Evidence of meeting #34 for Access to Information, Privacy and Ethics in the 43rd Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was c-11.
A video is available from Parliament.
11:25 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Actually, that money would be needed because of the additional mandate we would have under Bill C-11.
11:25 a.m.
Bloc
Rhéal Fortin Bloc Rivière-du-Nord, QC
Leaving aside Bill C-11, as it stands now, would you say that you have the budget to carry out your mandate, apart from what may happen next with Bill C-11?
11:25 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The digital revolution, which requires us to provide more advice and set more guidelines, is always a factor. For example, we give guidelines to companies. These are guides, which are not legally binding. A few years ago, after a consultation, we identified about 30 topics for the private sector that should be covered by privacy guidelines. We're not even halfway there.
Although we have budgets, and they have been increased, if we look at our overall activities, we find that we have been unable to update guidelines for businesses and support for individuals because the digital world raises too many new issues. We're unable to provide the amount of advice, the amount of guidance, that we should be able to provide.
11:25 a.m.
Bloc
Rhéal Fortin Bloc Rivière-du-Nord, QC
Obviously, as you've already said, the pandemic situation isn't helping. The increase in communications on social media, meetings—like this one this morning—that are held through the Zoom platform, but that we would normally attend in person on the Hill, must be major challenges for the Office of the Privacy Commissioner.
Could you tell us about the kinds of challenges you face in the context of the pandemic?
11:25 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
This takes many forms. As I was telling Mr. Fergus, many companies, departments and government entities are seeking our advice on pandemic-related initiatives. It's also important to be aware of how the technology is being used in a pandemic context. I have mentioned before that technology is being used much more in these circumstances for service delivery, particularly in education and health care.
How can this be done in a way that respects the privacy of information shared on digital platforms? We're looking at that. There are investigations. We note things that need to be investigated. I gave you an example earlier of the use of artificial intelligence in job interviews. We'll also talk about facial recognition later.
So we try to use our budgets as best we can, based on the risk we see.
11:30 a.m.
Bloc
Rhéal Fortin Bloc Rivière-du-Nord, QC
Right now, you don't necessarily have all the funds you need to carry out your mission, but have you established any kind of guidelines or criteria for what you will say no to?
For example, you told us earlier that you had received requests to update directives, but that you were only able to do part of the work. How do you prioritize? How do you decide what you're going to do and what you're going to set aside?
11:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Our assessment of risk based on what we observe in various settings is what determines it. In this context, the current and future legislation, as part of Bill C-11, requires us to investigate when complaints are referred to us.
Except in very rare cases, when a complaint is filed by an individual, the legislation requires us to investigate. This is a real constraint. Again, there are advantages to this system, particularly in terms of access to justice. We're an ombudsman with a relatively expedited process, one that is simpler than judicial tribunals.
I understand all of that, but the fact remains that it creates a real constraint because we have to investigate every complaint that comes in. We believe that, like other privacy regulators, we should have more flexibility. The question is what recourse there would be if the office were unable to investigate a complaint. One of the things Bill C-11 talks about is a private right of action before the courts.
These are sensitive issues, but having to investigate every complaint we receive is a real constraint.
11:30 a.m.
Bloc
Rhéal Fortin Bloc Rivière-du-Nord, QC
As I understand it, you can do less prevention. Can we say that the lack of funding is having a negative effect on prevention?
11:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Basically, yes.
11:30 a.m.
Conservative
The Chair Conservative Chris Warkentin
Mr. Fortin, your time is up, unfortunately.
We're going to turn to Mr. Angus now for the next questions.
May 10th, 2021 / 11:30 a.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Thank you, Mr. Therrien. It's a pleasure to have you back before our committee.
As you know, we have been studying the issue of non-consent videos and photos of people being on the site Pornhub MindGeek. Are you presently involved in an investigation of whether or not they have breached the privacy rights of Canadian citizens?
11:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
11:30 a.m.
NDP
11:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
11:30 a.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
I imagine you're not able to tell us anything about your investigation.
11:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That's correct.
11:30 a.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
I fully understand.
I'm interested because one of the survivors who approached us had tried to get the RCMP to investigate. The RCMP are saying they believe in a voluntary compliance model. We tried to see if the Attorney General's office is interested. They don't seem to be moving on this file at all.
One of the things that an RCMP officer told this survivor was that they believe Pornhub MindGeek was exempt because of their terms and conditions, the consent that exists on their website, and I know you've raised issues of the vague nature of terms of consent on websites.
Do you believe that the fact that they have their own set of terms of consent would somehow absolve them from the Canadian privacy laws?
11:30 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'll be careful because we're investigating.
I'll just note the general principle that consent is generally required to collect, use and disclose personal information under Canadian private sector privacy laws, and even if consent is given, there's a further rule that provides that even if consent is provided, a company cannot collect, use and disclose information if a reasonable person would find that inappropriate.
11:30 a.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
Thank you very much for that. I really appreciate it. I understand that you are investigating, so I won't ask you any more on that. I just wanted to clarify that.
In the last Parliament, our committee sent the government a number of recommendations on strengthening the role of your office and ensuring that we get stronger protections for Canadians' privacy rights, the rights of our citizens. I have spoken with many people in the privacy and data field who have looked at this new legislation, Bill C-11, and they're raising concerns that this legislation may actually hinder a number of the objectives that we had laid out at our committee in the previous Parliament. One of those is the issue of meaningful consent.
You state that the consumer privacy protection act “leaves out an important facet of our current legislation, the idea that meaningful consent requires that the person giving it understands the consequences of what they are consenting to.” You further state that you believe this law “would result in less consumer control than under the current law”.
Can you explain your concerns?
11:35 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes. There's no question that Bill C-11 is a comprehensive and serious attempt to address privacy issues in the digital world, but at the most general level, we think that in order to provide adequate protection for privacy, the bill needs very significant changes.
Why? In part it's because we think that even though there are provisions on consent in Bill C-11, the ultimate impact would be less control for individuals, in part for the reason you suggest, that a requirement in the current law that individuals, consumers, understand the consequences of what they are being asked to consent to does not exist in Bill C-11 as drafted.
There are also important exceptions to consent in Bill C-11, some of which are appropriate but others much too broad. For example, there is an exception to consent where it is “impracticable” to obtain consent. We think that such an extremely broad exception to consent makes the rule hollow—so less control for individuals, more flexibility in Bill C-11 for organizations. We're not against additional flexibility for organizations per se, particularly when organizations want to use personal information for the public good or for a legitimate public interest, but we think additional flexibility should come with additional accountability.
11:35 a.m.
NDP
Charlie Angus NDP Timmins—James Bay, ON
I see. I'm running out of time here, but I just wanted to clarify that. I know that there has been a real concern, certainly under section 18, about the broad nature of so-called business activities and whether or not it's better to establish a fiduciary responsibility that imposes the duties of loyalty and of care when personal information is collected, particularly when we're dealing with information about people's racial and ethnic origins, philosophical beliefs, religious beliefs or their biometrics or genetics.
Do you think we need to have a much clearer definition of the obligation to protect this information?
11:35 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
In brief, yes.
We think that part of the solution is, yes, to give additional flexibility for companies to use information for legitimate business purposes but within a privacy law that has a human rights foundation. That ultimately would be the most significant protection given to consumers.
11:35 a.m.
Conservative
The Chair Conservative Chris Warkentin
Thank you, Mr. Angus.
I'm going to turn to Monsieur Gourde for the next round of questions.