to help. It’s starting to happen particularly with health authorities reporting some more significant breaches that are a little bit more challenging. I think it’ll take time for them to get used to the idea, but down the road I would certainly encourage a change to all of the legislation to require privacy breach reporting to my office in particular.


MS. MACDONALD: Have you spoken with your minister about this problem?


MS. TULLY: I have mentioned this among a number of things that I would see as being important improvements to the legislation.


MS. MACDONALD: And do you have any indication from your minister that there will be a response?


MS. TULLY: I don’t know exactly what their response will be. I think they appreciate the significance of managing privacy in this day and age. What I’ve been saying to everyone is that the risks are increasing dramatically. Government is holding huge amounts of personal information in databases and the more they hold, the more risk it’s creating. It’s an opportunity right now in Nova Scotia to manage that well with the privacy management framework. Included in that framework is having a breach management process, and included in that process should be a notification to my office. Like I say, I’ve said it to anybody who will listen, including to my minister.


MS. MACDONALD: Thank you.


MR. CHAIRMAN: Ms. Peterson-Rafuse.


HON. DENISE PETERSON-RAFUSE: I certainly appreciate your presentation, and your knowledge base is certainly coming across this morning in your presentation. I congratulate you on the work that you have accomplished and succeeded in the last six or so months, and I wish you the best going forward.


I know you mentioned you just started in September 2014; however, you’re probably aware that in October 2013 we did have an election and there were election promises made at that time. My question is, did those promises come to your attention either through the Premier or through your minister to discuss a plan going forward?


There were three promises that were made in a letter dated October 4, 2013, and its three promises for transparency in Nova Scotia. It’s all based on if elected as Premier: (1) I will expand the powers and mandate of the review officer, particularly through granting her order-making powers; (2) I will impose a binding timeline of 30 days, extendable once by a maximum of 30 days, for responding to access to information requests; and (3) in our dealings with government lawyers my government will only claim solicitor-client privilege in cases where confidentiality is necessary to protect an impending court case or negotiation. It’s signed by the now Premier McNeil.


My question is, have those promises been brought to your attention in discussions with either the Premier or your minister, has there been a commitment to fulfill those promises, and is there a particular time frame to do that?


MS. TULLY: Thank you for your question, I’m aware of those series of letters that were issued around the time of the election. I have had some discussion with government about some aspects of that, but that has really been the extent of it.




MR. CHAIRMAN: Ms. Peterson-Rafuse, I was wondering if you could submit that letter so we have a copy of it for this committee?


MS. PETERSON-RAFUSE: Yes, we can do that. I don’t have a copy with me right now.


MR. CHAIRMAN: To this committee - thank you. Mr. Orrell.


MR. ORRELL: Back to the professional medical personal health intake files. You were saying there were 400 requests brought in, would that be a lot more if you didn’t have professional organizations dealing with some of those breaches before or should they go to your office as well? I’m on a professional organization, the Nova Scotia Physiotherapy Association. Anything with breaches as far as confidentiality with us goes to that association - should that stuff go to you guys as well?


MS. TULLY: What I’m interested in hearing about are the privacy breaches that could be characterized as a real risk of significant harm. So if it’s very sensitive personal information where a lot of people are affected even if it’s minor, where it hasn’t been managed, it hasn’t been contained, and there’s a risk of any kind of harm or embarrassment to individuals, I would like to hear about those. In fact if you can’t decide, just tell me about everything and we’ll have a conversation to figure out what makes sense. Once we’ve had a few conversations, it’s really an educational opportunity for whoever has reported to our office. It helps them to manage the breach, we’ll give them the materials we have.


I’m open to any question; there are no dumb questions from my perspective. We’re happy to talk to any organization, any health custodian that wants some guidance around this.


MR. ORRELL: If I could get some clarity, if a freedom of information request is submitted to your office, the person who submitted the request, does it become knowledge who submitted it, who it’s against, what it’s for - when does that stuff get revealed to the individuals involved in a request, or does it ever get submitted to that individual? If I was making a request against somebody else, would that person know that that request was made against them? Would they know that that request came from whatever association or group and what the request might be, or is that ever disclosed or has that ever happened? Just run me though the whole process, I guess.


MS. TULLY: Of course my office doesn’t receive access requests for information we have but within the government - let’s say I’m a reporter and I want to know the travel expenses for an ADM - do we have ADMs in Nova Scotia, assistant deputy ministers? Sorry, I worry that I speak British Columbian instead of Nova Scotian.


So I’m a reporter, my name is Sue Smith and I make a request for an expense claim for an ADM. The identity of the applicant - me - should not be revealed through the ministry. There’s no need to know who asked because it’s not a personal information request.


