Appearance before the Standing Committee on Access to Information, Privacy and Ethics on the 2016 Main Estimates

May 3, 2016
Ottawa, Ontario

Opening Statement by Daniel Therrien
Privacy Commissioner of Canada

(Check against delivery)

---

Introduction

Mr. Chair, members of the committee,

I am pleased to address our Office’s Main Estimates. With me today are Daniel Nadeau, our Chief Financial Officer, and Patricia Kosseim, Senior General Counsel.

In my allotted time, I will discuss:

• The technological evolution of the digital economy and its impact on privacy;
• Our plans for the year ahead; and
• The challenges we face going forward given our current level of funding.

As you may know, our funding has been holding steady at approximately $25 million in recent years and is currently forecasted to remain at this level for the foreseeable future, despite mounting investigative pressures and a number of new responsibilities.

The technological evolution of the digital economy and its impact on privacy

The fast-paced evolution of the digital economy due to constant technological innovation is a reality that affects many government regulators. This trend, however, has had a significantly disproportionate, indeed revolutionary, impact on the field of privacy.

When the Privacy Act came into force in 1983, computers were not mainstream. When PIPEDA came into force in 2001, Facebook did not exist. Smart phones, cloud computing, big data and the Internet of Things, to name but a few data-rich technologies, all raise significant and highly complex privacy issues with respect to the collection, use, disclosure and safeguarding of personal information.

Keeping up with all these changes has been a real struggle, especially when operating under privacy legislation that predates many of these technological innovations.

My Office has nonetheless effected much positive change on behalf of Canadians with our limited resources. We have demonstrated sound stewardship and management practices, realizing significant efficiencies through optimization of resources and business re-engineering. However, we are getting to a point in which we are unable to keep pace with demand.

For example, despite our best efforts, by the end of fiscal 2014-15, 291 out of an inventory of 759 active Privacy Act files, or 38 percent, were already more than a year old. Ninety percent of Canadians feel they are losing control of their personal information and they expect to be better protected.

The year ahead

It is a fact that technology allows businesses and governments to collect and analyze exponentially greater quantities of information. But with great reward comes great risk: the potential for government and corporate surveillance and massive data breaches. 

As you know, breach reports to my Office are growing year over year, particularly since 2014 when government reporting of material breaches was deemed mandatory under Treasury Board policy. And Bill S-4, the Digital Privacy Act, will soon make reporting by private organizations a legal obligation.

Unfortunately, our lack of funding for these activities is adversely impacting our ability to effectively deal with breaches.

At this time, we are only able to cursorily review, advise and follow up on all but a few of the breach reports we receive. We expect this problem to continue in the years ahead. The increased complexity of Privacy Act investigations due to technology and the inter-connectedness of government programs are also putting added pressure on our compliance activities, with the result that too many are not completed in a timely way.

That being said, looking ahead, my Office will try to confront these realities head on as we embark on a number of ambitious initiatives related to the new privacy priorities, which I’ve spoken to you about before.

As part of our Government Surveillance priority, we are carefully reviewing how information sharing is occurring between federal institutions for the purposes of national security following the passage of Bill C-51, the Anti-Terrorism Act, 2015.  We hope our review will inform the upcoming public debate on how to amend that legislation.

In keeping with our Reputation and Privacy priority, we are consulting widely on matters related to online reputation as we work to establish a position on such things as the right to be forgotten in the Canadian context.

Under our Economics of Personal Information priority, we are examining the current consent model, the efficacy and even viability of which many are now questioning in the context of modern technologies. Our aim is to identify potential improvements, to implement those that fall within our legal framework and to recommend legislative changes where necessary.

We will also offer new guidance to businesses and individuals on privacy protection, paying special attention to small and medium-sized businesses as well as vulnerable groups such as children and seniors. 

We also look forward to working with Parliament in the year ahead to update the technologically and legislatively archaic Privacy Act.

Future challenges and what we could do with more resources

That Canadians would feel uninformed about their privacy rights and not able to control their personal information is hardly surprising given the speed and breadth of technological change.

In my view, improving public education and regulatory protection through OPC guidance and industry codes of practice, in addition to completing investigations in a timely way, are all critical to meeting public expectations and maintaining trust in the digital economy.

For example, we have been unable to fulfill our statutory role to encourage private sector organizations to develop industry codes of practice. We would also like to be able to offer timely guidance to Canadians on fundamental issues such as Big Data and the Internet of Things.

We are also concerned about our ability to invest in key public education tools, such as the web, and in drawing the public towards these tools, to help address privacy knowledge gaps amongst Canadians.

Furthermore, it is critical that we increase our capacity to monitor and research technology in order to better understand how it affects privacy, and that we promote privacy enhancing technologies.

Conclusion

In closing, it is clear that technology has fundamentally changed the privacy landscape and as a regulator it is imperative that we stay ahead of these changes. I am confident the strategic priorities we have chosen position us well for this task.

Still, new regulatory responsibilities and an ever-growing investigative workload have added to the expectations of my Office. Ensuring we can continue to provide Canadians with the level of privacy protection they expect while also maintaining their trust in government and the digital economy remains our primary goal, but it is one that is increasingly challenging to achieve given our current funding levels. I would welcome a discussion on whether additional funding for my Office would be appropriate to do what is expected of us by organizations, by Canadians and of course by Parliament.

I look forward to your questions.