Information & Ethics committee  That the PIA be done would be the legal requirement and that my office be consulted in appropriate cases; again, there may be situations where you have to manage the risk at play. There's also the sensitivity of the information. Situations have to be looked at on their facts. Our recommendation is that if it were a legal obligation, there would be more compliance.

Information & Ethics committee  A government entity's use of spyware raises privacy concerns right off the bat. That doesn't mean that it won't be allowed in situations where it's appropriate. As I said earlier, privacy is not an obstacle to the public interest, but it always has to be taken into account. Privacy is a fundamental right and needs to be taken into account.

Information & Ethics committee  This afternoon, you'll be hearing from RCMP representatives. I think they will highlight the fact that these tools are subject to oversight under part VI of the Criminal Code. In its response, the RCMP said that the use of these types of tools was subject to judicial authorization.

Information & Ethics committee  In the context of facial recognition technology, there was coordinated work with provincial privacy commissioners. A joint statement was issued on recommended principles in these matters.

Information & Ethics committee  Not at this time; we were made aware of its use through the media and the question on the Order Paper at the end of June. We reached out to the RCMP. They are aiming to provide us with information at the end of August. It will be coming this month, but it hasn't come yet.

Information & Ethics committee  Well, we have not received detailed information in terms of the context and the use. That's what we look forward to receiving and to providing advice on with the facts. I think what I could say at a high level is that, on the one hand, these tools appear to be potentially highly intrusive in terms of their capabilities to gather information.

Information & Ethics committee  Sure. Currently, there's no legal obligation on departments or the RCMP for doing this. There is a policy from the Treasury Board and there's a directive. Those policy instruments require that PIAs be done when there's a new program or new use that could potentially be having an impact on the privacy of Canadians.

Information & Ethics committee  Under not a legal obligation but under the policy documents of the Treasury Board; this is something that's not legally required but is more internal. The sanctions could be imposed by the Treasury Board itself...or removal of delegation or these types of things, but there is certainly in this policy the sense that my office should be notified and that a PIA should be done in high-risk situations where the tools can have an impact on privacy.

Information & Ethics committee  I know that the Department of Justice has issued a paper recommending proposed modifications to the Privacy Act in a modernized version, as this committee has done as well. One of those goes to the preamble and strengthening the language in the preamble to highlight the fundamental importance of privacy to the dignity and rights of Canadians.

Information & Ethics committee  What I will say is that the impact of this type of information coming out in the public through media reports or questions can raise questions and can raise concerns. I think from a trust standpoint and generating confidence, it would be far preferable that privacy impact assessments be done at the front end, that my office be consulted, and that this can be conveyed somehow to Canadians so that they are reassured that there are institutions there, such as my office, to provide advice and to make sure that privacy is top of mind.

Information & Ethics committee  When we work with organizations, we ensure that the information is treated appropriately in terms of confidentiality and security. From my standpoint, as I stated, privacy is not an obstacle to the public interest. They go hand in hand. They strengthen each other.

Information & Ethics committee  I know that this has been discussed in terms of the appearance of my predecessor at this committee with regard to facial recognition technology. There were questions asked about that. To my knowledge, this is not something that is used by government institutions, but this type of technology is the type of technology that to my mind should be looked at very carefully from a privacy standpoint to ensure that its impacts are known and mitigated.

Information & Ethics committee  No, we have not, but in the context of this matter, we look forward to receiving the PIA and information from the RCMP—not with Pegasus, but with the type of tools that are being used in this context.

Information & Ethics committee  I'm not aware of other types of technology or privacy assessments. Our office has been involved in reviewing the facial recognition technology. It has been involved in Clearview and the use of images and an investigation in terms of cell site simulators—these types of technology.

Information & Ethics committee  Good morning Mr. Chair and members of the committee. I am pleased to be here today to assist the committee in its study of the device investigation tools used by the RCMP. I am accompanied by my colleague Gregory Smolynec, deputy commissioner, policy and promotion branch. This study follows media reports and a response to a question on the Order Paper confirming that the RCMP was using technical tools to obtain data covertly and remotely from targeted devices, subject to judicial authorization.