Evidence of meeting #108 for Public Safety and National Security in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was privacy.
A video is available from Parliament.
6:10 p.m.
Liberal
Chris Bittle Liberal St. Catharines, ON
Is some mythical agency that the government will create—a better agency to deal with it?
6:10 p.m.
Liberal
Chris Bittle Liberal St. Catharines, ON
With respect to agencies that exist, Senator, you'll agree with me that this is the agency that is most likely to police this particular piece of legislation.
6:10 p.m.
Liberal
6:10 p.m.
Senator, Quebec, ISG
Well, I'm not going to be pushed to answer a question like “you'll agree with me”. It's not the kind of question I like. We have not defined in the bill who it is, so you can certainly think what you're thinking, but I would come back to the following fact. What would you have done to define pornography without taking the definition in the Criminal Code, which is one of our main laws in Canada, and which is serious, which has been interpreted by all the courts as being pornography, not as being artsy pictures of whatever?
You're right that there's a dose.... It's not scientific, but I would say this definition is pretty good and has been used in the past to show that this is not light.... This is pornography we're talking about when we're using sexually explicit material.
6:10 p.m.
Liberal
The Chair Liberal Ron McKinnon
Thank you both.
Thank you to Mr. Lussier and the senator for bearing with us here tonight.
That concludes this portion of the meeting. We'll suspend and bring in the next panel.
We're suspended.
6:15 p.m.
Liberal
The Chair Liberal Ron McKinnon
I call this meeting back to order.
I would like to welcome our witnesses for this second hour.
From the Office of the Privacy Commissioner of Canada, we have Mr. Philippe Dufresne, the Privacy Commissioner of Canada, and Lara Ives, executive director of the policy, research and parliamentary affairs directorate. From the Department of Canadian Heritage, we have Owen Ripley, associate assistant deputy minister of cultural affairs; Katie O'Meara, policy analyst; and Galen Teschner-Weaver, policy analyst.
Mr. Dufresne, thank you for waiting. You've been very patient. I now invite you to make an opening statement of five minutes, please.
6:20 p.m.
Philippe Dufresne Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Thank you, Mr. Chair.
Thank you to the Members of the Committee for this invitation to appear on your study of Bill S‑210, An Act to restrict young persons’ online access to sexually explicit material.
As Privacy Commissioner of Canada, my mandate is to protect and promote individuals’ fundamental right to privacy. This includes providing advice, guidance, and recommendations for protecting personal information, and overseeing compliance with Canada’s two federal privacy laws—the Privacy Act, which applies to federal government institutions, and the Personal Information Protection and Electronic Documents Act, which is Canada's federal private-sector privacy law.
In January, I launched my Strategic Plan for my Office which is focused on three priority areas: maximizing the OPC’s impact in promoting and protecting the fundamental right to privacy; addressing and advocating for privacy in this time of technological change; and championing the privacy rights of children.
I support the purposes of Bill S-210, which include protecting the mental health of young people from the harmful effects of being exposed to sexually explicit material, but the bill raises some privacy implications, and I would propose some changes to address them.
As drafted, the bill provides that any organization that makes sexually explicit material available online to a young person for commercial purposes is guilty of an offence and liable to a fine that would increase in amount, depending on whether it was a first or subsequent offence. A defence is available if an organization believed the young person was at least 18 years of age, having implemented a prescribed age verification method to limit access to the sexually explicit material.
Age verification can raise privacy implications, as it generally requires the collection of personal information, which could include biometrics or identity documentation. As drafted, the bill would apply to services, such as social media and search engines, that may make available some sexually explicit material, but may be primarily focused on other content. This could result in age verification requirements, including when the majority of content may not be of a sexually explicit nature.
To address this, the committee could consider restricting the requirement for age verification to websites that primarily provide sexually explicit material for commercial purposes.
Before prescribing an age-verification method, the Governor in Council would need to consider certain criteria, including whether the method maintains user privacy and protects users’ personal information. These criteria are important and beneficial.
