Information & Ethics Committee on May 7th, 2026

[Philippe Dufresne]

There are two things on that.

Of course, yesterday I issued my decision on OpenAI and ChatGPT. We had been investigating this, and during that time, I had instructed that we not use the tool during the time of the investigation, other than for the purposes of our investigation.

We have developed our in-house AI tool, called PrivIA, and it's quite contained. It's very safe, and we are taking small steps in terms of how we can leverage this technology and be the best example in saying that we want the safeguards, the use, the efficiencies. We are doing this in a gradual manner, and we hope to expand its use, but for the moment it is very much all in-house.

[Wade Chang, Liberal, Burnaby Central, BC]

Thank you. It's good to hear this.

I see that for 2024-25, your actual resource for indigenous contracts was 10.7%, while your planned target for 2026-27 is 5%. Could you explain the factors behind the figures and how your office approaches indigenous procurement as part of the commitment to economic reconciliation?

[Philippe Dufresne]

I don't have the specific details for you on this answer, but I would be happy to provide them in writing.

We do report on the use and the contracting. There have not been major trends or concerns or anything that comes to my mind at this time. If my team here wishes to advise me before the end of the hour, I can report to you; otherwise, we'll report back to you in writing.

[Wade Chang, Liberal, Burnaby Central, BC]

Thank you, Commissioner.

I want to clarify the apparent contradiction between your findings and those of B.C.'s privacy regulator. Your office says that the matter involving OpenAI has been resolved, while B.C. says it has not. In practical terms, is OpenAI currently operating in violation of B.C.'s privacy laws? If so, what enforcement mechanisms or consequences are available for regulators? What are the implications for British Columbians who are using ChatGPT today?

[Philippe Dufresne]

Those questions would be better answered by my colleague Michael Harvey, who's the Privacy Commissioner for B.C. However, what our report says in terms of their findings is that because of the specifics of their law and the specific definition of “implicit consent” under their law, they were unable to find that the type of AI training being done by ChatGPT, namely the scraping of information on the web, could be justified under that definition. From my perspective under federal law, I found that federal law was more flexible, and it allowed me to interpret the expectations of Canadians and the safeguards being put in place in a way that would allow both the protection of privacy and also the development of that training of AI, so from a federal standpoint, it is now compliant with federal law.

[Wade Chang, Liberal, Burnaby Central, BC]

Thank you.

Commissioner, the review of the Privacy Act comes at a time when Canadians expect both strong privacy protections and modern, efficient public services. In your view, how can Parliament strike a balance between protecting personal information and enabling better service delivery across government?

[Philippe Dufresne]

I think that the government's consultation is a very good start in doing that, because it highlights a number of things. It highlights, first, that you need to have strong and stronger privacy protection. Privacy is going to be the basis for trust, whether for the strong economy, whether for innovation, or whether for government services. That's number one.

Reinforcing things like order-making power, the obligation to report breaches, the obligation to have safeguards and treating privacy as a fundamental right are all key, but the consultation also talks about the need for departments to be able to share more information with each other, in appropriate cases, to deliver better services for Canadians. I think that is something that needs to happen in appropriate cases, with appropriate safeguards.

In some cases you need more flexibility, but as long as you have strong privacy protections, then you have both, and Canadians deserve to have both strong, effective government services and strong privacy.

[Wade Chang, Liberal, Burnaby Central, BC]

Can you speak to the importance of amending the Privacy Act to recognize that privacy is a fundamental right in Canada, underscoring the importance of enabling service delivery and advancing reconciliation with indigenous people?

[Philippe Dufresne]

These are all elements that I agree, with the government, that we have to achieve. We need strong, effective government services. Canadians deserve that.

In terms of how to make sure that the law isn't too strict and forcing Canadians to start over every single time they need to do something, there's perhaps a need for more flexibility there.

You need to take into consideration, as well, the perspective and interests of indigenous people. There's been lot of discussion on privacy, about whether it's only individual rights or whether there should be a collective component to this, and recognize that in the interpretation.

