Information & Ethics Committee on Oct. 25th, 2023

[The Chair, Conservative, John Brassard]

Could that be in 13 seconds?

[Philippe Dufresne]

As legislators you can do a lot to protect the privacy of Canadians by amending public sector and private sector privacy legislation. Those are really ultimately the first tools we use to do our job.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne.

Ms. Damoff, you have five minutes. Go ahead, please.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Thank you, Chair.

Thank you for being here.

I remember someone who had a marketing company saying a number of years ago that people give a lot more of their personal information when they're doing it online versus when they actually talk face to face with a person. That's certainly true on social media too, when you think about the things you're sharing.

Do you think the government should be investing more money in educating Canadians about digital literacy and the privacy concerns that you've expressed? I don't think people think about these things.

[Philippe Dufresne]

I do. I think we should do more at all levels.

This is something I would want my office to do more of. We have a promotion mandate, and we're looking at it and thinking about how we can do that, particularly with respect to children. That was a big part of our internal discussions. I'll be consulting stakeholders as well. I am having lots of discussions with industry and governments and academia about how we can reach out and do more for Canadians to help them understand about their privacy, particularly but not only when it comes to young children.

This resolution that we issued this month with our provincial and territorial counterparts is an effort we have made to state some of the expectations on how you need to protect children's information and how you should do that.

This is a collective effort for government, absolutely, and for schools and teachers.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

I think it should be children in particular, because they're more vulnerable, but I don't think parents think about that when they let their kids go onto social media platforms.

I know we've talked a lot about TikTok today and about kids being vulnerable. Is it just TikTok, or is it all social media platforms, and is it a problem for kids because they tend to be the predominant users of TikTok?

[Philippe Dufresne]

It's a problem for kids because of their greater vulnerability. We've made a number of recommendations in terms of making sure that we're not using these behavioural techniques of nudging. We shouldn't be nudging individuals generally, but certainly not children, into making bad decisions and making bad privacy decisions. There needs to be work on that.

There have been reports on social media being addictive and being addictive for children generally. Sometimes the business model is to try to encourage them to stay longer, because that's what generates more revenues. That has to be taken into consideration with children who have been online more and more during the pandemic, and since then with school. I've seen it and parents have seen it.

We need to adjust to this new reality as parents, children and society as a whole, so that there's a greater awareness of what this means and what their rights are.

Bill C-27 proposes a right to disposal. That's informing.... When I say that children have a right to be children, that's what I'm alluding to. Children do things online. If it stays online forever, then they're treated as adults right from when they're teenagers. It stays forever, and it could be used against them for jobs and so on and so forth.

We need to deal with this. Bill C-27 will deal with it to some extent, but we certainly need to build greater awareness of it as we are living more and more in a digital world. It brings innovation and it brings great things, but we need to be well equipped to deal with it and we need to learn about it. I would hope to see mandatory training in schools early on, so that individuals can get the tools early on.

We'll get these reflexes. We're going to ask questions. We're going to ask why they need this information. We're going to learn to see what a good privacy policy is, and if it's not, we're going to learn how to complain about it so that it could become a good privacy policy in the future.

That way, we're creating ambassadors for privacy everywhere.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

I have only a minute or less left.

Privacy policies come up as very long and as very much stated in legalese. Is there a way that those could be simplified for people before they say “accept”?

[Philippe Dufresne]

Absolutely. They need to be simplified. They need to be shorter and more concise, and they need to get to the heart of it.

Sometimes you have a very long-drawn-out legalistic policy that doesn't really communicate very important things that could be done more briefly. You agree to this and you agreed to sharing it with third parties, including parties outside of Canada. If you agree to this policy, they can make inferences about you and draw conclusions that go beyond what you're giving them. You need to know that. They can guess your age. They can guess a number of things about you.

It's finding that balance in terms of content and conciseness.

[The Chair, Conservative, John Brassard]

Thank you, Ms. Damoff.

Our next speaker is Mr. Blanchette-Joncas, whom we welcome to the committee.

You have two and a half minutes, Mr. Blanchette-Joncas.

[Maxime Blanchette-Joncas, Bloc, Rimouski-Neigette—Témiscouata—Les Basques, QC]

Thank you very much, Mr. Chair.

Good evening to my colleagues and the witnesses who are with us tonight.

My question is quite simple, but the answer can be quite complex.

Can you tell us whether you think a revision of the law is necessary, and explain why?

[Philippe Dufresne]

Yes, a revision of the two laws is necessary. One is under way for the law in the private sector. This is Bill C‑27. This also includes a specific component for artificial intelligence.

