Industry and Technology Committee on Jan. 26th, 2026

[The Chair, Liberal, Ben Carr]

Good morning, everyone.

Welcome back to Ottawa. I hope everybody enjoyed a set of quality moments with friends and family over the course of the holiday. We're certainly being greeted with some winter weather, although I want to note for the record, for all those from Ontario and other parts of the country complaining, that my partner sent me a note yesterday to show that in Winnipeg it was -51°C with the wind. Unless where you come from is worse than that, thanks for your understanding about how we Manitobans feel.

This is a retreat, is it not, Ted?

[Ted Falk, Conservative, Provencher, MB]

It's a retreat.

[The Chair, Liberal, Ben Carr]

Colleagues, for our first hour today, we have something a little bit out of the ordinary in the course of our normal affairs but is ordinary within the affairs of Parliament as a whole. I received a letter from the chair of the finance committee to ask for our assistance in reducing the load they have to undertake in the evaluation of the BIA, the budget implementation act. She has done this with many other committees. It's common practice in order to have efficiency within the process at committee.

Pursuant to that standing order, today we have an evaluation of an act to implement certain provisions of the budget that are relevant to our committee—in particular, clauses 389 to 398, division 23; clauses 589 to 591, division 39; and clauses 597 and 598, division 43.

We will have two guests with us today. Following that, Minister Joly and her officials will be here next week. That was the ask from the finance committee. We are fulfilling that in today's meeting and in Monday's meeting, assuming the schedule goes according to plan.

Joining us today are Philippe Dufresne, Canada's Privacy Commissioner, and Marc Chénier, deputy commissioner and senior general counsel. They will speak to their responsibilities within the BIA and why they're here today. Then there will be an opportunity, as always, for members to speak.

I am going to hold us to time today. We'll end this at exactly the one-hour mark. We have things to get to in the form of a draft report and a couple of other items of business.

With that, Monsieur Dufresne, I will pass the mic to you. The floor is yours for up to five minutes, sir.

[Philippe Dufresne, Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada]

Thank you, Mr. Chair.

Thank you for the invitation to appear today to share my views on the privacy impacts of division 23 of part 5 of Bill C‑15, budget 2025 implementation act, no. 1.

Privacy is an important, topical issue in Canada. As more and more personal data is collected, used and shared, protecting it becomes increasingly important to Canadians and Canadian organizations.

In the past two years, we've seen many examples of how Canadian privacy law can address major issues that cause serious and long-lasting harms to individuals—for example, protecting against the non-consensual sharing of intimate images in my investigation into Aylo, which operates Pornhub and other pornographic websites, and addressing the 23andMe breach, which impacted the highly sensitive personal information of seven million customers, including more than 300,000 Canadians.

My recent investigation with my provincial counterparts into TikTok, meanwhile, highlighted the importance of protecting children's privacy in today's online world. The impact of our investigation into this widely used platform went far beyond a report. It also enabled the company to implement improvements to its privacy practices in the best interests of its users, especially children.

I recently announced an expanded investigation into the social media platform X and its Grok chatbot. This investigation will examine the emerging phenomenon of AI being used to create deepfakes, which can present significant risks to Canadians.

These are just a few of the many examples that show the importance of privacy for current and future generations. The examples also illustrate how prioritizing privacy is a strategic and competitive asset for organizations.

That's why it's so important to modernize the legislation so that we can have modern laws to help businesses make sure they have adequate protections.

For organizations, embedding data protection into programs and services can enable responsible innovation, facilitate global operations, improve data security and mitigate risks, including of major breaches. Modernizing privacy laws aligns with Canada's ambition to support growth, to seek opportunities with partners around the world and to continue to be a voice of modern progress, setting the stage for a safe and secure digital future for Canadians and Canadian industry.

Bill C‑15 includes clauses that would amend the Personal Information Protection and Electronic Documents Act to include a right to data mobility to facilitate information sharing among all economic sectors. I support efforts to introduce the right to data mobility in Canada.

A right to data mobility would give Canadians greater control over their personal information and let them decide who their information can be shared with. It would also make it easier for them to switch service providers and choose the organizations they want to deal with. These are important considerations in building trust in today's digital economy.

Enhancing data mobility provisions can also support economic growth in Canada. For example, it would help promote competition and innovation by allowing individuals to take advantage of new business models, like consumer-driven banking, and by encouraging new players in the market, therefore helping to support small and medium-sized organizations. Specifically, Bill C-15 would add a new division 1.2 to PIPEDA that would require an organization, upon an individual's request, to “disclose the personal information that it has collected” from them to a designated organization. This right would be subject to regulations and would only apply “if both organizations are subject to a data mobility framework.”

Bill C-15 would amend PIPEDA to provide the Governor in Council with the authority to make regulations regarding data mobility frameworks. These regulations would cover key aspects of a mobility framework, including safeguards and technical parameters for ensuring interoperability. They would also specify which organizations are subject to a framework and would provide for exceptions to the requirement to disclose information.

