Good morning Mr. Chair and members of the committee.
I am pleased to be here today to assist the committee in its study of the device investigation tools used by the RCMP. I am accompanied by my colleague Gregory Smolynec, deputy commissioner, policy and promotion branch.
This study follows media reports and a response to a question on the Order Paper confirming that the RCMP was using technical tools to obtain data covertly and remotely from targeted devices, subject to judicial authorization. The response and media reports also indicated that the RCMP had not consulted my office prior to using these tools.
As you know, as the Privacy Commissioner of Canada, I am responsible for the protection and promotion of the privacy rights of Canadians in the public and private sectors. My office does so by investigating complaints, providing advice to government departments and private sector organizations, reporting publicly on compliance with privacy laws, and promoting public awareness of privacy issues.
When I appeared before you in June to discuss my proposed appointment as Privacy Commissioner, I indicated that I would have as my vision the following three elements: privacy as a fundamental right; privacy in support of the public interest; and privacy as an accelerator of Canadians' trust in their institutions and in their participation as digital citizens.
Applying these elements to the committee’s study generally, I would say the following.
Privacy as a fundamental right means that all institutions, including the RCMP, should have privacy as a key consideration when designing and deciding to use any technology that could have adverse impacts on the privacy of Canadians.
Privacy in support of the public interest means that by considering privacy impacts at the front end and by consulting with my office, organizations can prevent privacy harms at the outset and indeed improve the tools that will be used to further the public interest, whether it be the prevention of crime, the protection of national security, or the advancement of Canada’s competitiveness. Privacy and the public interest go hand in hand, they build on and strengthen each other and Canadians and their institutions should not have to choose between one or the other.
Privacy as an accelerator of Canadians’ trust in their institutions and in their participation as digital citizens means that when organizations such as the RCMP consider privacy impacts at the front end and are seen to be doing so, this generates trust and reassures Canadians about the necessity of the tools and the measures put in place to mitigate privacy impacts and ensure proportionality between the measures and the objectives.
In terms of specific background to your study, I would start by saying that the Privacy Act does not require the RCMP or any government institution to prepare privacy impact assessments, or PIAs, for my consideration, but the Treasury Board requires it in its policies. I hope to see this included as a binding legal obligation in a modernized version of the Privacy Act.
As you know, the RCMP recently indicated that it had put in place a program to use on‑device investigative tools, or ODITs, and other methods to obtain data covertly and remotely from targeted devices. The RCMP confirmed that these tools could collect private communications such as texts and emails sent or received from the device, documents and media files stored on the device, as well as sounds within range of the device and images viewable by the cameras built into the device.
The RCMP has also stated that the use of these tools is subject to judicial authorization. My office was not informed of, or consulted on, this program prior to its implementation or since. After learning about this through the media in late June, we contacted the RCMP for more information, and the RCMP has since scheduled a demonstration for my officials in late August. In its response to the question on the Order Paper, the RCMP indicated that it began drafting a PIA in relation to these tools in 2021, but we have not yet seen it.
Once we receive the PIA, we will review it to ensure that it includes a meaningful assessment of the program's privacy compliance and measures to mitigate privacy risks. We will also review it to ensure that any privacy-invasive programs or activities are legally authorized and necessary to meet a specific need, and that the intrusion on privacy caused by the program or activity is proportionate to the public interest at stake. This would require the RCMP to consider whether there is a less privacy-intrusive way of achieving the same objective. If we find shortcomings in terms of privacy protections, we will provide the RCMP with our recommendations. We would expect them to make the necessary changes.
In conclusion, I would reiterate my hope that the timely preparation of PIAs be made a legal requirement in a modernized version of the Privacy Act. Doing so would recognize privacy as a fundamental right, support the public interest and generate necessary trust in our institutions, such as the RCMP, who are doing vital and important work for all Canadians.
I would now be happy to answer your questions.
