Information & Ethics Committee on Oct. 6th, 2025

[The Chair, Conservative, John Brassard]

Good morning, everyone. I'm going to call the meeting to order.

Welcome to meeting number seven of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.

Pursuant to Standing Order 108(3)(h), the committee will proceed today to a briefing session with the Privacy Commissioner of Canada, followed by a briefing session from the Commissioner of Lobbying.

I have a reminder for everyone about the earpieces. Please be mindful about where they're placed on the desk.

I would like to start by welcoming Monsieur Philippe Dufresne, who is the Privacy Commissioner of Canada.

Mr. Dufresne, I know you've been extremely busy lately. I want to thank you for being with the committee this morning. It's been a while, and I'm sure we have lots to catch up on.

You have five minutes. Go ahead, sir.

[Philippe Dufresne, Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada]

Thank you, Mr. Chair.

Thank you, members of the committee, for the invitation to appear before you to discuss the work of my office and the importance of prioritizing privacy.

As Privacy Commissioner of Canada, my mission is to protect and promote individuals’ fundamental right to privacy. This includes overseeing compliance with both the Privacy Act, which applies to federal institutions, and the Personal Information Protection and Electronic Documents Act, or PIPEDA, Canada’s federal private-sector privacy law.

At a time when more personal data is being collected and shared than ever before, often across borders, this is an essential mandate for Canadians. From the moment that we start our day and check our phones until the time that we wind down by streaming music or a favourite show, our personal data is being sought.

New technologies bring new opportunities to connect, to create and to innovate. For organizations, personal information can be used to offer tailored services, refine operations and evaluate results, but this also brings risks to our privacy.

It is a different reality from that of just a decade ago.

Canada's privacy laws and even my office were designed in and for a pre-digital time.

Since becoming Privacy Commissioner of Canada in 2022, I have advocated for modernization of Canada’s privacy laws, and for increased investment in data protection. Prioritizing privacy must be our collective imperative at this time of unprecedented change.

Privacy matters to Canadians. The OPC's latest public opinion research found that nine in 10 are concerned about their privacy. Sixty-two per cent believe that government respects their privacy rights—

[Luc Thériault, Bloc, Montcalm, QC]

Mr. Chair, I have a point of order: the interpretation is not working. It is usually available on the French channel, but now it is on channel 03. As a result, my legislative assistant is having trouble hearing the interpretation. That needs to be corrected, because we can only hear it intermittently.

[The Chair, Conservative, John Brassard]

Okay.

We apologize for this problem, Mr. Thériault and Mr. Dufresne. The technicians have just fixed it and everything is working now.

You may continue with your opening statement, Mr. Dufresne.

[Philippe Dufresne]

Thank you.

Privacy matters to Canadians. The OPC's latest public opinion research found that nine in 10 are concerned about their privacy. Sixty-two per cent believe that government respects their privacy rights, and only 40% say the same about business. The survey also showed that more than two-thirds of parents are moderately to extremely concerned about their children's privacy online.

The number of privacy complaints to my office is rising. In the first quarter of the year, the number of complaints increased by 51% over the same quarter last year. This, along with increases in breach notifications, highlights the need for efficiencies, reform and resources.

A necessary precondition to establishing trust in the digital economy is a privacy regulator with sufficient capacity to respond to privacy breaches and to carry out timely investigations. It is within this context that my office works to provide resources and guidance, respond to major privacy incidents, and keep pace with an ever-evolving digital world.

Last year, I established three key strategic priorities for my office—maximizing impact, advocating for privacy in this time of technological change and children’s privacy.

I believe that as a small organization it is important that we prioritize efforts in areas where we can have the greatest impact for Canadians and where the greatest risks lie if they are not addressed.

In January, I launched a transformation at the OPC, informed by a comprehensive review of internal structures and resources, to increase efficiencies, streamline operations, amplify results and make our service to Canadians as efficient as possible.

Our response to the breach at PowerSchool this year is an example of this approach. My office engaged with the company to achieve a timely resolution by focusing on its response to the incident and on implementation of measures that will result in stronger protection for the personal information of students, parents and educators across Canada.

Domestic and international collaboration remain a central component of my tenure. Last month, I was honoured to be elected chair of the Global Privacy Assembly, the international forum that brings together data protection and privacy authorities from all over the world.

