Information & Ethics Committee on May 10th, 2021

[The Chair, Conservative, Chris Warkentin]

Thank you, Commissioner.

Colleagues, I want you to be aware that we should be expecting a vote in the House of Commons. The bells may start as early as 12:35, so unless there's an objection at that point in time, I will assume there's unanimous consent to continue with the questions. We will ensure that sufficient time is allowed for members to log in, so that at 1:05, when the voting begins, members are logged in and able to vote.

Unless there's an objection from committee members, we'll continue with the questioning.

We will begin with Mr. Carrie.

[Colin Carrie, Conservative, Oshawa, ON]

Thank you very much, Mr. Chair.

Monsieur Therrien, I want to thank you for your wisdom. With Bill C-11 coming down the pipe, it's so important that we lean one way versus the other way.

I know with facial recognition, when you first see it, it's so cool. We all heard about the issue with Cadillac Fairview, the shopping mall issue. Maybe we'll get to that today, but even sites like Facebook, they have these tag suggestions and they insert them as default settings. Theses sites are collecting our data, our faces, and many times people are totally unaware of it. That's where I want to start our conversation today.

I come from Oshawa. Oshawa is one of those communities that historically built cars and sent people back and forth across the border, things along those lines. I want to talk to you a little bit about the international utilization of facial recognition. I've heard that border efficiencies could be improved. I was wondering if you could comment on the opportunity, perhaps, for these opt-in, opt-out options if we're going back and forth across borders for business or as individuals.

Are there any international conversations about the right to delete and destroy information that may be gathered from Canadians as they cross borders into other countries?

[Daniel Therrien]

I will answer the question by going back to the point that I made early in my statement that facial recognition can serve society. At the border, for instance, it can greatly accelerate and make more efficient the triage of individuals who wish to cross the border. In police and law enforcement, it can facilitate the resolution of crimes or find missing persons.

I would not start from the premise that facial recognition should be banned completely or even in certain sectors completely, as in law enforcement, for instance. It can be useful, but it is very special in that it collects the attributes of a person that are immutable. If there's a breach of that information in the company or the government department that has collected it, you cannot change your biometrics like you can change a password. It is immutable and that means that this particular technology needs to be regulated very rigorously so that it does bear fruit and provides benefits to society without creating nightmares for individuals who, again, can no longer protect their privacy if someone uses their biometrics, including facial recognition, for nefarious ends.

That would be my answer for the border.

[Colin Carrie, Conservative, Oshawa, ON]

It's a good answer. I sat on the international trade committee, and we just completed the CUSMA, agreement. As we move through this process with the framework of our trade agreements, do you have any thoughts about ensuring Canadians have their rights looked after when we enter into these trade agreements? Do you think CUSMA has sufficient protections in it, basically?

[Daniel Therrien]

That's a huge issue.

[Colin Carrie, Conservative, Oshawa, ON]

I know. That's why you get the big bucks.

[Daniel Therrien]

When the time comes to share personal information outside Canada, and still do it in a privacy-protected way, I think there needs to be additional safeguards to those that apply within Canada, because the risks to privacy are not the same when the data leaves the country. This does not mean that we should live in a data localization world where the data of Canadians does not leave Canada, but I think it's important to acknowledge that the risks are higher when the data leaves Canada.

Then of course comes the question of what additional protection should come in these situations, because we live in an interconnected world. We're neighbour to the United States. It's a reality that data often moves to the United States. I'm afraid I won't give an opinion on whether CUSMA adequately does that. Whether data leaves Canada is not a benign issue, and we should think hard about what additional protections should be created by Parliament to ensure that privacy continues to be protected when data does leave Canada.

[Colin Carrie, Conservative, Oshawa, ON]

That's excellent. Thank you very much.

Maybe another time I'll ask you about China and that might be a more interesting conversation.

Thank you very much, Mr. Commissioner.

[The Chair, Conservative, Chris Warkentin]

Thank you, Mr. Carrie.

We'll go to Mr. Dong next.

[Han Dong, Liberal, Don Valley North, ON]

Thank you, Chair.

I want to thank the commissioner and his staff for agreeing to stay longer to answer some very important questions. I had some questions prepared, but after your opening statement I have a few others added to the list.

First, there has been a lot of discussion, our committee included, with regard to facial recognition technology and whether it could potentially be more harmful to racialized communities. In your findings, is there any evidence to support that?

[Daniel Therrien]

There's certainly a lot of literature and analysis by academics and experts on this question. We have not actually made findings on this in the context of Clearview AI, but we have read a lot of very credible scientific research that is concerned with whether the technology is sufficiently precise, particularly in the case of racialized communities, to be used in a way that does not violate privacy or other rights like equality rights. There are concerns about this.