If I, Sue Smith, asked for my own personal information, then it’s important for whoever is gathering the records or signing it off to know that I’m asking for my own personal information; otherwise, why are we giving out all this personal information? You need to know it’s the applicant, so we’re not severing it because it’s their personal information. But because it isn’t my personal information, generally speaking there would be no need to disclose the identity of the applicant through the ministry because the request can be processed without that information.


MR. ORRELL: So would the ministry know that that request was against them, say?


MS. TULLY: Well, it depends on where the records are held. If the expense records are in the hands of the ADM, would they know about the request? Yes, they would.


MR. ORRELL: Oh yes, definitely. With us filing our own expenses, those are filed monthly. If a request is brought in against, say, our personal expenses, they would go to the Speaker’s Office to get that information and do that. Would we ever know that that request was made against us, if that was the case?


MS. TULLY: You might know because often, as also with calendar requests, it’s difficult for, say, an analyst who is supposed to go through the records to necessarily identify the personal information that actually should be withheld. So it isn’t that unusual for the owner of the records to go through and say okay, this is my personal stuff. It’s within the realm of possibility and certainly not an unusual approach to managing an access request for the holder of the records.


The other thing is that often it’s the creator of the records who knows best what risks are associated with the disclosure. So while they might not know the Act, they may be able to give some background to the person who is tasked with severing the record and applying the Act, to know what the risks are associated with it.

MR. ORRELL: Thank you.


MR. CHAIRMAN: Ms. MacFarlane.


MS. MACFARLANE: I’m curious, I know that you have some full-time staff and then you contract out to others to conduct work within your office. I’m looking at your budget and I’m just wondering - the ones that you contract out, would they be considered under Salaries and Benefits or would that be the Professional/Special Services budget that I’m looking at? That’s Page 17.


MS. TULLY: That’s the Professional/Special Services. It’s really just the front desk - clerical assistance.


MS. MACFARLANE: So with work being contracted out between your full-time staff, does that have an influence on the backlog?


MS. TULLY: It’s very important to us to have somebody at that front desk because if we don’t, the person who is the intake manager would have to take on that task, and the person who is the intake manager probably resolves 40 per cent of the files. She’s very effective and experienced. Of course, she gets to cherry-pick the quick ones, but she gets that work done so they’re not sitting forever, so it is an important position for us, yes.


MR. CHAIRMAN: Are there any other questions? Mr. Jessome.


MR. JESSOME: In light of some of the questions coming from the Opposition, I’m curious - we’re talking about the consideration for quasi-government bodies to be considered under FOIPOP legislation. In your opinion, where would you draw the line to say this type of an organization would not fall under the office’s purview or your purview?


MS. TULLY: For now, we’d have to be governed by what the Act says fits as a public body, but just as a general principle - which, I think, is what you’re asking - it’s important whether taxpayers’ money is being used and whether they’re setting any kind of public policy. These are two core factors in deciding whether or not they should be subject to the Act because, of course, the purpose of the Act is to allow people to understand and have the information they need to subject government to some oversight and to understand the sources of the policy decisions. For me, those are the core elements.


MR. CHAIRMAN: Ms. MacFarlane.


MS. MACFARLANE: Perhaps I’m the only one sitting here where it went over my head or something, but I know when Mr. Rankin asked the question with regard to revenue coming in earlier, you had said that there’s a $5 applicant fee. So I guess when we’re looking at the budget and we don’t see any line for revenue - I’m not sure if that’s what Mr. Rankin is asking, but I’m curious to know - where does that small amount of money go?


MS. TULLY: That’s money that’s paid by applicants to the government departments or the municipalities when they make the access requests. After they’ve made their request, if they’re unhappy with the response, they come to us - we’re the appeal body. In the past, you actually had to pay to appeal to us, but that was removed through the legislation a number of years ago. So for a while it was probably, oh well, I guess it went to central revenue.


So the only money that’s coming in is going directly to the departments or the municipalities, but not to us. That’s why it doesn’t show up in our budget because we’re just the appeal body, completely separate.


MS. MACFARLANE: Thank you for explaining that.


MR. CHAIRMAN: I would like to ask a quick question if there are no more. Is there a difference between your position as a review officer and the FOIPOP Review Officer? Are different procedures followed?


MS. TULLY: The confusion is in the name. If I was called the information privacy commissioner, which is what I’m called everywhere else in Canada, except in Nova Scotia, I think it would be clear. So if you think of me as the information privacy commissioner, it might be clear. The government itself uses the word “officer” for positions within government. We are almost outside of government in the sense that there’s some independence to the office.


