Information & Ethics Committee on May 7th, 2026

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

I just have an offer to make. Tell us the biggest suggestions that you would like to make. You made recommendations, but what would be the summary of our meeting? There were no changes in 2007. There haven't been any since your arrival in 2017, I believe.

You have the floor for the next minute.

[Nancy Bélanger]

There is definitely a need to increase the number of entities that need to be listed to improve transparency. The Lobbying Act needs to be simplified to make it fair and equitable for everyone. Everyone who lobbies would be subject to the same registration criteria. There have to be penalties that are proportionate to the offence, because right now that's not the case. That's all there is to it.

If the act can be simplified, the work of the Office of the Commissioner will be much simpler. Maybe I won't even need to ask for more money to hire more people.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

That's understood.

[Nancy Bélanger]

I hope so.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Thank you, Madam Chair.

[The Vice-Chair, Liberal, Linda Lapointe]

Thank you.

Thank you for being here. I appreciate it.

The meeting is suspended.

[The Vice-Chair, Liberal, Linda Lapointe]

Welcome back, everyone.

I would like to welcome the witnesses for this second hour of the meeting.

I would like to welcome the two witnesses from the Offices of the Information and Privacy Commissioners of Canada: Philippe Dufresne, Privacy Commissioner of Canada; and Marc Chénier, deputy commissioner and senior general counsel.

Thank you for being here.

You have five minutes for your opening remarks.

[Philippe Dufresne, Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada]

Thank you, Madam Chair.

Mr. Chair, members of the committee, thank you for inviting me to discuss the Office of the Privacy Commissioner of Canada’s main estimates for fiscal year 2026-2027. With me today is Marc Chénier, deputy commissioner and senior general counsel.

My office operates in a rapidly changing environment, one in which unprecedented volumes of Canadians’ personal information are being collected and used. Evolving technologies bring opportunities to connect, to create and to innovate. At the same time, technological advances pose new and complex issues for privacy.

In this context, prioritizing privacy is more important than ever. Appropriate safeguards are essential to ensuring that Canadians can benefit from new technologies without giving up their fundamental right to privacy.

Just yesterday, I announced the findings of my joint investigation into OpenAI's AI-powered chatbot, ChatGPT. Through this milestone investigation, conducted with counterparts in Quebec, British Columbia and Alberta, we identified privacy issues and made recommendations that led to improved protections for Canadians' personal information. I expect that the findings will also inform and advance the privacy-protective design of other AI-powered technologies.

As Privacy Commissioner, I continue to champion the protection of privacy in support of responsible innovation, setting the standard for a safer digital world for individuals while supporting innovation, economic competitiveness and Canada's digital sovereignty.

Several factors influence my office's capacity to deliver on our mandate and strategic priorities as effectively as possible. These include, for example, a significant increase in the complexity and volume of our work, fiscal constraints, and reliance on the courts to implement investigative findings.

Over the past year, my office has concluded hundreds of investigations, including several high-profile ones, such as those into TikTok, Google and 23andMe. Earlier today, I released the findings of an investigation into breaches at the Canada Revenue Agency.

The number of complaints received by my office in the last fiscal year has increased by 82%, to more than 6,000 complaints. This rise is also placing increased demand on the OPC’s limited resources.

At the time of writing our departmental plan, I noted that the temporary funding that had allowed my office to reduce investigative backlogs had expired. I am pleased that the government has since approved an extension of this funding for five years, as noted in the spring economic update.

Without permanent funding, however, we will continue to face long-term resource constraints that limit my office’s ability to effectively carry out its mission and keep pace with technological developments.

I welcome the government's recent announcement that it is reviewing the Privacy Act, and I also remain optimistic about movement on private sector law reform. Canada needs modernized privacy laws to reflect this modern world.

In early 2025, I launched a transformation plan aimed at building greater collaboration and cohesion across my office and at streamlining processes to support more integrated, agile and strategic approaches. These changes support my strategic priority of maximizing our impact for Canadians.

The transformation plan includes implementing alternative approaches to full resource‑intensive investigations. This includes promoting compliance strategically and using all the tools at our disposal to better serve Canadians through more timely outcomes.

I also continue to advance my other strategic priorities: addressing and advocating for privacy in this time of technological change, and championing children's privacy.

I am committed to growing the OPC's internal expertise on emerging technologies. Our team has developed an in-house AI that will deepen our understanding of a technology that we regulate while also helping to optimize our work.

To support the children's privacy priority, we've undertaken a number of initiatives, such as establishing the OPC Youth Council, and earlier this week I announced new guidance documents on age assurance.

Collaboration continues to be an important tool that extends well beyond compliance actions. My role as chair of the Global Privacy Assembly and participation in the G7 data protection and privacy authorities round table ensure that Canada is at the table to help influence the direction and future of privacy protection around the world.