I would recommend adding additional criteria to the list to ensure that the prescribed methods are sufficiently privacy protective. Specifically, this could include assessing whether the prescribed methods are proportionate and limit the collection of personal information to what is strictly necessary for the verification. Age-verification methods should also prevent tracking or profiling of individuals across visits to websites or services.
Internationally, various jurisdictions have taken action to prevent children from accessing pornography, but some of these laws have a narrower application than Bill S-210. For example, Texas and Utah only require age verification measures on sites that meet a certain threshold of pornographic content. Some regulators have also worked to mitigate the privacy risk associated with the use of age verification technologies. For example, Spanish and French regulators have worked with researchers to develop and evaluate potential age verification mechanisms.
My office is conducting further research in this area and is a member of an international working group with other privacy regulators to share information on age-verification methods and learn from each other’s experiences. Notably, members of this working group intend to publish a joint statement of principles for age assurance later this year. My office is also developing guidance for organizations on age assurance and privacy, and will launch an exploratory consultation on this next month.
Finally, should Bill S-210 be adopted, I would be happy to provide advice on regulations that pertain to privacy and the protection of personal information at the appropriate time. I will be pleased to take your questions.
Thank you.
6:25 p.m.
Liberal
The Chair Liberal Ron McKinnon
Thank you, Mr. Dufresne.
We'll go now to Mr. Ripley.
I invite you to make an opening statement of up to five minutes.
6:25 p.m.
Owen Ripley Associate Assistant Deputy Minister, Cultural Affairs, Department of Canadian Heritage
Mr. Chair, thank you for inviting me to discuss Bill S‑210. As the associate assistant deputy minister for cultural affairs at the Department of Canadian Heritage, I will be responsible for the Online Harms Act that is being proposed as part of Bill C‑63.
While Bill C‑63 was being drafted, the department heard directly from experts, survivors from civil society and members of the public on what should be done to combat the proliferation of harmful content online.
A common theme emerged from these consultations: the vulnerability of children online and the need to take proactive measures to protect them. With this in mind, the future online harms act proposes a duty to protect children, which will require platforms to incorporate age-appropriate design features for children. Bill C‑63 also proposes a specialized regulatory authority that will have the skills and expertise to develop regulations, guidance and codes of practice, in consultation with experts and civil society.
Bill S-210 seeks to achieve a similarly admirable goal of protecting children online. However, the bill is highly problematic for a number of reasons, including a scope that is much too broad in terms of regulated services, as well as regulated content; possible risk to Canadians' privacy, especially considering the current state of age-verification frameworks internationally; structural incoherence that seems to mix criminal elements with regulatory elements; a troubling dependence on website blocking as the primary enforcement mechanism; and a lack of clarity around implementation and an unrealistic implementation timeline.
I'll briefly unpack a few of these concerns in greater detail.
As drafted, Bill S-210 would capture a broad range of websites and services that make sexually explicit material available on the Internet for commercial purposes, including search engines, social media platforms, streaming and video-on-demand applications, and Internet service providers. Moreover, the bill's definition of sexually explicit material is not limited to pornography but instead extends to a broader range of mainstream entertainment content with nudity or sex scenes, including content that would be found on services like Netflix, Disney+, or CBC Gem. Mandating age-verification requirements for this scope of services and content would have far-reaching implications for how Canadians access and use the Internet.
While efforts are under way globally in other jurisdictions to develop and prescribe age-verification technologies, there is still a lack of consensus that they are sufficiently accurate and sufficiently privacy-respecting. For example, France and Australia remain concerned that the technology is not yet sufficiently mature, and the testing of various approaches is ongoing. Over the next couple of years, the U.K. will ultimately require age assurance for certain types of services under its Online Safety Act. Ofcom is currently consulting on the principles that should guide the rollout of these technologies. However, the requirement is not yet in force, and services do not yet have to deploy age assurance at scale. In jurisdictions that have already moved ahead, such as certain U.S. states or Germany, there continue to be questions about privacy, effectiveness and overall compliance.
