I find that interesting that the Minister responsible for the Power Corporation has only found out now about these delays that might have incurred cost to them and that it was in fact found out through the news article.

To the question, though, Mr. Speaker, we do a lot of business in the United States as a government. There is obviously a difference sometimes in dollar amounts based on the Canadian dollar. Now that we have waited a significant period of time for these generators, the Canadian dollar has gone down. It was a $2.5 million awarded contract. Are we going to expect to see a supplementary appropriation for any kind of increases to this contract given that the Canadian dollar has gone down? Will we see an adjustment supplementary appropriation?

I would not expect that we would. I am not certain whether in Canadian or American dollars the contract was entered into. Often, contracts with American providers are entered into in American dollars. That is simply the way of the world. I am not expecting there to be any significant additional costs as a result of the change of dollar. I am not certain what the contract said about that.

Further to that, I am going to ask the Minister if he will endeavour to actually check into that and see if, in fact, we are going to pay the $2.5 million, whether it is Canadian or US? If it is Canadian, will we be expecting a supplementary appropriation for any kind of adjustment due to a declining Canadian dollar?

I simply don't have that information in front of me. I am not certain how the contract was set up, whether it was denominated in Canadian or American funds or dollars. I will look into it. I doubt there will be any supplementary appropriation required.

Masi. Oral questions. Member for Frame Lake.

Mahsi, Mr. Speaker. I would like to just pursue this issue of changes to the diamond mine environmental agreements a little bit further with the Minister of Environment and Natural Resources. Earlier, I said that I can assure the Minister that the initiative to change the agreements last time to remove the federal government from the agreements was actually coming from our government, GNWT. I am pleased to hear him say that is not the case now, that there were some letters sent in December of 2016 about changes. Can the Minister table some sample letters in this House just so we have a better sense of what is going on? Thanks, Mr. Chair.

Masi. Minister of Environment and Natural Resources.

Thank you, Mr. Chair. Mr. Chair, I will find out if I am able to do that, or if I do find the letters, I will share them with the Members, and if possible, I can table them. Thank you, Mr. Speaker.

Masi. Oral questions. Item 8, written questions. Item 9, returns to written questions. Mr. Clerk.

Masi. Returns to written questions. Item 10, replies to Commissioner's opening address. Item 11, petitions. Item 12, reports of standing and special committees. Member for Kam Lake.

Thank you, Mr. Speaker. Mr. Speaker, your Standing Committee on Government Operations is pleased to provide its report on the review of the 2014-2015, and 2015-2016 Annual Reports of the Information and Privacy Commissioner of the Northwest Territories and commends it to the House.

Introduction

The Access to Information and Protection of Privacy (ATIPP) Act came into force on December 31, 1996. The purpose of this legislation is to promote government accountability by balancing access to government information with the protection of individual privacy rights related to that information.

Under the act, the Information and Privacy Commissioner (IPC or Commissioner) is appointed for a five-year term as an independent officer of the Legislative Assembly. That appointment is currently held by Ms. Elaine Keenan Bengts. The act requires the Commissioner to file an annual report on her activities and authorizes her to include recommendations for amending the legislation to improve the act’s efficiency and effectiveness.

On October 20, 2016, the Standing Committee on Government Operations (SCOGO or the Committee) conducted a public review of the 2014-2015 and 2015-2016 Annual Reports of the Information and Privacy Commissioner, which were tabled in the Legislative Assembly on October 2, 2015 [Tabled Document 329-17(5)] and October 14, 2016 [Tabled Document 148-18(2)] respectively. This report summarizes that review.

The Role of the Commissioner

Access to Information and Protection of Privacy Act

The Office of the Information and Privacy Commissioner was established with the 1997 enactment of the Access to Information and Protection of Privacy Act. The Office provides independent oversight and enforcement of the ATIPP Act, which applies to a number of GNWT departments, boards, and agencies.

The Commissioner is appointed as a statutory officer of the Legislative Assembly for a five-year term and can only be removed “for cause or incapacity,” which affords her the ability to comment freely and directly. Ms. Keenan Bengts currently holds the office for a five-year term terminating on October 30, 2020.