At this time of rapid and unprecedented change, prioritizing privacy must be a collective imperative. Trust in how data is handled is an increasingly important factor in how individuals interact with the government, businesses and technology. This is a significant consideration, particularly during these challenging economic times.

I'll be happy to answer your questions.

[The Vice-Chair, Liberal, Linda Lapointe]

Thank you.

Mr. Barrett, you have the floor for six minutes.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Thanks very much.

I appreciate your being here today.

I'm wondering if you can tell us about.... Going one step beyond your report yesterday about OpenAI, there is much conversation about protecting youth on social media platforms or when they are interacting with AI chatbots. Of course, if age limits were put in place, there would need to be a way to verify users' ages.

What concerns do you have, or what risks does that raise? Are there examples, including in the EU or within any EU countries, of digital IDs or digital passports having been compromised by hacks or through other breaches?

[Philippe Dufresne]

Earlier this week, I launched our guidance on age assurance. That is the result of significant consultation with industry, children's groups and like-minded organizations. We list a number of considerations, and really key to those are the protection of privacy, the safeguarding, making sure that platforms are not getting more information than they need and making sure that the measures are appropriate and are being used not to identify individuals but to vet the person's age.

We also set guidelines and factors to consider in terms of when age verification should be used. It would, of course, be based on laws, but in the absence of laws, it's based on risk. It's based on the likelihood of a significant number of children using the site.

In terms of your question of age verification tools and breaches, the European Union recently launched an app, or made it public. In the early days, there were concerns about a hacker being able to go in and defeat the safeguards. That's a reminder that before you launch your product, you need to make sure that you put in place a sufficient safeguard and do testing so that this does not occur.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

I have a couple of other questions.

I want to ask you about Signal, the encrypted end-to-end messaging app, and I want to ask you about TikTok. Before I do, can you tell me what the limitations of use would be for something like Interac, in terms of identifying or providing sufficient age verification?

That's a system that's widely used in Canada. It's tied to bank accounts, which, of course, government ID is used for. It's simple, like a red light or green light being generated through something like banking portals, without having to provide any other identifying factors to the service provider or application.

Would there be anything that would prevent that from being useful in an application to verify the age of users?

[Philippe Dufresne]

I would need to assess the tool technically to see the safeguards and so on.

What you're suggesting is a tool that takes only as much information as it needs and gives only as much information and validation as is needed. This is consistent with the guidance that we're putting forward. You shouldn't be saying, “This is my name and this is my date of birth,” and all of that. You want to find a way to say, “Are you an adult or are you a child?“ and “Are you allowed to use that or not?”

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

What guidance have you issued on the use of Signal specifically?

You're familiar with the application.

[Philippe Dufresne]

We've not issued specific guidance on Signal. I'd have to know the specific concern that you would have.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Are you familiar with the application?

[Philippe Dufresne]

I'm familiar with it, yes.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

In the EU, there have been a string of incidents. There's been a large-scale global cyber-campaign through which Russian-based government-sponsored actors are seeking to compromise the use of this service by government officials in EU countries. If it's not a subject that you're familiar with, we'll move on to the next, but I was curious. This has increased in popular use in Canada. Once people believe something to be secure, their risk aversion to sending sensitive information of course decreases.

Particularly in the company that we're in today, with elected officials.... If you don't have specific guidance, I won't ask you to create it on the spot, but I'm wondering if this is something that you've considered or if it would even be under your purview.

[Philippe Dufresne]

Certainly from a privacy standpoint, if we see concerns related to a specific industry or a specific product, we can issue guidance on it or do investigations, which may lead to findings. If there is a concern discovered about privacy, then there's a role for authorities to flag that.

There can also be concerns on national security aspects, and then it becomes a role for government institutions, either to say that the government and parliamentarians shouldn't use it or to flag those concerns, but I agree with you that if there are known risks, Canadians should be made aware of them.

[The Vice-Chair, Liberal, Linda Lapointe]

Thank you.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Is that my six minutes?

[The Vice-Chair, Liberal, Linda Lapointe]

It's finished for you. I'm sorry.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

We were having such a good time.

[The Vice-Chair, Liberal, Linda Lapointe]

Yes, you can say that.

Go ahead, Mr. Chang.

[Wade Chang, Liberal, Burnaby Central, BC]

Thank you, Madam Chair.

Commissioner, thank you for being here with us.

I have two questions on the main estimates.

Your departmental plan highlights ongoing work related to artificial intelligence, including the creation of internal AI tools. Can you please elaborate on how AI is currently being used in your office and what operational benefits will be achieved by AI?

Also, how will you ensure that its use will remain aligned with privacy and ethical standards?