Information & Ethics Committee on June 13th, 2022

[Philippe Dufresne]

Thank you for your question.

It is a fundamental one. In one of my previous answers, I said that the right to privacy and privacy issues affect everyone. It affects younger people, older people, people who are fascinated by technology, and even those who are not. There is a lot of potential and innovation involved in this context. However, there are also risks.

It is very important to have a privacy regime in place for private industry. As commissioner, my role would be first to be there to advise Parliament when the next modernization of the private sector privacy legislation comes before Parliament. It all starts with that legislation and the principles that flow from it to address the recommendations you made in your report.

The Privacy Commissioner also plays the role of interlocutor with Canadians, and with private industry as well. It's very important that there be a legal regime and that there be incentives in the right direction. I think we also need to have discussions with the private industry representatives to find out their concerns and realities. It is important that the regime be both practical and easily accessible to Canadians so that they understand their privacy rights and their opt-out rights. It is also important to facilitate access for private industry so that they understand what they need to do. This role of the commissioner was intended whether it was to review codes of practice or to provide advice.

[The Chair, Conservative, Pat Kelly]

I'm going to have to step in.

I'm sorry. It's time to go to Monsieur Villemure.

Go ahead, Monsieur Villemure.

[René Villemure, Bloc, Trois-Rivières, QC]

I would like to reassure my colleague Mr. Fergus: I will continue in the same vein as he did.

Mr. Dufresne, I congratulate you on your appointment. Your curriculum vitae speaks for itself. We are pleased to have you here today.

I would like to touch on a few points.

Many Canadian citizens feel that they are under surveillance and that this surveillance undermines their trust in institutions. What is your opinion on this surveillance?

[Philippe Dufresne]

As was mentioned before this committee, it is important that the regime does not focus exclusively on the notion of consent, that it does not completely leave it up to citizens to inform themselves about these provisions, which are often very complex, to understand them and to say "yes" or "no.”

Canadians need to be reassured by a legal regime based on a fundamental right model. This regime needs to frame certain practices that should not be allowed even if there is consent and others that could be allowed without consent. There is also an element of transparency. Companies and government need to take proactive approaches and do privacy audits. We need to have what is called integrated privacy and better communication about these provisions. That way, Canadians will know what is really going on. Sometimes this concern is well founded, but it can also come from a lack of understanding of what is going on, which leads to doubts and suspicions.

One of the themes that came out of your recent work on mobility was about communicating what was being done, what data was being collected, why it was being collected and how it was being used. There were a lot of concerns.

The recent Tim Hortons investigation raised other concerns of this type.

I think there's a lot of work to be done in terms of the legal regime, communication and education.

[René Villemure, Bloc, Trois-Rivières, QC]

Past events have shown us that companies are still creative and that starting a dialogue with them is a very good idea. However, there will always be things that are legal but not ethical.

In such cases, how proactive do you intend to be in order to keep up with a market that is always in motion?

[Philippe Dufresne]

I think we need to have ongoing exchanges with private industry, but also with citizens, interest groups, and the academic and parliamentary communities.

As for what is legal but unethical, this raises very important questions. If it is legal and unethical, should it continue to be legal? Shouldn't the legal regime be regulating that?

When I worked for the Canadian Human Rights Commission, I interacted with leaders who were acting in good faith and who absolutely wanted to do the right thing. However, they were faced with several legal obligations in this or that area. They had some flexibility, a framework. It was wishful thinking, but it was not legally binding. People set their priorities.

In my opinion, you have to put the incentives in the right place. If all we do is say that this is wishful thinking or an ideal, it is unrealistic to think that companies will necessarily give priority to this rather than to legal obligations that have deadlines and consequences.

[René Villemure, Bloc, Trois-Rivières, QC]

So we need something that is clear.

We recently presented a report on mobility. Commissioner Therrien told us that he had been consulted, but that he had not been involved in the study in question.

The office of commissioner guarantees the citizen's trust in the government. What should we think when the government itself does not consult its own representative in such cases?

[Philippe Dufresne]

In your discussions with Commissioner Therrien, he noted that he had offered his services, but that the government had chosen to use its own experts. I believe that Commissioner Therrien recognized that the government had the right to do that and that his office was not necessarily the only one with expertise.

However, where it becomes important is in terms of this trust. The fact that internal advice was sought has raised suspicions. Will these opinions be as independent as the external ones? This is a role that the commissioner can play, and this was the subject of recommendations in your report. The commissioner can do proactive audits. So he could check that, discuss it with you and then validate what you are doing. I think that would be useful.

[René Villemure, Bloc, Trois-Rivières, QC]

Do you think that the fact that the commissioner was consulted but not involved was due to a lack of credibility on the part of the Office of the Commissioner? Or do you think that it was a prerogative or a right that the government chose to exercise?

[Philippe Dufresne]

I hesitate to comment or to speculate on that, because I was not involved in this file in any way. That said, I think that, with regard to the consequences that were discussed before this committee, we heard several people tell you that it was preferable for the commissioner to play that role. You made recommendations in that regard.

[René Villemure, Bloc, Trois-Rivières, QC]

Since it is still a bit unclear to citizens, what could the Office of the Privacy Commissioner do with regard to privacy education?

[Philippe Dufresne]

A recommendation has been made in this regard under the federal Privacy Act, which has a more explicit mandate on this subject and which already exists under the Personal Information Protection and Electronics Documents Act, for the private sector.