For example, the lead on access and privacy for the government, her position is Chief Information Access and Privacy Officer, and I am the review officer. So I think the members of the Legislature get a bit confused about who is who. If you think of me as the privacy commissioner, then you get a sense that I have no role in processing access requests. I’m not part of the ministry. I’m not in the workings of how and when they process requests. It only gets to me when it’s all done and the applicant is unhappy - then they come to me. I’m the oversight agency with the power to make recommendations back to the ministries to perhaps change or continue with what they have done before.


MR. CHAIRMAN: Very well done - a lot of technical and I hear you use the words “common sense” quite a bit so it’s nice to see that being used.


MS. TULLY: I hope to be, yes.


MR. CHAIRMAN: On behalf of the committee, I would like to thank you for coming today. We’re pleased to have you here and we’re pleased with your discussions. I will be looking at Hansard when it comes back, to go back over some of this.


MS. TULLY: I’m sorry if I was too technical and I welcome any questions you have. Feel free to call my office if you have questions about access or privacy. We’re there to help, provide information, and make the system work well.


MR. CHAIRMAN: Are there any other comments you would like to make?


MS. TULLY: No, that’s it - thank you.


MR. CHAIRMAN: Thank you for coming today; it was much appreciated.


We will now take a five-minute recess before we do the ABCs.


[11:00 a.m. The committee recessed.]


[11:07 a.m. The committee reconvened.]


MR. CHAIRMAN: If I could, I would ask everyone to take their positions, please, and we can begin the ABCs.


A couple of issues have come up. One is that we’ve been requested within the last hour and a half or two hours to not appoint any members to the Provincial Health Authority. We’ve received a letter: “On behalf of the Department of Health and Wellness, the Executive Council Office would like to withdraw from consideration, by the Standing Committee on Human Resources, the appointments to the Provincial Health Authority board that were forwarded to your office last week.”


MR. ORRELL: Was there a reason given why that’s the case?


MR. CHAIRMAN: The only reason that I am aware of is that they want to appoint all the board members and other board members in the next week or so. They’d like to do it all in one sweep.


MR. ORRELL: Are we going to have to have another meeting for that, Mr. Chairman?


MR. CHAIRMAN: Yes, we will. (Interruptions)


MR. ORRELL: The next meeting will be in a month’s time and that’s just before the . . .


MR. CHAIRMAN: Yes, we will have to request a special meeting.


MR. ORRELL: From what we’ve seen on the papers there, Mr. Chairman, a lot of those people were big donors to the Liberal Party, the ones that were going to be there today. We’re concerned that that’s a problem and if they’re going to do this a week or two before the district health authority comes into play, how are these people going to be able - so we’re going to have a special meeting to have that?


MR. CHAIRMAN: Yes, we are, and it was suggested maybe the 11th would be the preferred time to have one, which is a Wednesday, a caucus day for most of us.


MS. MACDONALD: Mr. Chairman, I’d like to put a motion on the floor that the committee receive information on all 59 applicants for the Provincial Health Authority board. That’s my motion.


From the information we have, we know that there were 59 applicants for this post, but we don’t know who those applicants were. This is probably the single most important board of government. This is the board that will oversee the operation of our health care system. I think it’s incumbent on us as a committee to ensure we have all of the information that we require when we are agreeing to appointments of members of this particular board, who the applicants were, and that we are getting the best applicants - a representative group of applicants and people that we feel confident will be acting in the public interest in terms of the public health care system, unimpeded from any partisan political considerations. For that reason I think this merits additional information to the members of this committee.


MR. CHAIRMAN: Are there comments from anyone else? Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is defeated.


Mr. Farrell.


MR. TERRY FARRELL: Mr. Chairman, I understand that pursuant to the rules governing committees that if there is to be a special meeting that it will require a motion giving the chairman the authority to do that. I would like to make a motion at this time that the committee give the chairman the authority to call a special meeting, at the discretion of the chairman, to deal with reviewing the appointments to the Provincial Health Authority board.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


We can set that date right now if you like. We were looking at March 4th or 11th, but preferably the 11th. I would suggest that the 11th be the date, that’s a Wednesday.


MR. ORRELL: So is that just going to be for that board?


MR. CHAIRMAN: As I understand it.


MR. ORRELL: Could we have that later in the afternoon because of caucus meetings and travelling to the city?


MR. CHAIRMAN: Do you have a time you would suggest?


MR. ORRELL: Most caucuses are at 1:00 p.m. (Interruptions) Or 12:30 p.m., if it’s only a half-hour. If it’s just for that board.


MR. CHAIRMAN: Mr. Rankin.


MR. RANKIN: I don’t think we need to set the date today because I think there’s a lot of other information we have to figure out for the best date for everybody.


MR. CHAIRMAN: Yes, it was felt by myself that the 11th would be appropriate, a caucus day for most or all of us. (Interruptions)


MR. GORDON HEBB: The motion gives him power to convene it, so you’re just really discussing when it would likely be, but Mr. Farrell’s motion gives the chairman the final say on determining when that particular meeting is.