Given the scope of the issues that will be regulated, the office of the commissioner absolutely must be consulted by the government as the regulations are developed. I look forward to working with the government on these important issues.

With that, we look forward to your questions. Thank you.

[The Chair, Liberal, Ben Carr]

Thank you very much, Mr. Dufresne.

Okay, colleagues, we'll enter into our lines of questioning.

Mr. Guglielmin, the floor is yours for six minutes.

[Michael Guglielmin, Conservative, Vaughan—Woodbridge, ON]

Thank you, Chair.

Thank you for your testimony, Commissioner.

In division 23, under part 5 of Bill C-15, there is proposed section 10.4 of PIPEDA, which is on this proposed data mobility framework. This framework is intended to grow out of regulation. In other words, it will be bureaucrats, not parliamentarians, who have oversight over its development. Do you believe this introduces transparency concerns around the way in which Canadian data is handled?

[Philippe Dufresne]

I believe that my office should be consulted in the development of those regulations. That's why I'm setting out my expectation here, as I did in the other place when I appeared there to discuss this.

I think the legislation provides for the framework and the important topics, safeguards and parameters, and it specifies organizations and exceptions. For my role in this, I will be reaching out to the government to make sure that my office is consulted, and I expect this to not be an issue.

[Michael Guglielmin, Conservative, Vaughan—Woodbridge, ON]

Do you think transparency might be enhanced by amending the legislation to allow for provisions of the data mobility framework to be statutorily established?

[Philippe Dufresne]

That's a decision for Parliament to make. Certainly, there is always a balance between having elements in legislation, with more debate and more parliamentary accountability.... Having some elements in regulation allows for faster development and more adaptation, so it's up to Parliament to strike the right balance.

In this instance, I do not have concerns with the way it is provided. However, this is based on my expectation that the government will consult with my office in the drafting.

[Michael Guglielmin, Conservative, Vaughan—Woodbridge, ON]

Do you think the overall transparency and, potentially, the efficacy of the legislation could be strengthened by requiring that the regulations governing the data mobility framework be published before they come into force?

[Philippe Dufresne]

The more we publish before it comes into force and consult with industry and the regulator, the more awareness industry and Canadians will have so they can prepare for the implementation and provide their feedback.

[Michael Guglielmin, Conservative, Vaughan—Woodbridge, ON]

What do you think are the chief challenges with developing this framework through regulation outside of the immediate focus of the Canadian public?

[Philippe Dufresne]

I think the challenge is making sure you have something that will work for Canadians, that will work for industry and that allows key elements. We see some of that in the bill in terms of consumer banking, consent, safeguarding, and making sure that if there is a privacy breach, it is reported quickly to the authorities, to the regulator. There's a big role for the Bank of Canada in the banking sector to approve entities and report breaches.

I think it's going to be important for the Bank of Canada, my office and other affected entities and regulators to work together, and I look forward to doing that.

[Michael Guglielmin, Conservative, Vaughan—Woodbridge, ON]

I'm going to switch over to where in your testimony you were talking about deepfakes. The government has now introduced legislation, Bill C-16, that is intended to criminalize the creation and distribution of intimate deepfakes. At the same time, we have experts like Suzie Dunn, assistant professor of law at Dalhousie University, who have warned that the bill's definition of “deepfake” may be too narrow to capture much of the harmful content currently circulating online. That includes platforms like X.

As the committee prepares to undertake a study on artificial intelligence more broadly, what recommendations would you offer to us to ensure that legislation more effectively protects Canadians' privacy and potentially provides meaningful recourse for victims who have already experienced non-consensual AI intimate images?

[Philippe Dufresne]

My overall recommendation is to modernize PIPEDA, to modernize private sector privacy legislation. That is a mandate of this committee. That is an area where the Minister of AI has said publicly that the government will look to introduce, at some point, modernized legislation. There were attempts in the past.

My main message is that we need to modernize and we need to give my office enforcement authorities. This is a major gap in the enforcement regime. I can only issue recommendations. I cannot issue orders and I cannot issue fines. We are standing out among international partners in this respect. That is an easy fix that Parliament can do. There are other elements that need to be modernized as well, but that would give me the enhanced tools I need.

In the meantime, I have been using and will continue to use existing tools to deal with those issues. That's what I did in dealing with Pornhub and that's what I am doing in dealing with the investigation of X and deepfakes, but the fact remains that I cannot issue orders at the end of those investigations.

[Michael Guglielmin, Conservative, Vaughan—Woodbridge, ON]

I understand that xAI has recently indicated that it will geoblock content where it violates laws of a particular jurisdiction. However, there are many who would argue that this response comes after significant harm has already occurred. Victims of intimate deepfakes continue to live with the consequences long after content is removed or restricted.

Simply from a privacy and victim protection perspective, what does that say about the adequacy of current regulatory approaches, which often rely on reactive enforcement rather than preventative safeguards?

[Philippe Dufresne]

Well, I won't say too much on X, because I launched my investigation last week. We're going to proceed swiftly on it, we're going to use the tools and we're going to draw our conclusions on it.

