Information & Ethics Committee on Oct. 6th, 2025

[Gabriel Hardy, Conservative, Montmorency—Charlevoix, QC]

Thank you very much, Mr. Chair.

Mr. Dufresne, thank you for being here today.

My question will have a broader scope, as I'm new to Parliament and I'm trying to get a clear understanding of the structure.

We've talked about public trust. I think it's really important that our institutions regain the public's trust. Earlier, you said that the transfer of data must be done under a more rigorous framework in order to inspire public confidence. There needs to be a third party that can provide a balance so that people know that it's not policy-makers who have the green light when it comes to privacy.

My notes say that Canada's privacy laws date back to 1985 and 2000. In a context where technology is evolving so quickly, do you think your office has enough funding and clout to do the necessary work? Do you have enough resources to do what is being asked of you?

[Philippe Dufresne]

We don't have enough resources. Our resources have not been increased in step with our increased responsibilities to manage privacy breaches. They have not been increased, either, to respond to the rapid development of artificial intelligence, the explosion of data and the heightened challenges that are arising in this area nationally and internationally and that require greater collaboration. I am aware of the very difficult financial context, but I continue to request an increase in my organization's funding for these reasons, which certainly distinguish my mandate from that of other organizations.

That said, we will do as much as we can using the financial resources we have, within the limits of the legislation and the structure in place. That's why I reorganized the office of the commissioner. I have reduced the use of some resources and optimized others. I use persuasion and flexibility. I will continue to use to the best of my ability all the tools at my disposal, which also include international collaboration and partnerships.

I'll give you a very concrete example of the privacy breaches at the big genetic data company 23andMe. I conducted a joint investigation with my U.K. counterpart. My office had more power than his during the investigation, but his office had more power than mine to impose penalties. So we did the investigation jointly and came to the same decision. My counterpart was able to impose a fine, whereas I did not have that power. Doing the investigation jointly amplified the outcome.

[Gabriel Hardy, Conservative, Montmorency—Charlevoix, QC]

This exchange is heading in the right direction.

Of course, we often talk about protecting personal information from the public's perspective, but I want to focus more on the internal structure of Parliament. You have important work to do in data management, and that work is gaining in importance year after year. Therefore, the underfunding of your office is a problem for the public, certainly, but the situation could also become problematic for the government itself and its internal structure.

Our committee heard from the Information Commissioner, who also told us that her office was underfunded. So we have parliamentary organizations that are underfunded and that have no real clout. For example, I think that, according to a recommendation from the Conflict of Interest and Ethics Commissioner, a public office holder at fault could receive a $3,000 fine. It's a slap on the wrist for someone who, at the end of their term in Parliament, would still come out ahead fiscally and make more money.

That's where I want to go with my question. Do you think your funding should evolve based on the real crisis we're currently experiencing when it comes to data management and artificial intelligence, which is on the rise?

[Philippe Dufresne]

Yes, I think the funding for my office should increase. I also think that all funding requests, including mine, should be scrutinized and assessed. Just because I ask for it doesn't mean it should be given to me automatically. I think a healthy debate should be held. However, if we have this debate on my office's funding requests, I think we will agree that they are justified, given the elements you mentioned—the rapid and explosive evolution of technology, the increased need for collaboration and the increase in privacy breaches, which unfortunately affect everyone. We keep hearing about that, and it undermines Canadians' confidence.

I see the additional resources I'm asking for as an investment, because it will save money in the future. Indeed, privacy breaches cost businesses and governments a fortune when there are data breaches or problems stemming from a lack of rigour. Conversely, the results we can achieve through cross-border trade can generate very significant revenues for the Canadian economy.

[Gabriel Hardy, Conservative, Montmorency—Charlevoix, QC]

Can privacy become a bit of a shield to avoid disclosing information that the public should know about some of our decisions? Do you think that this reason is currently being used by the government in certain situations, in the sense that it says it won't go any further because it's protected by privacy rules and principles, even though the situation is raising major questions among the public?

