Appearance before the Standing Committee on Access to Information, Privacy and Ethics on its study of the Use of Social Media Platforms for Data Harvesting and Unethical or Illicit Sharing of Personal Information with Foreign Entities

October 25, 2023

Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Thank you, Mr. Chair, Members of the Committee.

I am pleased to now turn to this part of the discussion, and thank the Committee for your interest in the ways that social media platforms, such as TikTok, harvest, handle and share personal information.

The online world brings with it a host of possibilities for innovation and connection, but it also carries potential for significant harm, especially for young people.

As you know, my Office, along with our counterparts in Quebec, British Columbia and Alberta, launched an investigation into TikTok in February.

We are examining whether TikTok’s practices comply with Canadian privacy legislation and in particular, whether it obtains valid and meaningful consent for the collection, use, and disclosure of personal information. We are also looking at whether a reasonable person would consider the purposes for which it handles personal information, in particular children’s information, to be appropriate in the circumstances.

This matter is a high priority for my Office, especially given the importance of protecting the fundamental right to privacy of young people, who represent a notable proportion of TikTok users. As a result of the ongoing investigation, there are limits to my ability to speak publicly about the company’s practices at the moment.

For that reason, I will focus my remarks today on the privacy principles that underpin my Office’s approach to the digital world from the perspective of the privacy rights of children.

Growing up in the digital age presents significant new challenges for the privacy of young people. As children and youth embrace new technologies and experience much of their lives online, we need strong safeguards to protect their personal information and how it may be collected, used, and disclosed. Increasingly, their information is being used to create personalized content and advertising profiles that are ultimately aimed at influencing their behaviours.

Children have a right to be children, even in the digital world.

As UNICEF notes in its policy guidance on artificial intelligence for children, young people are affected by digital technologies to a greater extent than adults. Young people are also less able to understand and appreciate the long-term implications of consenting to their data collection.

Privacy laws should recognize the rights of the child, and the right to be a child. This means interpreting the privacy provisions in the legislation in a way that is consistent with the best interests of the child.

I am encouraged by statements from the Minister of Innovation, Science and Industry indicating that there is a desire to strengthen children’s privacy rights in Bill C-27, the Digital Charter Implementation Act, 2022.

My Office has recommended that the preamble of a modernized federal privacy law should recognize that the processing of personal data should respect children’s privacy and the best interests of the child. I believe that this would encourage organizations to build privacy for children into their products and services by design and by default.

The law must have strong safeguards to protect children’s information from unauthorized access, and reflect greater consideration of the appropriateness of collecting, using and disclosing their information.

Earlier this month, my provincial and territorial colleagues and I adopted a resolution calling on organizations in the private and public sectors to put the best interests of young people first by, among other things:

• providing privacy tools and consent mechanisms that are appropriate for young people and their maturity level;
• rejecting the kind of deceptive practices that influence young people to make poor privacy decisions or to engage in harmful behaviours; and
• allowing for the deletion and de-indexing of information that was collected when users were children, something that I am happy to see was included in Bill C-27.

In closing, it is critical that government and organizations take action to ensure that young people can benefit from technology and be active online without the risk of being targeted, manipulated, or harmed as a result.

I expect that the findings from our investigation into TikTok will be informative not just for that company, but also for other organizations that collect and handle children’s sensitive personal information.

I also look forward to seeing Bill C-27 progress through the legislative process in a way that will provide children and minors with the privacy protections that they need in this increasingly digital world.

I am happy to take your questions.

Thank you.