I think there's a challenge, if I look to our concluded investigation of Pornhub on the similar and related issue of online-based abuse and the sharing of intimate videos without the consent of individuals in the context of revenge porn and other types of situations. We investigated. We made a finding that this breached privacy law. We made strong recommendations that there needed to be a solution from now on, forward looking, but what do you do with what has already been posted? We also wanted that to be taken down. We wanted the takedown mechanisms to be faster and to be user-friendly. The company refused to do that.

Now we are in Federal Court trying to enforce this, but it is slow and expensive, and in the meantime those images continue to be available. That's where amending PIPEDA and giving my office order-making powers and the ability to issue or recommend fines would allow a much more immediate remedy, which could then be challenged in front of the court. That's the challenge.

You're often going to have responsive complaints or proactive complaints. In the context of Grok, I initiated it myself, but what's important is that once those are concluded, you get a real and meaningful remedy if there has been a violation.

[Michael Guglielmin, Conservative, Vaughan—Woodbridge, ON]

Thank you.

[The Chair, Liberal, Ben Carr]

Thanks very much, Mr. Guglielmin.

Mr. Bains, the floor is yours for six minutes.

[Parm Bains, Liberal, Richmond East—Steveston, BC]

Thank you, Mr. Chair.

Thank you, Commissioner, for joining us today.

My first question for you is, how will the government ensure that regulatory requirements for data mobility do not disproportionately burden small and medium-sized enterprises?

[Philippe Dufresne]

I think that is an important part of any new law, rule or regulation the government adopts. It's important to hear from industry. It's important that the department hear from industry. It's important that industry itself is able to make its concerns and realities known, and a small or medium-sized enterprise in particular.

From my standpoint as a regulator, I also need and want to know what the challenges of industry are. What are the hurdles? For regulation to be effective, it has to be practical. It has to be doable by small and medium-sized enterprises, and of course, it has to protect Canadians. Building in privacy at the outset and making sure that we have good frameworks, good involvement of the regulator and good dialogue with industry allow industry to build this in from the beginning. It's more effective, it's less expensive and it leads to more trust from consumers.

This is going to be key, in my view, in data mobility and consumer banking. Canadians need to trust this, and they will trust it if they can see that privacy is built in from the start.

[Parm Bains, Liberal, Richmond East—Steveston, BC]

I have a question with respect to monetary penalties. You appeared before the Senate committee on banking, commerce and productivity, where you stated that you do not currently have “the authority to impose financial consequences” for a breach of liability. In your view, is a monetary penalty one of the most effective ways to ensure compliance, or do you have other ways that you would go about that when dealing with breaches of sensitive information?

[Philippe Dufresne]

I believe we need to use all of the tools at our disposal. The financial penalties, the orders and the enforcement should always be a last resort. We should always try to prevent, resolve, educate and work together, so that's what we're doing at my office. I'm trying to resolve things quickly and informally, with letters of engagements, commitments and compliance agreements.

However, in situations where there is a disagreement or a major violation, you need the capability to enforce and also, I would argue, the possibility of fines to help decision-makers, CEOs, boards and investors invest the necessary sums to protect privacy. If there's the risk of financial consequences, it gives argument to the privacy champions in those organizations to build protections for Canadians, so it serves everyone in the end.

I want the ability to issue fines. I hope to rarely, if ever, have to issue them, but the existence of that possibility will make it easier for my office to convince organizations to prevent issues and take the necessary steps.

[Parm Bains, Liberal, Richmond East—Steveston, BC]

Part of the committee's responsibility is to establish recommendations. Maybe you could provide a set of recommendations with respect to data mobility safeguards that need to be put in place. How can we put those in place? How can Canadians feel secure that their information and data aren't going to be exposed when they're shared?

[Philippe Dufresne]

In terms of recommendations, we've highlighted a number of priority recommendations for law reform, which I think are relevant in the context of what you do to protect the mobility of Canadians.

You need to make sure there is strong enforcement if there is non-compliance. You need to make sure there is a proper assessment, whether it's a privacy impact assessment or privacy by design, and make sure you bring this to the forefront. There are good elements of that in Bill C-15 in terms of consumer-based banking and making the consent express and user-friendly. These are things we always recommend and want to see.

Things like preventing the identifying of privacy breaches are major challenges to society all over the world, not just in Canada, and we're seeing them increase in number and magnitude. I talked about the 23andMe major breach I investigated with my counterparts from the U.K. There was very sensitive genetic information, and hundreds of thousands of individuals were impacted. We need to work on that.

This also costs money to organizations, so it's bad for everyone. The regulations need to provide for good safeguards and good reporting mechanisms in consumer-based banking. They're talking about immediately advising the entity responsible. We need to do all of those things, and there needs to be good and strong collaboration between regulators when there's potential overlap, as there would be here.

I look forward to working with the Bank of Canada as I am working already with the Competition Bureau and the CRTC. Digital issues and mobility issues don't stop at the border of one regulator or even one jurisdiction, so that collaboration is essential.