Information & Ethics Committee on Oct. 25th, 2023

[Philippe Dufresne]

I think institutions and regulatory authorities like ours need to do their job, investigate complaints and verify compliance. If there is no compliance, they should issue orders or make recommendations. I also believe that governments have a responsibility for national security and the security of public servants' information. That's what the Government of Canada has done in this case by talking about the work tools of public servants, tools that deal with very sensitive information. I think this is part of the responsibility of states.

[René Villemure, Bloc, Trois-Rivières, QC]

You talk about national security. However, we associate TikTok with a hobby. We don't think for a moment that it could have an impact on national security when, in reality, it does.

Last week, a TikTok representative was asked if TikTok sold data to the parent company. He replied in the negative, but, all of a sudden, he somehow dropped the words “We share.” In other words, TikTok shares data.

What do you think of this data sharing?

[Philippe Dufresne]

Data sharing, whether paid or unpaid, is targeted. There are restrictions on what can be done in the way of data collection, disclosure and use.

[René Villemure, Bloc, Trois-Rivières, QC]

There is a particular concern that they share data with the parent company, which is still recognized as part of the Chinese communist regime.

[Philippe Dufresne]

In my opinion, this is part of the context that needs to be considered. In the case of sharing, one must check whether it is appropriate, whether it respects legal limits and whether it gives rise to security concerns.

There are various players in the system. Now, it is useful and good that they can publicize, in an appropriate way, such conclusions. This underlines that there are institutions, that they function and do their work.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne.

Mr. Boulerice, you have the floor for six minutes.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you very much, Mr. Chair.

Thank you, Mr. Dufresne, for being with us.

I'll take a brief step back in time. In the last century, when people bought a newspaper in the morning, they felt they were buying a product that gave them news, an account of what was happening in their society. But then someone thought about it and said that the newspaper was actually selling the reader to the person who was buying advertising in the paper. The buyer wasn't who we thought. In those days, a company that owned a lingerie store, for example, and bought advertising in the newspaper generally had no idea who its customers were or even who the newspaper's readers were.

Today, however, with social media, the dynamic is completely different. Indeed, people almost voluntarily provide their personal information to large conglomerates that sell or share this information in order to make huge profits. In other words, citizens provide information free of charge, enabling these large companies to target advertising precisely to their wants, desires and needs. At the same time, this enables large companies, large conglomerates, to reap considerable profits.

You spoke earlier of a consumer or citizen reflex. Do you get the impression that most people around us understand that they are selling themselves for free to the Web giants and social media?

[Philippe Dufresne]

There's an expression that says if it's free, you're the product. That's exactly what you're describing. I think we need to be aware of this. When we buy a product and they ask us our date of birth and tell us it's because they're going to give us a discount on our birthday, that's exactly what's happening. We're given a small discount and that information is used.

It's important to make people aware of this phenomenon so they know, even if they feel it's free, that in some cases they're giving up a fundamental part of their identity, their personality.

We need to be aware of this fact and avoid seeing it solely as an advantage. Indeed, one should not simply sell or trade one's privacy. Even if consent is given correctly, we must always be aware that it is a fundamental part of our individuality. That's an important point.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you, Mr. Dufresne.

In one of his sets, which I won't redo here, Louis-José Houde says that just because he buys a spatula doesn't mean we'll have access to his cell phone.

On a more serious note, in 2019 you did an investigation into Facebook, which is now called Meta. The report included four major findings, which were quite disturbing, namely that Facebook failed to obtain valid consent from not only users, but also from those users' friends or contacts. In addition, measures to protect users' personal information were inadequate. These four findings are quite worrying, given the popularity of this platform.

Since you carried out this investigation and came to these four conclusions, what exactly has happened?

[Philippe Dufresne]

The law doesn't give us the power to issue orders, as we've discussed. What the law does allow us to do is to go to the Federal Court, re-argue the case before the Federal Court of Appeal and ask them to issue the order that we recommend. So that's what's been done.

The Federal Court dismissed our application after hearing it and concluded that the claim had not been established. We then appealed on the two fundamental issues you identified, namely consent—there are several levels of consent to protect data—and security measures.

