Information & Ethics Committee on Feb. 2nd, 2026

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

Thank you, Mr. Chair.

Commissioner Dufresne, the Prime Minister recently struck a deal with Xi Jinping to allow for the import of 50,000 Chinese EVs annually. He did so notwithstanding serious concerns regarding national security and privacy concerns, including audio and video surveillance as well as tracking people's movements. Premier Ford has characterized these EVs as spy vehicles. Others have characterized them in the same way. The U.S. has a functional ban on vehicles that contain Chinese software.

In the face of these very serious concerns that go directly to the privacy of Canadians, did the Prime Minister's Office, the Minister of International Trade or anyone in the government consult with your office about these concerns before striking a deal with Xi Jinping?

[Philippe Dufresne]

We were not consulted about this trade effort with China.

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

Thank you.

About an hour ago in the House, the minister responsible for AI indicated that the government would be tabling updated PIPEDA legislation in the near future.

Have you been consulted about that updated legislation?

[Philippe Dufresne]

Yes, I have. I and my team have been in communications with the department. I am pleased with how those exchanges have gone.

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

Do you expect that PIPEDA, the updated legislation, will give you the order-making power that you said moments ago you need and which you do not have?

[Philippe Dufresne]

That's going to be up to the government tabling the legislation. My expectation and hope is that I've made it very clear to the government that this is one of my top priority recommendations. I need stronger enforcement power. I am optimistic.

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

Okay.

Changing gears a little bit, the Supreme Court, in its jurisprudence in the Spencer decision and the Bykovets decision has been clear that access to personal information or personal data requires prior judicial authorization. Is that correct?

[Philippe Dufresne]

In criminal cases.... In administrative law cases, it wouldn't necessarily be the same.

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

Under the Liberal government's so-called cybersecurity bill, the Minister of Industry has the power to order a telecommunications service provider to collect, retain and share with the minister things such as metadata, subscriber account information, website visits, the location of financial data, among other personal information. Is that correct?

[Philippe Dufresne]

Yes.

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

Constitutional jurisprudence has recognized that metadata such as Internet browsing activity is highly sensitive personal information that is protected by section 8 of the charter, which says, “Everyone has the right to be secure against unreasonable search and seizure.” Is that correct?

[Philippe Dufresne]

That's my general understanding of that jurisprudence. Under my legislation, sensitive information is entitled to higher levels of protection.

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

That's because metadata can reveal a lot about someone's online activities and their personal life, among other privacy issues. Is that correct?

[Philippe Dufresne]

Yes. The Supreme Court, in Bykovets, talked about how much you can glean from this type of information.

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

Bill C-8 does not require the Minister of Industry to obtain prior judicial authorization as a precondition to ordering the collection, retention and sharing of highly sensitive personal information such as metadata, does it?

[Philippe Dufresne]

No, it does not. Again, this is not in a criminal context.

I should say that I appeared before the SECU committee on Bill C-8 and shared my recommended amendments to the bill, which include necessity and proportionality framing for the exercise of those powers.

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

Do you believe there should be a requirement for the minister to obtain judicial authorization? Should it be narrowed, as opposed to as it is currently written, where the minister would have really broad powers to order the collection, retention and transfer of privacy information, which the Supreme Court has been very clear requires judicial authorization?

[Philippe Dufresne]

In my testimony, I highlighted that there is a balancing between the national security objectives. This is where necessity and proportionality become important. In some parts of the bill, I highlighted that you only had necessity or—

[Michael Cooper, Conservative, St. Albert—Sturgeon River, AB]

It would be fair to say that at present it's not fully adequate from the standpoint of protecting Canadians' privacy in this. There's room for improvement.

[Philippe Dufresne]

I've made recommendations on the standard, on information-sharing agreements and also on notification to my office in cases of breaches.

[The Chair, Conservative, John Brassard]

That you, Mr. Cooper.

Ms. Church, go ahead for five minutes.

[Leslie Church, Liberal, Toronto—St. Paul's, ON]

Welcome, Mr. Dufresne. Thank you for once again being at the committee and for all the work that your office is doing to shed light on some of these emerging and concerning privacy issues that we're seeing, particularly with AI and digital tools.

I want to take you in a different and more positive direction. In a lot of the work that I do with seniors, persons with disabilities, families and caregivers, I hear a lot about the challenges of navigating through government systems, between provincial and federal systems, and application processes. One of the things I'm interested in with a modernization effort is how we can better use data to support modern service models, proactive benefit eligibility and simplification of access to services.

Is there anything that you're proposing in this modernization that would help us deliver services better as a government?

[Philippe Dufresne]

I think this is a very important point in the sense that privacy does not and should not stand in the way of the public interest. Data can help with good government service delivery. Data can help even with protecting privacy itself in terms of privacy-enhancing technology.

In part of my recommendations, I'm talking about privacy by design with privacy impact assessment, for example. This is a great tool where, if you have a process where you're going to be sharing information because you need to share it or you're going to use it to make better decisions for Canadians, transparency is important. That assessment is important.

In many cases when I'm asked for my views, I'm not going to say don't do it or don't give the police a tool if it's warranted and if there's a need for it, but I'll ask if it is necessary and proportional. Is it transparent? Have you assessed it?

My recommendations for amendments to both private sector privacy law and public sector privacy law go in that direction. For instance, right now, privacy law for the public sector does not require necessity and proportionality as an assessment. I think it should. I think this would allow for more sharing and use of information, but in a way that keeps Canadians' trust.

[Leslie Church, Liberal, Toronto—St. Paul's, ON]

It safeguards that data and privacy. I would agree with that.

Can I ask you about the work your office has undertaken around a children's privacy code? Can you give an update to the committee as to where that's at and what the next steps are?

[Philippe Dufresne]

Absolutely.

This is another area where law reform would be beneficial because in the previous bill, Bill C-27, which was before the last Parliament, there was an element in there that would create the ability to have codes of practice that I would approve and that would give some protections to organizations, and also some obligations and some predictability.

A children's code would fit very well in that regime. Right now, we don't have that, so the children's code I am working on putting in place is going to be setting out my expectations and my office's expectations to organizations on things like the best interests of the child, making sure that you have privacy protections by default if you're geared to children and making sure that the consent and the information is shared in a child appropriate way.

All of that is under way with consultation with stakeholders in Canada and around the world. A part of that also is the notion of age estimation, age assurance and making sure that you're keeping kids off certain websites like TikTok if they're underage. How do you do that without going too far and taking too much personal information? It's that balance that we want to help reach.