Evidence of meeting #25 for Access to Information, Privacy and Ethics in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was companies.
A recording is available from Parliament.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Dufresne.
Ms. Lapointe and Mr. Hardy, you can ask more questions if you like.
Ms. Lapointe, you have the floor.
Liberal
Linda Lapointe Liberal Rivière-des-Mille-Îles, QC
Thank you very much, Mr. Chair.
I'd like to welcome the two witnesses.
This is all very interesting. When it comes to the government's work on your recommendations, I believe you're hopeful that your recommendations will come to fruition, aren't you?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I am very hopeful. The Minister of Artificial Intelligence has made some public statements where he said work was in progress and that work is needed when it comes to artificial intelligence. It boils down to what I have said, which is that we need to have this innovation and a strong economy while protecting privacy. That is feasible.
Liberal
Linda Lapointe Liberal Rivière-des-Mille-Îles, QC
Thank you.
You talked about your U.K. counterpart earlier. You said you carried out a joint investigation into a genetic data company that received mailed-in tests from people who wanted to learn about their ancestry, and that you reached the same finding, but that in the U.K., the company was fined.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That’s right. It was a global genetic genealogical company, which had experienced a privacy breach. People stole information on millions of people, including 300,000 Canadians. You can imagine what that means. Genetic data are extremely sensitive.
When we receive this type of complaint—in this case, I conducted a joint investigation with my U.K. counterpart—we check whether the company took proper precautions when processing data and if it had sufficient protection mechanisms. Unfortunately, we found the company lacked strong passwords and protection systems, and it was too slow to respond to signs that bad actors were trying to get into their system.
My U.K. counterpart and I had similar findings. However, they have order-making powers and the power to impose fines in the event of such significant violations, and they used those powers. I believe they levied millions of pounds in penalties. On the other hand, I could only make recommendations. It was a pretty flagrant situation. We held a press conference, and I was asked why I had not levied fines. I responded that I did not have the power to impose fines.
Liberal
Linda Lapointe Liberal Rivière-des-Mille-Îles, QC
Did the penalties in the U.K. force the company to move more quickly to take corrective measures?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Indeed, the company agreed with all our recommendations. This shows fine-making and order-making powers encourage organizations to agree with recommendations. Would the company have been that amenable had it dealt with my office only? Maybe. As I said, we can be very persuasive. We criticize organizations publicly and they don’t like that. However, if there are no financial penalties, it’s difficult to persuade boards of directors to spend huge amounts of money to implement recommendations. I believe they need incentives. I think any company executive is going to pay attention to risks, both legal and financial.
Liberal
Linda Lapointe Liberal Rivière-des-Mille-Îles, QC
Earlier, you spoke at length about the best interests of the child, and consent. I know that right now, people are leaning towards not putting up pictures of children because they don’t have the children’s consent. Indeed, young children can’t give consent.
What would you recommend to ensure consent and the best interest of the child when it comes to all the photos on social media?
Also, how can facial recognition and the possibility that it may not end well for these children, who did not choose to be on social media, be taken into consideration?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
All of these examples show why I have made children’s privacy one of my three top strategic priorities. They are vulnerable because sometimes people put their data online without their knowledge or consent. We need to do several things. First, we need to interpret the law in a way that takes their best interest into account. This occurs in family law and across all legal fields in general, but its application when it comes to privacy is still falling short.
For example, it would be a matter of saying that a child’s consent must be informed and age appropriate. In certain cases, parents will give their consent, while in other cases children will give their personal consent. Communication must be tailored to the age of the child. I recently set up a youth advisory council within the Office of the Privacy Commissioner. I will meet with young people aged 13 to 18. I will ask them how they feel, what they want in terms of privacy, and how they use social media.
In short, we need to do more.
Liberal
Conservative
The Chair Conservative John Brassard
Your time is up, but you can ask more questions in the next round.
We’ll now go to Mr. Hardy, who is sharing his time with Mr. Cooper.
You have five minutes, Mr. Hardy.
Conservative
Gabriel Hardy Conservative Montmorency—Charlevoix, QC
I have a fairly simple question, and it ties back to what I asked you earlier about the Chinese government.
Until very recently, China was seen as posing the most significant threat to our country. However, now we’re opening up trade with the country. You work with global counterparts around the world, including Australia and England.
Are you comfortable working with China, should a collaboration come up? Do you have good contacts? Do you feel you can work with China and at the same time trust that security of personal information will be guaranteed in the same way that it is by our counterparts from the U.K., Australia, and maybe even the U.S.?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Canada is very active on the global stage and there are many networks, including the global privacy enforcement network, the G7 data protection and privacy authorities round table, which we spoke about earlier, and the Asia Pacific privacy authorities forum. We work closely with Japan, Korea and Singapore. There are also commissioners in Hong Kong that we work with. I must say that we have productive discussions on privacy and what we would like to see as privacy commissioners.
However, I’ve not had any interactions on privacy with the Chinese government, only with my counterparts. We try to speak with one voice, the strongest voice possible, and this has allowed us to issue a number of statements on privacy. That said, during our investigation into TikTok, for example, we expressed concern that the Chinese government had expanded powers to obtain information from private companies, and we wanted TikTok to state there was a possibility data could be sent to China and made accessible in that context.
Conservative
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes, TikTok agreed to change its policies on that issue.
Conservative
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
Commissioner, let's go back to the government's cybersecurity bill. In addition to not requiring judicial authorization before the minister can order a telecommunications service provider to turn over metadata, subscriber account information, website visits, the location of financial data and other personal data, the bill, as you noted, and those powers do not require that it be necessary and proportionate. The current standard is one of relevancy. Is that correct?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
It's correct for one of the powers. There are a number of powers in the bill. Some—
Conservative
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes.
Conservative
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
It's much more permissive than necessity and proportionality, which is why I've recommended that it be changed to that.
February 2nd, 2026 / 5:35 p.m.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
There's no judicial authorization and no necessary and proportionate standard. We're talking about some pretty significant information and data concerning the privacy of Canadians.
I would characterize it as excuses the government has put forward when privacy concerns have been raised with regard to this bill. It has said there's a lower expectation of privacy with respect to engaging in a regulated activity. That's true. There is a lesser expectation or reasonable expectation of privacy.
I want to confirm that when it comes to the Internet, that is not a regulated activity, is it? In fact, it engages significant privacy expectations.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
In this case, I have not called for there to be a warrant or judicial authorization. I have called and I am calling for a stronger threshold, which should be, in my view, necessity and proportionality.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
Right, but I'm also saying that this is an activity, the use of the Internet, metadata, all of these things, based upon judgments of the Supreme Court, that engage significant privacy expectations. That's a fair statement, isn't it?