Evidence of meeting #144 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was investigation.
A recording is available from Parliament.
René Villemure Bloc Trois-Rivières, QC
In its current form, does Bill C‑27 allow you to issue orders?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes. I could issue orders, but I couldn't impose fines. Those recommendations would be made to a new tribunal, which would then decide whether or not to impose them.
Bloc
René Villemure Bloc Trois-Rivières, QC
It seems paradoxical to me that we're proposing a new law on privacy, when precedents already exist and already work in Canadian territories and provinces or in Europe, for example.
According to a recent report by the Canadian Security Intelligence Service, the Communist Party of China can access the personal data of TikTok users.
How could we better protect citizens in this regard?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
As part of the study on Bill C‑11 which preceded Bill C‑27, we made recommendations, which we reiterated in the report on Bill C‑27 provided to the committee.
One of them was to include in the Personal Information Protection and Electronic Documents Act more specific rules on transfers of personal information outside the country.
At the moment, the act is quite general on the issue. It states that we must, by contract or otherwise, provide protection equivalent to that provided by Canada.
However, other countries in Europe have more rigorous protection regimes where there is talk of alignment. Those countries assess the other country's legal system and determine whether privacy is sufficiently protected. There may also be model provisions, among other things.
That said, the regime could be stricter, which would lead to greater protection.
Bloc
René Villemure Bloc Trois-Rivières, QC
I'd like to talk about the 23andMe company.
Recently, an Israeli company acquired a Quebec genealogical company called MesAïeux.com.
To what extent do people who use that company's site and agree to the terms of use consent to data sharing of this type?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We've made some decisions with respect to the use of a supplier's services in a third country. The Privacy Act doesn't prohibit that. In Canada, data can be transferred outside the country. The regime basically says you have to give protection equivalent to that in the other country.
When we look at such cases, we check that consent is given for the same purposes as those for which it's used in the other country. We also check whether the terms of use are transparent, which is to say, that users who give their consent are fully informed of the purposes for which their information may be used. In some cases, we found that acceptable.
Bloc
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes. If there's a concern about a lack of transparency and the use of personal information for reasons other than what was believed, then we may be called upon to respond to a complaint. We could also launch our own investigation, but generally speaking, we respond to a complaint.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Villemure and Mr. Dufresne.
Mr. Green, you have six minutes. Go ahead, please.
NDP
Matthew Green NDP Hamilton Centre, ON
Thank you.
Welcome back, Mr. Dufresne.
Certainly, there have been a lot of really interesting and probing questions.
You mentioned in your opening remarks that the decision by the government was made pursuant to the Investment Canada Act, which allows for a review of foreign investments that may cause injury to Canada's national security. You went on to say that the guidelines on the national security review of investments include a number of factors, such as “whether a foreign investment could facilitate access to sensitive personal data, including personally identifiable health or genetic information; biometric information; financial information; private communications; geolocation; or personal data concerning government officials.” You also went on to make the distinction that your investigation is focused primarily on “younger users”.
I would ask that if the government makes such an alarming declaration, based on those guidelines, to actually ban a company from this country, why haven't you also undertaken to look at some of the issues that may be related to the review of foreign investments that might injure Canada's national security?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We're focused on the application of Canadian privacy law and, in this case, we're focusing in particular on the protection of children. This is one of our priorities. It's a priority that's shared with my colleagues in the province. We've issued statements on this, so we're moving forward on it.
The national security aspect is a different matter, and there can be some overlap in some respects, but that one is being taken on by the government. We saw that as well when the government took the decision to ban TikTok from the devices used by government employees, for instance. That decision was made and announced a couple of days following my investigation.
There are different tracks, and they're moving forward on them. Again, if there are some aspects in our investigation that touch upon foreign access or otherwise, then we could—
NDP
Matthew Green NDP Hamilton Centre, ON
Let me put the question another way. Let's say that the government hadn't made this decision. Would it not at least warrant an exploration? These are very serious accusations, and the guidelines seem to have what I would describe—and maybe you can confirm whether you believe this to be the case as well—as a form of corporate espionage. I refer, for example, to backdooring sensitive information, not just of young users but of corporate CEOs, researchers, people in academia, government officials dealing with regulatory issues as well as politicians.
Would you agree that the guidelines for the national security review seem to point to the notion of a type of technological espionage?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I don't want to interpret the guidelines that are used and interpreted by the government. What I can say is that our investigation is focused on consent, on the appropriate purposes and the privacy practices of TikTok in terms of—and you're right—not just with regard to younger users, but all users. We are in the process of investigating this. We will be issuing our—
NDP
Matthew Green NDP Hamilton Centre, ON
I'm going to ask you a couple of questions, because I want to make sure that we get to the heart of the matter here, so I'm going to ask them fairly quickly.
Have TikTok representatives, either through the Canadian subsidiary or the head office, co-operated with your investigation?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We have been working with them. We have been obtaining information. Again, I don't want to comment beyond that, because the investigation—
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We've made a statement on our investigation, what it covers. It is looking at the privacy practices of TikTok. I can refer back to our statement.
NDP
Matthew Green NDP Hamilton Centre, ON
Sir, I really need to get these questions in, and you're just kind of drifting on some of these answers, so let's focus in.
Is the investigation nearing completion?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I hesitate to give a specific date. This is a joint investigation, but we are pushing to move along as fast as possible.
NDP
Matthew Green NDP Hamilton Centre, ON
Has the Minister of Innovation, Science and Industry's announcement ordering the windup of TikTok in any way impacted your ability to investigate?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I wouldn't be able to say yes to that. No, I think we're moving along with our investigation at this stage, and we'll be concluding it as soon as we can.
NDP
Matthew Green NDP Hamilton Centre, ON
Okay.
Do you feel like you have the power within the mandate of your office to adequately access the information needed to have a full and complete report?