Information & Ethics committee  I saw the departments' responses. They've provided information about the types of programs they would use this for. There hasn't been anything that has worried me in terms of this being a completely inappropriate purpose or use. They're using this to fulfill their mandates as organizations, to apply their enabling legislation or to do some investigation.

Information & Ethics committee  There is. There is a consideration of the retention practice and the safeguard practices. That would go to—

Information & Ethics committee  They would be best placed to answer that question, but certainly at the OPC we look at the information: What type of information is it? Is it protected A, B or C? Are there security risks to individuals if this is lost? Are there national security considerations? There's a whole range of rules and criteria that have to be followed to protect.

Information & Ethics committee  We have not received complaints on this that I'm aware of.

Information & Ethics committee  That's fair.

Information & Ethics committee  Yes.

Information & Ethics committee  That's fair. I don't know that for certain.

Information & Ethics committee  I think when you have a statutory obligation, it emphasizes that obligation; that's always the case. It is indeed much easier to fall back on a directive or a policy, but an act really imposes pressure, constraints, the need to take the time, and to manage the situation differently.

Information & Ethics committee  I know that Bill 25 includes certain requirements for privacy impact assessments, particularly when data leaves Quebec or is related to the use of new data by the government or the private sector. The act has certainly codified the need for such assessments in some cases, but I would have to get back to you with details on that.

Information & Ethics committee  Bill 25 gave the Commission d'accès à l'information du Québec the power to issue orders and the ability to impose administrative monetary penalties. It may be less essential in the public sector context, but it can still help treat privacy as a fundamental right and make it a priority.

Information & Ethics committee  That's for sure. The act was written before the advent of the Internet and social media. There have been a lot of changes that mean that the laws have to be modernized. That said, I would like to take this opportunity to repeat that my colleagues, both in Canada and internationally, and I have made a number of statements on AI indicating that existing laws apply.

Information & Ethics committee  I agree.

Information & Ethics committee  That's a very relevant consideration in terms of management of information generally, as well as in terms of a privacy impact assessment. It's looking not only at what are you obtaining and why, and whether you need it, but also at how you are protecting it. We're seeing more and more situations of privacy breaches, cyber-attacks and information being stolen, so the security of that information is very important and who has access and the need to know—

Information & Ethics committee  I think I heard the question to be whether we have investigated any of those departments as a result of this. We have not. As indicated, it's not a legal requirement under the Privacy Act, so I would not have a basis for investigating non-compliance with that directive. We have reached out to them and we're going to continue to do so.

Information & Ethics committee  They do. That's where sometimes you'll have an interpretation that this is not a new program, that this is an existing program and that they haven't really changed what they're doing; they just have a new, more powerful tool. They didn't do a privacy impact assessment on that tool because the program was already assessed.