Evidence of meeting #32 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was rcmp.
A video is available from Parliament.
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
Is there any evidence or any indication that the RCMP has used this tool beyond the scope of what's allowed in the Criminal Code? Was there any indication of mass surveillance or anything like that?
Lawyer, As an Individual
I don't have that. I know that the RCMP said yesterday that it's not just a question of just believing them. They told you yesterday that it would be a crime for them to use the tool without judicial authorization and that they do not do that. I accept that.
Liberal
Lisa Hepfner Liberal Hamilton Mountain, ON
Thanks very much.
I'm pretty much out of time, Chair, so I'll cede the floor.
René Villemure Bloc Trois-Rivières, QC
Thank you, Mr. Chair.
Mr. Therrien, thank you for testifying before us once again.
We always appreciate your informed comments.
Yesterday, Commissioner Dufresne said he was surprised to learn the facts, and, unless I'm mistaken, I believe you were too.
The aim of our debate is to preserve the public's trust in our institutions. I believe the Office of the Privacy Commissioner of Canada is one of the leading institutions, one of the preferred institutions, in achieving that end.
RCMP representatives told us they had consulted you. In other studies, we also learned that you had been consulted but were unable to look under the hood, as it were. It seems to me the RCMP consults you on trivial matters so it can say it consulted you but refrains from doing so on other matters.
Am I wrong in saying so?
Lawyer, As an Individual
I think that's a central issue in your study. It may be more complicated than it seems.
Yesterday, you discussed the possibility of amending the act to provide for the conduct of privacy impact assessments, PIAs. That's a legal obligation, and I think it's a very good idea. This obligation currently derives from a Treasury Board standard or policy. It's somewhat vague on when assessments are to be conducted and when the commissioner must be consulted.
Going back to what I said a little earlier, I repeat that the fundamental conditions for confidence are clear legal rules, high legal standards and independent oversight.
Part VI of the Criminal Code provides for all that. It's not as though there aren't any rules; there are rules. Can those rules be improved? Probably.
Yesterday, you discussed a potential improvement: that the RCMP or other federal institutions be required to consult the Office of the Privacy Commissioner and that they have a legal duty to do so. That's a good idea, but if you recommend that it should be a legal obligation, I encourage you to specify the circumstances in which assessments must be conducted. Under the Treasury Board standard, an assessment must be conducted where a new or deeply altered program has an impact on privacy. The RCMP told you yesterday that the fact that it uses this technology in particular is nothing new. You shouldn't focus on the technology, but rather on the violation of privacy. According to the RCMP, there are supporting arguments in this matter. I don't personally agree with that, but I don't think it's an unreasonable position.
I think that, in addition to saying there's a legal obligation to conduct assessments, you also have a responsibility to state in general terms when they must be conducted and for what purpose. That way you can ensure proactively that the act is being complied with. There wouldn't simply be an ex post facto review but also a preliminary examination to ensure statutory compliance. Ideally, you should also recognize privacy as a fundamental right, as Mr. Dufresne suggested yesterday.
Bloc
Lawyer, As an Individual
Do you mean the statutory provisions on privacy?
Bloc
René Villemure Bloc Trois-Rivières, QC
So it's reasonable to believe a review of the legislation might be in the cards.
Isn't it?
Bloc
René Villemure Bloc Trois-Rivières, QC
Yesterday, there was a lot of talk about part VI of the Criminal Code. You know as well as I do that a situation may be lawful but unethical for many reasons. It seems to me it's not enough to address part VI. We have to be able to examine the situation impartially. The impression I got yesterday was that I was being forced to believe the RCMP. We had to believe it.
Do we have to maintain that position, that we must believe the RCMP? If that's the case, does that preserve or increase public trust?
Lawyer, As an Individual
I don't think the situation is the same as in the Clearview AI affair. In that case, the legal framework regarding facial recognition was weak, nearly nonexistent. There was also no oversight by an independent authority.
Part VI provides a legal framework comprising strict standards and independent oversight by the courts. Is that regime perfect and impossible to improve? The answer is no. We have a good starting point.