From a privacy perspective, the issue would be that facial recognition needs to be used in a way where accurate information is collected. The principle of accuracy is one of the important privacy principles. Again, there is a lot of literature to the effect that, for racialized communities, the information collected may not always be accurate, depending on the technology in question.

[Han Dong, Liberal, Don Valley North, ON]

Without any empirical evidence that facial recognition technology could be harmful, particularly to a racialized community, is there anything in Bill C-11 that we can do to provide a guardrail to make sure that the vulnerable communities don't get harmed as facial recognition technology develops?

[Daniel Therrien]

Bill C-11, as mentioned, does not have a human rights approach to the privacy law in question. It would be very beneficial if the proposed CPPA had a human rights foundation because then the principle of accuracy that I just alluded to could be used to ensure that potential discrimination against populations in the use of facial recognition would be part of our remit to ensure that, under privacy principles, technology that would result in discrimination would be found contrary to privacy.

I'll say that some would argue that these issues should be addressed through human rights legislation. Certainly, that's a credible point. I would say that, in the virtual world as in the physical world, the fact that there is some overlap in the jurisdiction of regulators here, as between my office and the Canadian Human Rights Commission, is not a bad thing as long as the regulators speak to one another, are efficient and benefit from each other's expertise. Our model would be to have a human rights approach to privacy law.

[Han Dong, Liberal, Don Valley North, ON]

I see. That's a very good point.

You mentioned that the facial recognition technology could be beneficial to our law enforcement system. Do you have any thoughts on what processes are in place or should be in place to ensure that the Government of Canada has the public's trust in utilizing facial recognition?

[Daniel Therrien]

I'll say something on the general level because we have not completed our investigation on the RCMP. The issue you raise is central. Obviously, whether it's companies or government departments—including law enforcement agencies—that use facial recognition, they should have processes ahead of the implementation of these technologies to assess the impact that they may have in order to ensure that privacy is respected. That's a central part, I think, before the technology is actually put into place.

[Han Dong, Liberal, Don Valley North, ON]

I don't mean to cut you off, but I want to get my next question in.

Does your office currently have enough resources to dive deeper on the algorithm, data storage or process to access data? Does your office currently have enough resources to do this type of investigation? It's not just with money. I'm also talking about technically—

[Daniel Therrien]

You mean the nature of our expertise.

[Han Dong, Liberal, Don Valley North, ON]

Yes.

[Daniel Therrien]

We do have a group of technologists. Roughly 12 individuals who are experts in technology assist in our policy development and investigative activity. In terms of the kinds of people, I think we have the right people. Then there's the question of how many resources, and that was the subject of some discussion in the last hour.

[Han Dong, Liberal, Don Valley North, ON]

You mentioned a partnership between the federal government and the provincial government. In your mind, what is the jurisdictional divide between the provincial and federal systems?

[Daniel Therrien]

Do you mean as to facial recognition?

[Han Dong, Liberal, Don Valley North, ON]

I mean the legislative aspect of facial recognition.

[Daniel Therrien]

It is the same jurisdictional divide as for other technologies. There's a federal private sector law that governs the private sector when the provinces have not legislated. Obviously, the provinces would legislate the conditions under which their own officials would use facial recognition, so the same jurisdictional issues would arise here as with other technologies.

[The Chair, Conservative, Chris Warkentin]

Thank you, Mr. Dong.

We'll turn to Monsieur Fortin now for the next round of questions.

Monsieur Fortin.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

Thank you, Mr. Chair.

Mr. Therrien, the more I listen to you, the more I realize that studying Bill C-11 is quite a chore. The privacy situation is really concerning. It's something that everyone is concerned about, here in Quebec at least, and I'm sure it's the same in the rest of Canada, if not the entire planet.

I'm a little concerned about what you're telling us with respect to Bill C-11, which might not cover all the angles, some of which would be quite important. I note, among other things, your caveat about facial recognition data being immutable. Once we have that data, it will be there for life. I also note the issue of exchanges between countries, where we must be even more careful, because the protections are not the same in all countries. In this day and age, with more and more trade between countries, I guess you have to be more and more careful, and put more time and effort into it. Those are some of the concerns we have.

When Bill C-11 was being developed, did you intervene? Was the Conflict of Interest and Ethics Commissioner called in to advise the minister, and did he try to include the various safeguards that you feel are missing from the current version of the bill? Have you prepared a report or other document?