MR. CHAIRMAN: Ms. MacDonald.


MS. MACDONALD: On a point of clarification, it seems to me that we need to set a date that is possible for the members of the committee to actually attend. I think the chairman has the power to call a special meeting, but to call a special meeting and schedule it at a time when members of the committee are able to attend should be an implicit assumption.


MR. CHAIRMAN: I agree with that comment. I will make a suggestion of 12:00 noon, in this room - so on the 11th at 12:00 noon.


Is it agreed?


It is agreed.


We can carry on with the approval of recommended representatives from different departments for ABCs. Ms. Treen.


MS. TREEN: Mr. Chairman, under the Department of Communities, Culture and Heritage, I move that Erik Sande and Craig Thompson be appointed to the Art Gallery of Nova Scotia Board of Governors.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


For the Department of Community Services - Mr. Jessome.


MR. JESSOME: Mr. Chairman, I move that Nadine Bernard and Cheryl Watson be appointed to the Advisory Committee on the Children and Family Services Act as board members.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


For the Kings Rehabilitation Centre - Mr. Jessome.


MR. JESSOME: Mr. Chairman, I move that Judy Heffern be appointed to the Kings Rehabilitation Centre Board of Management as a board member.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


For the Advisory Council on the Status of Women - Mr. Farrell.


MR. FARRELL: Mr. Chairman, I move that Dr. Felicia R. Eghan, Kimberly A. MacDonald, Maura Ryan, Annie Saint-Jacques and Chelcie Soroka be appointed to the Advisory Council on the Status of Women as members.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


The Department of Economic and Rural Development and Tourism - Mr. Rankin.


MR. RANKIN: Mr. Chairman, I move that Chris Huskilson be appointed to the Innovacorp Board of Directors as a member.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


MS. MACDONALD: I’m abstaining.


MR. CHAIRMAN: Okay, you’re abstaining.


The motion is carried.


For the Trade Centre Limited, Mr. Rankin.


MR. RANKIN: Mr. Chairman, I move that Justin McDonough be appointed to the Trade Centre Limited Board of Directors as chair and member.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


For the Department of Finance and Treasury Board - Ms. Treen.


MS. TREEN: Mr. Chairman, I move that William Book and Doug Skinner be appointed to the Halifax-Dartmouth Bridge Commission as members.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


For the Department of Health and Wellness - Mr. Jessome.


MR. JESSOME: Mr. Chairman, I move that William Hart, Rosanne LeBlanc and Denise Rooney be appointed to the Nova Scotia Advisory Commission on AIDS as members.


MR. CHAIRMAN: Did you . . .


MR. JESSOME: She’s a chair.


MR. CHAIRMAN: Okay, as members, sure.


Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


MR. JESSOME: I also move that Louise Lalonde be approved for this commission as member and chairman designate.


MR. ORRELL: The documents provided by the department say the position of chairman had been remunerated $5,000 per year in the past, but now it’s showing only as $1,000. Is that a change for a specific reason or is it a typographical error?


MR. CHAIRMAN: Good question. Maybe our clerk can answer that.


MS. KIM LANGILLE (Legislative Committee Clerk): No. 6 in the guidelines talks about the remuneration and the change. The position of chairing the commission will now be remunerated at an annual $1,000 honorarium.


MR. ORRELL: So that’s a change from the past.


MS. LANGILLE: Yes, it had been $5,000 previously.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


The Midwifery Regulatory Council of Nova Scotia. Mr. Farrell.


MR. FARRELL: Mr. Chairman, I move that Teri Crawford be appointed to the Midwifery Regulatory Council of Nova Scotia as a council member.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


For the Department of Labour and Advanced Education - Mr. Jessome.


MR. JESSOME: I move that Brent Denny and G. Bernard MacKinnon be appointed to the Fire Safety Advisory Council as members.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


For the Fire Services Advisory Committee - Mr. Rankin.


MR. RANKIN: Mr. Chairman, I move that Matthew Pyke be appointed to the Fire Services Advisory Committee as a member.


MR. CHAIRMAN: Would all those in favour of the motion please say Aye. Contrary minded, Nay.


The motion is carried.


I don’t think there are any other issues other than . . .


MS. LANGILLE: Entertaining witnesses during the House.


MR. CHAIRMAN: Yes, there has been a comment about having witnesses or presenters while the House is in. We’re going to say no. We’ll still have our appointments for the ABCs, but we won’t have presentations. We do have one tentatively booked, but I don’t think we’ll carry through with that. We’ll have enough on our plates, I’m sure.


Is it agreed?


It is agreed.


I’ll adjourn the meeting.


[The committee adjourned at 11:22 a.m.]