Information & Ethics Committee on May 9th, 2024

[Philippe Dufresne]

We're working very closely with a number of our international counterparts. I'll name a few.

The G7 data protection authorities work yearly. Last year in Japan, we issued a joint statement on artificial intelligence from a privacy standpoint. I was very proud of that statement. It's a statement that was endorsed in the Department of Industry's and Minister Champagne's statement on voluntary codes for AI. It's that collaboration, the sense that my colleagues and I understand the need to have very strong privacy protection but at the same time very strong economies and a very strong ability for organizations to have data across borders.

I'll point to the U.K.'s ICO. They've done great work on children's privacy. They have a children's code, an age-appropriate code, talking about steps that we can take. I think this is something that Bill C-27 highlights. I was happy to see a recent amendment at the INDU committee recognizing the best interest of the child, which was one of my recommended amendments for this bill.

I think we're seeing lots of work in this space and lots of awareness too. Perhaps another example I'll give is the creation of what we call the privacy sandbox. A commissioner's office will invite industry to come and test a new process and highlight risks in privacy before this technology is deployed, so that the risk can be mitigated. You protect privacy, and you avoid a complaint on the front end.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

Do you get a sense that there are any social media platforms that are better than others at respecting the privacy of Canadians, or are they trying to perhaps look for ways to undermine?

[Philippe Dufresne]

We have ongoing complaints and litigation with some of those social media platforms, so there are clearly some issues that we're looking into.

We were in litigation following a complaint decision on Facebook. We have a matter vis-à-vis Google in terms of questions on the de-indexing of information. We're looking into our investigation of TikTok.

These social media platforms are attending and participating in terms of the global privacy discussions and meetings, and they are providing their input. They are listening to the comments and the input of the community, but I will continue to reiterate to them through both our promotion and persuasion tools and also the compliance tools where necessary.

[The Chair, Conservative, John Brassard]

Unfortunately, that's your time, Mr. Fisher.

Mr. Villemure, you have the floor for six minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

Commissioner, welcome back. I am always happy to hear what you have to say.

I am going to address a few questions before getting to the heart of the matter. A citizen of Trois-Rivières who is very concerned about privacy issues asked me a question the other day to which I did not have an answer. So I decided I would give him an answer only after I have heard your opinion on the subject.

The citizen's question was about visiting a website, which you can do without accepting certain conditions. However, the data is personalized when you accept the conditions, and so on.

He asked me if the mere fact of having visited a website in itself can be considered personal information.

[Philippe Dufresne]

Data about people's location and visited websites provide information about their interests. That is why we are concerned about browsing and localization cookies, and the use of this information to profile people.

So, indeed, refusal is an element that would be relevant to the protection of information. That is why the discussion about witnesses and accepting them is important, because it is all about getting information pertaining to our areas of interest.

[René Villemure, Bloc, Trois-Rivières, QC]

In other words, if a person refuses cookies and leaves a website while browsing, this information will still have been collected.

[Philippe Dufresne]

By refusing cookies, you restrict the use of certain things. Some uses are unavoidable, however, and there will also be a request for consent to use the information for targeted advertising, for example.

One of my concerns is that these choices are not always easy to make. The simplest choice is to accept everything. However, I would like the choice to refuse everything to be much simpler and more accessible. Often, you have to go through two or three other levels to get there, and even then, you have to provide details. On the other hand, the option of accepting everything is always there.

In my opinion, there is still work to be done here.

[René Villemure, Bloc, Trois-Rivières, QC]

When you start unchecking partners and there are 127 of them, it takes a long time. In fact, I am always amazed at the number of partners who can take advantage of our data.

So, to give a simple answer to the citizen who asked me this question, I will tell him that the information will still have been gathered.

[Philippe Dufresne]

If the person leaves the site, no further information is collected.

However, we are rightly concerned that we do not always know what we are consenting to. It can also prevent us from accessing a service we would like to be able to use otherwise.

These elements are part of our thinking. Furthermore, as algorithms become more and more powerful, artificial intelligence can detect more things with less information. So we need to be vigilant in this respect.

[René Villemure, Bloc, Trois-Rivières, QC]

It still threatens the concept of freedom of choice.

I actually had a question for you about vigilance. Earlier, my colleague asked you about platforms that respect privacy. But beyond the big platforms, which ones are the offenders? A lot of people around me use all kinds of stuff I have never heard of. Which sites should we be more vigilant about?

[Philippe Dufresne]

Recently, for example, we carried out an audit in this area, but the results have not yet been made public. We did what we call a data sweep. Working with international partners, we randomly checked a number of websites to see if there were any deceptive ways of communicating on these websites that encouraged people to give up too much privacy. We have done this in conjunction with the authorities in charge of protection competition, because there are clearly overlaps. When we get the results, we will be able to say that we have concerns about certain sites.

So far, we have tended to comment on undesirable practices and targeted cases where we condemn an organization, which we do after receiving a complaint. There are ongoing complaints that are cause for concern.

