Thank you very much, Mr. Chair.
Members of the committee, thank you for the invitation to appear as part of your study on the challenges posed by artificial intelligence and its regulation.
Addressing the privacy impacts of the fast-moving pace of technological advancements is one of my strategic priorities. This has also been a significant focus of my domestic, international and cross-regulatory work over the last few years given its rapid and broad adoption by individuals and organizations in Canada and globally.
Privacy is an important and timely issue for Canada. As more and more personal data is being collected, used and shared, data protection becomes increasingly significant for Canadians and Canadian organizations.
The protection of personal information is particularly important in the context of AI, as personal information can be used to train and operate those systems. Recently, I announced an expanded investigation into the social media platform X and its Grok chatbot. The investigation will examine the emerging phenomenon of AI being used to create deepfakes, which can present significant risks to Canadians, including children.
I expect that the results of this investigation, as well as my ongoing investigation into OpenAI, will help to inform privacy and policy direction with respect to AI, and help individuals and organizations to use and deploy these technologies safely and responsibly, and with appropriate protections for personal data.
Investigations by the Office of the Privacy Commissioner in the past two years have demonstrated how Canadian law is able to address major privacy issues that can have serious impacts on individuals.
For example, my investigation into Aylo, which operates Pornhub and other pornographic websites, addressed non-consensual sharing of intimate images. My joint investigation with my U.K. counterpart into the 23andMe breach examined an incident that impacted the highly sensitive personal information of seven million customers, including more than 300,000 Canadians.
Last fall, I announced the result of my investigation with my provincial counterparts into TikTok, which highlighted the importance of protecting children's privacy online. Because of our investigation, the company has implemented, and continues to implement, improvements to its privacy practices in the best interest of its users, especially children.
Technologies such as AI can bring economic, social and public interest benefits. The value of this innovation will be maximized when it is accompanied by trust.
A survey conducted by the Office of the Privacy Commissioner last year found that a significant majority of Canadians are concerned about how their personal information is collected and used—including 83% indicating concern about their privacy when using artificial intelligence tools. Many have taken actions to protect themselves and most indicated that they are less willing to share their personal information with organizations compared to five years ago.
This further underscores the strategic advantage for organizations to develop and deploy AI and other technologies in a responsible, privacy-preserving manner. It is key for developers and providers of AI to embed privacy in the design, conception, operation and management of their products and services and to consider the unique impact that these tools have on children, as well as on groups that have historically experienced discrimination or bias.
Organizations that use AI should be transparent about this use and accountable for any AI generated decisions about an individual, such as whether to grant someone a loan or a job.
As technologies continue to evolve rapidly, and become increasingly integrated into personal and professional lives, it is our collective role as regulators and policy-makers to ensure that privacy is protected for current and future generations. Canada’s privacy laws must be able to meet this challenge, and to do so will require modernization.
With respect to AI, my recommended amendments to Canada's federal privacy laws include recognizing privacy as a fundamental right, as well as establishing requirements to implement privacy by design and to conduct privacy impact assessments for high-impact data processing.
Personal information is at the heart of artificial intelligence, and therefore, privacy legislation should, in my view, be at the heart of AI regulation.
Thank you. I look forward to your questions.