Information & Ethics Committee on Aug. 8th, 2022

[Matthew Green, NDP, Hamilton Centre, ON]

Mr. Chair, I'd just like to request that, with the time remaining, the committee go back to its practice in first round in terms of the order and time allocations.

[The Chair, Conservative, Pat Kelly]

At the end of this round, I was going to canvass the room to see if there was interest in continuing and having additional speakers. I can see there is such an interest. I thought that, after concluding three full rounds, I'd check first, but we do have the commissioner for another half hour, so maybe just give me a quick show of hands to see who would be interested in another speaking round.

I think what I will do is proceed as Mr. Green has suggested. I'll take four more speakers, and I'm going to cut it to five minutes each. Let's just do five each.

I see Mr. Bezan, Mr. Villemure and Mr. Green. I haven't seen any hands up yet on screen. Now I see one. All right, Ms. Khalid, I'll have you up, and I'll maybe just go in the regular order and have Mr. Bezan go first for five followed by Ms. Khalid, Monsieur Villemure and Mr. Green.

Go ahead, Mr. Bezan.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Thank you, Mr. Chair.

Going back to Commissioner Dufresne, I am concerned that there hasn't been complete transparency here, never mind concerns around the issue of privacy. When you look at the track record of this committee's work, we've started down the mobility data avenue, and the Public Health Agency of Canada and the Minister of Health never went directly to the Office of the Privacy Commissioner to get advice. There was some information sharing, but there was never an ask for input from the Privacy Commissioner's office.

When we studied facial recognition technology, it was after the fact that we learned about Clearview and how they're using artificial intelligence, and the shortfalls in monitoring, and it was only after it became public that police agencies in Canada decided to quit using FRT from Clearview, in particular, and now we are here talking about ODIT and software companies like NSO that has the Pegasus spyware. You have all of these, as they've been described: mercenary data companies that are out there selling this not just to police agencies but also to other governments with access worldwide.

Are you not concerned that, as the RCMP, CSIS and other government agencies are using this commercially available technology, it could fall into the wrong hands, never mind the privacy breaches that can occur with the use of that technology here in Canada?

[Philippe Dufresne]

I think privacy breaches are always something that we have to be guarding against, and my office should be informed of them when they occur, and the more sensitive the information an organization holds, the stronger the protection should be in terms of those breaches. That's fundamentally important.

I think the potentially highly intrusive nature of these tools warrants that they be looked at from a privacy standpoint. Whatever the tool is, it needs to be looked at from its impact and needs to be looked at in terms of proportionality and minimal use, and, if there's a risk of private sector use, well, that has to be looked at within that context of private sector use, which is going to have far different justifications from the public sector in terms of law enforcement.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

As we look at the use of ODIT and look at the Pegasus software system in particular, the U.S. found that it was being used by malign actors and other foreign state actors within the United States. Do you have concerns of that potentially happening here as well?

The U.S. Congress has banned the use of Pegasus in the United States.

[Philippe Dufresne]

From what I see in the reports about the use of software like Pegasus directed at citizens without authorization, these are concerning allegations. This is something that, if it occurred in Canada, would certainly raise concerns.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Again, this comes down to trust in our institutions—between Canadians and the RCMP, Canadians and Parliament, Canadians and government agencies. When we had this question on the Order Paper returned, the RCMP said they'd used ODIT 10 times. Now, as referred to by one of the Liberal members, we have a letter from Commissioner Brenda Lucki to our committee. They're now saying that it's been used 32 times, yet they refuse to follow this committee's request for information on the details of the warrants that were used. The warrants are under all different aspects of the Criminal Code and our charter rights, so we have to be concerned about how it's being used that way.

Also, the RCMP refuses to disclose whether they are using this type of spyware here on the Hill, against parliamentarians, against our staff or against departmental officials.

How do you feel about the RCMP...? Again, the yardsticks keep moving. They refuse to comply with Parliament's supremacy here in getting information and are withholding critical information that this committee has requested, which would also help inform your office on how ODIT is being used in Canada.

[Philippe Dufresne]

I think these are questions that could be asked of the RCMP members. My focus is with respect to my office's role being consulted on the privacy impact assessment. I look forward to seeing that at the end of August. I would have liked my office to have seen that already, but, looking forward, we will review it, and we'll provide our best advice to ensure that this properly takes into consideration the privacy of Canadians.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Thank you.

[The Chair, Conservative, Pat Kelly]

Thank you.

Now we have Ms. Khalid for five minutes.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you, Chair.

On the line of questioning by Mr. Bezan, I've heard multiple times now from that members opposite that there's a lack of transparency in this whole process with the RCMP and on who's being surveilled. There are suggestions being made that MPs are being surveilled, that the general public is being surveilled.

I know you said this before, Mr. Dufresne, but I'll ask you again. Do you have any evidence or indication that this is the case?

[Philippe Dufresne]

I don't have any evidence that this is the case. I look forward to receiving the information on the use of those tools at the end of August.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Do you think that it would be right for you or your office to review the work of a judge signing off on a warrant for an investigation by the RCMP?

[Philippe Dufresne]

No. What I'm talking about with privacy impact assessments is really looking at the program as a whole at a macro level—not looking at an individual decision made in an individual case. Rather, it would be looking at the process. What are the criteria? What are the safeguards that could be put in place?

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you.

I think my colleague also spoke about private organizations and the way they are selling technology. For example, the Awz group is selling technologies sold by our former Prime Minister Stephen Harper. Should he be allowed to sell that technology, which is so invasive, so intrusive? Should there be limits on who he should be able to sell it to?

[Philippe Dufresne]

There is private sector privacy legislation, which raises these types of issues in terms of collection and use by private organizations. Again, the specific privacy-intrusive tools are going to be looked at differently, whether they're used for purely commercial purposes or for a public interest purpose by law enforcement authorities.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you.

Mr. Chair, do I have time left?

[The Chair, Conservative, Pat Kelly]

Yes, you have at least a couple of more minutes. You have close to three minutes.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you.

Mr. Dufresne, I know that we've talked about this before with respect to the PIAs striking that right balance. In your opinion, are there any missing pieces or gaps within how that PIA would strike that right balance that we are trying to achieve to increase transparency and accountability of government?

[Philippe Dufresne]

I think the PIA process, the way that it's described in the Treasury Board policy and the way it is described in the advice by my office on what we look for in PIAs, is very comprehensive. It balances risk. It looks at situations in their proper context, and it puts the efforts where they need to be put, and it is something that can achieve public interest goals while protecting fundamental privacy rights. I think this is a good tool. It's a flexible tool. It's not something that should be seen as a check or a nuisance. It's something that really helps the decision-making process and makes the program stronger from all aspects. I do highly commend it, and I think it should be something that is done as soon as possible. Mind you, there will be situations where exigent circumstances will prevent that from happening, but the standing point should be, as much as possible, to do that before the program is launched.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Are these conversations that you're having with your provincial and territorial counterparts as well with respect to provincial law enforcement?

[Philippe Dufresne]

We are talking about all issues relating to privacy. We're talking about trends, and we're looking at what to expect in terms of law reform and evolving technology. We haven't spoken about this specific topic.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you.

Those are all of the questions I have, Chair.

[The Chair, Conservative, Pat Kelly]

Thank you.

Go ahead, Mr. Villemure.

You have the floor for five minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Mr. Dufresne, I'm going to ask you the same question my fellow member—