In July, 2005 the government asked Mr. Justice Gerard LaForest to inquire into the desirability of merging the Office of the Privacy Commissioner and the Office of the Information Commissioner. While a merged office is the norm in many provices, Justice LaForest's report has recommended not merging the offices. And, he said, if the government plans to do the merger nevertheless, he recommends that it be delayed so that each office can sort out the current challenges they are facing. Read the report here: THE OFFICES OF THE INFORMATION AND PRIVACY COMMISSIONERS: THE MERGER AND RELATED ISSUES and in PDF here.

Here are the recommendations:

SUMMARY OF RECOMMENDATIONS

The major recommendations made in this Report may be summarized in the following manner:

• There should not be either a full merger of the offices of the Information Commissioner and the Privacy Commissioner or an appointment of one commissioner to both offices. These changes would likely have a detrimental impact on the policy aims of the Access to Information Act, the Privacy Act, and PIPEDA.
• If the Government and Parliament decide to proceed with a merger or cross-appointment, implementation should be delayed for a considerable period of time. The transition should take place gradually, and only after the challenges facing the current access and privacy regimes have been thoroughly studied and addressed.
• Caution should be exercised in proceeding with any attempt to share the corporate services personnel of the offices of the Information and Privacy Commissioners. Care must be taken to establish mechanisms ensuring adequate accountability and control.

Government must do much more to foster a "culture of compliance" with access and privacy obligations. With respect to access, it should:

• make it clear to officials that access should be provided unless there is a clear and compelling reason not to do so;
• develop better information management systems;
• ensure adequate training for access officials;
• create proactive dissemination policies; and
• provide adequate incentives for compliance

With respect to privacy, it should:

• pay greater attention to the implications of programs involving the sharing, matching, and outsourcing of personal information;
• ensure adequate training for privacy officials ; and
• develop comprehensive privacy management frameworks;
• The Access to Information Act and the Privacy Act should be amended to specifically empower the commissioners to comment on government programs affecting their spheres of jurisdiction. Ideally, there should be a corresponding duty imposed on government to solicit the views of the commissioners on such programs at the earliest possible stage.
• The Access to Information Act and the Privacy Act should be amended to recognize the role of the commissioners in educating the public and conducting research relevant to their mandates.
• The option of granting order making powers to the Information and Privacy Commissioners should be studied in further depth.
• The Access to Information Act and the Privacy Act should be amended to specifically empower the commissioners to engage in mediation and conciliation.

Labels: information breaches, privacy