Industry Committee on May 29th, 2020

[Daniel Therrien]

In my opinion, we can proceed in two stages.

As I was saying, even under our current flawed legislation, if an application were properly designed, it could work.

That said, a group called CIFAR, a research institute mandated by Dr. Mona Nemer, the Prime Minister's chief science advisor, recommended specific legislation for tracing applications. This legislation would essentially replicate the principles adopted with our provincial colleagues, and would give the federal or provincial commissioners a monitoring role, a watchdog role, with respect to the implementation of these principles.

The legislation should be amended. I wouldn't say that it's necessary to amend it immediately, but in the near future. These amendments would address not only the tracing applications, but also other uses of technology that are necessary and very useful for society. Consider telemedicine, for example, which is increasingly being used in the context of COVID-19.

It's extremely useful for society to have this type of tool. However, what about the privacy of conversations between patients and doctors on digital platforms?

The legislation is completely deficient when it comes to protecting personal information.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Exactly.

[Daniel Therrien]

The legislation must be amended soon, if not immediately.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

I gather that we're talking about the decorrelation of the social insurance number and about favouring a digital identification that will enable us to protect people's privacy. As you've already said several times, the personal data of 30 million out of 37 million Canadians is in circulation and can be used. Fraud makes this clear.

I want you to speak about the urgent need to address this. You've been telling the government about this issue for several years. Unfortunately, from one piece of legislation to the next, we keep moving straight past the issue.

What do you think about this?

[Daniel Therrien]

As you said, we've been suggesting for years that the federal legislation be amended. However, this issue is even more urgent in the context of COVID-19 and the increasing use of technology for purposes that are very useful but that expose people to risk. This is one of our important messages today.

You're talking about digital identity. That's one aspect. We've seen in the past that digital identity based on a social insurance number doesn't protect Canadians very well. This issue must be addressed as part of a legislative reform. That said, the issue isn't straightforward. Modern ways of protecting identity could be based on biometrics, among other things. However, the use of biometrics also raises privacy issues. This must also be addressed.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Okay.

I now want to ask a question about the approach implemented at Statistics Canada to measure the level of trust. You also know that we have a very low level of trust with regard to the management of our data.

What do you think of the results, which will be released in July, concerning the trust that Quebeckers and Canadians have in the government, among other entities, and which could enable us to make quick choices?

[Daniel Therrien]

Are you talking about the results of our survey regarding Statistics Canada?

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

I'm talking about the recently announced survey regarding people's level of trust, which is under way. The results will be released in July.

[Daniel Therrien]

I'm not sure that I saw what you're referring to. However, one thing that COVID-19 has demonstrated is that the private sector and the public sector are working together with regard to the use of data, which isn't necessarily a bad thing.

For example, we can see that the federal government and the provinces are holding discussions with various developers, including Google, Apple and many others. The private sector and the public sector are working together on data processing. Since data travels between the two sectors, this shows us that we should amend not only the private sector legislation, which has been discussed extensively at the federal level for years, but also the public sector legislation. It's very important—

[The Chair, Liberal, Sherry Romanado]

Sorry, but you're out of time.

Our next round of questions goes to MP Masse.

You have six minutes.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Madam Chair.

Again, thank you to you and the committee for the motion passed earlier to help Canadians fight fraud. It's much appreciated.

I will start with this question. In 1983, when the Privacy Act was passed and we created our current regime, we had floppy disks. We had mostly paper files, all those things. There hasn't been a major modification to the act. There were two attempts, I think, in 2010 or 2011, in which there was tabled legislation that Parliament never passed, so we're dealing with a very antiquated process to protect the public.

I believe the work the Office of the Privacy Commissioner has done since I've been a member of Parliament has been terrific. It's been important for citizen rights and also important for the economy. I would argue that it's actually strengthened investment in newer technologies in some sectors.

First of all, should this contact tracing be rolled out, would there be a way to differentiate where the exact strengths and weaknesses of an application could be within your powers? Second, would you be in support of a process whereby Parliament could reconvene quickly to pass legislation to give specific empowerment to protect people for data contact tracing? Would that be something that you would consider, as opposed to living with the weaknesses of the current legislation?

[Daniel Therrien]

Clearly, it would be much better if the legislation were amended. I spoke about the transfer of data between the public and private sectors. However, there's also the current issue of transfers between the federal and provincial governments. It's a very complex world, with a number of stakeholders. It would be extremely useful to adopt common principles for all stakeholders in order to better manage data transfers and data use while respecting privacy.

