Information & Ethics Committee on May 1st, 2018

[Daniel Therrien]

We have a communications group that could do part of the work, and we could hire staff to help us with advertising. Advertising is very costly. I don’t want to say that it would be the only method we would use, but our main issue is to be able to reach a greater number of Canadians.

The information that we want to disseminate is not only aimed at individuals or consumers. We would also like to reach companies or organizations. We already provide guidelines, including those on consent that should be published shortly, to help companies comply with the Act.

During the consultations that led to our report on consent last year, consumers and companies told us that one of the important roles of the Office of the Privacy Commissioner was to provide advice and guidelines. We’ve established a list of 30 important topics on which we would like to be able to provide guidelines or advice to consumers and companies. In light of the current budget, one of the major limits is time. Given the diverse nature of our work, including investigations, we will be unable to give advice on all 30 chosen topics within a reasonable time. Yet, I don’t believe that the list contains outlandish topics. These are all important subjects on which we should be able to give advice, but we can’t.

Finally, beyond general advice and guidelines, in specific cases more likely to concern many Canadians, we would like to be able to give advice to companies about to implement any type of commercial measures. Once again, we have very limited financial resources, so we can only do one or two of these interventions.

[Mona Fortier, Liberal, Ottawa—Vanier, ON]

Thank you very much.

[The Chair, Conservative, Bob Zimmer]

Thank you, Ms. Fortier.

Next is Mr. Gourde for five minutes.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chairman.

Mr. Therrien, my question focuses more or less on the same topic. Sometimes, you provide advice to a company that uses some private information. People contact you when they think that a company might have gone too far and a complaint has been filed. Would it be possible to do the opposite?

For example, can a company that must use certain data related to people’s private lives contact you to ensure it complies with legislation? Right now, it’s a bit of a free for all. Companies try their luck, they sell apps, they profile Canadians based on certain data, and if they get caught, they change the way they proceed.

Could we make it compulsory for these companies to consult your before they get into these troubles?

[Daniel Therrien]

We might not be able to force this on companies. This being said, this idea is in accordance with our desire to expand our activities. We give general advice and guidelines, but we would also like to be able to advise companies regarding specific activities.

We don’t want to become the legal services for all companies in Canada; that’s not what we want. However, if we could have more resources to provide advice to some companies that take actions likely to impact a large section of the population, that’s the type of work we would wish to do.

At the moment, we’re only able to do it once or twice a year. We’d like to be able to do it more often in order to prevent privacy issues instead of intervening only at the end, once rules have been violated. We’d prefer to intervene when programmes are being developed to ensure that these issues don’t occur.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

A representative from Facebook Canada who testified recently told us that, according to its business plan, this media sells targeted advertising to companies or individuals based, for example, on their gender, their region, and their age using information that people provide themselves on Facebook. It becomes a type of screen in relation to privacy and Canadian legislation. These companies claim that they use services offered by Facebook to advertise on that social media in order to reach their target customers. This way, they assume no responsibility with respect to the privacy of Canadians.

Do I describe the situation well? Do you think it’s possible to take measures to help companies act legitimately?

[Daniel Therrien]

As Privacy Commissioner, I don’t think it is for me to challenge business models. I must operate in the economic world of a democracy with a free economy. However, it is my duty to ensure that privacy principles are respected in the exercise or application of these business models.

If, among other things, the notion of consent is not well applied by companies that want and are entitled to make a profit using people’s data, it’s not for me to second guess the business model, but to make sure that privacy principles are accepted. I would like to be able to do so more often at the beginning of the process rather than at the end, as is often the case right now.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

The problem seems to be exacerbated by the size of the company and the billions of dollars that flow everyday on Facebook. An annual budget of $25 million seems really limited. Facebook admitted to us that it would add 10 000 employees to comply with the rules. I think that you’re far from being in a position to add even 50 employees to your office.

Are your means to respond to this problem very limited?

[Daniel Therrien]

If it were possible to impose real sanctions at the end of the process, and if organizations responsible for data protection all over the world could pool their resources, we would not reach the size of Facebook, but we could influence, to some extent, its behaviour.

[The Chair, Conservative, Bob Zimmer]

Thank you, Monsieur Gourde.

Next up for five minutes is Ms. Vandenbeld.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you, Chair.

Thank you, Commissioner, for being here once again.

Earlier you mentioned the new EU rules that are coming into effect, the GDPR, and you recommended that perhaps we could look at Canada's being more in line with those rules. Those are coming into effect later this month. In the interim, do you see any impact on your work? Obviously data flows between countries. If there's data flowing between Canada and Europe, would this impact work that you're doing in terms of Canadian data and privacy?

[Daniel Therrien]

The real impact of the GDPR as far as the OPC is concerned will be felt when the European Union makes a decision on adequacy, and that will take a while, according to the information we have.

A number of Canadian companies that collect or use information about EU citizens are subject to the GDPR directly, because the GDPR has that extraterritorial application, but for my office, the impact will be felt mostly after the decision on adequacy.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Thank you. I appreciate that.

[Daniel Therrien]

That will be a few years coming.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

This wouldn't have an immediate impact in terms of your resource needs.

[Daniel Therrien]

No.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Okay. Thank you.

Earlier today we heard from the Ethics Commissioner, who suggested that it would be useful if officers of Parliament were able to exchange information with one another with, of course, all of the protections in place that it wouldn't be made public. Do you agree with that?

[Daniel Therrien]

Yes.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Okay. Good.

One of the things you mentioned is that you are looking to do more commissioner-initiated investigations. How would you prioritize? How would you identify where you would do those investigations?

[Daniel Therrien]

A big factor for me is the number of individuals affected, the number of individuals whose privacy is affected, so I will prioritize an investigation that will have an effect for more people than fewer people. The seriousness of the violation, of course, is an important consideration, as well as the sensitive character of the information at play.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

Finally, I was listening to the words that you used in your opening remarks. You said things like “our overwhelmed investigators” and “the limited tools”. You've indicated a number of areas where you feel that technology is advancing to the point where your resources are not sufficient.

What would be the key priority areas where you would see an immediate need for more resources?

[Daniel Therrien]

I would go back to the need for balance between investigative and proactive work. Both are parts of our mandate. We have a legal obligation to investigate complaints, so we need to do that, but as part of our statutory obligations, we also have an obligation to educate the public, meaning not only citizens but also organizations. We need to do both, and that's a big challenge we have. I think my answer is that we need money on both sides to be effective.

[Anita Vandenbeld, Liberal, Ottawa West—Nepean, ON]

What is the current breakdown of your staff on the investigative side and then the education and proactive side?

[Daniel Therrien]

It's roughly the same, a little more on the promotion side.

Daniel, you had a number a minute ago.

[Daniel Nadeau, Director General and Chief Financial Officer, Office of the Privacy Commissioner of Canada]

It's about 70 staff on the promotion side and about 65 on the investigative side, the compliance side.