Two weeks ago, I announced, along with my counterparts in Quebec, British Columbia and Alberta, the findings of a joint investigation into TikTok, and this committee was interested in that file. This federal-provincial collaborative effort generated increased awareness for Canadians and will lead to improvements to the company's protection of children's privacy.

I will conclude where I began—on the importance of prioritizing privacy. Data has become one of the most important resources of the 21st century. Through modern laws, collaboration and engagement, we can and we must create a regulatory environment that will benefit Canada’s economy, support Canadian businesses and protect the privacy rights of Canadians.

I would be happy to answer your questions.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Dufresne.

Congratulations on your election. I know that comes with great responsibility, and I'm sure you're going to be very busy with that.

We're going to start our first round. I know that we've been a little loose on time, but I'm going to try to keep it tight to give everybody an opportunity to ask both commissioners a question.

Mr. Barrett, I'm going to start with you for six minutes. Please go ahead.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Good morning, Commissioner.

I have questions for you about the legislation, Bill C-8. There has been a pretty broad chorus of voices of those who are concerned about the sweeping and secret powers cabinet ministers would have over Internet access and telephone access for individual Canadians: the secret powers to seize private data without warrant and conceal those actions from the public.

Would secret orders to disable an individual's telecommunications access be inconsistent with the principles of the Privacy Act? If so, why, sir?

[Philippe Dufresne]

In the last Parliament, I appeared on Bill C-26 and talked about some of these issues when legislation aims at giving more power to the state to protect infrastructure and to disable and to take certain steps. As commissioner, I've always stated that privacy is not an obstacle to public interest, and it's not an obstacle to national security or to a strong economy, but we need to make sure that by protecting national security, we're not doing so at the expense of privacy.

In cases like this, what I said to the committee was that we needed to put into the legislation a criterion on necessity and proportionality, making sure that the exercise of those powers is going to be tested from a privacy perspective, and to say, “Is this necessary? Does it achieve the result for which it's been put in place and is it proportional?” That's the substantive element.

You mentioned secrecy. In certain instances, secrecy is necessary, but it should be challenged, and there should be ways for some reports to be made to appropriate authorities. It doesn't have to be necessarily that we make it public: reports to my office, reports to a national committee of parliamentarians or other means.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

In your review of this proposed legislation, then, does it check all of those boxes?

[Philippe Dufresne]

Well, I will be waiting to testify on Bill C-8 when called, and we're reviewing that very carefully, but there is, I think, more to be done in terms of the reporting mechanism and the necessity and proportionality.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

I would say for sure that there's more to be done. This bill proposes to let the government secretly cut a Canadian's phone or Internet service. The cabinet minister would have the power to issue the order that would prohibit the revelation of the existence of the order to cut that service—that the order even existed—which would, of course, eliminate the ability for anyone, including you, in your role as commissioner, to have any oversight whatsoever. Isn't this a direct circumvention of the act with which your mandate is concerned?

[Philippe Dufresne]

That's why, again, to make sure we're not making it more difficult to raise rights and to protect privacy, reporting to appropriate authorities, even if done in a confidential manner, is something I recommend—making sure there is the ability for my office to be aware of it and to raise questions. In some instances, a report to Parliament is appropriate or a report to committee is appropriate.

It should be part of the discussion and the assessment to say, “What type of reporting is there? Is it enough?” Certainly, in my view, there should be confidential reporting to some authority that would be able to raise questions about it.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Currently, what you're describing doesn't exist in the legislation. What you described as “essential” is not included in the legislation.

Bill C-8 lets a minister compel data without judicial oversight, so this also creates the risk of a parallel system whereby Canadians' personal information, their personal data, can be seized in secret, with, again, no redress by individual Canadians or by your office. Isn't this antithetical to the type of system that your office has been designed to protect?

[Philippe Dufresne]

If my office is not aware of something happening, of course we can't raise questions about it. We can't assist Canadians.

Again, I think there will be instances where making something known to the public may not be appropriate, but we should challenge a claim to absolute secrecy. We should make sure there's appropriate reporting to the appropriate authorities and that there is an appropriate means to raise questions.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Right. Of course, if your office doesn't know that the law is being broken, then I guess the government's contention is that it hasn't broken the law.

