Appearance before the Standing Senate Committee on Transport and Communications (TRCM) on Bill C-11, an Act to amend the Broadcasting Act (Online Streaming Act)

September 14, 2022

Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Good afternoon, Mr. Chair, Members of the Committee,

Before I begin and on behalf of my office, I would like to offer our condolences on the passing of Her Majesty Queen Elizabeth II.

Thank you for the invitation.

I am pleased to be here today to assist the Committee in its study of Bill C-11, the Online Streaming Act. I am accompanied by my colleague Brent Homan, Deputy Commissioner, Compliance.

As you know, as the Privacy Commissioner of Canada, I am responsible for the protection and promotion of the privacy rights of Canadians in the public and private sectors. My office does so by investigating complaints, providing advice to government institutions and private sector organizations, reporting publicly on compliance with privacy laws, and promoting public awareness of privacy issues.

When I appeared before the Senate in June to discuss my proposed appointment as Privacy Commissioner, I indicated that I would have as my vision the following three elements:

1. Privacy as a fundamental right;
2. Privacy in support of the public interest; and
3. Privacy as an accelerator of Canadians’ trust in their institutions and in their participation as digital citizens.

With these principles in mind, I can offer the following observations on Bill C-11 which would amend the Broadcasting Act to bring online undertakings within its scope and modify the mandate and powers of the CRTC in this context.

The Bill would provide the CRTC with the power to impose conditions respecting the discoverability of Canadian programs and programming services.

While the Bill specifies that in doing so the CRTC could not require the use of a specific computer algorithm or source code, discoverability conditions could nonetheless potentially require the adaptation of existing algorithms that rely on personal information or the analysis of personal information to determine whether user-generated content is Canadian. The potential privacy impacts would depend on the specific circumstances of each case, including how these powers are exercised by the CRTC and how regulated entities respond to new obligations by their collection and analysis of personal information. 

Given this, it will be important that these privacy implications be fully assessed and mitigated prior to the CRTC imposing these conditions.

I note in this regard that the Bill does include a requirement that a reasonable opportunity be given to persons carrying on broadcasting undertakings and other interested persons to make representations to the CRTC with respect to any proposed order. My office will want to avail itself of this opportunity in appropriate cases and will remain available to offer our regulatory expertise on privacy matters to both industry and the CRTC in this context.

I also note that while the Bill would provide the CRTC with the power to require broadcasters to provide information related to audience measurements, this power would specifically exclude information that could identify any individual audience member. Here again, the implementation of the Bill in a way that ensures that requested information is de-identified or anonymized will be essential and my office will be available to provide the necessary advice and guidance.

Given this and in light of the fundamental importance of privacy, the committee could consider amending section 3 of the Broadcasting Act to include the protection of the privacy of persons as a policy objective of that Act. This would be similar to the approach taken in the Telecommunications Act and would ensure that privacy is fully considered in the interpretation and implementation of the Bill, by the CRTC, regulated entities and courts.

I would also like to bring to the committee’s attention the European Union’s Digital Services Act which was adopted by the European Parliament in July and will come into force in 2024. This Act will require major online platforms to provide individuals with an option to turn off recommendations based on individual profiling. Once in force, this Act will provide an additional alternative to reduce the potential collection and use of personal information.

Lastly, I would reiterate my recommendation that the preparation of timely privacy impact assessments by public institutions be made a binding legal requirement in a modernized version of the Privacy Act.

I hope these observations are of assistance to the committee and I would now be happy to answer any questions.