Evidence of meeting #5 for Access to Information, Privacy and Ethics in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was good.
A video is available from Parliament.
Liberal
Greg Fergus Liberal Hull—Aylmer, QC
In your opinion, how long will it take your office to complete a proper assessment and determine whether or not the government has been able to protect Canadians' personal information?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We received complaints at the very end of 2021, about two months ago. We referred questions to the appropriate departments a few weeks ago, but we're still waiting for their responses. I wish I could tell you that we will be able to conclude the investigation while your study is under way, but I don't think we possibly can.
As I told you, we still haven't received a response from the departments. I don't mean to imply that the responses are late. It's just the normal course of events. In the months following the completion of your study, we will be able to close the investigation.
Liberal
Greg Fergus Liberal Hull—Aylmer, QC
Mr. Therrien, I want to say again that I greatly appreciate your work and that of your office. I certainly respect your professionalism. Having said that, if it takes several months to determine whether data has been de‑identified, in your opinion, does that explain why the government decided to bring in other experts in the field?
The pandemic had an impact on everyone and the government needed to come to a conclusion. This was an unusual situation.
Conservative
Liberal
Conservative
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
In a formal investigation, if we had been consulted, we could have made conclusions based on information that, I would remind you, the government still hasn't provided to us. In addition, in an investigation, you have to hear from both the complainant and the respondents, which draws out the investigation.
Conservative
René Villemure Bloc Trois-Rivières, QC
Thank you, Mr. Chair.
Had the Privacy Commissioner been given the choice, he would have stepped in? Am I right?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
As I mentioned earlier, we offered our advice, but the government decided to seek it elsewhere.
Bloc
René Villemure Bloc Trois-Rivières, QC
Very well, thank you.
In this whole thing, I'm much more interested in where the data came from than where it ended up. You stated earlier that it was virtually impossible to get informed consent from the people whose data was used.
In your view, can presumed consent replace informed consent? I don't mean under the law, I mean proper consent.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
In this case, I'm going on the premise that consent has a role to play in protecting privacy, but it's unrealistic in today's modern world to expect that all commercial or government use of a customer's data should be subject to consent. That brings us to the concept of consent that is oftentimes implied.
In the event of implied consent, the legal principle is that properly de‑identified data, being something that is entirely possible to do, is simply not personal information under current public sector law. So the government can collect and use it as it sees fit, without having to protect privacy. This is entirely possible, even though we haven't yet reached a conclusion.
Therefore, the rule that seems to apply in this case is that, if properly de‑identified, data is not personal information and consent is not required.
That's one reason we recommend that, even if data is de‑identified, the law should be amended to remain subject to the Privacy Act, so that certain principles apply, even to de‑identified data.
Bloc
René Villemure Bloc Trois-Rivières, QC
All right, thank you.
Do you believe the average cellphone user understands that their data can be used for purposes other than improving networks, for example? I'm not talking about the user knowing this, but understanding that aspect of it.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
No. People aren't fully aware of certain uses.
Bloc
René Villemure Bloc Trois-Rivières, QC
Telus customers could choose to opt out of giving consent. All they had to do was go to the Telus website and do it. Again, they had to know about and understand that.
Should it be made clearer to customers that they are free to opt out?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That essentially amounts to saying that cellphone users were unaware of the practice and therefore were unable to opt out. People can't withdraw consent when they don't know it's an option.
As I was saying, in my opinion, more steps should have been taken by Telus and the government to inform Canadians of how their data was being used.
Bloc
René Villemure Bloc Trois-Rivières, QC
Should this be part of the proposed review of the legislation?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The principle of transparency should definitely be included in the Privacy Act. There should be greater transparency.
Bloc
René Villemure Bloc Trois-Rivières, QC
Do you know of any countries around the world that have transparency principles in place and do a better job enforcing them?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I would say that in Europe, the laws are certainly more stringent. That said, we can provide you with a more detailed answer in writing, if you wish.
Bloc
René Villemure Bloc Trois-Rivières, QC
Thank you. That would be extremely fascinating.
In other words, even if the letter of the law or the regulations allowed Telus to make such use of customer data, the user would not understand it.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That's right.
As I said in my remarks, I don't think the ultimate solution is simply greater transparency and explicit consent, given that data is used in an extremely wide range of ways, sometimes for good reasons, sometimes for bad.
Therefore, you need objective criteria, covering things like legitimate commercial use and using data to serve the public good, that a regulatory agency would enforce. Consent is important, but a regulatory agency also needs to play a role in properly protecting Canadians, given the complexity of how their data is being used.
Conservative
