Industry committee  Of my 15 recommendations, it would certainly be the sixth, which deals with privacy impact assessments. This is fundamental, because without it, we won't be assessing the privacy risks posed by artificial intelligence, even though we know they're significant. So that's the first recommendation I'd stress.

Industry committee  I'm talking about all the privacy risks associated with data collection, use, retention, safeguarding, purposes, disclosure for purposes a reasonable person would consider acceptable, etc. This must be taken into account in the context of artificial intelligence and an obligation must be provided for.

Industry committee  On that point, one of the issues in the bill is that it allows a greater right to disposal of information, so that's a positive thing. In particular, vis-à-vis children, it creates a stronger right to disposal. There's the example you gave of posting something when you're a minor, and then, when you're an adult, wanting to take it down.

Industry committee  There are obligations for organizations to proactively prepare privacy management programs and to share some information about them. If it's information online, the idea is that you would see it online, but there are obligations for organizations to make it as useful.... Obviously, if organizations see information about themselves and they have challenges finding where it is, they can reach out to my office and we can assist in seeing what's going on there.

Industry committee  Yes.

Industry committee  I think you'd have to put your last question to the minister to find out why he accepted certain recommendations and not others. To be clear, he did say in his letter that he was open to looking at others, further to the committee's proceedings. Beyond that, I can't speculate. As for providing additional opinions, I would be glad to help the committee however I can be of service, whether it's commenting on proposed amendments or meeting with the committee again, later in the study, to answer other questions.

Industry committee  What I can tell you is that I saw the proposals in the letter, but at the end of the day, I certainly have to see the actual text of the amendments to know where things stand. Nevertheless, I can give you my views on what isn't in the letter. The minister mentioned four issues on which he was prepared to move forward.

Industry committee  We have a lot of discussions, in particular with the FTC in the U.S., which has jurisdiction for antitrust law. It is the equivalent of our Competition Bureau. Also, through that, it deals with privacy. There's no national privacy legislation in the U.S. at the moment. There are proposals before Congress on this, but it's not moving forward.

Industry committee  Yes, we're working very closely with Europe, with the G7 and the community worldwide. I was at a meeting of the Global Privacy Assembly just last week, talking about ethical uses of AI and highlighting the fact that we need proactive, strong privacy protections. Going back to the collaboration with the G7 again, working very closely together, we issued a statement on AI.

Industry committee  Bill C-27 needs to prevent that to the same extent that the current law prevents that. As you know, this was a matter that my office investigated. We made findings that Tim Hortons had breached privacy law by collecting more information than it needed and by not being transparent about what was being done with that information.

Industry committee  Yes, absolutely. The use of sandboxes is good practice. Our British counterparts are very far along on that front. In the case of AI technologies, the industry gets to test out the data and methods in a secure environment. It's clear that our office would have to be resourced to set up a sandbox.

Industry committee  On the current privacy legislation, we've provided guidance in terms of how to obtain meaningful consent. In that, we talk about some things that should be looked at in the context of children. My federal, provincial and territorial colleagues and I have recently issued a statement, a resolution, on protecting young persons' privacy.

Industry committee  The sensitivity of information is an element that's going to be considered in the bill. It's going to be considered. I have to consider that in how I conduct myself. The sensitivity of information impacts the form of consent, impacts the retention periods and impacts the security safeguards.

Industry committee  The bill provides for some exceptions to the ordinary obligation to have consent and knowledge. It provides exceptions in situations linked to and necessary for business operations. There is a carve-out for activities that should not be for the purpose of influencing individuals.

Industry committee  The concern I have with this provision is not in our ability to prove or disprove something, or to make a finding on something. It's because, if you add an activity in this list, I am bound by that list. The courts are bound by it. If you add an activity in there that isn't necessary, it becomes an unnecessary exception to the rule of consent.