Information & Ethics Committee on May 12th, 2023

[The Chair, Conservative, John Brassard]

I call the meeting to order.

Welcome to meeting number 71 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Today's meeting is taking place in a hybrid format, pursuant to the House order of Thursday, June 23, 2022. Therefore, members are attending in person in the room and remotely using the Zoom application.

Should any technical challenges arise, please advise me immediately. Please note that the meeting may need to be suspended for some time to ensure that all members are able to participate fully in the proceedings.

Pursuant to Standing Order 81(4), the committee will commence consideration of the main estimates 2023-24: vote 1 under the Office of the Conflict of Interest and Ethics Commissioner, vote 1 under the Office of the Senate Ethics Officer, vote 1 under the Office of the Commissioner of Lobbying, votes 1 and 5 under the Offices of the Information and Privacy Commissioners of Canada, referred to the committee on Wednesday, February 15, 2023.

I would now like to welcome the witnesses for the first hour of this meeting. From the Office of the Privacy Commissioner of Canada, we have Mr. Philippe Dufresne, Privacy Commissioner of Canada. From the Office of the Information Commissioner of Canada, we have Ms. Caroline Maynard, Information Commissioner of Canada.

Before we start, there are a couple of things I need to deal with for the committee.

I am going to leave a bit of time after our witnesses leave today, because we have to deal with procedural motions as they relate to the main estimates.

I understand that Ms. Saks has a procedural motion for the committee. It's on an individual, in order to allow that member to have access to the digital binder. Is that correct?

The third piece of information I need to pass on is this: We should have the documents from Madame Fournier, with the exception of two. The first is the timeline, which is going to take some time to be translated. I mentioned to the committee at the last meeting, on the ATIP document—the 160 pages—that the expectation is we may not have those until next week. However, we should have the remainder of the documents today. I've instructed the clerk to release those documents to the committee—as long as they're in context and in a proper timeline—confidentially, at some point. It should be by the end of the day today.

That's the status of the documents. I just wanted to update the committee on that.

Mr. Dufresne, you have five minutes, sir, to address the committee. Please go ahead.

Thank you for being here.

[Philippe Dufresne, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Good morning, Mr. Chair and committee members.

I am pleased to be here today with my colleague Caroline Maynard, Information Commissioner of Canada, to discuss the main estimates for the Office of the Privacy Commissioner of Canada for the fiscal year 2023-24.

As Privacy Commissioner of Canada, I am responsible for protecting and promoting the privacy rights of Canadians in the public and private sectors. In my last annual report, tabled in Parliament in September 2022, I point out that this is a pivotal time for privacy in Canada, and I highlight the important work of my office in this regard.

My office investigates complaints and breaches that have meaningful impacts for Canadians and privacy in Canada. For example, earlier this year, we released the results of our investigation into Home Depot's sharing of personal information with Facebook when their customers opted for an electronic receipt at checkout.

We found this practice to be a breach of privacy law, in part because we concluded that it was unlikely that Home Depot customers would have expected that their personal information would be shared with a third party like Facebook simply because they opted for an email receipt instead of a printed one.

Since issuing our findings, my office has learned of several other retailers allegedly engaging in similar practices. We have reached out to those organizations and are in the process of confirming how they are complying with the expectations flowing from our investigation.

Looking ahead, my office recently announced investigations into TikTok that focus on its privacy practices as they relate to younger users, as well as the company behind the artificial intelligence-powered ChatGPT. Children are less able to understand and appreciate the long-term implications of consenting to their data collection and need even greater privacy safeguards. We can and must do more to protect their privacy. This will be one of my key priorities in the years ahead.

My office also needs to stay ahead of fast-moving technological advances. We need to monitor and research technology so that we can anticipate how it may impact privacy and so that we can promote the technologies that most enhance privacy. This is another of my key focus areas.

My office provides advice to government departments and private sector organizations, publishes reports on compliance with privacy laws, and raises public awareness about privacy issues. In this digital age, the world is at our fingertips, and the price of that convenience is often the disclosure of personal information. That is why it is so important for Canadians to be aware of their right to privacy, to be able to control when and how their personal information is collected, used and disclosed, and to know where to turn for help when they need it.

We also provide advice and recommendations to Parliament on legislative reform and on privacy issues of considerable interest and importance to the public. On that note, I would like to thank the committee for the reports it published following studies on the device investigation tools used by the Royal Canadian Mounted Police and on the use of facial recognition technology.

