Evidence of meeting #101 for National Defence in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was office.
A recording is available from Parliament.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That example doesn't bring anything to mind.
Bloc
Christine Normandin Bloc Saint-Jean, QC
If that scenario were accurate, could it cause problems that might fall under your jurisdiction or under the Privacy Act?
I'm drawing a parallel with what happened to Véronique Cloutier, who found out that 400 individuals had needlessly accessed her medical file.
It seems that military personnel don't know who or how many individuals have accessed their file. For example, it might be someone who is the subject of a complaint made by that military member. If that's the case, what problems could arise?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
One of the problems that could arise concerns the reason the individual obtained the information: It needs to be a legitimate reason and relate to the organization's legislative mandate.
Second, the information collected must be protected. It must not be disclosed without cause and any disclosure of the information generally needs to be related to the initial reason it was collected.
When information is provided, not everyone in government needs to know it. If information is shared for purposes other than its intended purpose or if it isn't adequately protected, that's where privacy breaches can occur.
Bloc
Christine Normandin Bloc Saint-Jean, QC
Thank you very much.
On another subject, I'd like to hear your comments on artificial intelligence, or AI. I understand that you've done studies on ChatGPT, among others. As a result, you know how user data is being used, retained and shared.
The Minister of National Defence said that the army is likely to make increasing use of AI in the future. This is also true of the United States, which signed agreements with Amazon and Google.
Could you comment on the risks associated with the armed forces' use of AI on the personal data of military personnel and others?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Indeed, an investigation into ChatGPT, which I am conducting jointly with my counterparts in Quebec, British Columbia and Alberta, is still ongoing.
My G7 colleagues and I hold frequent discussions, both at the ministerial level as well as among fellow privacy commissioners. We released a statement on AI in which we stressed not only the need to adopt new laws and modernize others, but also the fact that existing legislation, including privacy laws, is already applicable to AI.
In December, my provincial and territorial counterparts and I released a statement in which we put forward various privacy principles that we want to see implemented. It refers in particular to consent, lawful authority, rigour, security and the consequences of using AI, including—even if it's not exactly within our mandate—the issue of discrimination.
The advantages of using AI need to be identified, because there are many, but guidelines also need to be established, even with existing legislation.
Additionally, with my colleagues from the Canadian Radio-television and Telecommunications Commission and the Competition Bureau, we created the Canadian Digital Regulators Forum to co-operate on these issues, particularly ones involving artificial intelligence. The considerations go beyond privacy, competition and discrimination, so we need to work closely together, even on national security issues.
That's certainly an important file for us, and one of my office's strategic priorities.
Liberal
NDP
Lindsay Mathyssen NDP London—Fanshawe, ON
Thank you for joining us today.
Earlier in this study, we heard from Michel Drapeau that when CAF members are filing grievances and cannot access their information, your team is in place, and that's the only way they can access some of that. You mentioned before that so many of the cases you deal with are lagging behind in terms of being able to get information. Even with the investigations that your office can take on, they take about a year or so, which creates a lot more delay in terms of that pursuit for information on their grievance.
Can you tell us where the delays are created and what's being done, if anything, by DND-CAF to improve that?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I can tell you certainly that, throughout, we are seeing this issue of delay as being an important one to tackle—for ourselves as well, the complaints, the process that we have. We've put forward as one of our strategic priorities the notion of looking at our own processes and whether we can make those more efficient. We've obtained resources from government and Parliament in terms of dealing with backlogged cases, prioritizing certain cases, and looking at our processes to see if they're as efficient as they can be and whether there are things that need to be changed.
That should be done by departments as well. That's where putting it as a priority, making sure that you are challenging your processes, you're removing inefficiencies and you're making sure that these things can proceed efficiently is certainly very important.
NDP
Lindsay Mathyssen NDP London—Fanshawe, ON
The deputy minister of defence said that the department was doing that.
In your opinion, is that the case?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I can speak about my office. We are still seeing some complaints...with time limit complaints. That's a big proportion of that.
I would encourage DND and all departments to continue their efforts in that.
