Evidence of meeting #25 for Access to Information, Privacy and Ethics in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was companies.
A recording is available from Parliament.
Liberal
Leslie Church Liberal Toronto—St. Paul's, ON
These are early days, but are you looking to any of the experiences or lessons learned from the early implementation of age verification in Australia?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We are, and we're working very collaboratively with colleagues from Australia, the U.K. and around the world. We've issued some international statements about what we want to see. We want to see something that has data minimization. We want to see something that is transparent that isn't used for more things than it should be and something that is secure against privacy breaches, all of these. It's really an area where the international community is looking and is working. Australia, quite rightly because of their approach to social media, has had to really accelerate that.
Liberal
Leslie Church Liberal Toronto—St. Paul's, ON
You've mentioned order-making powers as one of the tools you're looking for. Can you enlighten us with the other tools or capabilities that would be useful for your office to take something like a code and make sure that it's enforceable?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We're looking at enforcement-making powers and fine-making powers and also to have monetary consequences in appropriate cases. Again, this is something I don't want to have to use. I want the possibility of this to encourage organizations to invest in privacy.
The other thing is the issue of codes and, if an organization is going to spend money to develop a code and to put in place a program, that costs them money. If you're an SME, even if you're a bigger organization, that's an investment. One of the things we've heard from industry and lawyers is that sometimes they have a hard time selling this to management, because what are they getting from that investment? If they're not getting any kind of regulatory protection, it's a harder sell.
Then what was in Bill C-27 would say, “You develop this code. If it's approved by the Privacy Commissioner, then, when you have a complaint against you, you can point to that code as showing that you were in good faith here.”
It would make it much less likely that you would have a fine or that you even have investigations. To me, that puts the incentive in the right direction. It makes it easier for SMEs and other companies.
Conservative
The Chair Conservative John Brassard
Thank you.
We're way over time, but I did want to give you a chance to respond because it was an important question.
Mr. Thériault, you have the floor for five minutes.
Bloc
Luc Thériault Bloc Montcalm, QC
Thank you, Mr. Chair.
Commissioner Dufresne, in your opening remarks, you mentioned the expanded investigation into the social media platform X and its chatbot. How is the investigation going? Do you have all the tools needed to move it forward quickly?
Based on your discussion with the minister and future legislative intentions, are you going to have more resources to achieve results more quickly?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I'll start with the last part of your question. What I can tell you is that in my public and private discussions, I've made it clear that it's important to have more powers.
This came out very clearly in my investigation into 23andMe, the genetic data company. My U.K. counterpart and I and carried out a joint investigation and we arrived at the same findings. Ultimately, a fine was levied in the U.K., but in Canada, there was only a recommendation.
It's quite clear from this juxtaposition that it's important for me to have these powers, given that it's a matter of fundamental rights. I'm optimistic and I believe this will come to pass but I'm waiting to see what happens.
As far as our investigation is concerned, we will certainly make it a priority. I can't share more insights on the ongoing investigation, but I can say that when we launched the investigation, I expressed concern about this phenomenon and the significant risks it poses to the fundamental right to people's privacy and the rights of young people in particular.
We have the necessary resources, and we will use them to prioritize this investigation.
Bloc
Luc Thériault Bloc Montcalm, QC
In this process, right now, do you think you have enough resources to take this investigation to fruition?
I'm talking about concluding the investigation, as well as the ability to tackle this phenomenon, which is not limited to social media.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes, we have our internal resources.
Of course, we can do with more resources, but we're mindful of limitations in the current context. We are working closely with our international colleagues, and we share expertise and knowledge which we are going to put forward. We use the tools available to us based on the organizations we are investigating.
We do, however, have a problem, as I said, which arises when we complete our investigation, determine there is a violation, and the organization refuses to implement our recommendations. That was the case with our investigation into Pornhub, or Aylo, for example. We asked them to stop publishing pornographic videos without the consent of everyone in those videos. The organization did not agree with our recommendations. I therefore have to take them to court, and that takes time and a lot of resources. That's my concern because, in the meantime, our recommendation has not been implemented, and Canadians are not protected from this type of practice.
Bloc
Luc Thériault Bloc Montcalm, QC
On the distribution of deepfakes, do you have any recommendations now to better regulate this issue?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
In December 2023, my provincial and territorial counterparts and I made recommendations on artificial intelligence in general. However, on deepfakes in particular, we said it was wrong to use deepfakes to manipulate people, for example, to make defamatory statements or to disseminate non-consensual sexual content. There are guardrails on that already.
More recently, my office and the Canadian Radio-television and Telecommunications Commission, or CRTC, the Competition Bureau and the Copyright Board published an analysis on deepfakes from a privacy, competition law, broadcasting law, and copyright perspective. In my world, namely privacy, concerns are related to the use of this technology to manipulate people or to disseminate sexual content without consent, among others. We are also looking into the use of personal data and transparency.
