Information & Ethics Committee on June 13th, 2022

[Philippe Dufresne]

Some of the concerns that were raised, and there have been lots of comments made by the OPC, including recently to this committee, not necessarily looking back to Bill C-11 but anticipating, in terms of the new iteration, what some of those elements should be. The first one being a rights-based framework, so making sure this is a regime that is not exclusively based on consent and that it recognizes privacy as a fundamental right. Dealing with de-identified information is very important, and ensuring there are prohibitions on reidentification, as well as calibrating to make sure it doesn't fall outside of the law. Dealing with automated decisions and artificial intelligence, all of these new things that weren't present.

There were some discussions on Bill C-11 in terms of whether you needed a tribunal to review the commissioner's decisions in terms of penalties. The OPC took the position that it should not be and that it should be a final decision of the OPC, subject to a judicial review. This is going to be important to look at. I share the concerns in terms of delays, if you add layers of review that just make it longer before you have a final resolution. I share the concerns about the federal commissioner having perhaps less authority than provincial counterparts, but there were some other options that were raised in this discussion as to whether there could then be a direct appeal to the Federal Court of Appeal or a specialized tribunal.

The key point is to ensure that the OPC is able to operate within that regime effectively. There have been discussions in terms of resources. There's a concern that was raised in terms of the new powers or responsibilities for the commissioner to verify codes of practice. The commissioner, I think rightly, raised the fact that, if that's the case, there may need to be some discretion in terms of where you focus that work because, otherwise, it can very quickly take a lot of your resources.

This is something that I did at the Human Rights Commission. We adopted a public interest strategic litigation approach, where we would focus our key resources on the key cases that would have the biggest impact for Canadians, and that was very successful.

[Ryan Williams, Conservative, Bay of Quinte, ON]

That sounds great.

I think the biggest criticism of Bill C-11 in the past has been its ability to stifle innovation as much as protect it. You said earlier to Mr. Bezan that privacy is not opposed to innovation and that we can have both. How do you think we can have both? What do you think is an appropriate balance of privacy and innovation?

[Philippe Dufresne]

I would say it's for the same reason that I don't see human rights as being stifling of innovation or the public interest. These are things that can coexist. It requires collaboration. It may require better understanding and better communication, but I see it as coexisting in the sense that privacy rights that are strong, that are well known and that are practical are going to generate trust in Canadians to be participating in the digital economy.

That's going to be good for industry. It's going to create trust and credibility for the Canadian economy and industry vis-à-vis counterparts in Europe and other markets. It's going to generally send the message that this is supportive of trade and commerce. I do not see those as being opposed.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you very much, sir.

You did talk about the expansion of the role and about the role that you see the Office of the Privacy Commissioner playing in terms of the Privacy Act and PIPEDA. One of my main questions is this: Do these pieces of legislation need real teeth, strong and forceful penalties, to be effective?

[Philippe Dufresne]

I did, and I think I was talking about incentives. I think incentives are important. In terms of the existence of these powers and these penalties, you hope not to use them, but I feel that the fact that they exist gives a greater impact in terms of the views and the positions that are expressed by the OPC. It gives greater incentives in terms of compliance and also in terms of delay. If what you have is a recommendation that then is considered and can be made into an order later on if there's an application to the court, this really adds time to the process. I think we are seeing a trend.

[Ryan Williams, Conservative, Bay of Quinte, ON]

This is the last question, sir. Do you believe your office should be the one enforcing these penalties?

[Philippe Dufresne]

Well, that's up to—

[The Chair, Conservative, Pat Kelly]

It will have to be a yes or no. We're out of time.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Is that a yes or a no?

[Philippe Dufresne]

That's up to Parliament, but I will act accordingly.

[The Chair, Conservative, Pat Kelly]

Thank you.

Ms. Khalid, you have up to five minutes.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you, Mr. Chair.

Thank you, Monsieur Dufresne, for coming in today. We really appreciate your putting your name forward.

Maybe I'll start by asking this. Has the experience of being a law clerk, sitting in Parliament and watching the proceedings happen put you in a unique role to understand and to.... Although you were more reactive in terms of the actions you had to take, in this role as the Privacy Commissioner, do you see yourself being more proactive on the issues that you've outlined as priorities? We hear that a lot of complaints come to the Privacy Commissioner's office. How would you manage resources to be more proactive, if that's the case?

[Philippe Dufresne]

Thank you.

