Information & Ethics Committee on May 9th, 2024

[The Chair, Conservative, John Brassard]

I am now calling the meeting to order.

Welcome to meeting number 117 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Today the committee is considering the Main Estimates 2024-25 for the first hour; then will resume its study of the impact of disinformation and misinformation on the work of parliamentarians for the second hour; and finally, we will end with some time in camera to discuss a few items of business.

Before we begin, I would like to remind all members and other meeting participants in the room of the following important preventative measures:

I'm not going to go through them. I think we're all aware of them.

Mr. Dufresne, just make sure, if you're not using the earpiece, to put it in the proper place, as indicated on the table. We certainly would not want to cause any harm to our interpreters. Of course, the room has been adjusted for that as well.

Pursuant to Standing Order 81(4), the committee is resuming consideration of the main estimates 2024-25. We'll be dealing with votes, after we're done, under the Office of the Commissioner of Lobbying, the Office of the Conflict of Interest and Ethics Commissioner, the Office of the Senate Ethics Officer and the Offices of the Information and Privacy Commissioners of Canada, which were referred to the committee on Thursday, February 29.

I'm going to welcome, for our first hour, someone who is no stranger to this committee, Mr. Philippe Dufresne, who is the Privacy Commissioner of Canada, and Mr. Richard Roulx, deputy commissioner of the corporate management sector.

Commissioner, you have up to five minutes to address the committee. Please start now. Thank you.

[Philippe Dufresne, Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada]

Thank you, Mr. Chair.

Members of the committee, I'm pleased to be here today to discuss the Office of the Privacy Commissioner of Canada's main estimates for fiscal year 2024-25 and to describe the work of my office to protect and promote the fundamental right to privacy of Canadians. I'm accompanied by Richard Roulx, deputy commissioner, corporate management sector.

In January I launched a strategic plan that lays out three key priorities that will guide the work of the OPC through 2027. The first is protecting and promoting privacy with maximum impact, by using business intelligence to identify trends that need attention, producing focused guidance and outreach, leveraging strategic partnerships and preparing for the implementation of potentially new privacy legislation.

The second is addressing and advocating for privacy in this time of technological change, with a focus on artificial intelligence and generative AI, the proliferation of which brings both potential benefits and increased risks to privacy.

The third is championing children's privacy rights to ensure that their unique privacy needs are met and that they can exercise their rights.

I believe that these three priorities are where the Office of the Privacy Commissioner can have the greatest impact for Canadians, and that these are also where the greatest risks lie if the issues are not addressed.

Protecting privacy is one of the paramount challenges of our time. My office is poised to meet this challenge through strong advocacy, collaboration, partnerships, education, promotion, enforcement and capacity building, which includes doing more to identify and address privacy trends in a timely way.

Investigations under the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act, Canada’s federal private sector privacy law, are a key aspect of the Office of the Privacy Commissioner’s work on issues that significantly impact the lives of Canadians.

In February I made public the results of my investigation into Aylo, the operator of the website Pornhub and other pornographic websites. I found that the company had contravened Canada's federal private sector privacy law by enabling intimate images to be shared on its websites without the direct knowledge and consent of everyone who is depicted.

In releasing my report on this investigation, I reiterated that the non-consensual sharing of intimate images is a serious privacy violation that can cause severe harms to victims, and that organizations have an obligation under privacy law to prevent and remedy this.

This case is also relevant to the discussions that will be taking place on Bill C-63, and I will welcome the opportunity to share my views on the online harms act with parliamentarians.

I also look forward to sharing in the coming months the findings of two high-profile investigations that are closely tied to two of my strategic priorities—protecting children’s privacy and addressing the privacy impacts of emerging technology, including AI.

When I appeared before you last year on Main Estimates, I spoke about the launch of investigations into TikTok, as well as OpenAI, the company behind the AI-driven text generation ‘chat bot’ ChatGPT. Both investigations are being conducted jointly with my counterparts in Quebec, British Columbia and Alberta.

