Evidence of meeting #26 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was terms.
A recording is available from Parliament.
11:45 a.m.
NDP
Matthew Green NDP Hamilton Centre, ON
Thank you very much.
You're going to be putting together a plan for your department. You're going to be taking steps to pick up wherever Mr. Therrien left off. In doing that planning, what do you see as your biggest challenges?
11:45 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
Thank you.
Of course, I very much look forward to meeting the team and speaking with all the colleagues.
I've looked at the DPR. I think one thing that is top of mind is the fact that, with the extension order for the Privacy Act in July and the expansion of the mandate, there will be an influx of new cases. That is something I know the commissioner has asked for additional funding for. That's going to be something to follow up on.
It has also been stated that, if the new PIPEDA is modelled on Bill C-11—hopefully with improvements based on a lot of the comments made—it, too, would require a doubling of resources, as I think Commissioner Therrien mentioned.
These would be some of the immediate discussions I would have with the team.
Specifically, in terms of order-making power and what kind of structure is needed, Commissioner Therrien talked about adjudicators and so on. Those are some of the elements, as well as making sure the office is prepared to advise Parliament when this bill comes in.
11:50 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
The longer-term—
11:50 a.m.
NDP
Matthew Green NDP Hamilton Centre, ON
With technology where it's at, and with how our legislation seems to get left in the dust whenever there is a new transformation, under Moore's law, what do you see as our long-term challenges for your—
11:50 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
I think long-term challenges will focus on the digital innovations we're seeing, on making sure there is the legal framework and on making sure the OPC has the internal expertise to provide good advice on that, in terms of codes of conduct.
There have been some discussions on de-identification and the prevention of reidentification. What is appropriate? How do you accept it, and what kinds of mechanisms do you need to put in place so de-identification is accepted as such? Are you minimizing the risk of reidentification? This is fundamentally important to ensure there is that framework.
On artificial intelligence, more and more of these decisions are being made by algorithms using information, so how do you address that? There were some elements in the GDPR and Bill C-11 related to algorithmic transparency, understanding how those decisions are made and, ideally, being able to challenge those decisions. From a human rights standpoint, there were concerns raised about profiling, so how do you deal with this technology that is at an accelerating pace?
I think this is one of the challenges. Technology is accelerating very quickly, and legal amendments not as quickly. We need to find ways.
11:50 a.m.
Conservative
11:50 a.m.
Conservative
The Chair Conservative Pat Kelly
I have Mrs. Gallant, followed by Ms. Hepfner. That will take us to the end of two full rounds. We do have additional time, if other members would like it. We may have time for another question, but my intention was to complete the second round. We'll see if we have a motion, at that point, on the issue of the nomination.
With that, I'll now go to Mrs. Gallant.
11:50 a.m.
Conservative
Cheryl Gallant Conservative Renfrew—Nipissing—Pembroke, ON
Thank you, Mr. Chair.
Through you, often we find out about a breach in privacy after the fact, such as the metadata from people's phones that Health Canada purchased from cell carriers to justify the cruel and inhumane lockdowns we suffered through.
Do you see, in your role as Privacy Commissioner, requiring the telecoms and web giants, for example, to obtain pre-approval from your office on metadata before implementing, using or selling the information?
11:50 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
I think this was one of the recommendations in terms of either proactive audits or making sure, when you're dealing with this type of metadata or location-tracking—it was discussed in this committee in the context of the government, but also in terms of a third party—that individuals are aware. What is the information collected? Why is it going to be collected? What is the purpose? It would also be to constrain whoever it's going to be shared with, if anyone. There were concerns about keeping it even within government, or within a department if you're going to share with other departments. How do you proactively provide that information?
I think that's one of the elements. Oftentimes, the information may be there, but the onus is on the individuals to do a lot of digging to find it. I think one of the themes that came out in your report—and I agree—is making it as user-friendly as possible. Make it simple, make it easy to opt out and make it easy to know what is happening.
11:50 a.m.
Conservative
Cheryl Gallant Conservative Renfrew—Nipissing—Pembroke, ON
You don't believe, though, that it should receive your approval prior to being implemented, unless it has the easy opt-in and opt-out.
11:50 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
I'm not sure that it would be necessarily realistic that the OPC, in every single case, provides approval, but there may be certain cases where it is required, so focusing on that.... The more serious it is, of course, I think the more important it will be to ensure that it is vetted, whether it be by OPC or otherwise.
11:55 a.m.