As things stand now, the Office of the Privacy Commissioner of Canada would have jurisdiction only if a federal department were using data. This possibility isn't straightforward, since the federal government says that it wants to favour an application that could be implemented by the provinces. If no personal information is collected by a federal institution or department, the office would have no role to play. However, if provincial authorities collect and use personal information for the purposes of COVID-19, then my colleagues in the provinces will have jurisdiction.

[Brian Masse, NDP, Windsor West, ON]

Okay.

One of the things that you did was outline to us some major points. One weakness I'm concerned about and would like to get your opinion on is if we did contact tracing. It seems like a lifetime ago, but when Paul Martin moved to outsource the Canada census to Lockheed Martin—which was done—one of the problems that we faced, and fought a national campaign to reverse, was for the data to stay in Canada for assimilation because it was going to be shipped to Minneapolis, I believe, at that time. Under the U.S. Patriot Act, it became vulnerable.

Do you have any concerns about foreign applications and movement of data on any contact tracing? There have been considerable discussions internationally—including in France, most recently—about contact tracing, even everything from surveillance technologies.... You could even have consumer exposure. How do you feel about the data, information and security staying in Canadians' hands?

[Daniel Therrien]

I'll start by saying that Canada recently entered into trade agreements that limit its power to impose rules requiring that data remain in Canada. That said, some multinational corporations have their servers in Canada, which could be a solution, in practice. This issue is very complex. Trade agreements are a very significant factor that can limit Canada's power to require that data remain in the country.

That said, even if foreign companies had a role to play and even if personal information were to leave Canada, this wouldn't be an issue, provided that the companies comply with the proposed principles. Google or Apple could therefore say that they don't want to collect this personal information.

I'll conclude by addressing the “if.” If our principles are respected, there's no issue for privacy. However, companies or even the government are under no obligation to comply with the proposed principles. The Personal Information Protection and Electronic Documents Act doesn't go as far, which means that companies and the government could fail to comply with some of our principles because these principles aren't legally binding.

[Brian Masse, NDP, Windsor West, ON]

Really quickly, the problem with your current circumstance is similar to Facebook. You have to go to court. You have very limited tools to enforce breaches and bad conduct. Is that not correct?

[Daniel Therrien]

That's certainly part of the challenge. As I said, our legal system doesn't include basic principles such as those that we proposed to regulate the collection and use of personal information through tracing applications.

[The Chair, Liberal, Sherry Romanado]

Thank you very much.

We will now go to MP Patzer for five minutes.

I have a quick reminder. When you see this yellow card, you have 30 seconds until the end of your intervention. Thank you.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Thank you very much, Madam Chair.

I have a quick question right off the top here. Would it not be a violation of personal property rights to force an opt-out system for contact tracing, especially since it requires a forced update on our phones, which are our personal property, not the government's?

[Daniel Therrien]

Again, I am not sure I understand exactly how such a measure would apply in practice.

I understand that the companies responsible for the platforms could propose a modification that normally could or could not be accepted by the user. Are we talking about making the device not work unless consent is given? I'm not sure I understand exactly the nature of the proposal that would lead us to implied consent.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Yes, and again, it's the whole forcing of an update onto somebody's phone so it would automatically have that update. I get the consent piece, but for it to work in practice, you would have to force the system onto people's devices.

Moving on, recently an epidemiologist and associate professor at the University of Ottawa stated, “public health issues take precedence over individual rights issues”. Does your office share this belief that public health trumps individual rights?

[Daniel Therrien]

No, we believe that both of these objectives are very important. We do not in any way question the importance of protecting public health, especially at this time. We don't think it's a question of one interest over another. We think it is entirely possible to protect both interests at the same time.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Do you think the government is operating under the assumption, though, that public health takes precedence over individual rights?

[Daniel Therrien]

That's not what I'm hearing from ministers and public servants. What I am hearing is that privacy is very important, even paramount, according to some. I'm not questioning the interest or the intentions. Rather, I am questioning the fact that it is possible for certain players, including companies, to ignore the principles we are promoting and not protect privacy.

What I'm hearing are goals and intentions that I think are laudable. The question is whether they will be put into practice. That's why we are offering our services to look at exactly how these technologies would be designed.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Thank you for that. I appreciate it.

Has the government previously shown it is willing to fully co-operate with your office and its investigations?

[Daniel Therrien]

Departments generally cooperate with our investigations. They don't always agree with us. On balance, again, we do not have the authority to order a department or a company to behave in a certain way. Procedurally, departments cooperate, but on a fairly regular basis, not always, of course, departments do not agree with our recommendations.

This brings us back to the deficiency of the legal framework. We believe that a privacy expert should be able to order certain changes in practice to ensure that privacy rights are respected, as is the case in other jurisdictions.