Evidence of meeting #7 for Access to Information, Privacy and Ethics in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was lobbying.
A video is available from Parliament.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
It has privacy implications, in that you're making it easier to obtain the data.
Conservative
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Again, I'm giving in advance the testimony that I will be giving to the committee when called on for that specific bill. Certainly, what we've seen so far is that we would have a preference for it being reasonable belief as opposed to reasonable suspicion in some of those aspects, because of the sensitivity of information. There are areas where the standard, in my view, should be higher.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
The standard would be higher, in your view, in this context.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
It's the standard of reasonable belief as opposed to reasonable suspicion.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
What about the ability for law enforcement to access sensitive personal information? I think you would concede that the information we're talking about here is sensitive personal information. Would you agree with that?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
In many cases it will be. In some cases it may not be, but my point is that if we're talking about that sensitive information, the threshold should be higher. There are appropriate places for suspicion, but reasonable belief when we're talking about sensitive information is critical.
Conservative
The Chair Conservative John Brassard
I'm sorry, Mr. Cooper. That's five minutes. It's just a little over, but not much.
Thank you, Mr. Dufresne.
Ms. Church, go ahead for five minutes.
Liberal
Leslie Church Liberal Toronto—St. Paul's, ON
Thank you, Mr. Chair.
Thank you, Mr. Dufresne, for being with us.
Maybe just to pick up a little on this, could you take a step back for a moment? In your opening remarks, you talked a bit about how some of our frameworks have struggled to keep pace with technological change. I'm thinking in particular about the different provisions that we have in various laws in the Criminal Code that actually empower law enforcement. How are technological changes, like strong encryption, the cloud and cross-border data flows, these new types of technology, putting pressure on the framework that we have right now? What have you heard about some of the need for change?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
It is making the law enforcement work challenging. It brings innovation. It makes certain things easier. It makes certain things harder. I think in the Supreme Court's decision, the court recognized that. It said that it is creating challenges for law enforcement authorities. The court talked about innovation also helping law enforcement authorities in certain instances. You can get a warrant more easily and quickly because of technology. You can get an electronic warrant, and these types of things.
We need to look at the whole context. When I talk about necessity and proportionality, it certainly has to be context-based. Something that was not necessary before may be necessary now because of new technology and new challenges. I think the goal is to make sure that law enforcement authorities have the powers that they need but that they are appropriately challenged and limited. Looking at those criteria, these are the questions: Are we going too far in one direction, or are we going too far in the other direction? It's always a balance. That's the challenging work of legislators and courts.
Liberal
Leslie Church Liberal Toronto—St. Paul's, ON
I'll just pick up a little on that. In terms of thinking about the specific tools that law enforcement might require, do you have concerns about timeliness or about national security and how these interface with the privacy regime? Can you talk a bit about that?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
It's important for privacy authorities and national security authorities to talk to one another, to work together and to work closely with NSIRA, the National Security and Intelligence Review Agency. One of my goals is that we not be at cross-purposes. I don't want privacy to stand in the way of national security or law enforcement. That's why we're working very closely with a number of bodies, not only competition authorities and copyright but also FINTRAC. In terms of money laundering and financial crimes, we work very closely with them and the Department of Finance to create more opportunities for banks to share information to detect fraudulent and modern slavery types of fraud and terrorism financing, subjecting it to codes of practice that are reviewed by my office. In that sense, there is protection of privacy. There is a demonstration that the privacy aspect is considered. At the same time, we're allowing the authorities to have the tools that they need.
Liberal
Leslie Church Liberal Toronto—St. Paul's, ON
You read my mind in terms of where I was headed, which was actually around the uptick that we're seeing in online fraud, online scams and how personal privacy is being misused and abused. Are there ways that we can do a better job of trying to crack down on the illicit distribution of personal information that's allowing bad actors to access personal information and use it in these ways?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Again, it is this collaboration between all players. I work collaboratively, not only with my colleagues, the other privacy commissioners, but also with cybersecurity experts in Canada and around the world. We need to bring all of this together to say what the best practices are and what the challenges are. How do we do it by building privacy in the design while building security in the design? I think cyber-breaches are a great example of how it's a security issue and a privacy issue. We need to work together to make sure that we have the tools we need, that we're not doing things at the expense of privacy and that we're not doing things at the expense of security.
Liberal
Leslie Church Liberal Toronto—St. Paul's, ON
Are there ways in which we could actually enhance the individual's control over their own private information at this stage?