There are a number of tools, but again, you have to be creative. The Office of the Privacy Commissioner publishes a lot of excellent material, but I think we could look at creating an educational model for high school students and younger students, not necessarily for experts or practitioners. I think the Commission d'accès à l'information du Québec has been working on that.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

[The Chair, Conservative, Pat Kelly]

Thank you.

Now we have Mr. Green for up to six minutes.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you very much, Mr. Chair.

I'm going to begin by stating a bit of my disappointment with having Mr. Dufresne here today before us for this appointment, only insomuch as I didn't have a chance, in my very short time, to really pick his brain as the law clerk. He was obviously very capable and well respected around the table and now will be changing roles into this position.

I first want to thank you for your incredible public service under that role. I had the very brief privilege to see you before the Emergencies Act review committee, in which you provided us sage advice with a duty of candour that I expect you will carry on in your role as commissioner.

My friend Mr. Fergus referenced your time at the Human Rights Commission. I'm wondering if you can talk about this, because I heard you call it a “fundamental right”. Can you begin by expanding on why you believe privacy is a fundamental right for Canadians and how, as the commissioner, you would bring a rights-based approach to your work within the privacy commission?

[Philippe Dufresne]

Thank you, Mr. Green, and thank you for your role in the emergencies committee as well. It was a privilege to appear before you in this capacity.

I think that human rights and privacy rights are fundamental. Privacy rights have been recognized in the Universal Declaration of Human Rights at the same time as we had a major recognition of human rights. They deal with aspects that are of fundamental importance—and again, this was recognized, as far back as 1948—for individuals and have a need to be protected from actions of the state. That was the focus in the declaration. We see now in the context of privacy that it's not just vis-à-vis the state, but it's also vis-à-vis the market, and we've used the words “surveillance capitalism”.

Privacy has been recognized. It has been recognized by the Supreme Court as being a fundamental value in a modern democratic state in the Dagg matter in talking about being grounded in physical and moral autonomy and the freedom to engage in one's thoughts, actions and decisions. I think that if this was true in 1948 and it was true in 1997 in the Dagg case, it's certainly true today, where we see even more potential for privacy and for information being shared, collected and obtained without individuals knowing.

It is something that I would be—in my role should I become commissioner—advocating very strongly for. It has been done by the commissioner, Commissioner Therrien. I will certainly continue to do that, and I hope and like to think that I will bring credibility as a human rights practitioner in doing so.

[Matthew Green, NDP, Hamilton Centre, ON]

You referenced PIPEDA, the Personal Information Protection and Electronic Documents Act. Obviously, there's the Privacy Act as well. How do you see your role in providing advice to Parliament on those bills?

[Philippe Dufresne]

I see the role in providing advice in appearing before this committee, in publishing opinions and recommendations, and in engaging with officials, with parliamentarians and with academia. I think one of the discussions that I've seen in the OPC is on greater outreach, perhaps broader outreach, with academia, with practitioners, with citizens, with industry and with the private and the public sectors.

I see a very important role there, but certainly, deciding what will be in the modernized PIPEDA and the modernized Privacy Act is of course the prerogative of Parliament, so it will be for yourselves—this committee and ultimately the House—but as commissioner, I will certainly be doing everything to provide you with my best advice in the circumstances and in ensuring that the new bill that becomes law is rights based and makes sense for Canadians to trust and to participate in the digital economy and to have trust in their institutions.

[Matthew Green, NDP, Hamilton Centre, ON]

Moving forward, and I'm sure you've given this a lot of thought, what are going to be your main priorities during your tenure?

[Philippe Dufresne]

My main priorities are going to ensure that Canadians can have better understanding and better protection. The private sector law has expectations that may come first. Certainly it did with Bill C-11. It would be a priority to ensure that Canadians can participate in the digital economy. Canada's market—

[Matthew Green, NDP, Hamilton Centre, ON]

Do you have more to comment on Bill C-11? I'm glad you brought that up, because it's certainly one that we seem to have gotten bogged down on. I'm wondering if you would share any perspectives on Bill C-11, the former one.

[Philippe Dufresne]

A lot of the comments that have been made by the Commissioner to this committee in terms of looking at de-identified information, looking at a rights-based model, looking at increased powers for the Privacy Commissioner in terms of order-making powers, looking at penalties and the regime therefore, those are important things, as are looking at consent and calibrating to make sure consent is meaningful, looking at proportionality and necessity, and ensuring that certain purposes and certain uses are defined as either not being allowed or being allowed, without consent, but in appropriate cases.

Those are opportunities, again. We have to align them with looking at the international sector, the GDPR, what's happening in Quebec with Bill 64, ensuring there's interoperability and ensuring that we can deal with the private and public sector in a way that's consistent. We've seen, in terms of your study on mobility, these public-private partnerships. We see that more and more, so how do you ensure there is more harmony, that the government can't contract out by using private sector firms and that it's the same protection everywhere?

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

[The Chair, Conservative, Pat Kelly]

Thank you.

Mr. Williams, go ahead for up to five minutes.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you very much, Mr. Chair.

Through you, and to echo the sentiments from the rest of our colleagues, it sounds like we have the right person in the role. Thank you very much for coming today.

I wanted to get a bit more into the old Bill C-11. Privacy is obviously a lot harder to protect these days, because it is digital. You mentioned looking at consent, proportionality and the GDPR. Is there anything else you've seen in your work as a law clerk on the assessment of the old Bill C-11, and how effective it is? Do you see that modelling the GDPR from Europe at this point?