As I noted in my statements following the release of those reports last year, I welcome the committee's recommendations to improve privacy protections, to ensure that the law recognizes privacy rights as a fundamental right and requires federal institutions to consider and address the impact on privacy from the outset when designing and using new technologies, and to adequately regulate technologies that have an impact on privacy.

My office has an initial operating budget of $29.5 million for 2023-24. We manage these resources optimally to protect and promote the privacy rights of Canadians as effectively as possible.

We are also looking ahead and preparing for law reform. The government took an important step toward modernizing the private sector privacy law with the tabling of Bill C-27, which has been referred to the Standing Committee on Industry and Technology for further study. My written submissions and recommendations to the INDU committee were made public by the committee earlier this week. I'm looking forward to appearing before the committee to discuss this important bill.

I was pleased to learn that in the recent budget, the government proposed temporary funding of $6 million over two years for my office to undertake more in-depth investigations of privacy breaches and to improve response rates to privacy complaints, as well as $15 million over five years to operationalize new processes required to implement the proposed consumer privacy protection act. Should Parliament adopt Bill C-27, it will be essential that my office be properly resourced to fully and effectively take on important new responsibilities, especially those focusing on prevention.

Canadians are more concerned than ever about protecting their privacy. That is why the work of my office is so important.

I look forward to your questions.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne.

Ms. Maynard, you have the floor for five minutes.

[Caroline Maynard, Information Commissioner, Office of the Information Commissioner of Canada]

Thank you for inviting me to speak to you this morning.

I am pleased to report that my office had another record year in 2022-23. During the last fiscal year, my team closed 8,089 complaints. Since the beginning of my mandate in 2018, the annual number of complaints closed by my office has increased by 310%.

This is good news, but it's only a part of the story.

We also saw a record influx of 7,407 new complaints. This represents a 7% increase compared to the previous year. Through my team's extraordinary efforts, we have just managed to keep pace with the growing volume of incoming complaints.

Since these new complaints simply replace the previous complaints that we were able to close, our backlog is slowly decreasing. Despite all the measures taken to improve our efficiency, and considering the growing number of complaints registered, our backlog now stands at approximately 3,400 complaints.

Even if we manage to reduce the number of complaints in the backlog by a few hundred a year, we will not be able to completely eliminate it by the end of my mandate. A lot of the files are very complex. They sometimes involve tens of thousands of pages and numerous exceptions are invoked. At the current rate, it will take us several more years to close all of these files.

I still intend to try to secure temporary funding to tackle this inventory, in spite of the fact that the government turned down my recent request for more resources. This brings me to a topic I raised during previous appearances as well as in a letter I sent to the chair of this committee last week.

On more than one occasion, agents of Parliament have been obliged to submit requests for additional funding through a minister overseeing a department for which the agent has an oversight role. Such requests are currently required to include language on how this will contribute to the government's priorities or other considerations, which should not be the determining factors for granting such funding.

Whether or not these requests are granted is secondary to the real issue. The optics of needing to work through central agencies in order to secure funding may create the appearance of a potential or real conflict of interest in the conduct of my investigations.

One suggestion that I made in the letter I sent to your committee was that your report on the access to information system review include a recommendation specifically addressing the need for an independent funding mechanism for the Office of the Information Commissioner. For some years now, my fellow officers of Parliament and I have been calling for a different funding model in order to be accountable only to Parliament, not to the government of the day.

There is no reason this cannot be achieved. Several other bodies associated with Parliament operate effectively under alternate funding and accountability models. My colleagues would agree that this is not about money; this is a matter of independence and the credibility of our role in our democratic institutions.

We will continue to work together to press for a commitment by the government that it will implement an alternative model that reflects our accountability to Parliament.

Last month, the President of the Treasury Board told this committee that she supports the independence of the Information Commissioner. If the government truly cares about access to information and the independence of officers of Parliament, it should demonstrate it by taking this important step as soon as possible.

That concludes my remarks.

[The Chair, Conservative, John Brassard]

Thank you, Ms. Maynard.

We will now begin the first round.

Mr. Gourde, you have the floor for six minutes.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you, Mr. Chair.

Thank you to both of our witnesses for being here this morning.

I would like to acknowledge your work, Ms. Maynard. You've been before this committee a number of times. When spring arrives in Ottawa, the tulips bloom and you come back to tell us about your work.

