Appearance before the Standing Committee on Access to Information, Ethics and Privacy (ETHI) on Main Estimates

May 9, 2024

Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Good morning, Mr. Chair, Members of the Committee.

I am pleased to be here today to discuss the Office of the Privacy Commissioner of Canada’s Main Estimates for Fiscal Year 2024-25, and to describe the work of my Office to protect and promote the fundamental right to privacy of Canadians. I am accompanied by Richard Roulx, Deputy Commissioner, Corporate Management Sector.

In January, I launched a strategic plan that lays out three key priorities that will guide the work of the OPC through 2027. They include:

• Protecting and promoting privacy with maximum impact by using business intelligence to identify trends that need attention, producing focused guidance and outreach, leveraging strategic partnerships, and preparing for the implementation of potential new privacy legislation;
• Addressing and advocating for privacy in this time of technological change with a focus on artificial intelligence and generative AI, the proliferation of which brings both potential benefits, and increased risks to privacy; and
• Championing children’s privacy rights to ensure that their unique privacy needs are met, and that they can exercise their rights.

I believe that these three priorities are where the OPC can have the greatest impact for Canadians, and that these are also where the greatest risks lie if the issues are not addressed.

Protecting privacy is one of the paramount challenges of our time. My Office is poised to meet this challenge through strong advocacy, collaboration, partnerships, education, promotion, enforcement, and capacity-building, which includes doing more to identify and address privacy trends in a timely way.

Investigations under the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law are a key aspect of the OPC’s work on issues that significantly impact the lives of Canadians.

In February, I made public the results of my investigation into Aylo, the operator of Pornhub and other pornographic websites.

I found that the company had contravened Canada’s federal private sector privacy law by enabling intimate images to be shared on its websites without the direct knowledge and consent of everyone who is depicted.

In releasing my report on this investigation, I reiterated that the non-consensual sharing of intimate images is a serious privacy violation that can cause severe harms to victims, and that organizations have an obligation under privacy law to prevent and remedy this.

This case is also relevant to the discussions that will be taking place on Bill C-63, and I will welcome the opportunity to share my views on the Online Harms Act with Parliamentarians.

I also look forward to sharing in the coming months the findings of two high-profile investigations that are closely tied to two of my strategic priorities—protecting children’s privacy and addressing the privacy impacts of emerging technology, including AI.

When I appeared before you last year on Main Estimates, I spoke about the launch of investigations into TikTok, as well as OpenAI, the company behind the AI-driven text generation ‘chat bot’ ChatGPT. Both investigations are being conducted jointly with my counterparts in Quebec, British Columbia, and Alberta.

In the case of TikTok, the four offices are examining whether the practices of the company that owns it, Bytedance, comply with Canadian federal and provincial privacy legislation and, in particular, whether valid and meaningful consent is being obtained for the collection, use, and disclosure of personal information. Given the importance of protecting children’s privacy, the joint investigation has a particular focus on TikTok’s privacy practices as they relate to younger users.

The investigation into OpenAI and its ChatGPT chat bot is examining whether the company is compliant with requirements under Canadian privacy law in relation to consent, openness, access, accuracy, and accountability. As well, the investigation is considering whether OpenAI is collecting, using, and disclosing personal information for an appropriate purpose.

Both investigations remain a high priority and we are working to complete them in a timely manner.

Protecting and promoting privacy with maximum impact remains integral to fulfilling my current mandate and preparing for potential changes to federal privacy law.

In the 2023 Budget, we received temporary funding to address pressures related to privacy breaches and a complaints backlog, as well as to prepare for implementation of Bill C-27.

While these temporary funds provide necessary and immediate support, it is essential that my Office be properly resourced on a permanent basis to deal with the increasing complexity of today’s privacy landscape, and associated demands on my Office’s resources. To address this, we will continue to present fiscally responsible funding requests, and will also aim to maximize agility and cost effectiveness by assessing and streamlining program and service delivery.

With that, I would be happy to answer any questions.

Thank you.