Information & Ethics Committee on Feb. 1st, 2024

[Matthew Green, NDP, Hamilton Centre, ON]

That's fair enough.

In your assessment or investigation of this, would that be a consideration that you would consider? Would they be required to report to you about instances where there was no warrant and no PIA?

[Philippe Dufresne]

The warrant issue is relevant to us when we're looking at the legal basis for the use. That's one criteria. One investigation that we did years ago involved the use of cell towers. Some of the things were done without a warrant, and we said that's not justified.

[Matthew Green, NDP, Hamilton Centre, ON]

Do you mean the Stingray technology, specifically?

[Philippe Dufresne]

I think so. We'll get the exact name.

That was an issue. We looked at that as the first question. Even if you have that warrant, and you have that legal basis, there is then the second question: Do you have to do a PIA?

[Matthew Green, NDP, Hamilton Centre, ON]

Just in summary, for the privacy impact assessment, you are putting that as something that would be a consideration on top of a warrant. Even for something that might be legal by basis of a warrant, that might not be ethical or in keeping with the act, in your opinion, under a PIA.

If you determined, under a PIA, that it wasn't those things, do you have the power to actually stop them from implementing these technologies?

[Philippe Dufresne]

I don't because it's not a legal requirement. We can flag it and Treasury Board can raise it, but it is all internal to the government's rules.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne and Mr. Green.

That completes our first round of questioning. We're going to go to our second round now.

You know how much I hate interrupting on a timeline. We went well over the six minutes on each of the rounds, just to be fair to everyone. Let's try to keep it a little bit tighter now to the five minutes or whatever time we have. We're getting into the meat of the issue here, I believe, and I want everybody to have that opportunity.

Go ahead, Mr. Kurek, for five minutes, please.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you, Chair.

Thank you, Commissioner, for being here. Thank you to your team for their work.

I just want to highlight something for those listening and watching. There are 13 government institutions that were called into question in the article that's been mentioned. It's Fisheries and Oceans Canada, Environment and Climate Change Canada, the CRTC, the CRA, Shared Services Canada, the Competition Bureau, Global Affairs, the Transportation Safety Board of Canada, Natural Resources Canada, Correctional Service Canada, the Canada Border Services Agency, National Defence and the RCMP.

I think, like many Canadians, that some of those are not surprising. I think it's disappointing that they did not conduct PIAs, as was referenced. The question around trust is certainly highlighted here.

Commissioner, do you believe that this information would have come to light had it not been reported? Is there a reporting mechanism within government that would have said, these tools are used and here's the number of times? Had it not been for this article that references this, would this information have come to light otherwise?

[Philippe Dufresne]

We were not aware of all of those uses. We were aware of some of the programs, but that's the issue the directive on the privacy impact assessment is meant to address. We should be advised. My office should be advised before these new tools and activities are deployed.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I'm hopeful that we'll have a minister sitting in the chair that you're in at some point.

Does your office have the resources to ensure that there are timely responses to the PIA questions that would be asked by any of these 13 departments?

I'm quite frankly concerned that there may be more than this. If we have 13 departments and they work with a lot of other departments...and on and on the story goes.

Are you confident that your office would be able to respond and give advice as needed, whether it's to these 13 or other departments that may be utilizing tools like this?

[Philippe Dufresne]

Generally, I have asked for more resources from Parliament for my office, including for our promotion activities. We do have a government advisory team that is on standby to provide advice to departments. We prioritize what we get based on the importance and impact. We will continue to monitor that. We may be making more requests for additional resources.

Certainly, the key thing is that we need to know about those matters. We need to be advised by the departments prior to these things happening. That's also part of the policy directive of the Treasury Board.

That's what I'd like to see more often, more proactive reaching out from those departments to say, “We're considering this. Do we need a PIA? Here's the information.” That's so we don't find out about it in the media. The media reporting is very important in this case, but ideally, this would be something that we would have known in advance.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Just to clarify, if somebody called you, even if it was a developing situation that required a level of immediacy, somebody would be there to pick up the phone and you'd be able to provide advice and a response. That's just to clarify.

