Information & Ethics Committee on May 9th, 2024

[Philippe Dufresne]

What we look for in terms of investigations and reviews is whether an organization is putting in commensurate measures to protect the sensitivity of the information of minors and children. Are they aware of the likelihood that their users are minors? We're investigating TikTok, and we announced that we are going to be focusing particularly on children's use, because this is a big part of the clientele of that website.

[Matthew Green, NDP, Hamilton Centre, ON]

Is that because you don't think Instagram, Facebook and X do the same, or that they do it in different ways? Help me understand that.

[Philippe Dufresne]

We're investigating TikTok right now, so this is the one where we will have some findings to make. We made a general statement for all social media, in terms of protecting the rights of children, with my provincial-territorial counterparts. We cautioned against nudging techniques that would encourage children to give more personal information than they need to. We called for the treatment of children's personal information to be different and for them to have a greater right to delete information. I won't make a specific comment about a specific website if we haven't investigated it particularly on that issue, but generally we are calling on all of those platforms to be mindful of those elements.

Again, I think Bill C-27 will bring greater tools in respect of this heightened protection. I've made it one of my priorities, so we're going to continue the education work but also targeted compliance, as needed, to protect children, whichever platform is at issue.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Green.

Thank you, Mr. Dufresne.

Mr. Kurek, I have you up. We're going to start our second rounds of five minutes. Go ahead, sir.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thanks very much, Chair, and thanks, Commissioner.

I'm curious, Commissioner, are you aware of the privilege debate that took place in Parliament last night and this morning regarding 18 members of a parliamentary association with an attempted hack of personal information?

[Philippe Dufresne]

I am not. No, I haven't been briefed on that yet, unfortunately.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

It's a very quickly developing situation. We learned only a couple of months ago, because of an unsealed report from the Department of Justice compiled by the FBI in the United States, that in January 2021 there was an attempt by a hostile foreign state actor connected with the communist dictatorship in Beijing to infiltrate 18 parliamentarians' personal email accounts.

I know you haven't had a chance to get into the debate that took place in Parliament—I am hopeful, and certainly, I've been at committee here and we haven't been called to a vote, so I think that's a good sign that it passed unanimously to send that to PROC—but I'm wondering if you can share some thoughts with this committee about how important that is, and not just the protection of private information when it comes to MPs being able to do their jobs. Obviously, that's one part of it, but I also brought up in my speech last night how important it is to ensure that Canadians feel protected and that appropriate responses are brought forward when there are attempts to use private information for nefarious purposes, whether that be with diaspora communities that may be at odds with a government they have a connection to or other uses. I'm wondering if you can provide any comments on that and share some thoughts with this committee.

[Philippe Dufresne]

I issued a declaration last December with the UN special rapporteur on privacy and human rights, and I highlighted the link between the protection of privacy and other fundamental rights. That includes democratic rights, so in protecting privacy, whether it's the privacy of members of Parliament, voters or citizens, we can see that there are overlaps with other sectors. That's why it's so important to protect privacy for its own sake and also because it supports and promotes other fundamental rights. That's an issue that's raised in this instance. I will certainly be interested to see where the.... The question of parliamentary privilege is a question for the House, of course, but certainly we'll be mindful and will be briefed on it.

There is a proposed modification to the Canada Elections Act vis-à-vis privacy obligations for political parties, so that's another example in which you have some intersectionality. My office has a role to play, but there are other regulators, such as the Canada Elections CEO, so this is an area where I work very closely with other regulators where there are areas of overlap, and we'll be following up.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Is informing parliamentarians, in this case, and the public...? It was interesting that, as the debate was taking place last night, Premier Eby of British Columbia announced.... I happened to see the statement on Twitter, and of course it provided a link to a Government of B.C. website.

Is informing those affected and, generally, the public of what's going on a part of the process of making sure that privacy can be safeguarded?

[Philippe Dufresne]

Well, if we're talking about privacy breaches generally in the private sector or public sector, one of the elements is that the organization would have to notify my office and would have to notify the affected individuals as early as possible. That's one of the mechanisms to provide that information, and then there are mechanisms to take steps to protect and prevent and address it.

We have complaints under way with respect to privacy breaches, for instance, with the government's location services, BGIS. We've launched an investigation vis-à-vis the Global Affairs privacy breach, so privacy breaches are something that we are concerned about. They're happening more and more, and we have a role to play in that.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you, Commissioner.

Certainly, I'd value, if you have any.... I'm basically out of time, but if there's any further feedback that you could provide this committee and hopefully, if you have a chance, send.... As PROC, hopefully, will be seized with this in the near future, I'd certainly encourage you to share your feelings and feedback there.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Kurek.

