Information & Ethics committee  I think it's been mostly with the RCMP, but perhaps....

Information & Ethics committee  Thank you, Mr. Chair. I'm pleased to now turn to this part of the discussion. I thank the committee for its interest in the ways that social media platforms such as TikTok harvest, handle and share personal information. The online world brings with it a host of possibilities for innovation and connection, but it also carries potential for significant harm, especially for young people.

Information & Ethics committee  There are three we made specifically on AI that would help that issue. One was mandating privacy impact assessments whenever you have a high-impact system of AI. That would be one. Doing that, as an organization you would need to ask what the risk to privacy is. What is the risk of these types of deepfakes?

Information & Ethics committee  That was a decision that was made by the Government of Canada. The Government of Canada made decisions based on its review, based on the expert assessment of the chief information officer and experts. They made that on the basis of privacy and security considerations. They would be better placed than I would be to discuss this decision.

Information & Ethics committee  To the extent that they're privacy concerns from the government in making its decision, and there were some privacy concerns stated, there may be some overlaps there. I'm not involved in that assessment from the government side. My focus in the investigation will be to look at the data practices, the consent for appropriate purposes, with a particular focus on children and youth, because they are the majority of the users.

Information & Ethics committee  I would say a few things. One is that we've issued a declaration with my federal, provincial and territorial colleagues called “Putting best interests of young people at the forefront of privacy and access to personal information”. It's available on our website. We give a number of recommendations and expectations for organizations about making sure that they're protecting children and the best interests of the child and that they're treating their information appropriately.

Information & Ethics committee  This is why I recommended that I have the authority to issue binding orders, which I do not have under either the private sector or the public sector. What I have is the authority to make recommendations and to make those recommendations public. This is what I have used. I was pleased to see the response from the public and parliamentarians.

Information & Ethics committee  We made some overall recommendations, mostly towards the public sector. This was my colleague, before my arrival, but certainly there were recommendations in terms of necessity and proportionality, in terms of time limiting and in terms of making sure you were documenting and data minimizing.

Information & Ethics committee  There were some recommendations, certainly. There was one breach in the context of ArriveCAN. We made some recommendations there in terms of stronger safety measures for this type of information and for avoiding errors. This was a situation in which there was an error—people were told they needed to isolate when they didn't—so it was about making sure that you maintain good information and that you get rid of bad information.

Information & Ethics committee  Absolutely. Privacy laws apply to personal information, information that can identify us, because it has to be protected. That information can be used to draw a number of conclusions about us. The law sets out an exception: public information is not subject to certain obligations.

Information & Ethics committee  Giving people false information, using information that appears to be true but isn't to mislead Canadians is a worrisome practice. That's why generative AI is worrisome. The OECD surveyed G7 ministers and put out a report. The thing that worried them most about AI was disinformation.

Information & Ethics committee  The OECD report is publicly available.

Information & Ethics committee  Yes, of course. Under the Privacy Act, the public sector's obligations are less stringent than the private sector's. Departments are required to show that the information is used for purposes related to their respective mandates. For example, they have to show that they have a legal mandate to do X, so they can do it.

Information & Ethics committee  For the moment, we are investigating OpenAI and ChatGPT, but again, when we do these investigations, we try.... If we identify lessons or principles, they can assist, hopefully, and can guide other organizations. For instance, in the Home Depot decision, while we made our conclusion specific to Home Depot, this was a practice that was being used in the industry.

Information & Ethics committee  Certainly, and thank you for the question. We talked about that in the annual report. There is a very strong active domestic—federal-provincial-territorial—Canadian community, but also internationally there are a number of groups. I've been very active with the G7 round table of data protection authorities.