Evidence of meeting #104 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was use.
A recording is available from Parliament.
11:45 a.m.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
My understanding is that all of whatever is done to employee phones is done either through consent or through warrants. Do you think that is not sufficient to protect an employee?
11:45 a.m.
Associate Professor, As an Individual
I don't think consent is enough. I don't think people necessarily know what they're consenting to.
11:45 a.m.
Liberal
11:45 a.m.
Associate Professor, As an Individual
We go back to my comments around privacy impact assessments being tools for self-regulation. We need to have an external body like the OPC that decides whether or not these things should be used in the first place. A body like the OPC could decide what sort of processes need to be in place for people to give informed consent around the examination of their devices.
11:45 a.m.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Do you hold that same view for private organizations as they deal with their employees, or is it just government departments that you feel need to go through these extra measures?
February 15th, 2024 / 11:50 a.m.
Associate Professor, As an Individual
Do you mean corporations?
11:50 a.m.
Associate Professor, As an Individual
I would be troubled if corporations were able to buy these technologies. If they were, I would have the same expectations in terms of consent.
11:50 a.m.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Lastly, I just want to go through what your definitions were with respect to spyware and digital forensic software. You said that they are basically one and the same, but that's not what we've heard in testimony from other witnesses. Can you clarify your position on that, please?
11:50 a.m.
Associate Professor, As an Individual
Their capabilities are somewhat the same. With spyware, you have applications that are surreptitiously installed on people's phones in order to spy on them in real time. Mobile forensic devices give you the ability to access the same granularity of data after the fact, so they're not the same thing at all, but they essentially provide the same access to data that you would not have otherwise without having to get a warrant, to the degree that you would need to get a warrant to access each connection to a cloud service provider, for instance.
11:50 a.m.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
You don't have evidence to support that this is what is actually being done in these departments for now.
11:50 a.m.
Associate Professor, As an Individual
No, but I do have evidence that they have purchased the technology to do it. Why would you purchase technology to be able to access these things if you were not planning to do it? These are separate technologies. Mobile forensic devices are various software and hardware pieces. They can be bought piecemeal, and technology with the capability of doing this has been recently purchased. There are licences that are active through the middle of summer 2024.
11:50 a.m.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Light.
Thank you, Ms. Khalid.
It sounds like someone's phone is making noise. Could you please put your phones on silent mode?
Mr. Villemure, you have two and a half minutes.
11:50 a.m.
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you, Mr. Chair.
Mr. Light, the things you're describing are quite worrisome. Technology moves quickly. Some organizations come back to the fact that, back in the day, hiding a microphone in a lamp did the job, but today, they have to use forensic technological tools. Given how far technology has come, is a privacy impact assessment enough?
11:50 a.m.
Associate Professor, As an Individual
I don't think so.
The comments the committee has heard so far all point to the same concern, a privacy impact assessment examines the program, not the technology. As the Competition Bureau Canada officials told the committee on Tuesday, this type of tool has been in place since 1996, before the Treasury Board directive was introduced. Other organizations such as Shared Services Canada have privacy directives that predate the use of these tools. It's wrong to think that the data are the same as they always were. More and more data are available thanks to these new technologies.
11:50 a.m.
Bloc
René Villemure Bloc Trois-Rivières, QC
Do you think the Privacy Commissioner is going to have to keep a more watchful eye on things given how far the technology has come?
11:50 a.m.
Bloc
René Villemure Bloc Trois-Rivières, QC
All right.
You mentioned the comments of other witnesses a number of times. Were you reassured by what you heard the witnesses say this week? Is everything going to be fine?
11:50 a.m.
Associate Professor, As an Individual
I'm reassured because I now know a lot more about what's going on than I did before.
11:50 a.m.
Bloc
René Villemure Bloc Trois-Rivières, QC
Would you say that the whole reality around privacy, to some extent, amounts to underestimating its value?
11:50 a.m.
Associate Professor, As an Individual
I think so. With our use of technology, social media and new ways of communicating, we developed new social standards and new communication standards, but we haven't updated our laws.