Information & Ethics committee  I'll ask my colleague for the specific statistics. We have them in the annex of the report, listed by department, in terms of the public sector. As well, we are listing, in terms of—

Information & Ethics committee  As legislators you can do a lot to protect the privacy of Canadians by amending public sector and private sector privacy legislation. Those are really ultimately the first tools we use to do our job.

Information & Ethics committee  I do. I think we should do more at all levels. This is something I would want my office to do more of. We have a promotion mandate, and we're looking at it and thinking about how we can do that, particularly with respect to children. That was a big part of our internal discussions.

Information & Ethics committee  The law doesn't give us the power to issue orders, as we've discussed. What the law does allow us to do is to go to the Federal Court, re-argue the case before the Federal Court of Appeal and ask them to issue the order that we recommend. So that's what's been done. The Federal Court dismissed our application after hearing it and concluded that the claim had not been established.

Information & Ethics committee  I hesitate to generalize, especially when it's a specific case that's before the courts. However, I can say that when we draw conclusions, if there is a case for broader conclusions, we do so. I expect social media to be aware of the decisions we make. If it's a specific case, I always invite organizations to review their practices and, if they have similar practices and we've found them to be a violation, it's up to them to correct them.

Information & Ethics committee  I'm not aware of that. I don't have information on that, unfortunately.

Information & Ethics committee  There are a number of tools in the act in terms of site visits or in terms of requests for documentation. We have a technical lab at the OPC, so we're looking at technical tools to be able to do the investigations and obtain the information we need. I don't know if Mr. Maguire has anything to add in terms of general investigative tools.

Information & Ethics committee  Data sharing, whether paid or unpaid, is targeted. There are restrictions on what can be done in the way of data collection, disclosure and use.

Information & Ethics committee  In my opinion, this is part of the context that needs to be considered. In the case of sharing, one must check whether it is appropriate, whether it respects legal limits and whether it gives rise to security concerns. There are various players in the system. Now, it is useful and good that they can publicize, in an appropriate way, such conclusions.

Information & Ethics committee  There's an expression that says if it's free, you're the product. That's exactly what you're describing. I think we need to be aware of this. When we buy a product and they ask us our date of birth and tell us it's because they're going to give us a discount on our birthday, that's exactly what's happening.

Information & Ethics committee  What I can tell you is that the platforms attend privacy conferences. They are very involved, very aware and very interested when it comes to privacy issues. My office examines what the platforms do and how they use the information. That's what our recommendations are based on.

Information & Ethics committee  I think we have to be aware that there is often an economic incentive to use information. It's normal, it's part of the economic system. States and regulatory bodies must therefore be able to create incentives in the other direction to protect information. I see two kinds of incentives.

Information & Ethics committee  At the moment, I lack the power to issue orders and the ability to impose administrative monetary penalties. If an organization is raking in millions or tens of millions of dollars using data and there are no monetary penalties when a breach occurs, going in that direction becomes tempting.

Information & Ethics committee  That's why the European model, which is the General Data Protection Regulation, the model in Quebec, which is Bill 25, and the model proposed in Bill C‑27 provide that it's going to be a maximum amount of $10 million, for example, or 3% of sales. I think that addresses the issue you raised.

Information & Ethics committee  I think institutions and regulatory authorities like ours need to do their job, investigate complaints and verify compliance. If there is no compliance, they should issue orders or make recommendations. I also believe that governments have a responsibility for national security and the security of public servants' information.