Evidence of meeting #90 for Industry, Science and Technology in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was office.
A recording is available from Parliament.
5:20 p.m.
Liberal
The Chair Liberal Joël Lightbound
Thank you very much. I'll now turn to Mr. Turnbull.
The floor is yours.
5:20 p.m.
Liberal
Ryan Turnbull Liberal Whitby, ON
Thanks, Commissioner.
There's some really great conversation today. I really appreciate all the questions and the positive engagement here. I think this is really good for this work and this legislation.
I want to get back to a line of questioning that I started on and didn't quite finish.
I sort of take it that Bill C-27 and the minister's letter, which provides details, introduce new obligations for organizations and companies. It's also giving your office and you new powers, which I think are both positive.
One of the questions that keep coming up for me when considering what work you'll have ahead, once we hopefully get this bill through and strengthened in many ways, is whether there is enough around detecting non-compliance. It seems to me that it must be hard to detect who is not complying with these additional obligations that are being introduced in Bill C-27.
Can you speak to how you'll undertake that? I know you mentioned it with the last question about additional resources needed. I'm certain that's part of it, but could you speak to how you'll detect non-compliance when it does occur?
5:20 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, for sure.
Certainly, resources are part of it, because there are a number of things here, whether they are audits, certification programs, guidance or communication, to make sure Canadians can flag things for us. There's also the technological aspect. We have a technical lab at the OPC, where we are trying to stay ahead of the evolving technology, and getting those resources, that expertise and that understanding will be important. Using all those tools, compliance and the request for information, there are obligations in there where I can ask to see certain information of organizations or their privacy management programs.
Certainly we'll need something put in place so that we are not in a reactive mode but are aware of what's going on. I have to say, we have good engagements with representatives in industry and academia. I think this will continue, both in Canada and internationally, to make sure that we are hearing what the trends and concerns are and can act on them.
5:20 p.m.
Liberal
Ryan Turnbull Liberal Whitby, ON
Just as a thought experiment—because I'm sort of testing this in my mind—I'm sure there are cases of bad actors who are not forthright in fulfilling their obligations in certain instances. I guess what I'm asking is whether you have sufficient powers and tools to be able to really detect those nefarious activities where they may not, and intentionally may not, be living up to the obligations, even once Bill C-27 has passed?
5:20 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We will continue to develop our technical abilities and our technical resources in terms of identifying things we see in the ecosystem. The bill will provide more powers to obtain information and to initiate audits. There is an ability for my office to launch investigations. We call them “commissioner-initiated investigations”. That exists. That's what we've done in the context of our TikTok investigation and in the context of ChatGPT.
We're going to continue to use all the tools we have. Legislation would place more obligations on organizations to proactively share their information. In terms of bad actors, we'll need to make sure we're proactively able to identify them, working with our colleagues.
5:25 p.m.
Liberal
Ryan Turnbull Liberal Whitby, ON
Thank you.
Do you start an investigation only when you get a complaint, or how do you initiate or initially detect individuals—or companies, in most cases, I think—that are not living up to their obligations? Currently how do you do that? Also, in the future, how do you envision doing that? I assume that, with additional obligations and additional powers, there's going to be a lot more activity to monitor, and we want that. I think this bill enables that and is designed in such a way as to empower you to do that. However, I guess I'm just a little unclear as to what that process looks like.
5:25 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We do not require a complaint from an individual to launch a matter. We have the ability to issue audits. We have the ability to issue a commissioner-initiated investigation. That can come from a variety of sources. It could come from the monitoring of media reports. It could come from monitoring industry experts and actors who could flag things.
We're going to continue to expand on these capabilities to do spot checks and to make sure about trends and concerns, but certainly this is something that needs to be proactive and not just reactive. We'll need to have the resources for it, because, as you say, the environment is vast, and there are a lot of resources outside of my office, including in organizations that we may need to be investigating. We need to have equivalent capabilities, then, to do our work.
5:25 p.m.
Liberal
Ryan Turnbull Liberal Whitby, ON
I'm not trying to give you ammunition to ask for even more funds, but I suspect that there's a lot of online activity and a lot of data being collected, and I suspect that it would be very challenging to try to monitor and detect any breaches of the obligations that would be in Bill C-27. With respect, I think you have your work cut out for you in the future. I don't envy you that, but I appreciate the work that will be undertaken.
Maybe I'll leave it there for the moment on that.
I have another question or two. On the flip side of this—and I think my colleague Mr. Van Bynen asked some questions about this—what are the risks in going too far? By “going too far”, I mean are there risks within this legislation and this debate we're having, such that we could go a step or two too far and impede all of the positive benefits Canadians are getting out of the use of these online tools?
The data that's collected has enhanced our lives in a lot of different ways. There's a sense in which there's that balancing act between innovation and privacy, which you've already talked about. I guess I want to know specifically whether you see any risks in going too far. We really have been talking from the other side, about not going far enough on privacy rights. If we go too far, we might also stifle innovation. Would you agree with that, and are there any risks to that?
5:25 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We have to strike the balance, but we have to remember that we are dealing with a fundamental right, so we need to start with that premise. We need to make sure we're protecting the fundamental right to privacy, because it's core to who we are as a society and as individuals.
Absolutely, though, we need to do it in a way that supports innovation. We need to do it in a way that puts Canada in a competitive situation and that allows Canada to work and trade on the world stage.
The good news, in terms of protecting privacy, is that it actually gives us economic advantages in many ways, certainly in terms of Europe and being recognized by that system as providing adequate levels of privacy protection. That's not just good for privacy; it's good for trade, because it allows our companies to trade with Europe in a better way.
There are benefits there, but absolutely we need to make sure, and you need to hear from industry. I've heard from industry. I have good dialogues with them. They may not always take the position I do, and that's okay. However, I can tell you that we have regular discussions and exchanges. They will be coming in front of you, and they have a valid perspective to bring.
5:25 p.m.
Liberal
Ryan Turnbull Liberal Whitby, ON
They do.
I was sort of leading up to this, which is interesting. With very much respect, I'll say.... As the Privacy Commissioner, advocating for the fundamental right of privacy, it seems to me that you might naturally be inclined to support one side of this debate. I can hear that you definitely appreciate the side of innovation and industry, which, in a way, is the minister's responsibility.
There also may be a flip side to this. Those industry stakeholders would express their position with regard to where we could go too far and limit the benefits that are also very important for this work. I wanted to put that out there.
Respectfully, I hope we can continue to have a very collaborative working relationship as we move forward. I would expect nothing less, because that's been the history so far in our working relationship.
Thank you very much for being here today. With great respect, I really appreciate your testimony.
5:30 p.m.
Liberal
The Chair Liberal Joël Lightbound
Thank you very much, Mr. Turnbull.
Thank you, Mr. Dufresne, and your team for making yourself available again.
5:30 p.m.
Voices
Hear, hear!
5:30 p.m.
Liberal
The Chair Liberal Joël Lightbound
It's not every day that our witnesses are applauded like that. It's a credit to you.
I thank the analysts, interpreters and support staff.
The meeting is adjourned.