There is one word that somewhat bothers me. I was pleased to hear you talk about the independence of your work. In the spring, we learn all kinds of things. On January 23, a letter from the Clerk of the Privy Council was sent to your office. In this letter, which is not long, Janice Charette is asking you, on behalf of the Privy Council Office and pursuant to subsection 6.1(1) of the Access to Information Act, for your authorization not to proceed with certain requests, because the Office is of the opinion that these requests are frivolous. The clerk explains that the individual who made these requests is essentially abuses the right of access and it interferes with the office's operations. Personally, I know that the applicant in question works for a national francophone media outlet.

What bothers me is that you talk about independence, but the Privy Council sends you a letter asking you to authorize it to refuse to examine or work on an access to information request. Is that common?

[Caroline Maynard]

Section 6.1 that Ms. Charette is referring to is a new section of the act, which allows any institution, not just the Privy Council, that receives a complaint or access request that it considers abusive or frivolous to ask me for permission not to respond to it. Such a request is legal and is part of the process put in place following the passage of former Bill C-58.

I can't speak to the request itself because we haven't responded to it yet. However, I can tell you that this process was put in place to prevent institutions from rejecting such requests on their own initiative. They have to ask the Information Commissioner for permission. The Office of the Commissioner then reviews the institution's request and the requester's request to see whether they comply with the wording of subsection 6.1(1).

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Ms. Maynard, I personally find that this kind of letter puts you between a rock and a hard place, the rock being the right of access to information and the hard place being the Privy Council's request to allow it not to respond to a request for information. This practically forces you to examine the complaint in depth. I don't like the situation that puts you in. It's not your fault; you've been put in a really compromising situation.

[Caroline Maynard]

In fact, requests of that nature are exceptional. It is very rare that we accept that type of request precisely for the reasons you raise. The right to access information is a quasi-constitutional right. The request for information truly has to be abusive or frivolous and an abuse of the right of access for our commissioner to allow an institution to decline to respond to a request.

I am glad that there is a lot of jurisprudence on this. We have had this authority for just a few years. Over the past three or four years, out of 30 or so requests for permission to decline a request for information, I accepted maybe five. It is very rare for the request to be extremely abusive.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

This request comes from a national francophone media outlet. It is not Jacques Gourde asking you something about his private life.

Could you explain to Canadians what a vexatious request is?

[Caroline Maynard]

That is when the requester's intention is not really to have access to information. It is when the request is really abusive in the sense that it may constitute harassment or be completely unreasonable. At one point, we received a request involving over one million pages of information and the requester refused to negotiate.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

What I find odd is that the clerk of the Privy Council asks for your approval to reject the request. It asks for your permission to not provide the information requested. It feels like the clerk is putting that on your shoulders. At the end of the day, you are the one who decides whether the information is provided or not. The clerk washes their hands of it.

[Caroline Maynard]

Yes, but that is my role. It is a somewhat judicial role. I have to weigh the arguments of both parties, who, in these cases, have the opportunity to make representations. I am glad that the institutions have to go through my office. This helps limit these types of requests and ensures that rejections apply truly to exceptional cases.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Do you receive this type of letter often?

[Caroline Maynard]

No, it is not common. As I was saying, we have received maybe 30 or so requests for permission to reject a request for access to information. We rarely approve those requests.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

Thank you very much, Ms. Maynard.

[The Chair, Conservative, John Brassard]

You have 45 seconds left.

[Jacques Gourde, Conservative, Lévis—Lotbinière, QC]

I will stop there.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Gourde and Ms. Maynard.

Mr. Fergus, you are next. You have six minutes.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

Could I have the remainder of Mr. Gourde's time?

[members]

Ha, ha.

[The Chair, Conservative, John Brassard]

No, but I could give you a bit more time.

[Greg Fergus, Liberal, Hull—Aylmer, QC]

That is fair. Thank you very much, chair.

I also want to thank the two witnesses for their work as commissioners in their respective fields.

Mr. Dufresne, several governments here and around the world have recently banned TikTok on government devices. Can you describe to Canadians in a very clear way what makes this app so dangerous?

[Philippe Dufresne]

Thank you, Mr. Fergus.

The Government of Canada and others have taken—

[René Villemure, Bloc, Trois-Rivières, QC]

I am sorry. I cannot hear my colleague, who is using the wrong microphone, I believe. His voice—