A revision is necessary because the law is 20 years old. It's older than social media. We're still applying it, the principles are there, but technology is advancing rapidly. In my opinion, this calls for stronger proactive obligations, for example. We need to force organizations to make basic assessments that they have to disclose to our office; we also need to impose greater transparency, particularly when it comes to artificial intelligence.

The law governing the public sector, on the other hand, is even older. It dates back 40 years. It needs to be modernized and strengthened, because when it was passed, it was really at a time when the impact of data was not what it is today.

[Maxime Blanchette-Joncas, Bloc, Rimouski-Neigette—Témiscouata—Les Basques, QC]

That's right. As you mention, social media didn't even exist when this law was passed.

Can you explain concretely the consequences of having a law that is outdated and doesn't reflect today's reality, in 2023?

[Philippe Dufresne]

Fortunately, the law is based on principles. So we're able to apply those principles to organizations that use and disclose data. That's what allows us to investigate TikTok and ChatGPT.

That said, there are shortcomings: we don't have the power to issue orders or fines.

In the case of organizations making huge profits from data, there is a shortcoming. It may not have been an issue before because companies weren't making so much money from data, but, now, they are.

So there have to be fines. We need to be more proactive. We need greater transparency. Explaining decisions made by algorithms, by artificial intelligence, obviously wasn't a problem. We can regulate this with principles, but there are certain things that become a little more technical. I think that, when it comes to artificial intelligence and algorithmic decisions, our requirements need to be broad enough that they still apply five years from now, ten years from now, to ChatGPT's successors. These requirements must be reinforced.

[Maxime Blanchette-Joncas, Bloc, Rimouski-Neigette—Témiscouata—Les Basques, QC]

Thank you very much.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Blanchette-Joncas and Mr. Dufresne.

For the last intervention, the floor goes to Mr. Boulerice for two and a half minutes.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Thank you.

Mr. Dufresne, in your presentation, you talked a lot about protecting children and teenagers. I'm wondering how we can ensure that the age required to participate in social media is respected. For example, I think you have to be 13 to have a TikTok account and 14 in the case of Facebook.

That said, we all know that there are plenty of youngsters who are perfectly capable of getting around these rules and creating an account anyway.

What's the responsibility of companies and the government to make sure the age requirement is respected? Otherwise, it becomes pretty easy to sign up for social media.

[Philippe Dufresne]

Indeed.

This raises the whole question of online age verification and techniques for determining whether a person is underage or not. This will be important in the context of Bill C‑27, which explicitly grants rights and treats information differently. It's an issue we're looking at, in the privacy field. There's a lot of discussion about it. In fact, the Information Commissioner's Office of the U.K. has issued guidelines on verification tools.

What we're saying, at the Office of the Privacy Commissioner, is that these tools need to be appropriate and not ask for too much personal information. Age verification needs to be managed, but we don't necessarily want to ask for too much personal information to do that. That said, there are ways of doing it and technologies to do it. It's another area where we need to be creative.

Also, it has to be context-appropriate. Some sites may be higher-risk and will require tighter verification. We can think of gambling or pornography sites, for example. Some sites may be less sensitive. Others may be aimed specifically at children. There may be a presumption.

I think this will be part of the implementation of this law. My office will have a role to play in this as it can issue guidelines.

In addition, the bill also provides for the creation of codes of practice and certification programs.

This will encourage organizations to adhere to a series of rules. If they respect them, it will have an effect on the complaints process, which will be beneficial for these organizations. So it will be one more tool. I suspect that the Office of the Privacy Commissioner will be able to work on it, precisely to give these details.

The Office of the Privacy Commissioner also has an advisory mandate. Companies, especially small and medium-sized enterprises, can contact us for answers to specific questions. We're here to help them with questions like these, especially those of a more technical nature.

[The Chair, Conservative, John Brassard]

Very well.

Thank you, Mr. Dufresne and Mr. Boulerice.

Before we go, first of all, I want to thank you, Mr. Dufresne, for being here today. I know a couple of hours is a long time. You were solid, as always.

Mr. Maguire, thank you for being here. You were solid in support.

On behalf of Canadians, I want to thank you for your service to our nation.

My understanding is—I caught up with Mr. Barrett—that there is consent to extract the first hour of TikTok information to put into this study, so we will do that and we will make sure that the analysts do that.

That's it for today.

I want to thank everyone. Thank you to our clerk, our analysts and our technicians.

The meeting is adjourned.