Information & Ethics Committee on Oct. 25th, 2023

[Some hon. members]

Agreed.

[The Chair, Conservative, John Brassard]

We had a lot of crosstalk about TikTok, so we're going to move into our second hour, which is our social media study focused on TikTok.

Mr. Dufresne, if you'd like to address the committee for five minutes, I'd appreciate that. We'll then get into questioning.

Thank you. Go ahead.

[Philippe Dufresne]

Thank you, Mr. Chair.

I'm pleased to now turn to this part of the discussion. I thank the committee for its interest in the ways that social media platforms such as TikTok harvest, handle and share personal information.

The online world brings with it a host of possibilities for innovation and connection, but it also carries potential for significant harm, especially for young people.

As you know, my office, along with our counterparts in Quebec, British Columbia and Alberta, launched an investigation into TikTok in February. We are examining whether TikTok's practices comply with Canadian privacy legislation, and in particular whether it obtains valid and meaningful consent for the collection, use and disclosure of personal information.

We are also looking at whether a reasonable person would consider the purposes for which it handles personal information, in particular children's information, to be appropriate in the circumstances.

This matter is a high priority for my office, especially given the importance of protecting the fundamental right to privacy of young people, who represent a notable proportion of TikTok users. As a result of the ongoing investigation, there are limits to my ability to speak publicly about the company’s practices at the moment.

For that reason, I will focus my remarks today on the privacy principles that underpin my office’s approach to the digital world from the perspective of the privacy rights of children.

Growing up in the digital age presents significant new challenges for the privacy of young people. As children and youth embrace new technologies and experience much of their lives online, we need strong safeguards to protect their personal information, and how it may be collected, used and disclosed. Increasingly, their information is being used to create personalized content and advertising profiles that are ultimately aimed at influencing their behaviours.

Children have a right to be children, even in the digital world. As UNICEF notes in its policy guidance on artificial intelligence for children, young people are affected by digital technologies to a greater extent than adults. Young people are also less able to understand and appreciate the long-term implications of consenting to their data collection. Privacy laws should recognize the rights of the child and the right to be a child. This means interpreting the privacy provisions in the legislation in a way that is consistent with the best interests of the child.

I'm encouraged by statements from the Minister of Innovation, Science and Industry indicating that there is a desire to strengthen children's privacy rights in Bill C-27, the Digital Charter Implementation Act, 2022. My office has recommended that the preamble of the modernized federal privacy law should recognize that the processing of personal data should respect children's privacy and the best interests of the child. I believe that this would encourage organizations to build privacy for children into their products and services by design and by default. I was pleased to hear the minister signalling his agreement with that recommendation.

The law must have strong safeguards to protect children’s information from unauthorized access, and reflect greater consideration of the appropriateness of collecting, using and disclosing their information.

Earlier this month, my provincial and territorial colleagues and I adopted a resolution calling on organizations in the private and public sectors to put the best interests of young people first by, among other things, providing privacy tools and consent mechanisms that are appropriate for young people and their maturity level; rejecting the kind of deceptive practices that influence young people to make poor privacy decisions or to engage in harmful behaviours; and allowing for the deletion and de‑indexing of information that was collected when users were children.

I am happy to see this was included in Bill C‑27.

In closing, it's critical that government and organizations take action to ensure that young people can benefit from technology and be active online without the risk of being targeted, manipulated or harmed as a result. I expect that the findings from our investigation into TikTok will be informative not just for that company but also for other organizations that collect and handle children’s sensitive personal information.

I also look forward to seeing Bill C-27 progress through the legislative process in a way that will provide children and minors with the privacy protections that they need in this increasingly digital world.

With that, I will be happy to take your questions.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne.

Mr. Barrett, you have six minutes. Go ahead, please.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Thanks, Chair.

Thanks very much for continuing your appearance with the committee.

Can you give us more detail about the scope of the investigation and the complaint that you've initiated against TikTok, or concerning the issue of TikTok?