The ATIPP Act enshrines two principles:

1. public records must be accessible to the public; and

2. personal information must be protected by public bodies. The act outlines the rules by which the public can obtain access to government-held records and rules about the collection, use, and disclosure of information by government.

Generally, the act requires that the government collect only the information that is absolutely necessary for the implementation of the program under which the information is collected. The Supreme Court of Canada has ruled that laws like ATIPP are “quasi-constitutional” laws that are generally paramount to other laws and define fundamental democratic rights.

The Commissioner reports to the Legislative Assembly of the Northwest Territories. Additionally, the powers provided to the Commissioner under the ATIPP Act include the powers to investigate, mediate, and resolve matters concerning access and privacy disputes and complaints; comment on the privacy implications of proposed legislation or government programs; undertake research into matters related to the purposes of the act; and educate the public about their rights.

Health Information Act

The new Health Information Act, which came into effect on October 1, 2015, is intended to govern the collection, use, and disclosure of personal health information and provide for its protection. The act sets out clear direction that medical practitioners are to have access to records only to the extent required in order to provide care.

The act allows medical practitioners to assume that an individual who seeks healthcare has implicitly provided consent to the collection, use, or disclosure of such personal health information as is necessary to provide the patient with appropriate care. This assumption of implicit consent is contingent upon the practitioner’s belief that the patient is knowledgeable about how his or her personal information will be collected, used, and disclosed.

The act gives patients the right to put conditions on who has access to their records. Where a patient expressly indicates that the practitioner may not rely on implied consent, the practitioner is then required to obtain the patient’s express consent to collect, use, or disclose the patient’s health information. There are limited exceptions to this, such as in the provision of emergency health care.

The act gives patients the right to access their own health records. The process is similar to that contained in the ATIPP Act, which governs access to government records. Unlike the ATIPP Act, however, which only permits recovery of photocopying costs, access by a patient to his or her medical records under the Health Information Act is subject to the payment of fees.

The act allows a person who believes their records have been improperly collected, used, or disclosed to request the IPC to undertake a review. Rights of appeal under this act are different than those under ATIPP. Appeal rights apply to both access to information and breach of privacy issues. As well, the IPC has the authority to appeal the decision of a health information custodian to the courts.

Also new is the positive duty imposed on health information custodians to notify any individual whose medical records have been compromised. This notice must also be given to the IPC, who may choose to investigate the breach.

Commissioner’s Activities

Commissioner’s Message

The Information and Privacy Commissioner often chooses to highlight topical aspects of her work in her annual “Commissioner’s Message.”

For 2014-15, the Commissioner’s message focused on the impacts of technology on government and its implications on access to information and protection of privacy. She noted that, while the recording, storage, and sharing of data have become easier, technological advances such as portable and personal devices, USB drives, and other mass storage devices have made keeping track of information more difficult, thereby necessitating a robust records management system.

With respect to privacy, she observed that the use of technology has led to a tendency to over-collect and over-retain personal information. Over-collection can result in such things as inappropriate sharing, data matching (bringing together data from different sources and comparing it to identify and investigate people for further action) and data breaches. She suggested that government should be vigilant about the over-collection of data, as the use of data for purposes other than that for which it was collected is prohibited under the ATIPP Act.

For 2015-16, the Commissioner’s message addressed the implementation of the new Health Information Act, which came into force on October 1, 2015. The Commissioner observed a lack of any significant publicity campaign surrounding the new legislation. She noted that, notwithstanding this scarcity of information, the first complaint under the act was received on the same day that the act came into force, followed by six more complaints in the first six months of the coming-into-force date of the legislation. This suggests to her that people are concerned about their health information and how it is managed and protected and that health authorities have a lot of work to do to become compliant with the legislation.

The Commissioner also pointed out that next year will be the 20th anniversary of the coming into force of the ATIPP Act and that, especially with respect to digital communication, “the world has changed exponentially” since the act was first developed. The Committee shares the Commissioner’s view that the implementation of a new, updated ATIPP Act would be a fitting way to celebrate this milestone anniversary.

