Evidence of meeting #144 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was investigation.
A recording is available from Parliament.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
As the decision announced, it is not closing the app. It is calling for the windup of the Canadian operations of TikTok.
Liberal
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I haven't seen any order from the government banning the app in Canada, or preventing its use. It's calling on the organization to cease its corporate activities in Canada.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Does your office play any role with respect to the ICA's national security review?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
No, we're not involved in that decision. This is a decision made by, I believe, the Department of Industry in consultation with national security experts in the government. It is ultimately a decision of the executive.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Are you normally consulted, as part of the ICA national security review?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We were not consulted in the context of this specific decision. We could be consulted on a general-operation, privacy impact assessment of the program itself, but this decision is not one that involves me. It's not a decision where I would have been able to provide privacy input.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
I will change channels.
You and I are both of a generation where we experienced life without the Internet, then experienced life with the Internet and digital technologies. I think everybody around this table is of those generations. Well, maybe Mr. Caputo isn't. Oh, oh!
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
There have been concerns that TikTok's leaving their operations on Canadian shores will heavily handicap your oversight of the app and any data violations. However, it's my understanding that your office can assert jurisdiction over foreign companies without their having a physical presence in Canada. The physical location of servers is not determinative of your office's capacity to do its job.
Is that correct? Can you explain that?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That's correct in the sense that, for me to have jurisdiction over a matter, there needs to be what the courts have called “a real and substantial connection to Canada”. That could be by looking at things like the location of the target audience of the website. If there are Canadian users, then that factor is met. We also look at the source of the content of the website, the location of the website operator and the location of the host server.
It is a contextual assessment, but we usually look at jurisdiction when Canadians are affected by this, and if Canadians are using the app, then we take jurisdiction.
Where it can have some more challenges is, if there's time to enforce the decision, there's time to compel things, and if things are in another country, then we need to use the courts of that other country.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
If TikTok does not have an office in Canada, can you still have jurisdiction over their operations in Canada?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We still have jurisdiction to investigate the website, to investigate the impacts on Canadians, to investigate whether it complies with privacy practices. We have jurisdiction to make an order and to seek a court order from Canadian courts.
Where the issue could come up in terms of enforcement is if all the assets are in another country. It then becomes an issue of private international law where you seek to have another court of another country enforce a decision of Canadian courts.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
What kind of enforcement measures do you think would need to be taken in this instance?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
In this instance, we are still conducting our investigation. We're going to be issuing our report of findings in the coming months with my colleagues from Quebec, B.C. and Alberta, so I won't say any more about that. We haven't finalized the outcome. I don't have order-making powers, but in my case, the outcome could be recommendations. I could take action before Canadian courts. My colleagues in the province have order-making powers, so that's an issue that would come up at a later date.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Is it something that the RCMP would get involved in once your investigation is completed, or would that be a civil case that you think would need to endure?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Our investigation would not involve the RCMP. We conduct our investigation, and we issue our report. Then, if there is a finding that the law was breached, if there are recommendations or provincial orders, or if we take the matter forward to court, then it becomes a civil proceeding.
Liberal
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Are there any recommendations that you have to make to this committee with respect to how we should conduct ourselves, not just with how TikTok has operated with this move but also with other social media platforms? Is there anything that you think we can be doing to better legislate protective supports for our communities and our country?
Conservative
The Chair Conservative John Brassard
We're over our time here. I'm going to have to get you, Mr. Dufresne, to circle back on that response, if you don't mind, in the next round of Liberal questions. We're 28 seconds over time on that one.
Mr. Villemure, you have the floor for six minutes.
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you very much, Mr. Chair.
Thank you for being here, Commissioner and Mr. Chénier.
I think we're dealing with a paradoxical injunction, where we're being asked to do one thing and the opposite. I won't go into the details that you've already presented to my colleagues, but I'd like to know what you think of the Canadian government's decision to expel TikTok, while allowing its use. It seems paradoxical to me.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I can hardly comment on this decision, because I don't have the information on which the government based its decision.
The minister's statement says that this decision was made under the Investment Canada Act on national security grounds, and it explains what it does and doesn't do. I can't judge that. All I can say is that, in parallel to this, we're already conducting an investigation into TikTok to determine whether the Personal Information Protection and Electronic Documents Act is being complied with, particularly as regards young users, and that's what we're going to do.
Bloc
René Villemure Bloc Trois-Rivières, QC
I'm not asking you to reveal anything about your ongoing investigation, but it seems that this decision, which is based on the Investment Canada Act, doesn't help you. It seems to make your job a little more difficult.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
At this point, as I indicated, we're continuing our investigation. It doesn't affect our investigation. We'll be able to complete it in the coming months and make our decision.
Earlier, with your colleagues, we discussed what would happen if the company refused to cooperate or comply with the act when it no longer has a subsidiary in Canada. They were wondering if this could raise different issues. It's possible. However, for the time being, we're using the tools that the act gives us.
Bloc
René Villemure Bloc Trois-Rivières, QC
Could the order-making power, which has already been mentioned, be useful in this kind of situation?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
There's no doubt that this power could be useful. As you recommended in your report recently, this authority is a missing element of Canada's Personal Information Protection and Electronic Documents Act. That's clear when this legislation is compared, even within Canada, with the laws of some of the provinces and those of our international counterparts in Europe and elsewhere.
This year, Canada is chairing the G7 and I'm chairing the Roundtable of G7 Data Protection and Privacy Authorities. However, I don't have the power to issue orders. So it's a gap that needs to be filled, because until it is, you have to go to court and spend time and money on litigation. However, it's simple to fix.
As you also recommended, we should also consider the possibility of imposing fines. We hear about class action lawsuits involving large amounts of money, and that's what gets the attention of management and encourages compliance.