[Philippe Dufresne]

Sure. When we announced the investigation on February 23, 2023, we indicated that this was initiated in the wake of now settled class action lawsuits in the U.S. and Canada, as well as numerous media reports related to TikTok's collection, use and disclosure of personal information. We indicated that the four privacy regulators will examine whether the organization's practices are in compliance with Canadian privacy legislation and, in particular, whether valid and meaningful consent is being obtained for the collection, use and disclosure of personal information.

The investigation will also determine if the company is meeting its transparency obligations, particularly when collecting personal information from its users. We added that an important proportion of TikTok users are younger users, and that given the importance of protecting children's privacy, the joint investigation will have a particular focus on TikTok's privacy practices as they relate to younger users, including whether the company obtained valid and meaningful consent for these users for the collection, use and disclosure of their personal information.

In the course of the investigation, we have now added an element of reviewing whether this was done for appropriate purposes, which is another element of the act. That's now been added to those elements under review.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Has TikTok been co-operating with your investigation and the inquiries you made?

[Philippe Dufresne]

I'll look to Mr. Maguire. My sense is that—

[Michael Maguire]

They have been co-operative.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Does your investigation extend, or have any reach, to their parent company, ByteDance?

[Michael Maguire]

The investigation involves ByteDance as the owner of TikTok.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

The National Intelligence Law was passed by the CCP, the Chinese Communist Party, in 2017. It requires any organization to assist or co-operate with state intelligence work. That's on top of a 2014 law that says relevant organizations may not refuse to collect evidence for an investigation.

Does that cause concern? What assurances are you able to extract from ByteDance that their responsibilities to the Communist dictatorship in Beijing won't supersede privacy requirements here in Canada?

[Philippe Dufresne]

Again, we are focusing on specifically data practices with respect to children's information. We're looking at the safeguards, tools and rules.

There is a provision under PIPEDA that talks about an organization being responsible for information in its “custody, including information that has been transferred to a third party for processing.” They “shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party.”

However, the focus of the investigation here is very much in terms of what ByteDance is doing with the information of children.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Did you watch the testimony from the representatives from TikTok at this committee last week?

[Philippe Dufresne]

I reviewed the transcript.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Is all the information provided in their testimony consistent with the evidence you reviewed as part of the complaint you have undertaken?

[Philippe Dufresne]

I have not looked at it from that standpoint.

The investigation is ongoing. We have not made our findings and we have not drawn our conclusions, so I wouldn't be in a position to draw conclusions on this point, at this stage.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Do you know where Canadian user information for TikTok is stored? Do you know where those servers are?

[Philippe Dufresne]

I think, in the testimony of the TikTok witnesses, they mentioned Singapore, if I remember the transcript I saw.

[Michael Maguire]

I'll simply add that in the context of an investigation, we wouldn't be able to share information that's been provided to us in the investigation at this time. We have the ability to publish a report of findings, and when we have completed our investigation, we would share further information we obtained during it.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

What type of recommendations would you make to Canadians following a report into a platform like this? Can you take us through what your recommendations might look like? You've talked about your recommendations to the entity, but what about to the Canadian public?

It's one thing for you to tell Acme Co., “You ought to do this”, but what about telling the Canadian public what they ought to be doing when interacting with a platform about which you may or may not have identified concerns?

[The Chair, Conservative, John Brassard]

You have to keep it tight. You have 30 seconds.

[Philippe Dufresne]

Sure.

I'll give you an example of what we did with Home Depot. When we made that investigation public, we talked about the recommendations we made to Home Depot, but in doing that—I don't recall whether it was in the report of findings itself, or in my statement—we gave advice to Canadians.

In saying that, ultimately I don't want it to be delegated to Canadians to protect their privacy: The obligation is on organizations. However, there are good tools and practices, and we would certainly take that opportunity.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Would you go so far as to tell Canadians not to use a service or not to use an app, or not to provide their information to a business?

[The Chair, Conservative, John Brassard]

Very quickly....