Information & Ethics Committee on Oct. 25th, 2023

[Philippe Dufresne]

This is why I recommended that I have the authority to issue binding orders, which I do not have under either the private sector or the public sector. What I have is the authority to make recommendations and to make those recommendations public. This is what I have used.

I was pleased to see the response from the public and parliamentarians. There is a question on the Order Paper that was tabled, and there was a statement from Minister Duclos indicating that he had called the president and CEO of Canada Post to reiterate that the protection and preservation of Canadians' right to privacy are of the utmost importance. Following that, Canada Post issued a statement indicating it would conduct a review of its services program to ensure that it lives up to the standards Canadians expect, but that's all I've had.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

That's good.

I hope they do take action on that. When we looked at the Official Languages Act, we found that the Commissioner of Official Languages needed more enforcement powers as well. I think that's a good point to take forward.

I want to follow up on your discussion about the pandemic and some privacy issues there.

Obviously my employer can't share my vaccination status and my doctor can't share my vaccination status, but during the pandemic, every bar and restaurant had a list of everybody who was there and whether or not they were vaccinated. I thought that was a violation of PIPEDA.

Did you comment about this at all in your recommendations?

[Philippe Dufresne]

We made some overall recommendations, mostly towards the public sector. This was my colleague, before my arrival, but certainly there were recommendations in terms of necessity and proportionality, in terms of time limiting and in terms of making sure you were documenting and data minimizing. In the context of our report, we looked at the government's approaches in that sphere, and we applied the necessity of proportionality and made some conclusions there.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Were there recommendations of what to do differently in the future?

[Philippe Dufresne]

There were some recommendations, certainly. There was one breach in the context of ArriveCAN. We made some recommendations there in terms of stronger safety measures for this type of information and for avoiding errors. This was a situation in which there was an error—people were told they needed to isolate when they didn't—so it was about making sure that you maintain good information and that you get rid of bad information.

We made some recommendations sometimes in terms of the objectives. There were some debates sometimes about the objective in this case. Was it to increase vaccination, was it public health, or was it both? There were some recommendations there, and there were some recommendations in terms of documenting and retaining the information about what other options you considered. They were really in terms of the discipline of that process.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Very good. Thank you.

I want to turn my attention to digital technology and Bill C-27.

One concern that's been raised is people worrying about deepfakes, this generative AI that will make anybody look like they're saying or doing things they didn't.

Did you provide any recommendations to the minister or do you have any thoughts on how to fix that?

[Philippe Dufresne]

There are three we made specifically on AI that would help that issue. One was mandating privacy impact assessments whenever you have a high-impact system of AI. That would be one. Doing that, as an organization you would need to ask what the risk to privacy is. What is the risk of these types of deepfakes? How are you mitigating that? There are some proposed provisions in the AIDA, the artificial intelligence data act, that would do that as well.

We recommended great transparency for AI decisions. If a decision is made about you, you can ask for an explanation. If you see something that's strange, like a video of you, and you ask that question, you should get that explanation.

We also recommended collaboration among regulators wherever we can. I've just launched, with the Competition Bureau and the CRTC chair, a digital regulators forum, but there are limits on what we can do. We can't collaborate in investigations, for example. I can do that with the FTC in the U.S. and other countries, but I can't do it in Canada. That's a gap that would be easily fixed, and, in my view, it should be fixed.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne.

Thank you, Madam Gladu.

Mr. Kelloway, you have five minutes. Go ahead, please.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Thank you, Mr. Chair.

Normally I'm on the fisheries committee, so it's a nice change. Obviously, the work we do here is very, very critical.

I have a couple of questions.

When TikTok was here, they appeared to be concerned about the government banning their app on government devices. Was the decision to do that the right one or the wrong one? Can you unpack that for me?

[Philippe Dufresne]

That was a decision that was made by the Government of Canada. The Government of Canada made decisions based on its review, based on the expert assessment of the chief information officer and experts. They made that on the basis of privacy and security considerations. They would be better placed than I would be to discuss this decision.

I have initiated a complaint with my colleagues in Quebec, B.C. and Alberta to look at TikTok's practices in terms of data protection and use, particularly with respect to children. They're different issues. There may be some overlap in certain areas, but they are two separate decisions.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Where do you think those overlaps are?

[Philippe Dufresne]

To the extent that they're privacy concerns from the government in making its decision, and there were some privacy concerns stated, there may be some overlaps there. I'm not involved in that assessment from the government side.

My focus in the investigation will be to look at the data practices, the consent for appropriate purposes, with a particular focus on children and youth, because they are the majority of the users.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

They're the vulnerable users.

Mr. Maguire, do you have any thoughts on that?

[Michael Maguire, Director, Personal Information Protection and Electronic Documents Act, Compliance Directorate, Offices of the Information and Privacy Commissioners of Canada]

I don't think I would add anything, no.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Thanks for that.

I know this is going to surprise both of you, but I'm not a techie. I use Facebook, I use TikTok and I use Twitter.

For parents at home or people at home, Mr. Villemure talked about whether the toothpaste was out of the container, as it were. Is there any advice you can give people who are watching this, or may watch it later, on how to best protect their privacy, based on the work you've done?

[Philippe Dufresne]

I would say a few things. One is that we've issued a declaration with my federal, provincial and territorial colleagues called “Putting best interests of young people at the forefront of privacy and access to personal information”. It's available on our website. We give a number of recommendations and expectations for organizations about making sure that they're protecting children and the best interests of the child and that they're treating their information appropriately.

In terms of what people should do—and that's something we've said in our data-scraping statement with my international colleagues—ask yourself if you are comfortable sharing this much information. Do you know enough about the settings and the protections that are there? Is this something you want to potentially see forever?

In Bill C-27, there's a new proposed section to dispose of information, especially for minors. That's good, but whenever you're putting a picture of your children online, ask yourself if you want to take the risk. Have you put the privacy settings in a strong enough way? Are you sharing this with the whole world? If you don't understand enough about what the organization is doing and you find its privacy policy to be complex, I always encourage everyone to ask the organization.

Ask for more information. When stores ask for your birthday, ask them why they want to know your birthday when you're buying jewellery or any kind of item. Why do they need that information?

It's getting that reflex of not just saying, “Yes, sure, I'll give it to you.”

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Mr. Chair, how much time do I have?

[The Chair, Conservative, John Brassard]

You have 50 seconds.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

I think you touched upon this to some degree, but can you speak in a bit more detail in the time we have about the collaboration and coordination that go on with the other regulatory bodies, particularly law enforcement?

[Philippe Dufresne]

We have exchanges with other regulators, those being the Competition Bureau and the CRTC. We've launched this new digital regulators forum, and the goal is to talk about areas of common interest with privacy components and law enforcement. We have exchanges with the RCMP to discuss issues of new technology and provide our input. We have a government advisory section, so we're always engaged in these types of—

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Are local police involved in that? The RCMP is, yes, but do we deal with the other municipal—

[Philippe Dufresne]

I think it's been mostly with the RCMP, but perhaps....

[Michael Maguire]

Local police fall under provincial jurisdiction.

[Mike Kelloway, Liberal, Cape Breton—Canso, NS]

Thank you.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Kelloway.

It's always solid, Mr. Dufresne. I appreciate that.

That concludes our first hour. What I would like to do is roll right into the next hour and give Mr. Dufresne a second to get his notes together.

I want to make the committee aware that I had a request from TikTok to extend by a week the requirement to provide us with written responses to the written questions. If the committee recalls, it was supposed to be this Friday. They've asked to have until next Friday.

With the committee's consent, I'd like to give them that extension so that we get the answers we need. Is that okay?