For my part, I want to see more sites where privacy is included by default. My concern is that website visitors face a choice. It is easy to accept everything, but it is not easy to refuse everything.

[René Villemure, Bloc, Trois-Rivières, QC]

If you choose to continue without accepting cookies, is any information still collected?

[Philippe Dufresne]

Parameters can be set by default. Sometimes consent is given automatically. Sometimes, to continue, you have to click on “accept all”, and this is an aspect we are looking into. My colleague from the UK has made this a specific issue.

[René Villemure, Bloc, Trois-Rivières, QC]

As for consent to accept everything, would we need to amend the law? Or would it be enough to amend regulations?

[Philippe Dufresne]

In Bill C‑27, for example, the emphasis is on making consent easy to understand and simpler. In addition, organizations are required to be more proactive, and there is a greater role for my office in preparing guidelines. It also provides for the authority to issue orders. So, that is why I think this bill is a step in the right direction.

[René Villemure, Bloc, Trois-Rivières, QC]

Do you think an order would be followed? Or would it be disregarded, as in the case of the Information Commissioner's orders?

[Philippe Dufresne]

Until proven wrong, I am going to assume that an organization will abide by the law. If not, there is recourse to the courts, hence the importance of being able to issue orders.

In Canada, certainly, most organizations or companies care about their reputation and their customers. They want to do the right thing, so they will comply with a recommendation. We saw that, for example, in the Home Depot case, where recommendations were made that were followed, and there was good co-operation.

However, it is important to be able not only to make orders, but also to issue fines. I am not saying this because I want to use these powers, but they help responsible decision-making and motivate decision makers to prioritize privacy. Without it, those decision-makers might prioritize other areas where organizations could be fined because there are no fines in our sector.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne and Mr. Villemure.

Mr. Green, you have six minutes.

Go ahead, please.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you very much, Mr. Chair.

I have adequately taken control of my mute button, and I apologize for the earlier disruption.

Mr. Dufresne, I always appreciate you when you appear before this committee. In so many ways your work guides the work that we do, not just in the committee but as parliamentarians.

I would like to reference your 2024-25 departmental plan, in which you have survey results on the protection of privacy rights that I find very concerning. In the 2022-23 survey, only 39% of respondents felt that businesses respect their privacy rights. That's down 45% from 2020-21. Only 58% of respondents felt that the federal government respected their privacy rights, and again that was down from 63%. Both of these results fall well short of your target of 90%.

Can you explain why these numbers are so low and what can be done to reverse this downward trend?

[Philippe Dufresne]

I think those numbers are low. This is one of the reasons we have highlighted technology and children in our strategic priorities. I think there is a sense that technology is more and more intrusive. It's relying more and more on data and on personal information to fuel tools and innovation, so there are some of the discussions we have been having here today in terms of consent to use websites, in terms of what can people do to protect their personal information. I think Canadians feel they are bombarded by requests for their personal information, so it's important that the institutions and the systems provide recourse and provide proactive discipline in organizations, not only to protect privacy but to be seen to protect privacy.

We are seeing these types of concerns. We are seeing that Canadians want to see more rigorous legal protections of their privacy rights. This is why we're advocating for a modernized legislation whereby I would have order-making powers. There would be the possibility of fines. There would be the possibility of real consequences if privacy is not respected.

We also need to see more proactive privacy protections that are done at the front end. I have been calling for privacy impact assessments to be a legal obligation, both for departments and for private sector organizations.

I think there's work to be done. It shows that Canadians care about their privacy and that collectively we need to be mindful of this so that Canadians do not feel, as they seem to now, that it can be a trade-off between your personal information and innovation.

[Matthew Green, NDP, Hamilton Centre, ON]

Those are some very important points that you've raised. Certainly, when you talk about the impact, the privacy impact assessments, we at this committee dealt with what I consider to be the complete disregard of the mandate of the Treasury Board to provide those. Some departments were just completely disregarding privacy impact assessments and only doing them, in fact, after they were caught.

However, you raised the issue, which I think is quite important, about safeguarding our youth in this regard. Of course, I'm sure you would perhaps agree that youth today are not going to websites. They're using social media platforms. You referenced, I think, an assessment around TikTok.

Without getting into the details or pre-empting the release of your report, can you just provide us a high-level assessment of the ways in which platforms profile and use algorithms to target people based on their interests and why that would be a problem?

[Philippe Dufresne]

In some of these investigations we're focused on the consent. Are you obtaining meaningful consent by Canadians, and are you doing that in an appropriate way with respect to the age? We have guidance on that in terms of the fact that what is appropriate for an adult isn't going to be appropriate for a child, for a minor.

There are different types of circumstances, and Bill C-27 recognizes that by protecting minors' information and treating it as sensitive, so that's an additional positive step to recognize the best interests of the child.

[Matthew Green, NDP, Hamilton Centre, ON]

On a more pointed question, based on your preliminary work on this, do you find some platforms worse than others? For instance, TikTok is constantly brought up, and we're hearing lots of information about that, but how would they compare to, say, an Instagram or X, formerly known as Twitter, or Facebook?