The Year in Review

2014-2015

In 2014-15, the Commissioner opened 43 new files and undertook nine reviews resulting in recommendations. Of these, 10 were requests for the Commissioner to provide comment to government on matters related to information access and privacy; two were requests for the Commissioner to undertake a review by a third party objecting to an access or privacy issue; seven were requests for the Commissioner to undertake a review related to a breach-of-privacy complaint and two were requests for reviews related to an access-to-information complaint.

At the time the Commissioner’s annual report was written, there was no obligation for public bodies to disclose to the IPC when they have discovered a breach of privacy. Despite this, 11 public bodies voluntarily disclosed breaches in 2014-15. Most of these were dealt with informally and cooperatively. The IPC was pleased to see these proactive breach notifications, noting that many came from health sector organizations, including the Department of Health and Social Services, the Stanton Regional Health Authority, Yellowknife Health and Social Services Authority, and the Beaufort Delta and Fort Smith Health and Social Services Authorities. This suggests to the Commissioner that they are cognizant of the requirement for notification under the new Health Information Act scheduled to come into effect the following year.

The remaining 11 files opened in 2014-15 were related to a variety of miscellaneous matters, such as an access or privacy complaint regarding municipalities, over which the IPC has no jurisdiction; participation of the IPC on a federal-provincial-territorial working group; a request to disregard an access request; and other administrative matters arising under the ATIPP Act.

2015-2016

In 2015-16, purely by coincidence, the Commissioner again opened 43 new files and undertook nine reviews resulting in recommendations; however, these files related to matters which were different than in the previous year.

In her review, the Commissioner observed that her office is being asked more frequently to provide comments and input on pending legislation, which she views as a positive development. In 2015-2016, the Commissioner received 12 requests by government to comment on matters requiring access or privacy consideration. The Commissioner expects this trend to continue in the coming year, noting that the Department of Justice’s review of the ATIPP Act will demand a significant amount of the office’s time.

Privacy issues continued to be at the heart of the work of the IPC’s office. Six files were opened requesting the Commissioner to undertake a review related to a breach-of-privacy complaint, of which three arose prior to the October 1, 2015 effective date of the Health Information Act. As previously noted, with the coming into force of this act, it became a requirement under law for Northwest Territories’ health sector agencies to report to the IPC any instances where the privacy of a patient’s health information has been breached. This requirement for mandatory breach notification may have contributed to the drop in the number of voluntary breach notifications from 11 in the previous year to four in 2015-16.

As well, it is likely that the enactment of the Health Information Act also resulted in an increase in the number of requests for review of access and privacy matters falling outside of the IPC’s jurisdiction from one in the previous year to seven in 2015-16. Matters falling outside of the Commissioner’s jurisdiction are often related to the handling of information by municipalities which are presently not subject to the requirements of the ATIPP Act. However, in the lead-up to the implementation of the Health Information Act, the Commissioner additionally received requests for reviews that were premature but requiring follow-up once the Health Information Act was in effect.

In 2015-16, the Commissioner opened three files related to an access-to-information complaint. One file was opened in response to a request for review by a third party objecting to an access or privacy issue. The remaining ten files related to miscellaneous inquiries, requests, consultations and administrative matters.

IPC Recommendations for Legislative Change and Improvement

Access to Information and Protection of Privacy Act

As already noted, the Information and Privacy Commissioner is authorized to make recommendations for legislative change. Over the period of time covered by this review, the IPC has made a number of recommendations for changes and improvements to the ATIPP Act, including:

Access and privacy by design

Undertaking access and privacy impact assessments for new legislation, policy and program initiatives would promote early consideration of the impact that these may have on the right to access information and the privacy of the individual. The Commissioner has encouraged departments developing new legislation, policy and programs to seek the input of her office, pointing out that they are under no obligation to follow her recommendations.

Inclusion of local housing authorities

In 2015-16, there were a number of files involving the NWT Housing Corporation and local housing authorities. While these issues were resolved cooperatively, they highlight the fact it is unclear, in the view of the Commissioner, whether or not local housing authorities fall under the scope of the act. The IPC has recommended that the ATIPP regulations be amended to clearly include local housing authorities and associations.