I announced this appeal saying that it dealt with issues important to Canadians. We were not satisfied with the Federal Court's decision, and we wanted the Federal Court of Appeal to be able to rule on this issue. We are waiting to argue before the Federal Court of Appeal and we will then get a decision.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Based on what you understand and what you know, do you believe that Facebook's practices, or Meta's, represent the exception in the world of social media? Are they more representative of the behaviour of these large companies?

[Philippe Dufresne]

I hesitate to generalize, especially when it's a specific case that's before the courts. However, I can say that when we draw conclusions, if there is a case for broader conclusions, we do so.

I expect social media to be aware of the decisions we make. If it's a specific case, I always invite organizations to review their practices and, if they have similar practices and we've found them to be a violation, it's up to them to correct them.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Boulerice and Mr. Dufresne.

Before we proceed to the next round, I have had a request. I want you to consider this request. I'm not asking for consideration now, but I will ask at the end of the meeting.

As I mentioned at the onset of this particular round, there was some discussion about TikTok in the last hour. The request is to have some of that information extracted and placed into this report, which is relevant to our study on TikTok.

I see that Mr. Barrett is not here. He has stepped out for a second. That's why I want to give you a bit of a notice to consider this.

Ms. Gladu, you have five minutes. Go ahead, please.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Thank you, Chair, and certainly I think it would be a good idea to incorporate that data.

I want to continue on the questions about Meta, because the government made 2,859 requests to Meta between January and June of 2022 to restrict access to content. Do you know if any of those requests were related to concerns about privacy or about where the data might be going?

[Philippe Dufresne]

I'm not aware of that. I don't have information on that, unfortunately.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Very well. Let me go on to TikTok, then.

One of the concerns is that ByteDance might be sharing data, so you're looking into the situation. How would you verify what they say? How are they going to show that they're actually doing the protections that are required by law?

[Philippe Dufresne]

There are a number of tools in the act in terms of site visits or in terms of requests for documentation. We have a technical lab at the OPC, so we're looking at technical tools to be able to do the investigations and obtain the information we need.

I don't know if Mr. Maguire has anything to add in terms of general investigative tools.

[Michael Maguire]

We also have the ability to interview, including under oath, as well as to visit the site to require the production of information or documents or things. We have the ability not only to ask questions but also to ask that those be sworn and, finally, to verify through testing, either remotely or on site.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

That's excellent.

What about the concern with cyber-breaches? I know you indicated in the earlier hour that there have been fewer reported cyber-breaches within the government, but there is a suspicion that perhaps there is under-reporting. What about breaches of people's personal data from these various social media platforms? What can you tell us about the situation there?

[Philippe Dufresne]

In our annual report, we've provided statistics for both the public sector and the private sector.

In the context of the public sector, the overall comment was that we find the level of reporting low. It feels as though it must be higher than that in reality, so we're curious about that and we're flagging it.

In terms of the private sector, we've seen increases as well in terms of breaches. We have received notifications of those breaches and we are in contact with organizations when they occur. This is something that is a big focus because of the privacy harm this could do to Canadians.

Michael, do you have some statistics?

[Michael Maguire]

I don't have statistics, but I would add that what we have seen are examples of scraping of users' data from social media in cases like those of Clearview AI and Profile Technology before that. We found those to be unauthorized scrapings.

With our 11 international counterparts from six continents, we issued a joint statement on data scraping and directed that to social media companies, asking them to discuss how they comply with the expectations we identified in that statement. We continue to engage with those social media companies to get a sense of the best practices and potentially to make recommendations to improve protection against scraping of information off their platforms.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

That's excellent.

In terms of the complaints you received, you said they were up 37% overall. What percentage of those are related to social media platforms, and has that percentage or distribution changed over time?

[Philippe Dufresne]

I'll ask my colleague for the specific statistics.

We have them in the annex of the report, listed by department, in terms of the public sector. As well, we are listing, in terms of—

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

It's okay if you want to just make sure you send the reference to that to the clerk, and it can be distributed.

I have a final question. I'm running out of time.

What would you recommend this committee recommend to the government to do to better protect the privacy of Canadians?