Also, privacy, as a fundamental right, is something that is more important than ever. It is the recognition that privacy has to be protected. It is not something that should be sacrificed in the name of innovation or in the name of the public interest. It's not a zero-sum game, because privacy is what makes us free. Privacy is what enables all of the other fundamental rights that we hold dear.

I think those three pillars are absolutely key.

[Wade Chang, Liberal, Burnaby Central, BC]

Thank you, Commissioner.

[The Vice-Chair, Liberal, Linda Lapointe]

Thank you, Mr. Chang.

Ms. Gaudreau, you have the floor for six minutes.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Thank you, Madam Chair.

It's good to see you again, Mr. Dufresne. I have many questions for you, but I think that we'll get through them.

Let's get back to OpenAI. You were there, and there were four of you. Could you give us an example of non‑compliance that OpenAI denies?

[Philippe Dufresne]

In this investigation, we saw that, when OpenAI first developed its models, it didn't comply with the legislation. It obtained too much information from Canadians—about all of us—through everything on the Internet, social media and discussion forums. All this was used to train the models. They could obtain confidential information, medical information or information about young people.

There was also misinformation and disinformation. The statements made on social media weren't always true, but the responses could give the impression that they were. We found that transparency in this area was necessary and that tools were needed to determine where a response was coming from.

We also found that the consent process wasn't good enough for users and for Canadians in general. Work was needed in this area. This investigation gave us the opportunity to bring all these factors to OpenAI's attention, and we persuaded it to make these changes.

That said, the current tool is quite different from the one originally launched. This is largely in response to our recommendations.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

When you say tool, are you referring to PrivAI?

[Philippe Dufresne]

The tool is ChatGPT model 5.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Okay.

Is OpenAI now compliant?

[Philippe Dufresne]

It's compliant at the federal level in keeping with the recommendations.

It must take certain steps in the coming months, such as making the information more user‑friendly and providing more explanations on certain things. We'll be following up, because it made the commitment to do so. That said, it will be compliant at the federal level.

On another note, given the components of their legislation, my colleagues in the other provinces were unable to find it compliant.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

I would like to digress for a moment.

Have you heard of the CANChat application, or have you analyzed this application that will soon be available to all federal public servants?

[Philippe Dufresne]

We haven't analyzed it yet.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

It's coming, I'm telling you. I think that an analysis would be a good step. I'm concerned about privacy and national security.

I have other questions.

What about your ability to conduct an investigation?

Your current role is mainly to give advice. What are your recommendations for getting the right tools?

[Philippe Dufresne]

I've made a number of recommendations for legislative modernization. Good progress is being made on this consultation for the public sector. We're waiting for a new bill, I hope, for the private sector.

One thing missing is enforcement power. I don't have the power to issue orders or to impose fines. Canada falls far short of the rest of the world in this area. The vast majority of data protection authorities have this power. We don't necessarily need to use this power, but it must be available. To convince companies to invest in solutions, it helps if we can tell them that, if they don't, they're running a financial risk too.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

We're in agreement. I think that a fine amounting to a few thousand dollars, as opposed to a percentage of sales, reduces the incentive to break the law.

[Philippe Dufresne]

Exactly.

Bill C‑27 in the previous Parliament included this possibility. It was a good step, and I hope to see it in place before long.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

We hear you. It's important.

Madam Chair, in 2019, we were far from this. I recommended that we decorrelate our social insurance number. Once again, I feel that our legislative role is obviously out of step with the situation, and this worries me.

Mr. Dufresne, since you're impartial, the greater your powers, the more we members of Parliament can play our partisan games in a different manner.

I see that I still have two minutes left.

We said that the percentage was relevant, and that there are indeed responsibilities.

The commissioner involved in the investigation pointed to OpenAI's co‑operation during the process. Without this co‑operation, would your authorities have had the tools and powers to compel the company to provide the information needed to do their job?

[Philippe Dufresne]

Personally, I certainly wouldn't have had them. I'll give you a concrete example.

This happened during our investigation of Aylo, the company that owns Pornhub. We made recommendations. We said that, for explicit sexual videos, you need everyone's consent. That consent must be explicit, because this information is obviously extremely sensitive.

In terms of sexual videos uploaded without consent, we wanted them to be easily removable.