Appearance before the Standing Committee on Access to Information, Ethics and Privacy (ETHI) on Main Estimates

May 12, 2023

Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Good afternoon, Mr. Chair, Members of the Committee.

I am pleased to be here today alongside my colleague, Information Commissioner Maynard, to discuss the Office of the Privacy Commissioner’s (OPC) Main Estimates for Fiscal Year 2023-24.

As Privacy Commissioner of Canada, I am responsible for the protection and promotion of the privacy rights of Canadians in the public and private sectors. In our last Annual Report to Parliament, which was tabled in September 2022, I noted that this is a pivotal time for privacy in Canada and highlighted the important work that my Office is doing.

My Office investigates complaints and breaches that have meaningful impacts for Canadians and privacy in Canada. For example, earlier this year, we released the results of our investigation into Home Depot’s sharing of personal information with Facebook when their customers opted for an electronic receipt at checkout. We found this practice to be a breach of privacy law, in part because we concluded that it was unlikely that Home Depot customers would have expected that their personal information would have been shared with a third party, like Facebook, simply because they opted for an email receipt instead of a printed one. Since issuing our findings, my Office has learned of several other retailers allegedly engaging in similar practices, and we have reached out to those organizations and are in the process of confirming how they are complying with the expectations flowing from our investigation.

Looking ahead, my Office has recently announced investigations into TikTok, focusing on its privacy practices as they relate to younger users, as well as the company behind the artificial intelligence powered ChatGPT. Children are less able to understand and appreciate the long-term implications of consenting to their data collection and need even greater privacy safeguards, and we can and must do more to protect their privacy. This will be one of my key priorities in the years ahead. My Office also needs to stay ahead of fast-moving technological advances. We need to monitor and research technology so that we can anticipate how it may impact privacy, and so that we can promote the most privacy enhancing technologies. This is another one of my key focus areas.

My Office provides advice to government departments and private sector organizations, reports publicly on compliance with privacy laws, and promotes public awareness of privacy issues. In this digital age, the world is at our fingertips, and the price of that convenience is often the sharing of personal information. That is why it is so important that Canadians are informed about their privacy rights, that they feel empowered to control how and when their personal information is collected, used, and disclosed, and that they know where to turn for support when they need it.

We also provide advice and recommendations to Parliament on law reform and privacy matters of public interest and importance. On that note, I want to thank the Committee for its reports following the studies of “on device investigative tools” used by the RCMP and the use of facial recognition technologies. As noted in my statements following the release of those reports last year, I welcomed the Committee’s recommendations to enhance privacy protections; to ensure that the law recognizes privacy as a fundamental right and requires government institutions to consider and address privacy impacts at the outset when developing and using new technologies; and to promote the appropriate regulation of privacy impactful technologies.

My Office has an initial operating budget of $29.5 million for 2023-24. We manage these resources optimally to protect and promote the privacy rights of Canadians as effectively as possible. We are also looking ahead and preparing for law reform. The government took an important step toward modernizing the private-sector privacy law with the tabling of Bill C-27, the Digital Charter Implementation Act, which has been referred to the Standing Committee on Industry and Technology for further study. My written submissions and recommendations to the INDU Committee were made public by the Committee earlier this week, and I am looking forward to appearing before the Committee to discuss this important Bill.

I was pleased to learn that in the recent budget, the government proposed temporary funding for my Office of $6 million over two years to undertake more in-depth investigations of privacy breaches and to improve response rates to privacy complaints, as well as $15 million over five years to operationalize new processes required to implement the proposed Consumer Privacy Protection Act (CPPA). Should Parliament adopt Bill C-27, it will be essential that my Office is properly resourced to fully and effectively take on important new responsibilities, especially those focusing on prevention.

Finally, this July will mark the 40th anniversary of the Privacy Act and the creation of the Office of the Privacy Commissioner. I was encouraged by the remarks of the Minister of Justice and Attorney General of Canada, the Honourable David Lametti, who following the tabling of Bill C-27 last year, said that public sector privacy reform is not far behind.

Privacy matters to Canadians more today than ever before. This is why the work that my Office is doing to both promote and protect privacy rights is so important. The more that individuals trust that their privacy rights will be protected, the more confident that they will feel participating freely in the digital economy, which is good for Canadians, good for businesses, and good for innovation.

With that, I would be happy to answer any questions.

Thank you.