Conservative
Cheryl Gallant Conservative Renfrew—Nipissing—Pembroke, ON
The user would still have the opportunity to use the app or the operating system, or whatever it is that the cellphone covers, if that's what they are signing up for. When they say opt out, they opt out of that aspect of it, but they can still have it, so they are not under any type of duress to sign up.
We also have the case of the Tim Hortons app. Users were told that geolocation functions were only being accessed when they had the app open, but it was later learned that the app was collecting information even when it wasn't open.
Do you see the role of the Privacy Commissioner as having anything, again, to pre-empt such an aspect? In particular with this one, nobody can cash in their points unless they download the app so they say, “Okay, I can't have my points unless I give them access to this information.”
11:55 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
Right. Your last comment, Mrs. Gallant, highlights what was mentioned in this committee in the mobility study as being a culture of “I agree”. It's a culture of clicking “yes” to the policies, because you want to use the technology. I think this is part of making sure that Canadians can use and participate in this digital technology, but not at the cost of their privacy rights.
In the Tim Hortons incident, what came out was that there was a concern in terms of the purposes. There was no legitimate need for all of this information. It was very intrusive in the sense that it kept doing it, even when the app was not in use, and it was doing it very frequently. There was a concern about the consent. Users had not been informed as to how extensive it was going to be, and they didn't understand that it would result in their location information being used in such an excessive way. There were also concerns about the contract clause with the provider being too flexible in terms of how they could use it and in terms of the privacy accountability regime.
I think those are all areas where the Privacy Commissioner, with a proactive audit mandate, could have engaged and had discussions, saying, “Make sure that there is privacy by design here and make sure that there's a privacy impact assessment that's meaningful.”
There's a role for the OPC. There's also a role for legislation in mandating these types of accountability processes.
11:55 a.m.
Conservative
Cheryl Gallant Conservative Renfrew—Nipissing—Pembroke, ON
It would be the OPC or legislation that would need to be put in place to require all the apps that are already out there and, unbeknownst to us, collecting information or having information sold without our immediate knowledge....
11:55 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
The OPC would be able to do certain things based on authorities that it are given under the act. I would start with the act to ensure that, if it is to require organizations to do such things, and if it is to allow the OPC to be auditing it, that would be the place to start.
11:55 a.m.
Conservative
The Chair Conservative Pat Kelly
Thank you, Mrs. Gallant.
Now, for what I think will be our last round, we have Ms. Hepfner for up to five minutes.
11:55 a.m.
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
Thank you very much, Chair.
Through you, I would like to ask Mr. Dufresne what he thinks about the idea of the concept of a single digital identity. There's this idea that we could all have one Canadian national identity and we could have more control over our own information, but at the same time, some people are afraid that it would give the opportunity to have us tracked.
Could you weigh in on that whole idea?
11:55 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
Maybe I should have mentioned that in the answer to the earlier question from Mr. Green, I believe, on future issues to look at. This is a good example. I would want to learn more about the specific technical aspects of it.
You had a discussion, I believe, with Mr. Therrien on that. It came through that there is potential in that. There's potential for it to be a very useful and very effective tool, perhaps more so than SIN numbers and other such things, but there are also risks in terms of privacy.
This is an example where you would want to have a strong privacy impact assessment, ensuring how this is used, how safe it is and how the information is going to be contained. Again, it's reaching that public interest benefit for Canadians but not at the expense of privacy.
11:55 a.m.
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
Thank you.
As a federal privacy commissioner, how do you expect that you would interact and work with privacy commissioners at the provincial level?
11:55 a.m.
Nominee for the position of Privacy Commissionner, As an Individual
I would expect and commit to work very collaboratively with those colleagues who do fundamentally important work, and there are some areas of parallel with PIPIDA. In certain provinces it will be the provincial legislation such as in Quebec, B.C. and Alberta. There's a strong need to collaborate with all of the provincial authorities, and we've seen it. There have been joint investigations whether for Clearview AI or the issue of Tim Hortons. These are good examples.
It is very important not only for the exchange of expertise and knowledge but also in terms of the impact, so I would look forward to continuing that. I look forward to meeting all of them, hopefully, after the confirmation.
Noon
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
Thank you.
Earlier I tried to bring a motion to this committee that looked at the privacy of people working at home. There wasn't enough appetite on the opposition benches to move forward with that study, but there has been evidence that employers are increasingly surveilling employees at home.
With this change in the way our society is functioning, how quickly could your office adapt to upcoming issues like the privacy of people working from home?