I'm thinking about how we have very little transparency online around what data is being collected, about the right for people to opt out of that data collection, about the right to opt out of it being sold or brokered, and about the right to be able to delete it. Are these issues you see growing here in Canada?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Absolutely. These are issues in almost all our reports. In our recent TikTok report, half of the top issues were consent and information, understanding what information is being used, why it's being used and how much, etc.
I think in the context of breaches, it's also relevant. If you know what you're giving, are you aware of the risks of a privacy breach and the safeguards? We ask questions and we challenge. In the 23andMe joint international investigation I did with the United Kingdom, we challenged the security methods. Do you have multifactor authentication? Do you require strong passwords? Sometimes organizations are doing it with perhaps good intentions. They told us that people don't like complex passwords, because they're challenging and hard to remember. We said we understand that, but they need to insist on those; otherwise, they're exposing themselves to these terrible harms that are sometimes impossible to undo. That collaboration has to happen.
You also mentioned retention. We need to challenge organizations, government and the private sector to not keep information, personal or otherwise, longer than they need to, because that increases the risk.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Dufresne and Ms. Church.
Mr. Thériault, you have the floor for five minutes.
Bloc
Luc Thériault Bloc Montcalm, QC
Thank you, Mr. Chair.
In June, you held meetings as part of the G7 Data Protection and Privacy Authorities Roundtable. That led to the publication of a joint 20-point statement, which included encouraging organizations to prioritize privacy throughout the life cycle of a technology, from its design to its deployment, and to prioritize the protection of children.
How do you plan to implement those principles or that statement in the context of the cuts planned in your budget, among other things?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Thank you for your question.
Yes, privacy commissioners also meet in the background of the G7 leaders' meeting.
This year, it was important for me, as chair of that round table, to make a strong statement that recognizes the importance of protecting privacy from the time a technology is designed. In Canada, we pioneered the concept of privacy by design.
In my discussions with my G7 colleagues, we unanimously agreed to strengthen this message and recognize that doing so is not only important and good for the protection of privacy—which itself is a prerequisite for freedom, democracy and the rule of law—but it also helps support the economy and children. There is a consensus in the international community on the importance of protecting strong economies, as well as children and their privacy. This message was strengthened at the G7 summit.
I think it's important to convey this message with a united voice, and we will continue to do so on the international stage. This takes many forms, including common positions adopted by commissioners, joint investigations—such as the one on TikTok—or regulatory frameworks on data sharing under certain conditions, such as asking questions at the outset.
For businesses, as well, and especially SMEs, it is important that privacy protection be achievable. That being done earlier leads to better criteria and a more user-friendly process. That in turn makes the process less expensive and more efficient.
Bloc
Luc Thériault Bloc Montcalm, QC
In terms of the reaction of businesses to this issue, do you sense any collaboration or reluctance?
We've seen some cases recently where matters had to be taken all the way to the Supreme Court to defend people's interests.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
There will always be situations where a company or a government will express its disagreement and want clarifications. That's fair. My concern with that in Canada is that I don't have the power to issue an order or impose a fine. So the process is longer and more costly than it should be.
Companies are often in favour of the idea of setting up this kind of a mechanism, but they need to see a common position taken internationally. That's why it's important to have collaboration and a joint statement, as they show that the position is being adopted not only by Canada, but by countries around the world, whether they are G7 countries, or other countries in Asia or Europe. That way, companies that do business in a number of countries will know what position is being taken.
In my opinion, prevention and education are the best things to advocate for.
This takes us back to the issue of limited resources. We want to reserve long contentious investigations for cases that require them. In most cases, if we can resolve a situation through persuasion and communication, it's better for everyone.
Bloc
Luc Thériault Bloc Montcalm, QC
If I understand correctly, the scope of the challenges associated with the emergence of new technologies involves not only local measures, but also international or transnational collaboration, necessarily.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Absolutely. Even in Canada, there is close collaboration among the federal government, the provinces and the territories, not only to raise the criteria for everyone, but also to facilitate and simplify things for companies. Indeed, it is more complicated to deal with the responses of 8, 10, 20 or 50 regulatory authorities than to receive a response communicated by a shared voice.
The fact that data constantly crosses borders is one of the things that distinguishes the privacy field from many other fields. In addition, data is increasingly being used to do just about everything we do, including decision-making, innovation and assessment. That's a good thing, but it increases privacy risks. Therefore, collaboration is more important than ever.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Thériault and Mr. Dufresne.
The second round of questions is over. We'll now begin the third round, which will start with Mr. Hardy and Ms. Lapointe for five minutes. After that, the Conservative Party and the Liberal Party will each have two and a half minutes.
Mr. Hardy, you have the floor for five minutes.