Public Safety Committee on Feb. 12th, 2024

[Kate Robertson]

Yes, that's a function of the absence of publicity requirements with respect to the orders themselves, as well as the absence of any notice obligation set out under Bill C-26.

We've recommended in our brief that the constraints on secrecy must be defined and strictly curtailed to what is absolutely necessary. Language exists in the bill to support that amendment, as well as the need for notice obligations, which is an essential function for review mechanisms that would be necessary for this level of collection and sharing power, of course.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Now, even if the subject of this order did learn that this information was being compelled of the telecommunications provider, if they said that they didn't think it was fair and they wanted to take the government to court over it, this legislation allows the government to conduct these court hearings in secret and not have to share the information with the subject of this. Is that correct? Can you give us more of an explanation on how you see that working?

[Kate Robertson]

Yes. In the situation where an individual or institution would seek to challenge the collection powers or orders under Bill C-26, there is a judicial review mechanism that's available. There are other complaint proceedings that are available in law outside of the scope of Bill C-26.

In this case, it contemplates secret evidence. In this case, there is some language that is included. Unlike the minister's discretion to keep secret the orders themselves—and that discretion doesn't appear to have any limits—there is some language in the bill at least with respect to the secret evidence proceedings. However, we've recommended that it be tightened and aligned with that which is set out in the Canada Evidence Act, because there's no justification for diluting that requirement or the court's ability to balance the public interest in disclosure in contrast to the government's interest in confidentiality. That's essential, in our view, with respect to the constitutionality of the scheme.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Thank you for that.

Yes, I think there could be very compelling and extraordinary circumstances whereby the government would have to keep certain information secret, but we don't want to allow legislation to go through that gives overly broad powers that could potentially be abused, however good the intentions of the people passing the bill might be.

To the Privacy Commissioner, in my last 30 seconds, what sort of personal information are you concerned could potentially be inappropriately shared under this legislation?

[Philippe Dufresne]

Similarly, I think it's subscriber account information, communication data, website visits, metadata, location data and financial data that may not be what is ultimately requested, but we want to make sure that the bill doesn't allow for it.

What we're recommending is that notion of necessity and proportionality that would bring that rigour to say, “You may need it, but also consider whether there are less privacy-intrusive means to achieve the goal.”

[The Chair, Liberal, Heath MacDonald]

Thank you.

Thank you, Mr. Lloyd.

We'll go to Mr. Schiefke, please, online. Thank you.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you very much, Mr. Chair.

I, too, want to add my thanks to the witnesses for appearing today.

I have some questions for Mr. Yalkin and then Ms. Robertson.

I'll begin with Mr. Yalkin. What new powers and responsibilities will be given to the Office of the Superintendent of Financial Institutions under this act?

[Tolga Yalkin]

I think a lot would depend on the regulations, but as the committee will be well aware, there are a number of different expected outcomes associated with the legislation relating to identifying, managing, preventing, detecting and limiting damage associated with cyber-attacks. We're already quite active in a lot of those areas, and we have a lot of levers through our supervisory work to be able to try to encourage financial institutions to respond to those different expectations.

I think the difference here is that if this legislation were to be introduced and regulations were to be introduced, rather than having us rely on our supervisory oversight as a lever to try to encourage good practices, it would be the case that there are different expectations that would have the force of law, which would then be subject to regulatory enforcement.

In terms of the specifics around those different levers, I suspect others would be better placed to speak to them than I.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you.

You spoke earlier about reports that were shared with you with regard to cyber-attacks. Were those shared with you voluntarily, or was that mandatory?

[Tolga Yalkin]

We have an incident-reporting protocol whereby we set out for financial institutions our expectations of when and how they report incidents to us. Now, in a sense, one could say they're voluntary, but I'll give you a bit of background, if you'll permit me.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Please.

[Tolga Yalkin]

As a prudential regulator, we have a general responsibility when it comes to overseeing financial institutions and making sure that they're engaging in sound risk management practices. What we do, then, instead of issuing regulations that have the force of law, is articulate for them our expectations of them, which we then supervise them against.

When we issue, for example, a reporting protocol, which we have in place, more often than not the case is that financial institutions comply with it, because if they don't, we may consider that as part of our ongoing supervisory oversight of them.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Okay.

This legislation includes mandatory reporting mechanisms. Do you agree with those? Why is mandatory reporting important?

[Tolga Yalkin]

This legislation would be a bit different from what we currently have in place for reporting. Under our reporting protocol, banks report to us. If something happens, we have a mechanism for them to indicate to us within 24 hours that an incident has occurred.

Here, with this legislation, the reporting would be to a cybersecurity centre, so there would basically be dual reporting. We'd have to figure out, for example, how we effectively and efficiently facilitate that, because we have a form for reporting and there would undoubtedly be one under this particular regime as well. However, that's something we would be able to tackle with banks to make sure that the reporting expectations were clear to both coordinate parts of government.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you, Mr. Yalkin.