Inclusion of municipalities

The IPC has repeatedly recommended that municipal governments be subjected to some form of access and privacy legislation, noting that they have had 20 years to determine how to achieve this. She emphasizes it is her view that municipal governments, who spend public funds, should have legislated obligations with respect to access to information by, and the protection of the privacy of, the citizens they serve.

Changes to the appeal process

The IPC notes that, because of her ombudsman-like role, any applicant who is unhappy with the Commissioner’s decision is responsible to take the matter to court. In her 18 years as IPC, the Commissioner notes that there have only been three such appeals, which she attributes to the expense and complexity of such an undertaking. The Commissioner has suggested a review of the ATIPP Act should include a consideration of the ways to improve the appeals process under the act. She highlights her review recommendation 15-132, respecting the NWT Power Corporation, which exemplifies the difficulties an applicant faces in appealing a decision of the IPC to the court.

Changes to the scope of the IPC’s authority

As currently written, the ATIPP Act does not give the IPC the authority to investigate a privacy concern unless a formal request to do so is received. The Commissioner points out that since she received many letters in 2014 to 2015 expressing serious concerns about privacy breaches by people who were unwilling to lodge a formal complaint. She recommends amending the act to provide the IPC with the authority to undertake the investigation of privacy complaints on her own initiative.

The recommendations made by the IPC with respect to privacy concerns usually involve recommendations for changes to the processes and procedures followed by the public body in order that similar breaches be avoided in the future. Once the public body responds to the IPC’s recommendations, the act does not provide a formal mechanism allowing the IPC to follow up to ensure that commitments made by public bodies are being met. The Commissioner has recommended changing the legislation to provide some method for assessing how a public body is fulfilling its commitments, with a view to satisfying complainants that their concerns are being addressed.

Inclusion of requirements for mandatory breach notification

The Commissioner points out that under the Health Information Act, the Northwest Territories now has the requirement for mandatory breach notification in the health sector, which is consistent with the trend across other jurisdictions across Canada. The IPC asserts that it is time to make all public bodies subject to the same obligation.

Health Information Act Implementation

In her report, the Information and Privacy Commissioner observes that the coming into force of this legislation should have significantly changed the way the Northwest Territories health institutions deal with medical records. She is of the view that there has been no apparent change.

In the first six months since its coming into force, the IPC opened seven substantive files related to privacy issues under the act: three arose out of privacy complaints; and four in response to mandatory breach notifications.

While there was some basic training done for health sector employees before the act came into effect, it is the finding of the IPC that training has been sporadic and does not appear to have been made mandatory for any sector of the health services industry. She notes that few, if any, health authorities have yet been able to properly comply with section 8 of the act requiring the adoption of standards, policies, and procedures to implement the requirements of the act. She notes that some have suggested to her that this is the responsibility of the Department of Health and Social Services, which is not the case under the act.

The IPC holds the opinion that the act is complicated and difficult to interpret. She notes, for example, the term "medical practitioner" is not adequately defined and could be broadly interpreted to mean a wide variety of professionals such as dentists, psychologists, physiotherapists, dieticians, naturopaths, chiropractors, et cetera, even though it does not appear to have been the intent of legislators or the understanding of officials in the Department of Health and Social Services at the time of the development of the legislation.

Even more concerning to the IPC is that little appears to have been done to allow patients to limit and control access to their records. She notes that, in their current format, electronic records do not have the functionality to mask or physically block the access of those whose access is limited or excluded at a patient’s request. It is the Commissioner’s view that a great deal of work needs to be done to ensure that members of the public understand their rights under the new Health Information Act and know how their personal health information will be managed under the act.

No review recommendations were issued by the IPC under the act during the first six months of it being in force.

Committee Recommendations to the GNWT

Having considered the information put forward by the IPC in her 2014-15 and 2015-16 Annual Reports and the discussion held during the public meeting of October 20, 2016, the Standing Committee on Government Operations provides the following recommendations to the GNWT.

