Information & Ethics Committee on Aug. 9th, 2022

[Daniel Therrien]

It's a daunting question. Yes, if government officials see a vulnerability in a system, they should notify the creator or the vendor of the system of the vulnerability as a principle generally applicable and implemented, yes. That said, encryption is a challenge to law enforcement, so I think I make a distinction between laws dictating the creation of back doors and laws that authorize the police to circumvent encryption through existing vulnerabilities for a certain period, because that may be the only way to actually perform the investigation.

I don't know, frankly, what the best solution is in this regard. I agree with you that there's an obligation to inform the vendor or the creator at some point, but how do the police...? I see what's being done here as less problematic than laws creating back doors, particularly where there's judicial oversight of the system.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Let's talk about that oversight in the remaining time I have.

I'm comforted that the RCMP has said that they've only used this technology via judicial oversight, but of course, it would have been nice if they were more proactive in their disclosure of the use of this. We now have a pattern, I think, when we look at stingrays, Clearview AI and now this spyware technology, and again, we don't know who the vendor is.

Don't you think the Privacy Commissioner ought to be involved? When I look at the RCMP telling us nine out of 10 requests did not receive internal approval, I don't know what that internal approval framework is, quite frankly. I would think if I were responsible for the RCMP, I would proactively engage with the Privacy Commissioner in establishing that internal framework. Would that make sense to you?

[Daniel Therrien]

Yes, absolutely.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

It makes sense to me too.

[Daniel Therrien]

That's what we recommended for facial recognition, which led to the NTOP process. Yes, the OPC should be involved in ensuring that these processes are sound and robust.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Right, because then you have the internal approval framework in consultation with the OPC, and then you have the judicial framework on the back end.

Thanks, Mr. Therrien. I appreciate your public service. Take care.

[The Chair, Conservative, Pat Kelly]

Thank you, Mr. Erskine-Smith.

Mr. Villemure, you now have the floor for two and a half minutes.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Mr. Therrien, would you say the RCMP has developed a privacy culture?

[Daniel Therrien]

The RCMP has a culture of applying the legislation as it stands.

As was said, it's true the RCMP doesn't have particularly extensive privacy expertise. In the past year of my term, I've seen a willingness on the RCMP's part to improve its privacy knowledge, but that's not its initial inclination.

[René Villemure, Bloc, Trois-Rivières, QC]

We're on the right track.

Aren't we?

[Daniel Therrien]

Yes.

[René Villemure, Bloc, Trois-Rivières, QC]

In the last round of questions, Ms. Polsky discussed privacy impact assessments, saying they were something we could do but that ultimately might not produce results.

Do you agree with that statement?

[Daniel Therrien]

That's partly why I encourage you to make it a legal obligation to conduct PIAs and to include the purpose and content of those assessments in the act.

There's a real risk here. In many cases I've seen, the assessments were a purely mechanical exercise, and that serves no purpose. The aim is to ensure that programs and activities are designed to respect privacy and that privacy is a fundamental right. The idea behind an assessment is to be proactive.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Ms. Polsky, in less than a minute, do you think it's time for a public debate on the subject so citizens can form a clearer understanding of what's at stake?

[Sharon Polsky]

Absolutely, and I think Canadians need to be engaged to understand not only what's at stake nationally, but personally. Again, I go back to education, and it's mandatory, because otherwise, they have no option whether personally or in a corporate or government role to take the word of a vendor or someone else, without being able to have critical thought and ask the questions that need to be asked and know if they're getting legitimate answers.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

[The Chair, Conservative, Pat Kelly]

Thank you.

For two and a half minutes, we have Mr. Green.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

I want to go back to the end of my last question. I feel that Mr. Therrien was about to expand on his thoughts around how we can bridge the gap between the policy directives that are instituted under the purview of the President of the Treasury Board with the Privacy Act and all of the boards and agencies, including law enforcement, to begin to build in this culture of the underlying value of privacy as an actual fundamental right.

[Daniel Therrien]

The law is crucial here. We have in Canada policies that promote privacy, but sometimes, frankly, they are a little bit hollow. It's a check box exercise. For PIAs and privacy by design to be meaningful, to recognize privacy as a fundamental right, to ensure there is adequate enforcement, including order making and fines, it means that it is no longer possible for either the private or the public sector to speak the good words without actually delivering on privacy protection.

Policies are good, but they need to be backed up by serious legal standards and independent oversight.

[Matthew Green, NDP, Hamilton Centre, ON]

This is something that we've been kind of circling around at this committee in such a short period of time, responding to the recent use of this particular technology within the RCMP. I think, as you alluded to, it's not confined to that. I think it's safe to say that if the RCMP is using this technology, we're likely to see that the CSE and CSIS levels...although they have different constraints and requirements.

One thing that we didn't touch on was the possibility of the government doing indirectly what it can't do directly. Would you end by commenting on ways in which we might be able to ensure that our government isn't utilizing, even though it might be legal—I would suggest not ethical—unlawful information, unlawfully gained information from our foreign partners within the international security framework with Canadian agencies?

[The Chair, Conservative, Pat Kelly]

Give a very quick answer if you can, because we're out of time.

[Daniel Therrien]

I'll answer with regard to the private sector. In the OPC's investigation of facial recognition, we recommend that the law be clarified, that the government, the state, cannot do indirectly through the use of the private sector what it cannot do directly. I think that's a big part of the answer.

[Matthew Green, NDP, Hamilton Centre, ON]

Thank you.

[The Chair, Conservative, Pat Kelly]

Thank you.

With the final two rounds, we'll have Mr. Kurek for five, followed by Ms. Khalid.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Thank you very much.

Mr. Therrien, are wiretap warrants that are used by law enforcement under the Criminal Code automatically sealed?