Evidence of meeting #34 for Access to Information, Privacy and Ethics in the 43rd Parliament, 2nd Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was c-11.
A video is available from Parliament.
12:35 p.m.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
Thank you, Mr. Chair.
Commissioner, we have a sense that reality will be stranger than fiction given these new applications. I think Canadians are relatively worried about living in a world where you can be recognized and filmed at any time and at any place, especially when you live in urban areas where there are cameras on every corner and in virtually every building.
Where will the potential abuses be committed in this new life we will soon be living? In fact, it may have already begun.
12:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We've seen an example of this with Clearview AI. To socialize with friends and family, users innocently use social media with no idea that the information they provide, including their photos, may be collated by a company like Clearview AI, which uses the data for so-called police investigations or, as mentioned, to conduct private investigations of individuals.
You mentioned that the presence of surveillance cameras in some public places also poses a significant risk. I would add, again, that facial recognition can play an important role, particularly in providing security in relation to certain events. The use of facial recognition in public places is a sensitive matter, but I wouldn't say it should be banned altogether.
I strongly encourage you to ask other witnesses to come where they think the problems lie. For my part, I would answer that it is in several places. I don't think you can regulate the whole situation. You have to look at it from a values perspective, and that again brings me back to the question of anchoring legislation in a human rights framework. This is more apparent in the case of the Department of Justice proposals than in the case of Bill C-11. Values are important. Respect for human rights is important. Second, there should be mechanisms to balance commercial interests and human rights, and these mechanisms should be better than those in Bill C-11. We will forward our recommendations to you in this regard.
I would add as a final point that right now our laws in Canada and in many countries—it's not the case everywhere—are said to be technology neutral. That means that the principles apply equally across the board, regardless of the type of technology, including biometrics and facial recognition. There are great advantages to this, and I am not suggesting that this aspect of our laws should be set aside. I think one of the things that you should be looking at is—and your question is very relevant to this—whether there is a need to circumscribe facial recognition activities. This would mean either prohibiting them or subjecting some of them to particularly strict regulation. In this regard, I refer you to a draft regulation on artificial intelligence, published in April by the European Commission. In it, certain prohibited practices are defined, including the use of live facial recognition in certain public places, except for exceptional cases, such as the investigation of major crimes or acts of terrorism.
This is a mixture of general principles about how to balance commercial or governmental interests and human rights on the one hand, and laws of general application on the other. In my view, we need to ask ourselves if there is a case to be made for some specific rules that would either prohibit or strictly regulate this technology; it presents particular risks, because biometric data is permanent.
12:40 p.m.
Conservative
Jacques Gourde Conservative Lévis—Lotbinière, QC
What can Canadians do to protect themselves in extreme cases where their privacy has been breached or technology has been used improperly?
Recently, there were cases in Montreal. People had bought cameras online and installed them in toilets and showers. That is happening, and apparently, those types of tiny cameras are readily available and easy to hide. People are engaging in voyeurism, and those images can end up anywhere.
What recourse should people have?
12:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It's pretty clear that—
12:45 p.m.
Conservative
The Chair Conservative Chris Warkentin
Thank you, Mr. Gourde.
Mr. Gourde's time has expired, but I'll allow you to answer the question, Commissioner.
12:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It's pretty clear that that type of use is unacceptable, even under the current privacy legislation. It's unacceptable. Penalties would be the answer in this case.
Deterring that kind of behaviour would require significant penalties, and neither the current act nor Bill C-11 sets out such penalties.
12:45 p.m.
Conservative
May 10th, 2021 / 12:45 p.m.
Liberal
Patricia Lattanzio Liberal Saint-Léonard—Saint-Michel, QC
Thank you, Mr. Chair.
Thank you, Mr. Therrien, for your testimony this morning. It was quite informative.
What I'm drawing from it is that there's a constant need of striking a balance between individual human rights, public confidence and economic growth. It's going to be quite a difficult task, because technology is forever evolving and it's going at a very fast pace. In my opinion, a restudy is more than warranted as we do not know when we will get Bill C-11.
On the question of cross-border data, that's of interest to me because given the nature of cross-border data, as it flows, it adheres to international best practices and standards, which will be instrumental for ensuring Canadian competitiveness.
Is it correct to say—and I want to go back to that European notion you were talking about earlier—that the EU data protection regulation remains the international gold standard? How can Canada ensure equivalency with this regulation? That would be my first question.
Why is it in Canada's interests to retain the equivalency with the EU?
12:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The government certainly cited the desirability of Canada maintaining adequacy status in the EU as one impetus for Bill C-11. Indeed, maintaining adequacy is important. It allows data flows between Canada and the EU without specific mechanisms, like special contracts and the like.
Clearly, for Canada maintaining adequacy is helpful in order to maintain a freer flow of data between Canada and the EU. Beyond the EU, as I've said, we live in an interconnected world, and obviously, we have a neighbour to the south with whom we have very significant fundamental commercial relations, so data also needs to flow there.
