Information & Ethics committee  We can—certainly.

Information & Ethics committee  There's a principle of limiting collection, again linked to necessity and proportionality. If you're the employer and you're going to be looking at the data of the employee, it's all part of the transparency. Make sure the employee is aware that this is their work device. If they're using it for personal things, is there a mix?

Information & Ethics committee  I'll read you 4.2.2 of the “Policy on Privacy Protection” from the Treasury Board. It says: Notifying the Privacy Commissioner of any planned initiatives (legislation, regulations, policies, programs) that could relate to the Act or to any of its provisions, or that may have an impact on the privacy of Canadians.

Information & Ethics committee  This is not spyware. The difference is that spyware is covert and remote. You don't have the device, and you're doing it. This is a digital forensic tool, so it's a different type of tool.

Information & Ethics committee  We talk about that in our “Privacy in the Workplace” document that we revised in May 2023. It's really talking about the monitoring and the transparency. To your point, if you as an employee are aware—here's what the employer can and can't do, here's what the tools of the employer can do if you use this tool—then you have that awareness as the user.

Information & Ethics committee  There hasn't, but it highlights, again, another recommendation that I've made and that this committee endorsed in the ODIT study, which is the element of necessity and proportionality. That too should be in the law, because that's the point you're getting at. There may be a legitimate purpose.

Information & Ethics committee  Thank you. It's noted.

Information & Ethics committee  We would look at that as personal information about the individual being personal information relating to them. Whether it's on the device, on the cloud or in some other form, among other things, we look to see the following: Is this information protected appropriately? Who is gaining access to this?

Information & Ethics committee  We reached out to all 13 organizations. As I indicated at the outset, three of them indicated that they have done a PIA on their program. The remaining ones have not. We're going to be reaching out to all of them. We're going to continue that exchange to follow up and say, “Okay, we want to understand when this is going to be done and why it wasn't done and make sure it's done in the way that it needs to be done.”

Information & Ethics committee  That's right. That's what I'm recommending.

Information & Ethics committee  That's fair. In my office I don't have order-making powers, even for things that are in the Privacy Act. I can do an investigation and make a finding, but I have to rely on the government or the institution complying with that.

Information & Ethics committee  Yes, I would, certainly.

Information & Ethics committee  One of them has indicated that they purchased the tool and never used it. They did not indicate they were going to do one. One indicated that in their view it wasn't required. We're going to be following up to see if we agree with that and have a discussion.

Information & Ethics committee  It was the Competition Bureau.

Information & Ethics committee  We have various answers. For some of them it seems to be more regular as part of their activities. Some have indicated a smaller number of uses. For our standpoint, whether it's used two, three or four times or whether it's used regularly, we look at it in the same way. Is it appropriate, and should they do the PIA or not?