For me, the role of Privacy Commissioner is a combination, in a way, of my experience as a human rights lawyer for the commission and as a counsellor for the House. I think there is an important role in understanding parliamentarians and understanding legislators and understanding laws. There's also the ability to work with multiple parties, with members from all parties with different interests, and to balance that and understand that.

In terms of proactivity, I think as Privacy Commissioner I would be more proactive in terms of expressing views on what legislation should be. As law clerk, I would not typically do that. I would be focusing more in terms of the rights and privileges of parliamentarians. As commissioner, I would view the role, absolutely, as being proactive in terms of promoting, protecting and expressing views, and in terms of the complaints process, ensuring that it is used as effectively as possible—talking about strategic use, focusing on big cases, ensuring that the resources are used as well as they can be, and then ensuring that there is that discretion for the commissioner to have that greatest impact.

That's not to say that individual cases are not important. They are. You have to focus on them, but there's a way of doing both.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you.

We've talked a lot about privacy in the digital era. I think we would be remiss if we didn't also talk about the other side of that coin, and that is the era of disinformation. Do you see yourself as Privacy Commissioner having a role in kind of combatting that disinformation that is spread throughout not only the public but also the private sector?

[Philippe Dufresne]

I do. I think it's incumbent on public officials. Certainly, I would see that for agents of Parliament. I saw the commission as being important to express views to correct the record if misstatements are being made.

It's absolutely essential, of course, to be always fair with the facts. There is a lot of credibility that comes with such positions. I believe it should be used not only to make findings if there's a finding against the government, but if there's a finding to be made in favour of the government or industry, to highlight that something was done in the proper way and to show why. That is also part of generating trust to show that well.

This is consistent with the idea of having proactive audits, in that they can bring reassurance. The goal is not to go in there and necessarily blame or find fault, but to go in, work collaboratively and find solutions. If there is fault to find, if there is resistance and if that ultimate complaint is needed, so be it.

There's real opportunity, as well, to highlight when it is done properly. I think it is important for Canadians to hear that and to hear it from officials.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you.

We are currently studying facial recognition technologies. We heard from a number of witnesses that a moratorium on the use of facial recognition technologies is necessary in order for the government to go forward and protect Canadians' privacy rights.

I wonder what your views are on a moratorium and whether you think it's actually possible. Do you think that, as government, we'd be able to keep up with protecting the privacy of Canadians by way of a moratorium?

[Philippe Dufresne]

I think there may be situations where it's appropriate.

What's important is to have a regime and to have guidelines. I think that's what you've heard from Privacy Commissioner Therrien and others. A joint framework was issued on June 2, I believe that, until there is legislation, here's how it should be done in terms of proportionality, necessity, minimal intrusion and using it in appropriate cases. That is a good document. That is a good starting point in terms of how we deal with the situation now, but there is also a strong call for having a framework.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you very much.

[The Chair, Conservative, Pat Kelly]

Thank you.

Mr. Villemure, you have the floor for two and a half minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

Mr. Dufresne, a number of companies are asking for a legislation that would clearly establish what they can do. Other companies say that this would generate costs and prevent them from doing business.

Our American neighbours have rather minimal privacy legislation, let's just say. What is your position on the ability of large companies to regulate themselves in this regard?

[Philippe Dufresne]

The problem with self-regulation is that it is about incentives. In some areas, there are regulations and obligations. We have seen situations where there have been inappropriate use or problems with perception.

I don't think that self-regulation will give you the confidence that comes with a law regime and that leads to more specific and clearer elements for Canadians.

It's a complex issue and it's a reality that affects us all. We've all seen the examples of Tim Hortons, Facebook, and Clearview AI, which demonstrate that we need a regime in this regard.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

I have very little time left and I'm going to ask another question.

You talked a lot about trust. Trust is found, among other things, in compliance. Is it found strictly in compliance? More broadly, what do you call trust?

[Philippe Dufresne]

Firstly, I think that trust comes from having a clear legal regime based on a law model. So Canadians know that this regime protects them and that the full responsibility to protect themselves in this new world is not delegated to them.

Secondly, this confidence comes from the existence of mechanisms and bodies such as our office. These bodies provide citizens with a clear understanding of what they need to do and the assurance that they are protected in terms of the basics. They also know that companies know their obligations.

We talk about the concept of privacy by design, we talk about creating that culture of privacy. When companies start to set up these programs in a transparent way, communicate their obligations with respect to complaints and meet their obligations with respect to proactive disclosure, that's when you approach a culture of privacy.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

[The Chair, Conservative, Pat Kelly]

Thank you.

Mr. Green, you have up to two and a half minutes.