Evidence of meeting #7 for Access to Information, Privacy and Ethics in the 45th Parliament, 1st session. (The original version is on Parliament’s site, as are the minutes.) The winning word was lobbying.
A video is available from Parliament.
Liberal
Abdelhaq Sari Liberal Bourassa, QC
That's an instructive answer and good advice.
If we want to talk about sanctions, what kinds of sanctions can we impose?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
There are, of course, administrative monetary penalties, which influence high-level decisions. My goal would not be to impose penalties very often, because the mere fact that they exist becomes an incentive that promotes good decision-making.
The same applies to the power to issue orders, which also allows for faster results. At the moment, I can only issue recommendations. If those aren't followed, I have to go to court, which is costly and takes time. That's not ideal.
There is also the company's reputation, the importance of which should not be underestimated. That's why I make an effort to publicize the decisions we make, as well as our national and international expectations regarding corporate behaviour.
That said, I also believe in positive incentives. We need to recognize companies' good deeds. We must encourage them, in particular by ending an investigation more quickly when a company acts appropriately. That's what we did in the case of PowerSchool, where the company co-operated with us. We said that there was no need to conduct a lengthy investigation that would be costly for all involved, since we could obtain a letter of commitment and then follow up as required. We encourage such behaviour.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Dufresne and Mr. Sari.
Mr. Thériault, you have six minutes.
Bloc
Luc Thériault Bloc Montcalm, QC
Thank you, Mr. Chair.
Welcome, Commissioner.
First, I would like to hear your thoughts on Bill C‑2, particularly parts 15 and 16, which concern—among other things—the ability of authorities to intercept communications or conduct seizures without a warrant. It is inherently legitimate to fight transnational organized crime and fentanyl trafficking.
I know you will be reappearing before the committee to discuss the bill, but today I would like to focus on a number of issues that you may have identified.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Thank you for the question.
As I was saying to your colleague Mr. Cooper about Bill C‑8, I expect to be called to give formal recommendations on the subject.
What I can say about Bill C‑2 is that it does indeed give greater powers to authorities to do certain things—sometimes with a warrant, sometimes without one—according to certain criteria. Sometimes the test is reasonable suspicion. Other times, the test is reasonable belief. We are in the process of analyzing all that, and our priority will really be to determine whether, once again, that necessity and proportionality are being met.
We will want to determine whether the criterion is rigorous enough. If we obtain sensitive information on Canadians, the criterion should normally be higher—more rigorous than when the information is not sensitive.
We also need to look at whether there are good privacy practices, for example in terms of information retention. If information is obtained and turns out not to be useful for a prosecution, should it be destroyed? Will appropriate reports be produced so that questions or problems can be raised?
Those are the themes we're looking at for most of the issues around this bill. We want to review the criterion and determine whether it goes too far, whether too much leeway has been granted. We must also ask ourselves that question in light of the Supreme Court's decision in the Bykovets case—because in a similar context, the court ruled that, in some cases, warrantless searches could be problematic in terms of privacy. So we must be cautious.
Bloc
Luc Thériault Bloc Montcalm, QC
Thank you.
In the bill, could we force electronic service providers to provide information without already knowing themselves how they operate, and without knowing what information is there, sometimes unbeknownst to the individuals concerned?
Are the principles of necessity and proportionality not guaranteed at this point by a judge?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
If a power is granted that is conditional on obtaining a warrant, then that additional protection already exists, since one must go before a court to obtain the warrant.
That said, we need to look at the criteria, because judges' powers are also limited by law. If the law says that the judge may grant the warrant if it is useful to the investigation, that is very easy to establish. We can also limit what judges can do. For example, we can give the judge sufficient powers to impose all the necessary conditions, or we can limit their powers in this regard.
Would we allow the judge to consider the impact not only on that person's privacy, but also on third parties? Some of these powers allow certain things to be done with a Canadian's device and allow their communications with others to be examined. However, the impact on third parties is significant. All these issues are important.
