Information & Ethics Committee on June 2nd, 2022

[Ya'ara Saks, Liberal, York Centre, ON]

I'm going to switch gears a little bit.

In the day and age we're in, I have an intern here from Ukraine as part of the parliamentary internship program. She showed me on her phone that she has a digital passport with her code passport and her essential documents, including her birth certificate and other important pieces of ID that she's able to access, which is very helpful for her, considering that she's coming from a war-torn country and that documents may get lost and so on.

There's a lot of interest in the concept of digital IDs and having access to them. Could you explain how such a technology could potentially strengthen privacy security? Canadians have questions about how all that could potentially work.

[Daniel Therrien]

Digital ID, like all technologies, can be helpful and privacy protective or harmful to privacy depending on how it is designed. It is certainly conceivable that digital ID could enhance the verification process and the authentication process, allowing citizens to have access to services.

It is certainly conceivable that digital ID would be better from a privacy perspective than SIN numbers and the antiquated ways we have to identify ourselves currently. It all depends on how the technology would be designed. It is certainly possible that digital ID would lead to the data being available to many players or actors, corporate or governmental, that should not have access to all of this data, but it doesn't have to be designed that way. It could be designed in a way that provides authentication, which is the first part, and then controls correctly who in a department or who in a company has access to what information because they have a legitimate need for it.

[Ya'ara Saks, Liberal, York Centre, ON]

Thank you for that.

In the Canadian context we're in—and obviously there's also an issue with jurisdiction—some of our identification like driver's licences and OHIP cards—I'm from Ontario—are under provincial jurisdiction, but at the same time, we have social insurance numbers and passport numbers at the federal level. Do you think it's time for us as parliamentarians to take a deep dive into how we can best serve Canadians but also protect their privacy and enable them to move through this digital space with ease as well as with safety and security?

[Daniel Therrien]

Yes. I think digital ID is certainly an issue that has the potential to enhance access to services in a privacy-protected way. It's important to design it properly. It's entirely an issue worthy of consideration.

[Ya'ara Saks, Liberal, York Centre, ON]

Have you encountered international best practices in other countries? I gave Ukraine as an example, but has that come across your desk?

[Daniel Therrien]

Estonia is often referred to, but it is a very small country with a very small population. It is a model, and if need be, my office could provide other examples, if you wish.

[Ya'ara Saks, Liberal, York Centre, ON]

I would love some kind of written outline of best practices internationally. Thank you.

[Daniel Therrien]

Sure.

[Ya'ara Saks, Liberal, York Centre, ON]

I think I'm out of time. Thank you.

[The Vice-Chair, Liberal, Iqra Khalid]

Thank you very much, Ms. Saks.

Thank you, Monsieur Therrien.

I put this to members. We have a couple of minutes before we have to go in camera for committee business. If there are any brief questions that members want to ask, let me know.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

I have one question, if I may.

[The Vice-Chair, Liberal, Iqra Khalid]

Okay, so we'll just follow the same order. I'll come to you, and then I'll go to the Liberal side, the Bloc and then the NDP.

Go ahead, Mr. Kurek.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Sure. Thank you.

Thank you, Commissioner. I hope this was a good way to end your distinguished service with us.

You mentioned StatsCan in your opening remarks. I want to give you an opportunity to elaborate a little bit more about some of the concerns you have regarding financial information and some of the details of Canadians that Stats Canada would possibly have been able to get.

[Daniel Therrien]

Statistics Canada is a good example leading to my answer to Ms. Saks, namely that the principal amendment to make to the public sector law is to have a standard of necessity and proportionality limiting the collection of information by government institutions.

Statistics Canada had laudable objectives of better understanding certain problems of the poor's access to programs, so it went about getting extremely detailed—actually line-by-line—financial reports of banks and financial institutions to better understand citizens in order to give them access to better services. In our view, this very pervasive look at financial records was not proportional and necessary. We did not say that the objective was not laudable and legitimate, but there was just too much information obtained by this government institution. We have since worked with Statistics Canada and are still working with them to improve their systems, but I think the main lesson is that it is crucial that the standard of necessary proportionality be incorporated in a future public sector law.

[The Vice-Chair, Liberal, Iqra Khalid]

Thank you very much, Mr. Kurek.

If the committee doesn't mind, I'll ask a very brief question from the chair.

