Industry and Technology Committee on Jan. 26th, 2026

[Karim Bardeesy, Liberal, Taiaiako'n—Parkdale—High Park, ON]

You referred to the data uses increasing. Probably all of us in the House and at this committee are concerned about the growing prospects for data use and about getting ahead of Canadians' understanding of what their ability is, for instance, to even be protected by this legislation. They may not have an awareness of it, or they may not be familiar with which frameworks might actually protect them and which ones they could freely contract into.

Could you speak to your understanding of Canadians' literacy on data protection frameworks and what we might need to do to elevate that literacy?

[Philippe Dufresne]

We certainly need to elevate it. We're seeing in our surveys increasing concerns from Canadians. Nine in 10 Canadians are concerned about their data and privacy and have a sense that things are moving quickly. Parents are concerned that their kids will not know how to protect themselves and their personal information.

We need to do more. I'm working together closely with the community here in Canada and around the world. Recently, we issued with provincial and territorial colleagues a resolution on educational technologies, making sure of what our expectations are in the use of educational technologies, making sure this is top of mind and in the best interests of the child, and making sure that parents and kids have a good understanding.

A lot of kids do. We just created a youth council at my office. I meet with youth to understand their perspectives, but they do feel that they're being surveilled. They're very knowledgeable—sometimes more than we think—about the technology, but they feel a sense that they're being asked for information and that it's challenging for them.

We need more of that. It will require the whole community in Canada and the international community as well.

[Karim Bardeesy, Liberal, Taiaiako'n—Parkdale—High Park, ON]

Having sovereign data or protecting Canadian personal data within Canada depends on companies and markets that are sufficiently competitive so that you have options available in Canada or so that institutions, especially public sector ones, that might have limited resources can freely contract with entities that are able to provide protection in Canada and at an affordable price. Do you have any perspectives on that particular question as it stands right now?

[Philippe Dufresne]

I think the question of data sovereignty is a very important one, as is the question of competition and access. I think this is an area that government and Parliament need to reflect on, in particular in the context of privacy legislation.

I've recommended that one area of strengthening be cross-border data transfer. It's one of those areas of tension where, on the one hand, you need to protect data sovereignty and make sure that things that shouldn't leave a jurisdiction don't leave a jurisdiction. On the other hand, strong economies and international trade will require data transfers between jurisdictions. A good framework is required around that. That's why one of my priorities is to focus on that and make sure we have free data flow with trust and Canadians have better awareness and more transparency on that.

In terms of the decision on TikTok, one of our specific recommendations was to make much more clear, to which the organization agreed, the fact that the data of Canadians could leave the jurisdiction. Where is it going and what are the implications? People need to know that.

[Karim Bardeesy, Liberal, Taiaiako'n—Parkdale—High Park, ON]

Thank you.

[The Chair, Liberal, Ben Carr]

Thanks, Mr. Bardeesy.

Mr. Ste‑Marie, you have the floor for two and a half minutes.

[Gabriel Ste-Marie, Bloc, Joliette—Manawan, QC]

Thank you, Mr. Chair.

Mr. Dufresne, I'd like to come back to open banking, which involves both federal banks and fintech under provincial jurisdiction. What actually happens when the province and the federal government haven't harmonized? My concern is two companies playing hot potato, not being subject to the same legislation, and then the consumer being on the losing end.

[Philippe Dufresne]

That's why it's important to have these exchanges between departments, between regulatory authorities and between industry players. Having had discussions with civil society and industry lawyers, I can tell you that this is part of the challenges they tell us about and the questions they ask us. They say that it's important not only in Canada, but internationally as well. There are multiple legislative regimes in this area around the world. So what do we do?

For our part, we work closely with them and try to find some commonality. In some cases, we even conduct joint investigations. We did one into TikTok with our provincial colleagues. It also helps businesses, because they only have to respond to us once.

However, if there isn't enough integration and interoperability, people in the industry might certainly say that they will think of this as one law taking precedence over another, which could raise all kinds of less relevant questions for consumers. As far as privacy is concerned, if two laws can apply, I always recommend that industry comply with the most demanding one. That way, it will make sure it complies with both. However, sometimes industry doesn't agree to taking that position.

[Gabriel Ste-Marie, Bloc, Joliette—Manawan, QC]

Thank you very much.

Mr. Chair, my time is almost up, so I will stop here, to follow your instructions.

[The Chair, Liberal, Ben Carr]

That's kind of you. I gave you 45 seconds extra last time, so thank you for giving that time back, Mr. Ste‑Marie.