[Philippe Dufresne]

What you are saying is interesting. As Privacy Commissioner, when I hear that you can't do such and such a thing under the pretext of privacy, I always encourage people to ask questions. Questions need to be asked. Sometimes it's a privacy issue, but is that always the case? Personally, I don't want privacy to be an obstacle to transparency, rigour or national security, for example. We have to see what is really going on.

In addition, the Privacy Act provides for exceptions. The government may disclose certain information if it is in the public interest, even if there may be a privacy breach. So there is some flexibility, and we have to explore the possibilities.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne and Mr. Hardy.

Ms. Lapointe, you have the floor for five minutes.

[Linda Lapointe, Liberal, Rivière-des-Mille-Îles, QC]

Thank you, Mr. Chair.

Welcome, Mr. Dufresne. I'm very happy to see you here at the committee. I remember when you were the law clerk and parliamentary counsel at the House of Commons. It's a pleasure to see you again.

I liked hearing you talk about your priorities. You talked about optimizing privacy by taking into account all the possibilities offered by digital technology, among other things. I also liked hearing you talk about protecting children's privacy. This is a very important topic.

Many of you don't know this, but before I entered politics, I worked in the retail sector. One thing I hear a lot about right now in this sector is that shoplifting is a very serious problem. It's a very important issue. I'm talking about theft committed by organized groups, not about an individual who picks up an item and goes out the door without paying for it. The problem is more serious, as it involves organized groups. Merchants can use available technology and, for example, install facial recognition tools at the entrance of their business to determine whether a person could be a member of one of these organized groups.

I understand that there has to be a balance. You also said that you work with the president of the Commission d'accès à l'information du Québec.

On the issue of shoplifting, merchants are being told that they can't really use facial recognition tools. You can imagine that shoplifting is a huge problem. Several people enter the business at the same time, but merchants are unable to organize because they can't use facial recognition tools.

Where is the balance between respecting people's right to privacy and protecting businesses that are experiencing this problem?

[Philippe Dufresne]

Yes, you're quite right.

Thank you for mentioning Quebec's Commission d'accès à l'information. We do indeed work very closely with them. Quebec's Bill 25 contains specific provisions regarding the use of biometrics. Quebec therefore has unique obligations in this area.

As far as we are concerned, I'd say that it's important to ensure this balance, particularly with regard to facial recognition. We've already made joint statements on this issue at the federal-provincial level. We're not entirely opposed to the use of this technology. We're not saying it should never be used. However, its use should be regulated and strictly adhered to. These principles of necessity, proportionality and transparency should apply. If it is appropriate to use it, are people aware? Is it sufficiently clear that this technology is being used?

Several years ago, my office issued a decision on this matter concerning Cadillac Fairview. The concern raised was that customers didn't know they were being filmed or were unaware of it.

All aspects and principles relating to privacy must be examined, such as data minimization, transparency and retention. In other words, what is done with this information? Is it stored in databases for a very long time? If so, this increases the risk of privacy violations. I think it's important to have this dialogue.

I would encourage companies to continue raising these issues. If companies facing this problem feel they don't have the necessary tools, they should raise it with the commissioners, including my office. Not only can they do so by filing a complaint, they can also use our advisory services. We want to hear their concerns. Then we can make better recommendations.

[Linda Lapointe, Liberal, Rivière-des-Mille-Îles, QC]

Thank you, Mr. Dufresne. That's part of what I wanted to hear from you, meaning I wanted to know what you were suggesting be done in that regard. That's perfect; thank you.

When it comes to data storage and cloud computing, one thing is quite worrying: where our data is stored. You mentioned TikTok earlier. That's one thing. However, when our data is stored elsewhere, in other countries, what can we do to ensure that our data will be stored properly, in accordance with the laws and regulations in force here in Canada?

[Philippe Dufresne]

Indeed, one of my recommendations regarding the modernization of federal legislation on privacy protections in the private sector is that there should be stricter rules in this area and on extraterritorial data sharing: Guidelines are needed and, in some cases, assessments must be carried out beforehand. It is therefore important that the framework be very rigorous.