Review and Revision of the ATIPP Act

The Standing Committee is aware of the recommendations made by the Information and Privacy Commissioner over the past 20 years for modernizing and updating the ATIPP legislation. In addition to the recommendations noted above, earlier recommendations include, among other things, addressing the use of current-day technologies, providing strict and enforceable timelines for responses by public bodies to access requests, and encouraging them to properly document information-related decisions. The committee strongly encourages the GNWT to give consideration to all of the recommendations made by the IPC over the past 20 years to improve ATIPP legislation and to address these recommendations in the legislative proposal to amend the act.

The committee wishes to note, in particular, its support for the concept of access and privacy by design and the inclusion of municipalities under the ATIPP Act.

The committee is also aware of recommendations to government made by standing committees in previous assemblies, arising from earlier reviews of the IPC’s annual reports. This includes the recommendations to include a triggering provision for a mandatory statutory review of the act within a set timeframe, to ensure that another 20 years does not pass before the act is reviewed again.

The committee expects that the GNWT is compiling and considering all of these recommendations as it undertakes its review of the legislation. With that expectation, the committee notes here that it looks forward to further considering the merit of and providing detailed comment on the many issues raised by the IPC within the context of its review of the bill.

At this time, however, the committee is more concerned with the timely introduction of the bill so that changes to the ATIPP Act can be completed in the life of the 18th Assembly, as promised in the GNWT’s mandate. To this end, the Committee makes the following recommendations:

Recommendation 1

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories advise the House of specific target dates for the completion of a legislative proposal and the introduction of a bill to modernize and update the Access to Information and Protection of Privacy Act.

Recommendation 2

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories identify all recommendations made by the Information and Privacy Commissioner by this and previous Standing Committees, for improvement to the Access to Information and Protection of Privacy Act.

The Standing Committee on Government Operations further recommends that the Government of the Northwest Territories identify in the legislative proposal to amend the act how these recommendations are being addressed.

The Committee urges the Department of Justice to prioritize the modernization of the ATIPP Act to ensure that it can be completed prior to the dissolution of the 18th Assembly.

Recommendation 3

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories take the necessary steps to ensure that a modernized ATIPP Act is brought into force before the end of the life of the 18th Legislative Assembly.

Implementation of the Health Information Act

The standing committee is concerned by the IPC’s perception that health authorities have not done enough to bring themselves into compliance with the Health Information Act and that the efforts of the Government of the Northwest Territories to ensure all residents are aware of their rights under the act has also been less than adequate.

The committee takes notes of the fact that the first recommendation made by the Standing Committee on Social Programs during the review of the draft legislation in the 17th Assembly was “that the Department of Health and Social Services develop and implement a comprehensive public awareness campaign” on the Health Information Act.

Research by the committee reveals that the GNWT’s Department of Health and Social Services has made information available to the public on its website and has prepared a document titled “Health Information Act Guide: A Practical Guide to the Northwest Territories’ Health Privacy Legislation,” dated July 2015. The committee notes that this document was not tabled in the Legislative Assembly at the time of its release nor by the date of this report. This suggests to the committee that, while the Department of Health and Social Services has made efforts to prepare information to assist the public to understand its rights under the act, more work needs to be done to ensure that this information is broadly distributed to the public. To this end, the committee makes the following recommendations:

Recommendation 4

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories prepare and table a report on the status of the work it has completed to implement the Health Information Act, including the implementation of a public information campaign and training for health sector employees.

Recommendation 5

The Standing Committee on Government Operations recommends that the Minister of Health and Social Services table the Health Information Act Guide in the Legislative Assembly and provide a televised public briefing to the Committee on the Health Information Act and its impacts on the rights of those who access health care in the Northwest Territories.

Recommendation 6

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories ensure that Health Authorities undertake the steps necessary to establish or adopt standards, policies and procedures in compliance with Section 8 of the Health Information Act.

The Standing Committee on Government Operations further recommends that the Government of the Northwest Territories keep the Committee advised of progress on this work, with a view to having the appropriate written procedures in place within six months from the date of this report.

When the Information and Privacy Commissioner appeared before the Committee, she noted that the Department of Health and Social Services had not provided her with any privacy impact assessments related to health authority amalgamation, also referred to as the health system transformation initiative, and that the failure to do so appeared to be a contravention of section 89, paragraphs two and three, of the Health Information Act.