I think that's all good, but we need to.... Hopefully, in the context of the review of Bill C-11, we can look at ways to allow these data flows, but in a way that recognizes that when data leaves Canada, the risks are higher.
I'm not advocating for ways to prevent these data flows, but certainly, in the submission you will now be able to read, we make certain recommendations on how to enhance the protection of personal information when it does leave Canada, while still allowing that.
12:45 p.m.
Liberal
Patricia Lattanzio Liberal Saint-Léonard—Saint-Michel, QC
We will see these recommendations in the brief you spoke about earlier that you'll be filing. Is that correct?
12:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
12:45 p.m.
Liberal
Patricia Lattanzio Liberal Saint-Léonard—Saint-Michel, QC
Okay.
You also spoke about the overlapping jurisdiction with the Human Rights Commission. What about the Competition Bureau of Canada? Your colleagues there are also grappling with the new and emerging privacy issues brought about by some of the changes in technology we're seeing, including the emergence of facial recognition software.
Can you describe the relationship between the two offices?
12:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Indeed, that's another relationship that's very important. I think we have a good relationship with the Competition Bureau. Again, as I said earlier, in the virtual world as in the physical world, it's normal to have a number of regulatory agencies that share different activities from different perspectives.
It's good to have both the Competition Bureau and the Office of the Privacy Commissioner. The important thing is to ensure that the law allows a certain sharing of information between these agencies, so that we can benefit from our respective expertise and also, from an operational perspective, we can divide files according to who's best placed to handle them.
At the general level, we need to be able to co-operate with other regulators, including the Competition Bureau. There are provisions in Bill C-11 to facilitate that, and that's a good thing. We look forward to further co-operation with the Competition Bureau and others.
12:50 p.m.
Liberal
Patricia Lattanzio Liberal Saint-Léonard—Saint-Michel, QC
From a citizen perspective, how will the citizen be best guided as to where to place his or her complaint if we have overlapping jurisdictions between different offices?
12:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
There should not be complete overlap. Maybe I should make that clear.
The Competition Bureau has jurisdiction over consumer protection and competition, and there is some overlap with us when personal information is involved. To that extent, I think we need to live with these overlaps, but the mandate of these various bodies should make it clear who is responsible for what.
I'm not advocating to play a role in competition law; the bureau is well placed to do that. However, privacy issues should be largely within our realm.
12:50 p.m.
Conservative
The Chair Conservative Chris Warkentin
Thank you, Ms. Lattanzio. You are out of time, unfortunately.
We'll turn to Monsieur Fortin now for the next round of questions.
Monsieur Fortin, you have two and a half minutes.
12:50 p.m.
Bloc
Rhéal Fortin Bloc Rivière-du-Nord, QC
Thank you, Mr. Chair.
Mr. Therrien, I gathered from your remarks that a number of departments can propose legislation with a potential impact on people's privacy.
Let's say a department proposes legislation with some privacy implications. Do you think a directive should apply to the department requiring it to obtain the Privacy Commissioner's approval beforehand? Wouldn't such a requirement ensure privacy was adequately protected?
12:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I completely agree that departments should consult our office beforehand when they are considering legislative or even administrative measures with significant privacy implications.
You used the word “approval”, but I think departments need to retain their responsibilities, as delegated. I think it's a very good idea for departments to consult us and for our office to provide opinions that will then inform government decision-making. However, in keeping with the principles of accountability, the government should ultimately be the one deciding what to bring forward because it is responsible for proposing legislation.
12:50 p.m.
Bloc
Rhéal Fortin Bloc Rivière-du-Nord, QC
As I see it, Bill C-11, a pivotal piece of privacy legislation, is incomplete or ill-considered. We'll see. Quite a few deficiencies could have been avoided had you been involved in the legislative process from the outset. Wouldn't you say?
12:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, we would have liked to be more involved. However, we recognize that making decisions is the government's responsibility at the end of the day.
12:50 p.m.
Bloc
Rhéal Fortin Bloc Rivière-du-Nord, QC
I nevertheless think those decisions should be informed by the expertise of the Office of the Privacy Commissioner of Canada. That's just my opinion.
12:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That's my opinion as well.
12:55 p.m.
Bloc
Rhéal Fortin Bloc Rivière-du-Nord, QC
Most folks have already provided their biometric information, if only for the purposes of a passport or cell phone. Previously, people would unlock their phones using a fingerprint scanner, and now they can do it through a facial recognition feature. As members of Parliament, we use a facial recognition system to cast our votes. I would say that just about every single person has inevitably shared their biometric information somehow.
Don't you think it's a bit too late to prevent the misuse of that information? Do you think it's still possible to get the situation under control, to curb the problem?
12:55 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It is indeed late, but technology isn't going to stop advancing. I think government and parliamentary institutions need to develop rules governing the use of that technology going forward.
Someone brought up how complex technology was. That is absolutely true, but I think it becomes a whole lot less complex when we commit to projecting our values in the legislation regulating that technology.
Yes, technology is complex, but our values are well-known. My recommendation is to ensure the legislation that regulates the digital space reflects our values as a society. That would be a great starting point.