Information & Ethics Committee on Dec. 5th, 2024

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

It's funny: Whenever I have to enter a site that has MFA, I always groan and lament the extra process I have to do, but after this conversation and after this ethics meeting today, I'll be much more willing to entertain that extra step of using MFA, based on some of the things you've said.

[Darren Fisher, Liberal, Dartmouth—Cole Harbour, NS]

What improvements, additionally, that have not been talked about today would you like to see made to better coordinate different government agencies in protecting the confidential information of Canadians?

[Philippe Dufresne]

There are a number of things that we'd want to see.

I talked about breach reporting. We need to see this as a legal obligation in the Privacy Act.

We need to see order-making powers for my office. This is something I don't have at the moment, and that adds potential delays. If you have a department that agrees with the recommendations, that works, but if it doesn't, then we need to go to court, and that adds delays and costs.

I want to see privacy impact assessments made mandatory and not just Treasury Board policy, because privacy impact assessments are also part of the solution to this. It's early risk assessment of new programs and new tools, so this is important.

We want to see necessity and proportionality as requirements under the Privacy Act. They're not currently, but they're requirements for the private sector. There should be similar standards of protection for the public sector and private sector.

As well, there should be collaboration between different offices. One of the challenges currently in Canadian privacy law is that I cannot do a joint investigation with my colleague, the competition commissioner of Canada, but I can do that with the U.S. FTC. That's a gap. We need more of that collaboration, including to deal with breaches.

[The Chair, Conservative, John Brassard]

Okay, that's time.

Thank you, Mr. Dufresne.

Mr. Villemure, you have the floor for six minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

A lot has been said, and I won't make you repeat what you've said so far. However, I'll come back to my first point.

What intrigues me enormously, in situations like this, is the reasons why this has happened and continues to happen. I understand that there are more users, more apps, more platforms, etc., but I don't know why. When it comes to ethics, it's often said that a change made to the structure without addressing the culture is doomed to failure. Why do these things keep happening?

They're going to keep happening. What could be done to improve the situation?

[Philippe Dufresne]

I believe that the contribution of your committee, through its reports and recommendations, as well as the contribution of my office, through its investigations and recommendations, are important. In fact, on our side too, we're taking a close look at public communications and user-friendly tools.

We need to reinforce the importance of privacy not only in general, but also in the more specific context of breaches. We sometimes tend to see this as a very technical issue. Yes, we don't like complicated passwords or multi-factor authentication. However, it's important to understand why this is important. In the world we live in, a lot of information is transmitted over multiple platforms, so we need to develop the reflex to realize that when information is compromised, it has a major impact on people.

These are lessons we can already draw from our first report. We told the people in charge that they were underestimating the impact it has on people. We also told them that, when the problem arises, you can't point the finger at one department or another. We're a team and we need to find solutions.

[René Villemure, Bloc, Trois-Rivières, QC]

I often come back to privacy education. I'd even go so far as to say that the public isn't necessarily very literate when it comes to privacy, and that there's still an educational mission to be fulfilled here.

It seems to me that we might prefer to have a law rather than a directive, but the fact remains that it would be a measure used to right wrongs rather than to prevent breaches in terms of culture. I often put the same question to the Information Commissioner: does the government have a culture of opacity or transparency? She answers that it has a culture of opacity.

In this case, transparency wasn't there either, and I find that worrying, because it prevents us from having a culture of accountability.

[Philippe Dufresne]

I think one of your recommendations, in the report you just tabled today, concerns privacy literacy, and I support it. Equipping people is very important. With my provincial and territorial colleagues, I'm discussing the idea that there should be mandatory privacy courses in schools. It should be part of the learning process. The more tools we can give people, the better.

However, I also think that we shouldn't relieve organizations of their responsibilities. So it's not just a question of equipping people. It's also about organizations making privacy as easy as possible for people.

[René Villemure, Bloc, Trois-Rivières, QC]

This last point really resonates with me. I understood from the minister's testimony, when she came here, that the burden of proving anything was on the user. So, in the name of accountability, the organization is disengaging, which I find unacceptable. Literacy is certainly necessary, but it doesn't take responsibility away from the other party.

What you say about compulsory courses at school reminds me of the days when there were home economics courses. We laugh about it today, but it was important at the time. It seems to me that courses on the importance of privacy as a fundamental right should be compulsory.

