Appearance before the Standing Committee on Access to Information, Privacy and Ethics on the Office of the Privacy Commissioner of Canada’s 2022-23 Annual Report to Parliament

October 25, 2023
Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Good afternoon, Mr. Chair, Members of the Committee,

I am pleased to be here today to discuss my 2022-23 Annual Report to Parliament, which highlights the important work that my Office is doing to protect and promote the fundamental right to privacy in a time of unprecedented technological change.

It is encouraging to see this continued focus on the importance of privacy, as it impacts virtually all aspects of our lives.

Many of the public interest issues that you are seized with as Parliamentarians – children’s rights, online safety and cybersecurity, democratic rights, national security, equality rights, ethical corporate practices and the rule of law – all have privacy implications and, I would argue, all depend on strong privacy protections.

In this digital era, routine activities of daily life can also raise privacy issues, as you will see from some of the work and investigations that my Office has conducted this year – for example, socializing online, using mobile apps, getting packages delivered, or going to the check-out counter.

Since my appointment as Privacy Commissioner in June 2022, I have identified strategic priorities for my Office to help frame our work over the past year and guide the way ahead. These include:  

• addressing the privacy impacts of the fast-moving pace of technological advancement, especially in the world of artificial intelligence and generative AI;
• protecting children’s privacy; and
• maximizing the OPC’s impact in fully and effectively promoting and protecting the fundamental right to privacy.

To support these priorities, this past year we have engaged extensively with our domestic and international counterparts to identify and undertake collaborative opportunities.

We have also continued to advocate domestically for the modernization of Canada’s privacy laws. I was honoured to appear before the Standing Committee on Industry and Technology last week in the context of their study of Bill C-27, the Digital Charter Implementation Act, 2022, where I made 15 key recommendations needed to improve and strengthen the Bill. I was pleased to see a number of them endorsed by Minister Champagne in the form of amendments that will be put forward to the Committee, and I look forward to the work of Parliament in reviewing this important Bill.

I will turn now to some of our compliance work.

Last year, we accepted 1,241 complaints under the Privacy Act, which represents an increase of 37% over the previous year, and 454 under the Personal Information Protection and Electronic Documents Act, or PIPEDA, which was a 6% increase from the year before.

One of the public-sector investigations that is highlighted in this year’s report involved Canada Post’s Smartmail Marketing program.

Our investigation revealed that Canada Post builds marketing lists with information gleaned from the envelopes and packages that it delivers to homes across Canada and makes these lists available to advertisers for a fee.

We found that this contravened the Privacy Act as it had been done without the knowledge and consent of Canadians. We recommended that Canada Post stop its practice of using and disclosing personal information without first seeking authorization from Canadians. As a possible solution to remedy this matter, we recommended that Canada Post send a mail notice to Canadians to inform them of this practice and to indicate an easy way for Canadians to opt-out. Until the tabling of my Annual Report, which made this decision public, Canada Post refused to implement this solution. After the report was made public, Canada Post issued a statement that it would review its policies. I expect Canada Post to comply with the Privacy Act and I look forward to hearing from them on the next steps to resolve this matter.

The report also highlights some of our private-sector investigations from last year, including our investigation of Home Depot’s sharing of the personal information of customers who opted for an electronic receipt instead of a printed one at checkout with a social media company.

Home Depot has since stopped that practice and implemented my Office’s recommendations. This case underscored the importance of businesses obtaining meaningful consent to share customers’ personal information.

Another important area of our work is addressing breaches in the private and public sectors.

We remain concerned about possible under-reporting of breach incidents in the public sector. The number of reported breaches fell by 36% to 298 last year, and only one of those reports involved a cyber-attack. This compares to 681 breach reports from the private sector, of which 278 were cyber related.

We also engaged in ground-breaking policy work, provided advice and guidance to organizations in both the public and private sectors on privacy matters of public interest and importance, and continued to provide advice to Parliament.

We know that privacy matters to Canadians more today than ever before, and that they are concerned about the impact of technology on their privacy. Our latest survey of Canadians found that 93% have some level of concern about protecting their personal privacy, and that half do not feel that they have enough information to understand the privacy implications of new technologies. That is why the work that my Office is doing to deliver concrete results that have meaningful impacts for Canadians and privacy in Canada is so important.

In closing, I would like to thank the Committee for its work over the years, including many reports and recommendations, in the field of privacy.

I look forward to continuing our efforts to ensure that privacy rights are respected and prioritized by government institutions and businesses alike, and to position Canada as a global leader on privacy.

I would now be happy to answer any questions.

Thank you.