Some things will be outside our control, such as when a foreign government seizes information from a company in another jurisdiction. It is more difficult to control, but, even then, things can be done through international agreements, protocols and legislative requirements, as Europe has done. In this case, it plans to evaluate the other country's legal system to determine whether it's adequate or sufficiently compliant with the rule of law, so that people are aware and explicitly informed. In the TikTok investigation, for example, we asked for much greater clarity and transparency. Since the information was going to China, there was a possibility the Chinese government could access it.

The issue must be examined from all angles. In many cases, it will be useful, even necessary, to have this data in the other jurisdiction, but a framework will be needed to regulate its transmission. In certain circumstances, we may refuse to allow information to leave Canada because it's too sensitive or poses too great a risk.

[Linda Lapointe, Liberal, Rivière-des-Mille-Îles, QC]

Thank you very much.

[The Chair, Conservative, John Brassard]

Thank you, Ms. Lapointe and Mr. Dufresne.

Mr. Barrett, you have two and a half minutes.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Without meaningful limits, bills like C-8 and specifically Bill C-2 can hand the government secret, warrantless powers over Canadians' communications. This is a serious setback for privacy. It's also a serious setback for democracy.

With no requirement for privacy impact assessments before these laws or regulations are passed, and with their serious implications for Canadians' privacy, isn't Parliament simply being asked to grant sweeping powers of surveillance to the government without a formal review by the body—the commissioner—that Canadians and Parliament have asked to do that very thing?

[Philippe Dufresne]

Thank you for the question.

In fact, a privacy impact assessment is something that a Treasury Board directive requires government departments to do, but it's not a legal obligation in the Privacy Act. This is one of the recommendations I have made to Parliament and continue to make. It should be an obligation. There should be the opportunity for my office to give input before the fact when there's a major change, including legislation.

It's something to manage. There are cabinet confidences to be considered, but I would agree that the opportunity would be important.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Have you not had that opportunity with Bill C-8 and Bill C-2?

[Philippe Dufresne]

We're not consulted on specific pieces of legislation before they're tabled. We often have exchanges afterwards, with officials. They're good exchanges, but I think earlier consultation would make our feedback more meaningful, and our feedback would happen before it's tabled.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

I don't think I have a tremendous amount of time left, but to continue to pre-empt your appearance on Bill C-8 at another committee, do you have a particular amendment or guardrail you'd like to see included in that bill before it comes out of committee?

[Philippe Dufresne]

Not specifically at this stage, but I'll repeat that necessity and proportionality—strict criteria for the exercise of powers—and appropriate transparency and reporting mechanisms are the things we're looking for.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Thank you.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Barrett.

Mr. Saini, you have two and a half minutes, sir.

[Gurbux Saini, Liberal, Fleetwood—Port Kells, BC]

Thank you.

You've been elected as chair of the global organization. I'm wondering if you could compare Canada with the rest of the world in terms of where we are with our Privacy Commissioner and legislation.

[Philippe Dufresne]

Thank you.

I think Canada is extremely respected around the world. That was part of my election in that role. I think we are very much a leader in that space. We punch above our weight, and we want to do that, but I will flag that, compared with other parts of the world, the fact that my office does not have the power to issue orders and levy fines is an area where we are not as good as the rest of the world. That's a quick fix that we can improve to raise the level of Canadian privacy law to what's around the world.

That being said, privacy by design, our strong privacy culture and our strong collaboration culture, I think, are things that we can bring to the world and are all part of my goals in this role.

[Gurbux Saini, Liberal, Fleetwood—Port Kells, BC]

We are leaders in the world overall, but why do you think it's important that you have the authority to lay fines? I just want to know your viewpoint on that.

[Philippe Dufresne]

Well, I think it's important because if we want organizations to build privacy into design, if we want privacy and want them to invest money and time in building those things, we need to give them the incentive to do that. It's hard for a CEO and a board of directors to say, “We're going to spend millions of dollars,” when there's absolutely no risk and no financial consequence if they don't. It becomes something that feels like a “nice to do”, not something that you must do.

That's why this authority is important. Certainly, around the world, those risks exist for other jurisdictions. They don't exist here. That being said, I'm going to continue to use the tools that I have, including making reports public and including calling out organizations. I think those two powers would make the system faster, less expensive, more transparent and more effective.