Mr. Falk, you have five minutes, sir.

[Ted Falk, Conservative, Provencher, MB]

Thank you, Mr. Chair.

Thank you to our witnesses. You've provided some very valuable information.

I have a German shepherd dog that does investigations very quickly, issues his report swiftly and has the ability to escalate. You're telling me that you're missing the ability to escalate. You issue reports. What happens?

[Philippe Dufresne]

That's right. I issue a report and I make recommendations on whether there's been an infringement of legislation. We work with the respondents and say, “We want to bring you into compliance. Here is what we think you should do.” In many cases, I'm happy to say, the organizations will agree to our recommendations. They'll implement, and then we can say this was well founded and resolved, or conditionally resolved. That's the goal, unless it's not well founded. That even happened in the TikTok investigation, where they agreed to all our recommendations. That's a good-news story.

In some cases, there is no agreement, such as in the Pornhub investigation, where the organization refused—refused to require the express consent of all individuals whose intimate images are posted and refused to have a takedown mechanism that was at the level we felt would be user-friendly and quick enough. Then we have to take the matter to the Federal Court. It's different from an appeal in that we have to prove the case from the beginning, starting from scratch. Then the Federal Court will make its decision on whether there has been a breach or not. It can then be appealed all the way to the Supreme Court of Canada. That brings significant costs and delays to everyone—my office, the individuals affected and industry. It also delays the outcome.

In the case of Pornhub, it means there is no immediate enforceability of the order. If we had the ability to issue an order, the order would be made and then the information would be taken down. There could be an appeal afterwards, of course, and our decisions may be overturned, but in the meantime, Canadians would be protected. It would be the most protective approach. Right now we do not have that, and it's a gap.

[Ted Falk, Conservative, Provencher, MB]

You would say it's a significant enough gap that it should be addressed.

[Philippe Dufresne]

Absolutely. It should be addressed. We are standing out in the international community by not having this.

I'm grateful for the many times that organizations are going to agree to the recommendations, and that's a testament to them. However, as a legal regime, having something not enforceable that is so important to privacy, to individuals and to businesses that are, I would argue, part of Canadian values and necessary to freedom and democracy is a concern, and it should be fixed quickly.

[Ted Falk, Conservative, Provencher, MB]

Your mandate in this legislation is being expanded, but you're not getting the tools to really do the job.

[Philippe Dufresne]

Right now, there's no bill. It's expanded in this context from the standpoint that now there's going to be data mobility, but you are correct. I will have no greater enforcement power as a result of this than I did before.

[Ted Falk, Conservative, Provencher, MB]

On your enforcement, does that mean you always have to press legal charges, or do you go through the authorities to do that? Do you go to a minister to report it and say charges need to be pressed? What is the process?

[Philippe Dufresne]

No, I'm fully independent from the ministers. As an agent of Parliament, I report to you, to the House and to the Senate. I do not need that, but I need to take action in court and file applications with the Federal Court, with all of the necessary legal expenses that adds. I am like a prosecutor at that stage.

[Ted Falk, Conservative, Provencher, MB]

In the case of Pornhub, where you found significant breaches, law enforcement didn't pick up the torch and assign you a prosecutor who did the work for you.

[Philippe Dufresne]

No. We're doing that ourselves. I have lawyers representing me in court as we speak, and we're moving this forward. We continue to try to convince the organization to adopt our recommendations, but if this fails, the only avenue is to pursue the court matter to the end.

[Ted Falk, Conservative, Provencher, MB]

Inside this legislation, there's also a provision that allows ministers to waive laws without proper disclosure. I'm sure you have concerns there.

[The Chair, Liberal, Ben Carr]

Answer in about 30 seconds, Commissioner, if you can.

[Philippe Dufresne]

This is meant to allow the testing of technology and innovation and allows a suspension of legislation. We see that certain regimes have sandboxes. This is also very much an area where I would like to see regulator involvement. In many regimes, we see the regulators—my equivalents—involved in that. They participate in those sandboxes and are there to say “we have concerns” or “we don't have concerns”. That's not present in this current form.

[The Chair, Liberal, Ben Carr]

Thank you, Mr. Falk.

Mr. Ma, the floor is yours for five minutes.

[Michael Ma, Liberal, Markham—Unionville, ON]

Thank you, gentlemen, for being here.

My first question is, does this legislation mandate that data reside in Canada as a first measure? In the case of data mobility, will there be explicit consent by the consumer around exactly where the data will reside so they know exactly where the data is going?