[Philippe Dufresne]

I agree with you. We and our international partners reported this summer on deceptive cookie and consent form practices. We found that these practices were widespread. Complex language and psychological tools are being used to push people into making choices that are not good for them and that will make them reveal too much information.

So we need to better equip people to recognize such practices and challenge them. Organizations must also continue to do their part to make it easy for individuals to protect their privacy. It may never be easy, but it has to be easier than it is right now.

[René Villemure, Bloc, Trois-Rivières, QC]

I seem to spend a lot of my evenings managing parameters and unchecking boxes. If there are too many, the average citizen gets annoyed. If they don't understand what they're doing, they get annoyed too. I think you first have to understand what you're trying to protect. The means may not be the right one, but the fact remains that there are many deceptive practices. I still think that, after a while, people get tired of ticking boxes.

[Philippe Dufresne]

Absolutely. In fact, in our Home Depot survey, we found that when people asked for an e-mail receipt instead of a printed one, the information was communicated to Meta. However, this was not indicated at all to customers at the checkout. One of the company's responses was that it was in their policies on their website and that customers could find this information there. We told them it wasn't acceptable to put such a burden on people, and that it wasn't part of people's reasonable expectations to have to research this extensively before giving consent. This kind of practice leads to consent fatigue.

Recently, we won our case against Facebook over its consent practices. The Federal Court of Appeal pointed out that the texts on which Facebook's consent practices were based were often longer than an Alice Munro short story. It's complex and doesn't help users understand what they're consenting to.

[René Villemure, Bloc, Trois-Rivières, QC]

Plus, it's often written in legal language.

[Philippe Dufresne]

Yes, that's right.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Villemure and Mr. Dufresne.

I was told there would be no further questions from the Conservative and Liberal parties. Mr. Green's intervention will therefore be the last one of this meeting.

Mr. Green, you have six minutes. Bring it home.

[Matthew Green, NDP, Hamilton Centre, ON]

Wow. I'll take it somewhere. I don't know if it will be a Conservative slogan, but—

[Voices]

Oh, oh!

[The Chair, Conservative, John Brassard]

That's okay. Please conclude.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

Mr. Dufresne, you mentioned that there's a different mandate for public disclosure for private companies versus public agencies or departments. Why is that the case?

[Philippe Dufresne]

For the public sector, under the Privacy Act, I'm mandated to keep confidential the information that I received in my mandate, unless I'm making it public in an annual or a special report to Parliament, so there's a limit. In the private sector legislation, I also have to keep it confidential, but the act gives me the authority to make it public if I determine that making it public is in the public interest. That is the authority we regularly use to make private sector matters public, including with press conferences, so that's the practice.

In fact, the practice of the OPC used to be that, once a year, all of the public sector complaints were made public through the annual report. I decided to change that this year, because I felt it was too long to wait an entire year before making these things public. That's why we started doing special reports, including in this matter—to make it public to Parliament. I take the point, perhaps, of having more press conferences, and these should be done as well.

[Matthew Green, NDP, Hamilton Centre, ON]

I appreciate that. I'm going to reclaim my time. It's scarce.

What you described was the mandate, so, within your mandate, you are following the rules of the mandate. I would ask you this, given that this is a government that claims it wants to have a culture of transparency: Would it not be helpful to have equal consideration for disclosure of privacy breaches, regardless of whether they are private sector or public sector? In your opinion, what's the benefit of not having that in a mandate for both sides, public and private?

[Philippe Dufresne]

There's no benefit. I agree with you absolutely, Mr. Green. This is something that should be amended in the Privacy Act. We've been calling for legislative amendments to the Privacy Act for some time. It's a 40-year-old piece of legislation. This should absolutely be one of the changes.

In the meantime, I've started to use this special tool of doing a special report to Parliament, and we're going to reflect as to whether we can do more, including press conferences.

[Matthew Green, NDP, Hamilton Centre, ON]

I would put to you, in quasi-legal terms—my friend called it lying “by omission”—that it's a material non-disclosure. The public has a right to know when there are breaches, whether they're caused by private third parties like H&R Block or through an agency like the CRA. As we've heard, they have profound impacts on Canadians, people who were embroiled in potential fraud allegations and people who would no longer get access to their GIS or their OAS. It's a significant thing. I'm happy to hear you before committee, recommending that we provide that within your mandate.

You also mentioned your ordering powers. Can you expand on that a bit and on why it would be important to demand full disclosure and not have obstruction from, I would call them, belligerent departments?

[Philippe Dufresne]

I'm sorry; I didn't hear the last part of your question.