Public Safety Committee on April 3rd, 2019

[Dr. Gregory Smolynec]

Of course.

[David Graham, Liberal, Laurentides—Labelle, QC]

I would appreciate that. Thank you.

I have one last question. In the interest of time, I'll then share what time I have left with Mr. Picard.

Is there any privacy without security?

[Dr. Gregory Smolynec]

My initial response would be, yes, I can imagine circumstances where security concerns are not paramount, let's say, and a person wants to maintain some aspect of their identity or their personal information private. I suppose you could characterize something as a security issue, but it might be more of a privacy incident. Let's say it's an issue of privacy where an individual who might have access to a space legally, one where security clearances aren't a factor, really shouldn't be snooping—in a workplace, in a domestic setting, in a neighbourhood.

[David Graham, Liberal, Laurentides—Labelle, QC]

So not really. There are theoretical edge cases where you have privacy without security for it. At the core, if there's no security to protect privacy, the privacy is more or less meaningless in technology.

[Dr. Gregory Smolynec]

I wouldn't say so. I think you could have instances where people could be prying into the personal information of others without crossing any kind of physical or other barriers or security impediments, and where it's still a privacy violation that's taking place, but it doesn't necessarily indicate a breach of security.

[David Graham, Liberal, Laurentides—Labelle, QC]

Thank you.

[Michel Picard, Liberal, Montarville, QC]

Good afternoon.

Here's a scenario for you.

In the age of cloud computing and platforms such as iCloud, information on Canadians is stored on servers that belong to Canadian companies based abroad or on servers that belong to foreign companies. In either case, the information is on servers outside Canada; it's just the owner that's different.

To what extent can Canada regulate (a) data stored abroad and (b) third parties holding the information when they are not necessarily Canadian? Where does Canada's legislative authority end? What would you recommend on that front?

[Dr. Gregory Smolynec]

First of all, if the personal information of Canadians is at stake, any foreign company holding the information is subject to Canadian law. Canadian statutes applicable to the private sector stipulate that Canadians must provide express consent before their data can be transferred to a foreign jurisdiction.

Second of all, there are limits. Of course, technological advancements and business models operate on a large scale, so it's complicated, but the laws still apply.

[The Chair, Liberal, John McKay]

Thank you, Mr. Picard.

Mr. Paul-Hus, you may go ahead for six minutes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Thank you, Mr. Chair.

I missed the last question, so I may ask a similar one.

Foreign companies have a hand in our telecommunications networks and infrastructure. When companies with infrastructure in Canada are controlled by countries whose rules are different from ours, it gives rise to privacy protection concerns. Do you share those concerns?

[Dr. Gregory Smolynec]

It depends on each case.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Here's a real-life example. Chinese company Huawei and its 5G infrastructure are top of mind these days and people are concerned. China could decide to deploy its Huawei infrastructure in Canada. Has your office discussed the issue with the government?

[Dr. Gregory Smolynec]

Yes. Since 5G networks are used to share personal information, privacy protection issues or concerns certainly come into play. That is clear.

It is therefore important to make sure the networks are secure and provide adequate protection against a variety of threats including, of course, known threats. As for other countries' companies, we don't have the authority to conduct that kind of analysis.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I referred to Chinese company Huawei, but I can put the question in more general terms. Does your mandate to protect the personal information of Canadians include monitoring all the infrastructure in place in Canada?

[Dr. Gregory Smolynec]

Yes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

You have a duty to inform the government of various risks, so do you?

[Dr. Gregory Smolynec]

Yes.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Very well.

Now I'd like to turn to mobile devices. My iPhone has a facial recognition feature. Apple says my privacy isn't at risk and that the information stays on my phone. I have a hard time believing that. Do you pay attention to issues related to mobile devices such as visual and retinal recognition and the potential transfer of data to companies?

[Dr. Gregory Smolynec]

Yes, of course.

We perform technical analyses through our technology analysis directorate.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Can you tell us whether we are protected or at risk?

[Dr. Gregory Smolynec]

It depends on the specific device.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

I see.

You can't say whether some companies pose a greater risk than others?

[Dr. Gregory Smolynec]

Right now, I can't, no. Not here.

[Pierre Paul-Hus, Conservative, Charlesbourg—Haute-Saint-Charles, QC]

Very well.

That is nevertheless the kind of information that is available and in the government's hands.

[Dr. Gregory Smolynec]

We have limited capacity. We currently have six people working at the technology analysis directorate, so we don't have the resources to examine every device, network and so forth.