Monsieur Therrien, given your experience through all of this, are there any recommendations you would make to a future privacy commissioner as to how to work better with government and how to really address the issues of how digital governance and technology really impact privacy for Canadians? Also, is there any advice you would give to Canadians with respect to how they can proactively protect their own privacy in that digital space?

[Daniel Therrien]

I've actually started a number of activities during my term for the OPC to not only investigate violations after the fact but also to give advice to companies and departments as they design programs to ensure that those programs comply with the law.

We've already started quite a few engagement activities with government departments, and they are more and more popular among government departments. I would encourage the new commissioner to continue on that path. It is unquestionably much better to think about privacy protection—it's the privacy by design concept—early in the development of a program or initiative than at the end, obviously. We have started discussions, and we would encourage further discussions.

By the way, these discussions will hopefully provide better knowledge of privacy principles on the government side. On our side, it provides a better grounding of operational realities within which our privacy principles are to be implemented. It's a good and useful two-way conversation to have. I'm not saying it's always that meaningful and useful, but that could be one improvement to be made. We should continue these engagements to ensure that there's a true dialogue between the regulated entities that engage with us, and to be really conscious and aware of the context within which departments operate.

For Canadians, “Stay alert.” My overall thought is that given the complexity of new technologies and business models, I'm not expecting people to read 50-page privacy polices to protect their privacy. That's why a regulator is not a panacea, but it is really fundamental and essential. It will not solve the problem by itself, but it is really important that citizens have an expert body like the OPC to look after them, have their backs, and protect them.

Yes, there are certain measures that can be taken, but there is a very important limit nowadays to how people can actually protect their privacy.

[The Vice-Chair, Liberal, Iqra Khalid]

Thank you very much.

Next, we have Monsieur Lemire.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Madam Chair.

Mr. Therrien, I hope you will remain active and continue to serve the public interest, perhaps as a professor, who knows? I would like to see what happens next.

In closing, I would like to hear from you about the integrity that your mandate as Privacy Commissioner requires. I would therefore like to ask you the following question very directly.

What would you like to add today to everything that has already been said?

[Daniel Therrien]

I think the level of understanding and knowledge about the issue of privacy among the population is better now than it was eight years ago. That's one of the things I'm quite proud of. I don't claim that people are experts in privacy, far from it, but privacy used to be seen as an issue for experts, for technologists or for people who are maybe not quite on earth. Now we see that privacy is connected to the exercise of fundamental rights: democracy, in the case of Cambridge Analytica, surveillance, in the case of Clearview AI and Tim Hortons, etc.

Privacy is important, and I think people understand it better. It's a bit confusing, but people have a better understanding. It may bring some behavioural changes in the population. I hope it will especially lead to people putting more pressure on elected officials to pass the laws needed to protect them.

I don't think any consumer is asking for the right to have more privacy policies to read in order to be able to give consent. I believe that citizens want to participate in the digital economy and receive digital services from government in a secure manner, knowing that laws have been passed to protect them and that public bodies have been appointed to ensure that their rights are respected.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

This is not trivial.

Thank you very much.

[The Vice-Chair, Liberal, Iqra Khalid]

Thank you very much.

Last, but not least, we'll have Ms. Collins. Please go ahead.

[Laurel Collins, NDP, Victoria, BC]

Thank you again.

Reflecting on your past eight years, what do you see as the biggest challenge you faced, and what advice would you give to members of Parliament to support the next privacy commissioner?

[Daniel Therrien]

I think the biggest challenge is the appeal of new technologies. They can be very helpful and useful to society and to companies. Some companies have become extremely profitable. They provide very helpful services, but because new technologies are appealing and cheap to use, we forget that they also create harms. It is essential that the laws and how they are applied continue to facilitate responsible innovation, but reintroduce the idea that it should not be the wild west, that the Internet is not an unregulated place. It needs to be properly regulated, but it needs to be regulated in a way where, again, the rights we have acquired over the years, if not centuries, like privacy, are not set aside because technology is so easy, appealing and profitable.

[The Vice-Chair, Liberal, Iqra Khalid]

Thank you very much.

I'll take the opportunity now to thank you, Monsieur Therrien, for his service and for coming here today to answer our questions. On behalf of this committee, we wish you all the very best.

Mr. Williams, I see that you have your hand raised.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Chair, I just have one quick question, if you would allow me, as we have Mr. Therrien here for the last time.