I'll turn my questions over now to Ms. Robertson. Thanks for being with us today.

I'm very interested in hearing more about some of the oversight mechanisms you would like to see put in place. You mentioned them earlier in the line of questioning. Can you expand on those and perhaps comment a bit on how Bill C-26 intersects with the Privacy Act?

Is there anything in there that you see as problematic? How can that be mitigated here in committee? What can we do?

[Kate Robertson]

There are a number of recommendations, including those identified in my comments of the last date as well as in today's proceedings, in addition to those identified by Commissioner Dufresne.

We have set out recommendations relating to the need for proportionality and reasonableness limits as an overarching framework that guides both the minister and the government in the implementation of the bill, but also the oversight mechanisms that should be attendant to the privacy interests and other interests that are at stake in this type of legislation.

We have recommended that there be a formalization through the legislation of the role for independent regulators in the assessment of the proportionality criterion when considering potential orders to be put in place under the act.

In light of the really sweeping nature of the types of privacy interests that are engaged by the institutions at issue, including telecommunication providers, we've recommended, being mindful of the constitutional obligations of the government in legislating, that judicial oversight be applicable to private information, de-identified information that has a reasonable expectation of privacy, which is absent from the legislation at this time.

[Peter Schiefke, Liberal, Vaudreuil—Soulanges, QC]

Thank you, Chair, and thank you, Ms. Robertson and Mr. Yalkin.

[The Chair, Liberal, Heath MacDonald]

Thank you, Ms. Robertson.

We're going to move on to Ms. Michaud for two and a half minutes, and then Mr. Julian will be the last one up for two and a half minutes, with a hard stop. We're getting down on time here.

Ms. Michaud, go ahead, please.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Thank you, Mr. Chair.

Ms. Robertson, welcome to the committee.

The brief that you submitted to the committee contains a number of recommendations, and we appreciate them. It's very useful for us.

You recommended a mechanism whereby smaller telecommunications service providers, such as providers that have fewer than 250,000 or 500,000 subscribers or customers and that have historically been conscientious in their security arrangements, can seek at least some temporary relief if they're required to undertake new, modify existing or cease ongoing business or organizational practices as a result of a government demand, order or regulation.

Can you elaborate on this mechanism? On a number of occasions, I asked various stakeholders who met with us whether SMEs had any concerns about complying with these types of requirements under the legislation. This could mean more bureaucracy and an additional workload for these companies.

That said, it's a bit worrying that the government could force them to stop their business practices altogether. This may fall under the order‑making powers of the Minister of Innovation, Science and Industry and the ministers covered by the bill.

I'm wondering about the scope of the ministerial powers. I'll ask you the same question that I put to Mr. Dufresne earlier. How can we better regulate these powers?

[Kate Robertson]

Thank you for the question. My apologies for responding in English.

Our recommendations here intersect with the public policy implications of the legislation, as well as potential constitutional risks around the equity impacts or potential discrimination impacts of the legislation in the order-making power. In terms of the need for standards for telecommunication providers, to protect the security of individuals in Canada, it's absolutely necessary on a platform-neutral level. However, there are potential impacts for Canadians in certain regions, including in rural or indigenous communities, who may suffer from the adverse impacts of smaller, orbit-size providers being unable to maintain viability in implementing security measures.

We have noted that the CRTC has found recently that there have been successive years of decline in competition in Canada. This was particularly noted in Quebec and Ontario, where the declines have been most significant, so this is where we've identified the need for appropriate balance.

[The Chair, Liberal, Heath MacDonald]

Thank you, Ms. Robertson and Ms. Michaud.

Mr. Julian, please proceed, for two and a half minutes.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Chair.

Mr. Dufresne, I asked a question earlier about intelligence shared outside a country's borders.

Which country could serve as a model for privacy protection?

[Philippe Dufresne]

There are a number of models. I would have a hard time identifying one model as the best option.

For example, the European model sets out the key privacy expectations of necessity, proportionality and transparency. It gives a prominent role to privacy organizations. In addition, this model requires other countries to have a proper system in place. These countries are assessed. Canada has recently been granted the status of a country that ensures a proper level of protection. This model makes sure that these criteria are strictly enforced.

Other countries have reached agreements or signed treaties to this end. Quebec adopted Law 25. This legislation requires a privacy impact assessment if data is shared outside Quebec.

These are all examples of discipline and rigour. We must think about privacy from the outset, as soon as we come up with an initiative, as soon as we decide to use a tool.

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Thank you, Mr. Dufresne.

Mr. Yalkin, you mentioned earlier that in 2022, there were 10 priority one incidents of cyber-attacks. In 2023, that moved to 30. How would you describe a priority one cyber-attack? What is the difference between that level of cyber-attack and others?

[Tolga Yalkin]

Priority ones are basically high-impact incidents that cause disruption of service or leakage of data, so any that meet that definition would constitute priority one and be accordingly reported to us.