In the case of the TikTok investigation, the four offices are examining whether the practices of the company ByteDance comply with Canadian federal and provincial privacy legislation and, in particular, whether valid and meaningful consent is being obtained for the collection, use, and disclosure of personal information.

Given the importance of protecting children's privacy, the joint investigation has a particular focus on TikTok's privacy practices as they relate to younger users.

The investigation into OpenAI and its ChatGPT chat bot is examining whether the company is compliant with requirements under Canadian privacy law in relation to consent, openness, access, accuracy and accountability. It is also considering whether the collection, use and disclosure are done for an appropriate purpose.

Both investigations remain a high priority and we are working to complete them in a timely manner.

Protecting and promoting privacy with maximum impact remains integral to fulfilling my current mandate and preparing for potential changes to federal privacy law.

In the 2023 budget we received temporary funding to address pressures related to privacy breaches and a complaints backlog, as well as to prepare for the implementation of Bill C-27. While these temporary funds provide necessary and immediate support, it is essential that my office be properly resourced on a permanent basis to deal with the increasing complexity of today's privacy landscape and the associated demands on my office's resources.

To address this, we will continue to present fiscally responsible funding requests and will also aim to maximize agility and cost-effectiveness by assessing and streamlining program and service delivery.

With that, I would be happy to answer your questions. Thank you.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne.

We're going to start with our first six-minute round.

Go ahead, Mr. Barrett.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Thanks for joining us this morning.

Mr. Dufresne, on March 7 I wrote you a letter asking you to undertake another investigation into the government's ArriveCAN app. In light of the new information related to the handling and security of Canadians' data, can you provide the committee with an update to your ongoing investigation into ArriveCAN?

[Philippe Dufresne]

Following your letter, on March 19 I announced that I will be investigating allegations of privacy concerns following a complaint against the Canada Border Services Agency related to the development of the ArriveCAN mobile app. The investigation will examine contracting practices related to ArriveCAN and, more specifically, the measures that were in place to protect personal information during the development of the app, in order to assess compliance with the Privacy Act, which applies to federal departments and agencies.

The investigation is ongoing under the Privacy Act. I have to maintain the details of that investigation confidential while it is ongoing, but I look forward to completing it and to making the findings public once that is done.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Understanding that the Privacy Commissioner has obligations to respect privacy, I will ask you a series of questions, and if you're able to provide us with an update or further information, I'd appreciate it.

Do you have an expected date of completion as to when we'd be able to see your findings?

[Philippe Dufresne]

I do not.

We work to complete this investigation in as timely a manner as possible, but we seek answers and submissions. We consider them, and we will be working to complete this as quickly as we can.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Have you been able to obtain from the government and contractors all of the necessary documents that you've sought?

[Philippe Dufresne]

I don't have concerns to raise on that front. There are powers under the act that would allow me to obtain information if I needed it.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Are you investigating a potential breach of section 7 of the Privacy Act? Section 7 states:

Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except

(a) for the purpose for which the information was obtained....

[Philippe Dufresne]

We are examining the contracting practices. We're examining the measures in place to protect personal information during the development of that app, and we're going to be assessing compliance with the Privacy Act provisions. If we see concerns there, we're going to raise those and flag those.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

You're not able to say specifically which sections of the act apply, like section 8 of the Privacy Act, which states:

Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be disclosed by the institution except in accordance with this section.

It's section 7 or section 8, but you can't specify which.

[Philippe Dufresne]

My announcement of that investigation has not restricted specific provisions of the act or otherwise. We said that we are looking for compliance with the Privacy Act, and if we identify concerns there, we'll raise them.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

The Auditor General's report on ArriveCAN made it clear that the record-keeping done by the government was really so poor that the Auditor General wasn't able to precisely attribute a cost to ArriveCAN. She said that she thought it was $60 million. Are you finding that to be the case in your efforts?

