Industry committee  We do not require a complaint from an individual to launch a matter. We have the ability to issue audits. We have the ability to issue a commissioner-initiated investigation. That can come from a variety of sources. It could come from the monitoring of media reports. It could come from monitoring industry experts and actors who could flag things.

Industry committee  We have to strike the balance, but we have to remember that we are dealing with a fundamental right, so we need to start with that premise. We need to make sure we're protecting the fundamental right to privacy, because it's core to who we are as a society and as individuals. Absolutely, though, we need to do it in a way that supports innovation.

Industry committee  I think that the compliance agreements will help, because it will mean we can resolve matters. Again, it presumes that the organization will agree. A compliance agreement is a settlement agreement. If the organization agrees to pay the amount, then we can resolve it. If the organization does not, then there still needs to be a process that will go forward.

Industry committee  Yes, for sure. Certainly, resources are part of it, because there are a number of things here, whether they are audits, certification programs, guidance or communication, to make sure Canadians can flag things for us. There's also the technological aspect. We have a technical lab at the OPC, where we are trying to stay ahead of the evolving technology, and getting those resources, that expertise and that understanding will be important.

Industry committee  We will continue to develop our technical abilities and our technical resources in terms of identifying things we see in the ecosystem. The bill will provide more powers to obtain information and to initiate audits. There is an ability for my office to launch investigations. We call them “commissioner-initiated investigations”.

Industry committee  Proposed section 14 talks about new purposes and indicates that they must not use it for a purpose other than the one determined and recorded, unless the organization obtains the individual's—

Industry committee  On those purposes, one of the recommendations we've made is to make sure that the purposes are specific and explicit. It's important for Canadians to know why this is going to be used, and it's important that when you're collecting this information, Canadians have an understanding of what it's for and what it's not for, and that this is something they would be reasonably expecting.

Industry committee  You will no doubt hear views on that. We made recommendations on the predecessor bill in terms of inferences and treating inferences as personal information. I think that when you're talking about AI, we can see more and more ability to use information, maybe even de-identified information or anonymized information, then draw some conclusions about groups.

Industry committee  Yes, we have. The amount we came up with is almost a doubling of the current resources that we have. We would need an additional $25 million per year to have the resources on the compliance side, certainly, but also on the proactive side. The discussion we've been having provides responsibilities to approve codes of practice and certification programs, and maybe there will be a decision to have sandboxes.

Industry committee  With which model? I'm sorry, but I didn't hear you.

Industry committee  Well, it would be a different model. There would be a situation, and we would have to manage that in practice, because we do some joint investigations. As you know, we're currently doing an investigation on TikTok and ChatGPT. That's the case now, because right now I don't have the authority to issue fines or orders.

Industry committee  I've recommended a few things to address this in my 15 recommendations. In terms of the preamble, we did—

Industry committee  All right. I think that goes to the recommendation on making sure that the business activities are defined very carefully, that they are all necessary, and that you remove the ability to make exceptions by regulations without showing that they're necessary. The recommendation, in terms of clarifying and highlighting the fundamental right, has to be in the purpose clause, but it should also be in a preamble in the law, not just in the bill but also in the law itself, so that when people read it, they have—

Industry committee  It's crucial to ensure that the regime can be met by small and medium enterprises, absolutely. The bill provides for a role for my office in terms of guidance. It provides the ability to join in certification programs and codes of practice. It's something that has to be taken into consideration.

Industry committee  We need to make sure that the law will hold up despite the rapid evolution of technology, if not with it. There's a lot of talk about generative artificial intelligence right now. A year from now, it'll be even more powerful. Who knows? So the law has to be able to adapt. That's why the bill contains principles and doesn't talk specifically about generative artificial intelligence, for example, but rather about automated decisions.