Do you think that a vague standard like “any threat”, which is the term used in the legislation, undermines safeguards in the Privacy Act, such as the requirement that collection or use must be necessary, proportionate and authorized by law?

[Philippe Dufresne]

We've advocated in the past, and as I said, I expect to be called specifically on this bill to address it.... As a general proposition, I recommend that necessity and proportionality be in the legislation and made explicit—

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands—Rideau Lakes, ON]

Which they are not—

[Philippe Dufresne]

—so that there's a strong test.

[The Chair, Conservative, John Brassard]

Thank you, Mr. Barrett and Mr. Dufresne.

Mr. Sari, you have the floor for six minutes.

[Abdelhaq Sari, Liberal, Bourassa, QC]

Thank you very much, Mr. Chair.

Mr. Dufresne, thank you for your presentation, and congratulations once again.

I am going to share some information that may betray my age. I started working in information technology when I was still under 16. I have witnessed significant technological advances—particularly in terms of connectivity, affordability, popularization and use of social media, from their emergence to the integration of artificial intelligence in several areas.

As I often tell my students, technology is evolving very quickly, while governments, whether in Europe, Africa, or here in North America, are always very slow to update legislation. That's what I see when I do a quick comparative analysis.

You have knowledge and expertise in this area. In your opinion, what legislative changes should our government make as a matter of priority, given our responsibility to protect the privacy of Canadians?

[Philippe Dufresne]

I think both laws need to be changed: the public sector law and the private sector law.

Certainly, laws and regulations can never evolve as quickly as technology—which, as you say, is evolving extremely rapidly. We do, however, have a law for the public sector that dates back to the 1980s and a law for the private sector that dates back to the early 2000s. There is therefore no doubt that these laws were passed before this evolution took place. Both need to be amended in several ways.

I was referring to the criteria of necessity and proportionality, for example, which are not currently found in the Public Sector Privacy Act. That is a significant shortcoming, and the act must be modernized to address it. In addition, the government must be required to prepare privacy impact assessments and reports when there are privacy breaches.

A shortcoming is found in both acts: They do not grant my office the authority to issue orders and impose fines. That sets us apart from many comparable organizations internationally, and makes it more difficult for us to enlist the co-operation of institutions, since they are not exposed to that financial risk in the end.

[Abdelhaq Sari, Liberal, Bourassa, QC]

Before moving on to my second question, I must say that you've made a very important point. You clearly stated that protecting the privacy of individuals, broadly speaking, would not hinder economic development.

I could go even further and say that digital sovereignty promotes economic development. Would you agree with that statement?

[Philippe Dufresne]

Yes.

I think digital sovereignty is indeed important, but it should not be achieved at the expense of international trade. There needs to be a balance in everything we are discussing. Data must be transferred in a climate of trust, under crystal clear rules. We need to know what can and cannot be transferred, as well as the conditions under which Canadian data can be sent to another country. This raises all kinds of questions, including the rule of law in the country to which the data could be transferred. We need to think about the contractual or legal rules that apply to what companies can do.

We are working very hard on this. One of my recommendations is to adopt a more rigorous framework. In Quebec, the legislation goes further than the federal legislation. Quebec's Bill 25, the act to modernize legislative provisions governing the protection of personal information, has specific requirements. For example, privacy impact assessments must be conducted when data is disclosed outside the province.

We therefore need a stronger regime. In Europe, there are adequacy decisions, which involve a formal assessment. In Canada, along with the United States and Japan, among others, we are working hard to create global rules for data transfers. This is an international priority.

[Abdelhaq Sari, Liberal, Bourassa, QC]

Absolutely.

Finally, I won't ask a question, but I will ask for your advice. What should we say to companies or individuals in the private sector to convince them that protecting privacy will not hinder their economic development? If possible, please substantiate your advice with concrete examples.

[Philippe Dufresne]

Absolutely.

What we do know is that Canadians care about their privacy. We see that in our data, and I'm sure businesses see it too.

When someone loses faith in a company because that company has violated or failed to respect their privacy, that person will go elsewhere. Canadians will find other providers. Customer confidence is extremely important. It's something that companies value, and rightly so.

In Canada, I think privacy is not only a legal obligation, but also part of Canadian values. Consequently, a company that does not uphold privacy may see its market share drop. Higher customer confidence is good for business.