NDP
Lindsay Mathyssen NDP London—Fanshawe, ON
I have a bill, Bill C-362, that creates an independent civilian oversight agency within the ombudsman's office for CAF and DND. Many witnesses have supported this. Former ombudsmen have supported this.
The reason for that is the need for investigative bodies to have more teeth. As you mentioned before, certainly this could be very helpful.
The department refuses sometimes to disclose information, whether it's to CAF members going through the grievance process, veterans, journalists or researchers. As Mr. Kelly mentioned, the department will only disclose this information.... It's only when your office gets involved that they can get anything.
Can you talk about the teeth, I guess, that your team has on the investigative powers piece? Do you believe that more is necessary for the independence in that role within the offices?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Absolutely. We are working with departments on the complaints side, the guidance side and the promotion side. There is good collaboration, but the reality is that we do need to have order-making powers and binding authorities. It just assists.
It's not because I want to issue those orders. The mere existence of that possibility tends to focus the minds of decision-makers. It helps to prioritize efforts in those aspects. This is why it's very important that my office be given these order-making powers in both the private sector and the public sector context.
NDP
Lindsay Mathyssen NDP London—Fanshawe, ON
Ultimately, when you do find that there's a breach, what happens?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We'll investigate it. We'll make a finding. We'll make recommendations. In many cases, but not all, the recommendations are followed, and that's a good thing. That's where the order-making power comes in.
In the case of privacy impact assessment, it's required in Treasury Board policy. It's there. It has to be done before the program is launched. We have to be informed. We have to be consulted. It doesn't always happen. Sometimes it will happen after the program has been launched, which creates more risk for everyone.
Liberal
The Chair Liberal John McKay
Thank you, Ms. Mathyssen.
If the clerk's and my math is correct, we can still get another four-minute round in. If we don't, it's the clerk's fault. If we do, it's still the clerk's fault.
With that, Mr. Allison, go ahead for four minutes, please.
Conservative
Dean Allison Conservative Niagara West, ON
Thanks, Chair.
Thanks to our guests for being here today.
My question is, how would you rate the job that DND and CAF are doing based on the fact that we have over 300 complaints...the number of days delayed, etc.?
How would you describe DND and CAF? Would you describe them as being transparent and a good example of a compliant department?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We have statistics in our annual report in terms of the number of complaints that we received versus the department. They are certainly among the higher ones, with a higher number of complaints. We have received good collaboration from them. We're working with them to resolve these cases.
On the list, they would be fifth from the top in terms of the number of complaints that we've received.
Conservative
Dean Allison Conservative Niagara West, ON
It's in the top 10. Okay, there we go.
What about individuals who get an ATIP sent back that's deemed refused? What are their options?
If it's deemed refused, how do they respond?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Their option is to go to federal court. The legislation provides that at that stage, individuals can exercise those rights.
This is the import of that determination. It opens up that recourse with the federal court.
Conservative
Dean Allison Conservative Niagara West, ON
It almost seems impossible for an individual to be able to go to court to do that.
Is that correct?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Well, it's something they have to do. The onus is on them to do that.
Conservative
Dean Allison Conservative Niagara West, ON
Is the only option to go to court and incur some sort of costly legal battle to do that?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That's the only option to have enforcement.
That's why having order-making powers to be able to have a decision that will be binding is something we've been recommending.
Conservative
Dean Allison Conservative Niagara West, ON
Does the Privacy Commissioner have the same legal authority, when it comes to taking DND to court, as the Information Commissioner?
What types of powers would you have in terms of being able to deal with that?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
We have important powers in terms of the ability to obtain information from the departments as part of our investigations, so we can do that, but the power that we lack is the power to issue a binding order at the end of the investigation when we make a finding. If we make a finding that the legislation was not complied with, we make a recommendation rather than an order, so that's the critical difference.
There are also some who argue for there to be financial consequences—fines and so on—and that's something that's being proposed in the private sector legislation that's currently being debated in committee.
However, for the public sector, at a minimum, having this order-making power would, in my view, make the process more expeditious, because you would have the investigation by my office, by the regulator, and then you get a decision, and then that decision is binding. Instead of having the individual have to go to court and take those steps, that order applies, and then it would be up to the department to challenge that order in a court process.