[Philippe Dufresne]

These would be some of the comments and observations that we would make in the final report of our investigation, as was done by the AG in hers, so this is not something that I would be commenting on at this stage. It would be once the investigation is over.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

I'm interested to know whether or not you've interviewed government officials, contractors and people whose security clearance was unable to be accounted for. If you can speak to that, I'd appreciate it.

Can you take us through what an interview would look like, irrespective of whom you're interviewing?

[Philippe Dufresne]

In our investigation process, we will identify with the departments the issues that we're looking into. We're going to ask them questions. We're going to ask them for documentation, and we're going to look to see if their practices are compliant with the elements in terms of the use, the collection, the disclosure and the safeguards.

As it moves forward, we may have additional questions. We may follow up on that. We prepare a draft report of our findings. We share with them. We give them the opportunity to comment. This will be under way, but these are not elements of information that I would be making public until the investigation has been concluded.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

ArriveCAN was mandatory for use for travellers, and, for some people, travel is required for their employment or to access medical services, but it's also part of their rights as Canadians to travel freely. The use of the app was mandatory, and the collection of data was mandatory. They had to surrender their personal information.

What would the consequences be should you find that CBSA or that the government broke the law, broke the Privacy Act?

[Philippe Dufresne]

One of the areas in the Privacy Act that I would hope to see changed in future modernization of the act is that I do not currently have the ability to make orders, binding legal orders vis-à-vis a department of the government. I would make recommendations, and I would identify if there are shortcomings. That's what my report would do, assuming that there is a violation.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Barrett and Mr. Dufresne.

Mr. Fisher, go ahead for six minutes.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Thank you very much, Mr. Chair.

Thanks, gentlemen, for being here today.

You talked about emerging technologies. Can you maybe highlight what new initiatives and priorities you would be doing as part of a strategic plan that would grow Canadians' privacy with regard to these emerging technologies in the increasingly digital landscape?

[Philippe Dufresne]

Thank you.

We're doing a lot of things. We're working very closely with our provincial and territorial partners. This is one of the elements I'm very proud of in terms of our close collaboration. We've issued, for instance, a joint resolution on the responsible use of AI, setting out our expectations in terms of privacy practices vis-à-vis AI. We've done that with respect to children's privacy, highlighting things like the fact that technologies should not be used to nudge children and minors to make privacy-harmful decisions. We're looking at all of those aspects with a particular focus on AI, but we're looking as well to see how we can use technology ourselves within the OPC to be more efficient.

We've launched an online portal for privacy impact assessment submissions, to make that more seamless. We have developed a tool to assess whether certain privacy breaches would give rise to a real risk of significant harm. Again, it's not to replace the human decision-making but to provide assistance on that. We don't see technology as something that's prevented by privacy. You can have and you must have innovation, public interest and economic success alongside privacy, so we're really maximizing looking at that. Of course, there are always risks with the use of data in powering innovation. This is why I've said we do use data to support innovation, but we have to use innovation to protect personal information.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

First of all, I'm curious as to how Canadians would find out about this. What can Canadians do proactively, on their own, to protect themselves? Using these tools that you're talking about is great, but let's assume we're just trying to help Canadians proactively take care of their own privacy.

[Philippe Dufresne]

We issue a lot of documents in terms of guidance and statements on issues. For instance, with a number of international colleagues in the privacy community around the world, we issued a statement on data scraping, calling on social media companies to take rigorous measures to protect the information on their social media platform to protect against data scraping, to protect against privacy breaches.

In part of that document, we also gave advice to citizens and to Canadian, saying, “Here's what you could do to protect your own.... Check your privacy settings on your apps. Make sure you're aware who you're giving permission to when you're sharing pictures of your kids, the notion of sharenting. Be mindful of the implications.”

It's important to reiterate that the primary obligation shouldn't be on individuals to protect themselves. Organizations and departments and laws have to be there, because that's one of the concerns if we delegate this too much to individuals. They need to feel there is a system and that the organizations with the tools to do it are taking their responsibility seriously.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

I assume you go to school on our allies and what they do in their respective offices. Who's doing really well? What types of things are they doing? Are you following the good examples?