We published that analysis in September and it's a good summary. It also shows that we are collaborating not only with other privacy commissioners in Canada and around the world, but also with other digital content regulators, such as the Competition Bureau and the CRTC.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Dufresne and Mr. Thériault.
Mr. Hardy, you have the floor for five minutes.
Conservative
Gabriel Hardy Conservative Montmorency—Charlevoix, QC
Thank you for joining us again.
Earlier, when you answered a question from Mr. Barrett, you said we don't have the power to force companies like X to provide information on their operating structure or to force them to operate in a certain manner.
What recommendations would you give the government so we can act more quickly to protect the general public?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Thank you for your question.
Indeed, I have the power to ask for information in the course of an investigation, so when it comes to investigation, there is no problem with the law.
However, at the end of the investigation I do not have any powers. I can make a determination that the law has been broken, but I can't order an organization to put an end to an illegal practice, for example.
Conservative
Gabriel Hardy Conservative Montmorency—Charlevoix, QC
Yes, you seemed to imply that in Pornhub's case, for instance. You told Pornhub what it needed to do, but that was a recommendation, and it was therefore not really binding. Ultimately, you use a lot of resources and you conduct research, but in the end, companies do whatever they want.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That is what happened in this specific case.
Fortunately, many of the Canadian companies that we are dealing with agree with our recommendations. We have a talk and then they move forward. However, problems arise when companies disagree. In Pornhub's case, the company refused to implement two recommendations that I believe were essential.
First, we asked the company to make sure they obtain clear and direct consent from all individuals. Indirect consent can lead to non-consensual distribution or revenge porn, for instance, which was the focus of our investigation. Second, we wanted content shared on the company's website inappropriately to be removed quickly and to make it easy for victims to ask for content to be taken down.
The organization has consistently refused to implement either recommendation, and that's why the amendment I requested seeks to ensure I can issue orders that can be enforced right away. People can challenge my decision in court and that's normal and it's part of the rule of law, but there ought to be immediate protection for Canadians.
Conservative
Gabriel Hardy Conservative Montmorency—Charlevoix, QC
These recommendations were shared with the Canadian government, and you are still waiting for them to be implemented.
Have you made other recommendations that are yet to be implemented? The last time you appeared before this committee, you seemed to suggest your office was somewhat underfunded and understaffed.
Do you feel the support and resources you receive align with your goals? In my opinion, your goal is to protect people, and that is not a trivial goal.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
We have made a number of substantial recommendations, which require a new bill. The first recommendation pertains to powers, followed by recognizing privacy as a fundamental right, protecting young people and giving people the right to take down certain information that has been made public. There is also the concept of preliminary assessments as well as the international factor. We need a stricter regime regarding data that leaves Canadian jurisdiction—
Conservative
Gabriel Hardy Conservative Montmorency—Charlevoix, QC
That's the main issue. You raised it earlier, and here it comes again. How many recommendations have been taken into consideration and how many are moving forward? The Carney government took office a year ago. How many of your recommendations are actually being implemented?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I'm waiting to see what will be presented. I don't expect there will be one bill for each recommendation. I think there will be one for the private sector and another one for the public sector. I expect the public sector one to come later, but I will continue to stress the need to act quickly on this subject—
Conservative
Gabriel Hardy Conservative Montmorency—Charlevoix, QC
So far, despite your recommendations, the public is not any more protected than it was a year ago.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
So far, the recommendations have yet to be implemented. I'm still using the tools at my disposal as best I can while working with international partners, but I think there is an opportunity here that Parliament should seize as soon as possible.
Conservative
Gabriel Hardy Conservative Montmorency—Charlevoix, QC
Great.
I'll move on to another subject and talk about the studies you have carried out on artificial intelligence, identity theft, challenges with data monitoring and access to information, and so forth.
A partnership with the government of China to send 50,000 vehicles to Canada was announced recently. We know people spend a great deal of time in their vehicles, from where they have conversations with their families. They use vehicles for travel, and they probably discuss certain matters from within the vehicles. Earlier, you said we lose control of data once it leaves the country.
Do you see any potential risk there to Canadians?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
The transfer of data outside Canada is an issue that needs to be controlled. I don't think we can stop it completely because international trade is based on that. We need to strike a balance between privacy, national security and digital sovereignty while enabling international trade. In this connection, privacy measures are useful because they come with other elements related to consent and transparency.
Do we know what is happening? Are we okay with what is happening? Is it easy to say no? Is it for the appropriate purposes? It's important to verify all of these points with regard to digital vehicles, in Canada and abroad, but even more so when data leaves Canadian jurisdiction.