Lawyer, As an Individual
As a result of that starting point, I believe the public should trust that the RCMP will not commit a crime by using this tool without judicial authorization, as its representatives asserted yesterday. However, it's no doubt possible to improve that legal framework proactively, particularly with regard to privacy impact assessments.
Conservative
The Chair Conservative Pat Kelly
Thank you.
Now we'll move along to Mr. Green.
You have up to six minutes.
NDP
Matthew Green NDP Hamilton Centre, ON
Thank you.
I'd like to continue on getting to the heart of the matter for me, which is about strengthening legal frameworks.
We heard from the Privacy Commissioner earlier in testimony the suggestion that privacy impact assessments should be part of the process. We heard from the deputy commissioner, at least in the documents that we received, that they have a process for onboarding new technology.
Given your past experience in this, and understanding that much of our work as an ethics committee has been chasing situations after the fact in a very reactionary way, what points of legal framework would you recommend to this committee to help close the gap that clearly exists with what is legal, ethical and technological in terms of the rate of advancement of the technology versus the existing legislation?
Lawyer, As an Individual
If we start with the potential amendment that would make it a legal requirement as opposed to simply a policy for departments and institutions, including the RCMP, to proceed with privacy impact assessments, it's a good start.
On this point—and Commissioner Dufresne spoke about the role of the OPC here—I just suggested to Mr. Villemure that perhaps you want to make recommendations, not only on creating a legal requirement but on having a certain definition of what these PIAs are for. I would encourage you to consider the role of the OPC and the role of the courts.
I don't think the OPC should duplicate the role the courts play under part VI of the Criminal Code. I think the OPC's added value to the courts would be to look proactively at a program level, not at an individual case level, the conditions under which the tool would be used and make recommendations to that effect.
NDP
Matthew Green NDP Hamilton Centre, ON
I would tend to agree.
We heard as well, with the Privacy Act coming up, the distinction of language being included in the preamble versus the actual legal framework to provide guardrails.
In your experience, both with the Department of Justice and in the OPC, what recommendations would you provide in the upcoming Privacy Act that would be part of the legal framework that would provide, not just for law enforcement, but more broadly for the protection of this type of use against citizens here in Canada?
Lawyer, As an Individual
I think a preamble is a good idea.
You said yesterday that you would want clear legal standards such as the requirement to proceed with a PIA, and I agree, but a preamble helps set for everyone, including government institutions, how we look at privacy when a privacy impact assessment is made. For a preamble to say that privacy is a fundamental right essential for the preservation of the dignity of individuals, when the RCMP, the health department or whatever institution proceeds with a PIA, they have that important message in mind. It's not a check box exercise—
NDP
Matthew Green NDP Hamilton Centre, ON
It was also determined that it's not legally binding. How would we make legally binding the entrenchment of those rights, as fundamental rights within the framework of the Privacy Act?
Lawyer, As an Individual
The preamble can still be used as an interpretive tool. It's important to have a clear legal standard. Thou shalt proceed with a PIA—that's a clear legal standard, but a preamble, although not executory in itself, is a very helpful interpretive tool to give life to the legal standard in question.
NDP
Matthew Green NDP Hamilton Centre, ON
I'm going to follow a different line now. We've gone from the policy directives and hopefully the recommendations for legislation to what I believe to be an existing gap in oversight, which is what my colleagues have talked about—the police policing the police.
In the sample warrant that was provided, there was a section on interceptions by on-device investigative tools that talked about oral communications intercepted using an ODIT. The monitor who subsequently reviews the communication “must cease reviewing the communication as soon as the monitor determines that no person in paragraph 3a is a party to the communication”.
Essentially, we have the situation set up where this is placed on a device; it's being monitored and we're supposed to take their word for it even though, as described by the RCMP, they have no processes in place for auditing or performance evaluation of the sort. My concern is that, left unchecked, without explicit guardrails as to when and how this can be used, the comprehensive nature of the capture of data seems to be susceptible to unlawful search and seizure of subjects and materials outside of the purview of the warrant.
Do you have any comment on that and the ways we might be able to provide oversight?