[Philippe Dufresne]

Absolutely. We're there for that. We give advice. We flag issues. We're not there to be a roadblock to innovation and the public interest. We're there to provide advice and to say, “This is the privacy implication and this is how you should address it.” We provide more transparency. That's good for everyone.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I appreciate that, because quite often we hear that it was urgent so they didn't have the time or they didn't have the resources. I appreciate your clarifying that here today.

Of those 13 departments, have any PIAs been completed since this time?

[Philippe Dufresne]

Three of the departments have finalized the PIA on the relevant programs. That's been done. On the others, one of them had purchased the tool and didn't use it—so there's no PIA—and the majority, eight of them, are going to be updating or doing a new PIA. That is all outstanding.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

When it comes to the question that was asked as to who this applies to.... It's not widespread, like Mr. Green and Ms. Khalid had mentioned. It's not everybody in the country, but certainly there are some instances where it is the employees of a department. That doesn't diminish privacy expectations, as we've talked about, but there are instances where there may be citizens, where there are not warrants, who have been subject to these materials being used.

I just want absolute clarity in the last few seconds here that I'm interpreting what you've said correctly.

[Philippe Dufresne]

I'm saying that I'm relying on the departments to comply with their legal obligations in terms of whether a warrant is required or not, and their authorities.

What I'm flagging is that they have to conduct privacy impact assessments. In a number of cases here, they have not.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Kurek and Mr. Dufresne.

Mr. Bains, I have you next for five minutes. Go ahead, sir.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Thank you, Mr. Chair.

Thank you to the commissioner and our witnesses for joining us today.

Commissioner, has your office begun investigating any of these departments as a result of these revelations?

[Philippe Dufresne]

I think I heard the question to be whether we have investigated any of those departments as a result of this. We have not. As indicated, it's not a legal requirement under the Privacy Act, so I would not have a basis for investigating non-compliance with that directive. We have reached out to them and we're going to continue to do so. We're going to continue to insist that PIAs have to be conducted.

My recommendation to this committee and to the House is that it should be a legal obligation in the Privacy Act. It should also be a legal obligation in the private sector privacy act, so that this becomes a proactive duty that would then give me a clearer mandate and authority to make sure that it's done. Canadians would see that this is part of their privacy protections.

Too often Canadians will feel that they're left to their own devices. It's up to them to consent. It's up to them to inform themselves. We do give tips to Canadians on best privacy practices and so on, but Canadians deserve to feel that their institutions are there to protect them and for them to rely on, knowing that government is using this, that government has consulted the Privacy Commissioner's office and that there are privacy experts who are in on this from the design.

That's what I want to see more of. That starts with an obligation in the Privacy Act.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Part of our job here is to generate recommendations. The main recommendation of yours is to make it a requirement to do so.

Section 5.1 of the directive on privacy impact assessment provides that such an assessment must be done for “new or substantially modified programs and activities involving the creation, collection and handling of personal information”.

Do federal institutions make a clear distinction between a new and an existing program or activity?

[Philippe Dufresne]

They do. That's where sometimes you'll have an interpretation that this is not a new program, that this is an existing program and that they haven't really changed what they're doing; they just have a new, more powerful tool. They didn't do a privacy impact assessment on that tool because the program was already assessed. That type of situation may well be consistent with the policy in the sense that the directive would not require a new privacy impact assessment in that case.

It does raise the question, when we're talking about very powerful tools—perhaps it's not a new program but if it changes it so much now that you have this capability—of whether Canadians would benefit from more transparency on that new tool, even if it's within the same program.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Should any other changes be made to the Treasury Board directive on the PIA? What other things could be changed?

[Philippe Dufresne]

What I would like to see is more proactive reach-outs to my office in terms of new initiatives. We have that requirement in the policy, but we are not seeing that happening in most instances.

I think it's that reflex of saying, “You're not going to move forward on this until you've had that consultation, you've had that reach-out and you've done that due diligence,” and perhaps also clarifying that, in instances where a tool is much more powerful, it may require a second look at an existing program.