Previously, during the review of Bill 44, An Act to Amend the Hospital Insurance and Health and Social Services Administration Act, the Standing Committee on Social Programs in the 17th Legislative Assembly had recommended that the Department of Health and Social Services undertake a privacy impact assessment related to the health system transformation initiative.

In its response, the department noted that it had opted not to do this work, expressing the view that, under the Health Information Act, “the department is required to carry out privacy impact assessments whenever considering changes to or creating a new electronic health information,” and that “system transformation does not affect existing departmental plans for electronic health information systems, such as the Electronic Medical Record system, for which a privacy impact assessment had previously been completed.”

The question at hand is whether section 89(2) of the Health Information Act compels the Department of Health and Social Services to complete a privacy impact assessment of the changes to the information systems associated with the health system transformation initiative.

The department contends that the legislation does not compel it to perform a privacy impact assessment because the amalgamation does not involve changes to electronic health information systems. Their argument hinges on the notion that information systems are necessarily electronic systems.

The Committee is of the view that, under the act, the term “information system” is not synonymous with “electronic system” and that the department’s narrow interpretation of this section of the act is not in keeping with the spirit and intent of the act, the stated purpose of which is “to govern the collection, use, disclosure, and protection of personal health information in a manner that recognizes both the right of individuals to access and protect their personal health information and the need of health information custodians to collect, use, and disclose personal health information to support, manage, and provide health care.”

The committee believes that a privacy impact assessment on the health system transformation initiative would provide assurances to members of the standing committee and, more importantly, members of the public that the Department of Health and Social Services has exercised sufficient due diligence to ensure that the rights of individuals to access and protect their personal health information has not been adversely impacted by health system transformation. Accordingly, the committee makes the following recommendation:

Recommendation 7

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories obtain a legal opinion on whether “information system” as referenced in section 89 of the Health Information Act is limited to electronic health systems when the act is considered as a whole;

And further, that the Government of the Northwest Territories share that legal opinion with the standing committee, in confidence, once it is completed;

And furthermore, that the Government of the Northwest Territories conduct a privacy impact assessment on the health system transformation initiative, should the legal opinion find that “information system” as referenced in section 89 of the Health Information Act is not limited to electronic health systems when the act is considered as a whole.

CONCLUSION

Members would like to thank Ms. Keenan Bengts for her reports and for her appearance before the committee at the public review held on October 20, 2016. The committee also wants to take this opportunity to thank Ms. Keenan Bengts for her continued commitment and dedication to all matters relating to access to information and the protection of privacy by public agencies in the Northwest Territories.

Recommendation 8

The Standing Committee on Government Operations recommends that the Government of the Northwest Territories provide a response to this report within 120 days. Thank you, Mr. Speaker.

Masi. Member for Kam Lake.

Thank you, Mr. Speaker. Mr. Speaker, I move, seconded by the honourable Member for Hay River North, that Committee Report 8-18(2), Standing Committee on Government Operations Report of the Review of the 2014-2015 and 2015-2016 Annual Reports of the Information and Privacy Commissioner of the Northwest Territories, be received by the Assembly and moved into Committee of the Whole for further consideration. Thank you, Mr. Speaker.

Masi. The motion is on the floor. To the motion.

Question has been called. All those in favour. All those opposed.

---Carried

Committee Report 8-18(2) is now moved to Committee of the Whole. Reports of standing and special committees. Item 13, reports of committees on the review of bills. Item 14, tabling of documents. Ministry of Tourism and Investment.

I wish to table the following document entitled “Strategy for Revitalizing the Great Slave Lake Commercial Fishery - March 2017.” Thank you, Mr. Speaker.

Minister of Health and Social Services.

Tabling of documents. Member for Frame Lake.

Mahsi, Monsieur le President. I wish to table the following document. It’s a letter from the chair of the Giant Mine Oversight Board to Indigenous and Northern Affairs Canada regarding Giant Mine Oversight Board Funding Roll Over Provision. Mahsi, Mr. Speaker.