We're going to go to Mr. Bains next for five minutes.

Go ahead, sir.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

Thank you, Mr. Chair.

Of course, thank you, Mr. Dufresne, for joining us again today.

I'm curious to understand a bit more. How big is the team that you're working with? What resources do you have? Is this allowing you to be more proactive in engaging strategic priorities? Where are you at with your office and your team?

[Philippe Dufresne]

We have roughly 215 employees at the OPC, and we have proposed budget funding for my office in the 2024-25 main estimates of $34 million. We have had an increase of $4.5 million in the previous year. Half of that is attributable to collective bargaining increases, so that's not really increasing our budget or our ability to do our work; it's just maintaining it. We've had temporary funding, as part of budget 2023, of $2.4 million for that year to help us address the backlog and privacy breaches.

We need increases in our budgets on a permanent basis. This additional funding is useful and very important, but it will come to an end, and the challenges will not come to an end. We are seeing more privacy breaches. We are seeing them on a larger scale. We are seeing that they are more complex, and technology is making it more challenging.

There is a need for more permanent funding on that. Specifically on the point of more proactive and promotion work, we will also need additional resources in this space, particularly if Bill C-27 is adopted. Bill C-27 would bring new responsibilities to my office from an enforcement standpoint, with order-making powers, but also with, just as importantly, more guidance opportunities to help organizations and small and medium-sized enterprises know what their obligations are, to provide clarity on this industry, which needs as much certainty as possible to do its work and to know what the expectations are.

There are very interesting provisions in Bill C-27 that would allow the preparation of codes of practice and certification programs. These are things that businesses around the world have been asking for to give them more certainty, and I would be playing a role in approving them and providing some more legal certainty.

There are a lot of things that we could be doing. The resources limit that. Of course, public resources have to be used judiciously and cautiously. We're looking at that. We've made some requests. We're going to continue to do that in a fiscally prudent manner.

[Parm Bains, Liberal, Steveston—Richmond East, BC]

It's clear that your obligations are continuing to change and that your scope is broadening. As these technological advances occur, you have to continue growing from there, so I understand that.

Can you expand on the sandbox example you gave and maybe even the data sweep? What are the criteria you use?

[Philippe Dufresne]

In terms of the sandboxes for organizations, we're not currently resourced to offer this, but my international counterparts are, and they are doing it with business, so they will say, “You can come over, and you can test this new technology in a safe space where the regulator can provide input, can provide risk. We're able to provide proactive guidance and to be consulted, and we have services for that, but not to the extent of offering sandboxes. This is something I'd like to be able to do. I think it would be good for Canadians and good for industry.

We've identified that we would need ongoing annual funding, an increase of about $25 million for Bill C-27, to optimally provide those services based on those new authorities.

In terms of the sweep that you made reference to, with our partners we look at various numbers of websites and see.... I don't have the randomized formula that was used by the team, but the goal is to say that we're going to do some spot checks and see.... Are there trends? Are there concerns? Are we seeing some websites that are using what we call deceptive practices or dark patterns, which are communication tools that will lead people into making bad decisions and will sometimes trick them?

[Parm Bains, Liberal, Steveston—Richmond East, BC]

On that piece there, you talked about nudging techniques. Can you give some examples of that? Before I run out of time, I'm curious also if you can add on.... Should we be having an educational campaign across Canada to ensure that people know what to avoid and what kind of nudging techniques there are?

[The Chair, Conservative, John Brassard]

Mr. Bains, you are out of time, but Mr. Dufresne, if you can, answer that question quickly, please.

[Philippe Dufresne]

Very quickly, a nudging technique basically means that you're making it very easy to make one choice and very hard to make another choice. When you're making it very easy to make a bad choice, you're nudging towards that bad choice.

[The Chair, Conservative, John Brassard]

Thank you, sir.

Mr. Villemure, you have the floor for two and a half minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

Mr. Dufresne, I am going to take advantage of your presence again to ask you some questions that have been put to me by my Trois-Rivières constituents.

The other day, someone asked me the following question: When a company says that you have to accept strictly necessary cookies, who determines that they are strictly necessary? Is there a standard? Is it what the company considers to be strictly necessary?

[Philippe Dufresne]

This is the company's point of view.

In the act, there are provisions stating that companies should not collect more information than is necessary for them to achieve their purpose, but the determination of what is necessary is made by the organization.

[René Villemure, Bloc, Trois-Rivières, QC]

So there could be a gap.

[Philippe Dufresne]

It can be challenged. Some might question whether some information is really necessary. In that case, processes can be triggered, including with my office, to look into the matter.

[René Villemure, Bloc, Trois-Rivières, QC]

When it comes to financial technology, are there any particular privacy concerns?