In short, these international examples show that mandates regarding age verification or age assurance are still a work in progress. There is also no other jurisdiction proposing a framework comparable in scope to Bill S-210. Website blocking remains a highly contentious enforcement instrument that poses a range of challenges and could impact Canadians' freedom of speech and Canada's commitment to an open and free Internet and to net neutrality.
I want to state once again that the government remains committed to better protecting children online. However, the government feels that the answer is not to prescribe a specific technology that puts privacy at risk and violates our commitment to an open Internet. It is critical that any measures developed to achieve this goal create a framework for protecting children online that is both flexible and well-informed.
Thank you for your attention. I look forward to any questions you may have.
6:30 p.m.
Liberal
The Chair Liberal Ron McKinnon
Thank you for your remarks.
We'll now go to our questions.
We'll start with Mr. Caputo, for six minutes, please.
6:30 p.m.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Cariboo, BC
Thank you very much, Chair, and thank you to the witnesses for being here on this important matter.
It goes without saying that everybody around this table believes that protecting children from materials they shouldn't be consuming is of great importance, particularly sexually explicit materials. I have a 10-year-old son, and it's, unfortunately, time to have the talk. We heard in the senator's prior testimony that about 10% of nine-year-olds... I believe that was the statistic. I had to step out, but I was going to verify that statistic. Clearly, there is a pressing and substantial public interest in restricting children from this type of material.
To the Privacy Commissioner, did you appear at the Senate committee, or send any briefs, or anything like that?
6:30 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
No, I did not.
6:30 p.m.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Cariboo, BC
Thank you.
The focus of a lot of what I'm looking at here... The Privacy Commissioner did speak about regulations.
Could any of the concerns you mentioned be allayed through appropriate regulations?
6:30 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I mentioned one aspect with respect to the scope of the organizations captured, so that may be something that would require a change to the statute. However, yes, as to the regulations, we recommend necessity and proportionality. We recommend no tracking of individuals with this information. These are consistent with international best practices and agreements between my colleagues.
They could be put into regulations. If the statute adds the criteria, it just provides more certainty that the government will follow through on that. Either way, I will certainly be making recommendations to the government at the recommendation stage with respect to those contents.
6:30 p.m.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Cariboo, BC
For example, on the tracking of individuals, I'm looking at the regulations section. I'm focused on subclause 11(2). You're probably well aware of that subclause. I'll let you find subclause 11(2).
6:30 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I didn't hear the end of your question.
6:30 p.m.
Conservative
6:30 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes.
6:30 p.m.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Cariboo, BC
When we're looking at the tracking of individuals, which is something that, as Privacy Commissioner, is probably chief or salient among your concerns... When I look at paragraphs 11(2)(c) and 11(2)(d), they state:
(c) collects and uses personal information solely for age-verification purposes, except to the extent required by law;
(d) destroys any personal information collected for age-verification purposes once the verification is completed;
Especially, when it comes to paragraph 11(2)(d), does that not address the concern with tracking? My reading of the legislation is that tracking wouldn't be permitted on that basis.
6:30 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I want to make sure there is as much clarity as possible on those points.
Certainly, that would be an argument to put forward in making sure that the regulations preclude that. If that were the understood interpretation by the government in adopting the regulation, that would lead to the right outcome.
I am flagging that monitoring, profiling, or using this for advertising, or any other different purpose, is a concern. We should be explicit about that, either in the statute, or, at minimum, in the regulations themselves.
6:30 p.m.
Conservative
Frank Caputo Conservative Kamloops—Thompson—Cariboo, BC
The reason I'm asking this is not to push back, but just to give you my reading, because when I read paragraph 11(2)(c), for instance, it says, “collects and uses personal information solely for age-verification purposes”. When I read that, to me that would preclude the use of this information for marketing. I don't think you can get much clearer than the term “solely”, for instance.
Do you see where I'm coming from there?
6:35 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I understand that. When we're looking at age verification, given some of the concerns, and in order to provide information to Canadians to reassure them about what we are talking about here, it's whether there is a clear contradiction between age verification and privacy. The answer is no. You can have both of those things, but you need to have an age verification system that is appropriate and designed with privacy top of mind. Again, it's making sure this is not information that can lead to those outcomes.