Evidence of meeting #144 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was investigation.
A recording is available from Parliament.
Conservative
Liberal
Darren Fisher Liberal Dartmouth—Cole Harbour, NS
Thank you, Mr. Chair.
Thank you, Commissioner, for being here.
Just when I start to think I'm getting a handle on some of this, I get a little bit confused. I got confused there at the end by Mr. Caputo.
Can you clarify that the ICA review is completely unrelated to your investigation?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes, the ICA review is completely separate.
Liberal
Darren Fisher Liberal Dartmouth—Cole Harbour, NS
Thank you.
I think Mr. Barrett might have talked about this a little bit. Realistically, under PIPEDA, for both Canadian and foreign companies, what can you do if they fail to provide the requested information that you need?
You talked about jurisdiction and then you talked about enforcement.
Realistically, what can you do for a Canadian company with a Canadian subsidiary and a foreign company without one?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I think the big difference is if we need to compel. It's if there's a lack of collaboration and we need a court order to order the disclosure of something. That can be easier if the entity is in Canada than if it's not. That's where this would come up.
Under the law, I have powers to order a company to give me documents or to provide access to some of its information. We can exercise those if a company is in Canada. If a company is not in Canada, then that can raise different questions.
Liberal
Darren Fisher Liberal Dartmouth—Cole Harbour, NS
You could do that through international co-operation and MOUs. You could do that through the courts. We've already seen successful court cases, right?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Right. If something is in another jurisdiction and you need enforcement, then you seek that from the courts of that jurisdiction.
Liberal
Darren Fisher Liberal Dartmouth—Cole Harbour, NS
Realistically speaking then, if TikTok were to close up shop in Canada and still do something that negatively impacts Canadians' privacy, then you do have the ability to enforce PIPEDA, but you'd need to do it through an MOU or through the courts.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Right. If PIPEDA applies to something because there's a real and substantive connection to Canada, then we can get an order from courts. The question becomes making that order recognized in another jurisdiction.
As you say, this could be done by MOU or by international recognition.
Liberal
Darren Fisher Liberal Dartmouth—Cole Harbour, NS
Brenda talked a little bit about the Facebook versus Canada case. You said it was a very important ruling where global tech giants “whose business models rely on users' data, must respect Canadian privacy law and protect individuals' fundamental right to privacy.”
How does this case affirm your oversight and jurisdiction over foreign entities?
How does it affirm your jurisdiction over tech giants that have deep pockets, have been willing to spend a ton of money and have historically acted bullishly both in Canada and globally?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Courts in Canada have recognized that because of the nature of data and international relations, it's not necessary for a company to be domiciled in Canada for Canadian courts to have jurisdiction. That's the real and substantive connection test. Courts have recognized this. If Canadian users are impacted, Canadian institutions will have jurisdiction on it.
That's why, in a case like Facebook and in other situations, we are able to assert jurisdiction independent of whether an organization is in Canada or not, provided that Canadian users are impacted.
Liberal
Darren Fisher Liberal Dartmouth—Cole Harbour, NS
Can you talk a little bit about the Facebook case where they refused to say they did anything wrong, but paid $9 million to some Quebec educational entities? I think it was a class action suit.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That's a class action settlement. That is distinct, and we were not involved in this matter. I think what this highlights is that we need to have the ability in privacy law for my office to be able to issue orders and to issue fines, because we see the impact that these financial amounts can have. Ideally, they won't be imposed, because organizations are going to do the right thing, but it helps decision-making.
What we have now under Canadian law with our Facebook case is that we have to seek an order from the court and to push in that direction. So far we have not obtained financial compensation in that case, although I will continue to push for that.
Liberal
Darren Fisher Liberal Dartmouth—Cole Harbour, NS
This may not be a totally related question, but I'm wondering how, if they refuse to admit any wrongdoing, and they take their deep bank accounts and throw a little bit of money at something to make it go away—and it does end up going away—that gets us to a point, moving forward, where we can get them to act less—and I'll use the word—“bullishly”. How do we get to that place where we actually...because I think until we have a court case where we truly have someone say, okay, we screwed up, we're wrong...?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
There are a number of tools. We can do that with legislation. If you amend legislation as a parliament and you provide certain specific requirements, then that has an impact on organization. You have an impact with international dialogue and collaboration. We're working very closely with the G7 colleagues, with international colleagues, and are making international statements on AI and good practices. One of the reasons I'm advocating for order-making power and fines is that then you have a court order that says, “Here's what you need to do”, you have fines, which focus the mind, and then you can use the promotional work as well to really build that culture of privacy.
Conservative
The Chair Conservative John Brassard
That's it. Thank you, Mr. Fisher. I did start your clock a little bit late, so you had the six-minute round plus on that one.
That concludes our panel.
Thank you once again, Mr. Dufresne and Mr. Chénier, for being here today.
Mr. Dufresne, I want to thank you for your professionalism as well. This was a fascinating discussion.
Just to let committee members know, on Thursday we'll have CSIS here as part of our study. They'll be here in the second hour. H&R Block is coming in the first hour for the CRA study.
I have no other business ahead of me.
I'm going to adjourn the meeting.