Information & Ethics committee  Absolutely.

Information & Ethics committee  As I've described, these types of digital forensic tools are able to retrieve information from devices, from computers, to see information that may have been deleted or not deleted. They are able to obtain information, including personal information, which is why in situations where they're used and directed toward individuals, whether it's employees or in other circumstances affecting their privacy, a privacy impact assessment should be done.

Information & Ethics committee  My understanding is that they could in certain instances.

Information & Ethics committee  My understanding is that it can. These questions should be asked of the institutions as well.

Information & Ethics committee  Personal information could be the data that's contained on this: information, the files that are on that device and other types of use, whether something was deleted or not deleted or whether a website was accessed. These are tools that have important capabilities. That is why, in situations where they're being used to target individuals or to investigate individuals, this is where we would expect to see privacy impact assessments being conducted, so that these things can be assessed and mitigated.

Information & Ethics committee  Our understanding is that they could be—absolutely.

Information & Ethics committee  Track the movement of Canadians...?

Information & Ethics committee  Typically, these types of devices will not be used remotely with the device not being in the possession of the investigator. You would have that device in your possession. That was one of the distinctions between those and the on-device, the ODITs, or the spyware, where you can access the device with the individual not knowing that you have it and not being in possession of the device.

Information & Ethics committee  Thank you, Mr. Chair and members of the committee, for the invitation to contribute to your study on the federal government's use of technological tools capable of extracting personal data from mobile devices and computers. Last fall, CBC/Radio-Canada reported that 13 federal institutions had acquired such tools.

Information & Ethics committee  Fortunately, the law is based on principles. So we're able to apply those principles to organizations that use and disclose data. That's what allows us to investigate TikTok and ChatGPT. That said, there are shortcomings: we don't have the power to issue orders or fines. In the case of organizations making huge profits from data, there is a shortcoming.

Information & Ethics committee  Indeed. This raises the whole question of online age verification and techniques for determining whether a person is underage or not. This will be important in the context of Bill C‑27, which explicitly grants rights and treats information differently. It's an issue we're looking at, in the privacy field.

Information & Ethics committee  It's a problem for kids because of their greater vulnerability. We've made a number of recommendations in terms of making sure that we're not using these behavioural techniques of nudging. We shouldn't be nudging individuals generally, but certainly not children, into making bad decisions and making bad privacy decisions.

Information & Ethics committee  Absolutely. They need to be simplified. They need to be shorter and more concise, and they need to get to the heart of it. Sometimes you have a very long-drawn-out legalistic policy that doesn't really communicate very important things that could be done more briefly. You agree to this and you agreed to sharing it with third parties, including parties outside of Canada.

Information & Ethics committee  Yes, a revision of the two laws is necessary. One is under way for the law in the private sector. This is Bill C‑27. This also includes a specific component for artificial intelligence. A revision is necessary because the law is 20 years old. It's older than social media. We're still applying it, the principles are there, but technology is advancing rapidly.

Information & Ethics committee  In our annual report, we've provided statistics for both the public sector and the private sector. In the context of the public sector, the overall comment was that we find the level of reporting low. It feels as though it must be higher than that in reality, so we're curious about that and we're flagging it.