Information & Ethics Committee on Aug. 9th, 2022

[Daniel Therrien]

You might be partially surprised by my answer.

I don't think the RCMP is a rogue institution. Currently, they say, and I accept, that they use ODITs only with judicial authorization, and judicial authorization comes with terms and conditions. I do not start from the premise that the RCMP wishes to disrespect these terms and conditions. It may actually be a crime to disrespect the terms and conditions in question because the use of the tool is only lawful if consistent with the terms and conditions imposed by the court.

That said, it might be a good idea to have auditing processes to ensure that the police officer who has to perform the task in question does so in compliance with the court.

[The Chair, Conservative, Pat Kelly]

I'm really loath to do so, but I must interrupt because we're significantly over time with that answer. If you didn't complete your thought, maybe we could incorporate that in another response.

[Daniel Therrien]

No, I completed my thought.

[The Chair, Conservative, Pat Kelly]

It is time to go to Mr. Williams for up to five minutes.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you very much, Mr. Chair.

Mr. Therrien, thank you very much for joining us today.

You were the Privacy Commissioner for eight years. Is that correct?

[Daniel Therrien]

Yes, I was.

[Ryan Williams, Conservative, Bay of Quinte, ON]

In your words, why is the privacy commission an important part of the Canadian government?

[Daniel Therrien]

The OPC plays a number of roles. One of them is to investigate complaints and serve, as I said a few minutes ago, as an independent oversight to the government. The government has to comply with the law. It is assisted by the justice department, whose duty is to ensure that the government acts in accordance within the law, but all of these processes are within the executive branch.

One of the roles of the OPC is to provide confidence and trust to the population by having an independent look beyond the executive branch mechanisms to ensure that laws, and particularly privacy laws, are indeed being respected. It also has a proactive role.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Where I'm going with this, as I think you've mentioned, is that it's about trust.

[Daniel Therrien]

Yes.

[Ryan Williams, Conservative, Bay of Quinte, ON]

It's about instilling trust in Canadians that when we have government and institutions acting in many different ways, they can trust those institutions. Would that be correct?

[Daniel Therrien]

Yes.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Yesterday, as I think you heard as well, we heard from the RCMP and the minister that judges are only giving warrants where needed, that this technology is safe and that we can trust them. They stated they didn't feel they needed to do these PIAs, privacy impact assessments, and we've seen that.

In your opinion, how right is that? Can we just trust government intrinsically? Can we just get rid of the privacy commission? How true are the words they're saying?

[Daniel Therrien]

With respect, I don't think that's an example of “trust us” when they say courts only give the authorizations after review and therefore this is lawful. You say, "trust us". The question of trust depends on two things: a clear and rigorous legal framework and independent oversight. The courts provide independent oversight.

We have a good starting point with part VI of the Criminal Code. Can it be improved? Probably.

The OPC certainly has particular expertise in privacy to bring to bear, and proceeding with privacy impact assessments is most likely a good idea in the circumstances. There is also the the National Security and Intelligence Review Agency, NSIRA, that plays a role and is also an independent oversight body.

You have at least three institutions in total providing a measure of trust: the courts, the OPC and NSIRA, which are independent from the executive branch.

Your study is about, given the intrusiveness of this technology, whether the safeguards should be improved. It may well be that the answer is yes.

[Ryan Williams, Conservative, Bay of Quinte, ON]

In that role, the RCMP mentioned yesterday that sometimes this technology is used in active investigations.

Can you explain, having been in the role for so long, how a PIA protects technology that perhaps may be used in allowing the government to use it in such a way where you're doing an investigation or a PIA? How are you protecting that technology being used in active investigations? What steps can you recommend be implemented to do so?

[Daniel Therrien]

I think that speaks to the fact that there are many players, and each should play its role without duplicating the role of others. The courts have an important role, but the courts are bound by the terms of part VI of the Criminal Code. The Office of the Privacy Commissioner looks at privacy more broadly under its statute, and it can therefore provide additional assurance to the public that privacy writ larger than the Criminal Code will be respected when these tools are used.

Each of these mechanisms has a level of confidence. To put it differently, the fact that part VI exists does not mean that that OPC does not have a role. It does have a role.

[The Chair, Conservative, Pat Kelly]

Thank you.

Now, for up to five minutes, we have Mr. Hardie.

[Ken Hardie, Liberal, Fleetwood—Port Kells, BC]

Thank you very much, Mr. Chair.

Mr. Therrien, this is a fascinating topic. I'm happy to sit in for my colleague Greg Fergus today.

Judicial authorization is required. Is it required for more than just the incidents and the use of technology that we're talking about here? Are there other areas of investigation where judicial authorization is also required?

[Daniel Therrien]

Generally, under the Criminal Code, if there's an invasion of privacy through the use of investigative techniques—wiretaps would be a traditional method—judicial authorization is also required. Search activities, obviously, which do affect privacy, require judicial authorization. There are a number of manifestations of invasions of privacy that require judicial authorization.

[Ken Hardie, Liberal, Fleetwood—Port Kells, BC]

Are you aware when judicial authorizations are provided? Are you given a heads-up that there is activity going on?

[Daniel Therrien]

No, on the basis that courts provide independent oversight, and it's a mechanism that works on its own.

[Ken Hardie, Liberal, Fleetwood—Port Kells, BC]

Are you confident the privacy impacts that the courts assess when they're providing this authorization are reasonably well in line with the terms and conditions that you oversee?

[Daniel Therrien]

I'm confident that the courts apply the law correctly. If there's an error, there are appellate mechanisms to ensure that the law is applied correctly. I think it goes back to part VI of the Criminal Code that sets the standards for the courts having a certain definition of privacy, and the Privacy Act has a broader definition of privacy. The fact that I have confidence that the courts do their job correctly does not mean that the OPC applying a slightly different definition does not have a role as well.

[Ken Hardie, Liberal, Fleetwood—Port Kells, BC]

Notwithstanding the confidence you may have in the courts is there an auditing mechanism that you would be involved in to go back over the authorizations that the courts have provided to see if, in fact, everything is perfectly synchronized?

[Daniel Therrien]

My answer to that would be that the role of the OPC might be to look into how the authorization process worked in individual cases, not with a view to be revisiting what the courts had done—that would be inappropriate—but with a view to determining whether the legislation is sufficient to protect the privacy of Canadians.