The police must be given the tools they need, but I think this rigorous analysis is important. It is important to ask why we need this and why it can't be done while providing greater protection for privacy. I see it this way: I want to ensure that law enforcement agencies have the necessary tools, while having a strict and appropriate standard and mechanisms for reporting to the appropriate authorities.
Bloc
Luc Thériault Bloc Montcalm, QC
Thank you.
In the departmental plan for 2025-26, you indicate that you have temporary funding, which we understand will be abolished in 2026. Given the challenges ahead, do you think this will have an impact? Do you think that funding should continue, given the magnitude of the challenges you face?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes. This temporary funding must absolutely be maintained. This is a request that I have made to Treasury Board and to the government.
This actually highlights one of our challenges as independent officers of Parliament, since we still depend on government support for these requests. I agree that it's important that there be rigour and oversight. For us, however, it is problematic, because we have been mandated to conduct investigations into privacy breaches that occur in the public sector, but without having had permanent funding for that mandate. However, the work is permanent and increasing, as privacy breaches are increasing, with major repercussions in Canada and abroad.
The lack of ongoing funding is very problematic for us. I hope and expect that a decision will be made on that.
Conservative
The Chair Conservative John Brassard
Thank you, Mr. Dufresne and Mr. Thériault.
That concludes the first round of questions. We will now begin the second round.
Mr. Cooper, you have the floor for five minutes.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
Thank you, Mr. Chair.
Thank you, Commissioner.
The charter jurisprudence, based upon the Supreme Court's 2014 Spencer decision and the more recent 2024 Bykovets decision, is clear: Access to personal data requires prior judicial authorization. Is that correct?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Yes. Those were the findings of the court.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
Looking at the Bykovets decision, the court confirmed that subscriber data is the “key to unlocking” a person's identity and online activity. Based upon that, the court affirmed that even IP addresses attract “a reasonable expectation of privacy” and therefore cannot be obtained without a warrant. Is that correct?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That was a finding in that case. Again, the argument was that this information is not specific enough, so we can ask and obtain it. The court really found that we can draw so much about an individual with these types of data points, so in that case found that a warrant was required.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
Thank you for that.
In order to obtain a warrant or a production order in this type of context, the standard that would have to be met is “reasonable belief”. Is that correct?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
There are some instances where under the law it would be “reasonable suspicion”. That is where some of my recommendations are, to the effect that when we're talking about sensitive information, it should be “reasonable belief”. We should have a more rigorous standard to assess that.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
With that in mind, I want to ask you some questions about parts 14 and 15 of the Liberal government's Bill C-2. Buried within the so-called strong borders act are sweeping new powers to government agencies to demand Internet subscriber data. In the Criminal Code, for example, proposed section 487.0121 would allow police and CSIS officers to demand customer information from any company providing public services, including banks, telecoms and social media, on a mere suspicion, without judicial authorization. Do I have that right?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
That's right.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
In terms of understanding the implications of what that section would enable law enforcement to do, law enforcement, for example, could compel a bank, without a warrant, to reveal whether an individual is a client at the bank, how long they've been a client and where they have access to banking services, and to provide the name of any person who has provided services to that individual. Is that fair?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
I don't have the section in front of me, but that sounds right.
October 6th, 2025 / 11:30 a.m.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
It would provide warrantless access to subscriber data, including IP addresses, right?
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Again, that sounds right.
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
That sounds right. It would seem to me that it completely eviscerates the standard set out in Spencer and Bykovets.
Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada
Well, it modifies it. Parliament can do that. The question is, is it necessary and appropriate? When we look at this, we ask these types of questions: Why is it suspicion and not belief? Is it rigorous enough? Is there enough reporting?
Conservative
Michael Cooper Conservative St. Albert—Sturgeon River, AB
It raises serious privacy implications, though, does it not?