Appearance before the Standing Committee on Public Safety and National Security on Bill S-210

May 27, 2024

Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Thank you to the Chair and Members of the Committee for this invitation to appear on your study of Bill S-210, An Act to Restrict Young Persons’ Online Access to Sexually Explicit Material.

As Privacy Commissioner, my mandate is to protect and promote individuals’ fundamental right to privacy. This includes providing advice, guidance, and recommendations for protecting personal information, and overseeing compliance with Canada’s two federal privacy laws – the Privacy Act, which applies to federal government institutions, and the Personal Information Protection and Electronic Documents Act, or PIPEDA, which is Canada’s federal private-sector privacy law.

In January, I launched my Strategic Plan for my Office which is focused on three priority areas: maximizing the OPC’s impact in promoting and protecting the fundamental right to privacy; addressing and advocating for privacy in this time of technological change; and championing the privacy rights of children.

I support the purposes of Bill S-210, which include protecting the mental health of young people from the harmful effects of being exposed to sexually explicit material.  

The Bill does raise some privacy implications and I would propose some changes to address them.

As drafted, the Bill provides that any organization that makes sexually explicit material available online to a young person for commercial purposes is guilty of an offence and liable to a fine that would increase in amount depending on whether it was a first or subsequent offence.

A defence is available if an organization believed that the young person was at least 18 years of age having implemented a prescribed age-verification method to limit access to the sexually explicit material.

Age verification can raise privacy implications, as it generally requires the collection of personal information, which could include biometrics or identity documentation.

As drafted, the Bill would apply to services such as social media and search engines that may make available some sexually explicit material, but that may be primarily focused on other content. This could result in age-verification requirements including when the majority of content may not be of a sexually explicit nature. 

To address this, the Committee could consider restricting the requirement for age-verification to websites that primarily provide sexually explicit material for commercial purposes.

Before prescribing an age-verification method, the Governor in Council would need to consider certain criteria, including whether the method maintains user privacy and protects users’ personal information. I would recommend adding additional criteria to the list to ensure that the prescribed methods are sufficiently privacy protective. Specifically, this could include assessing whether the prescribed methods are proportionate and limit the collection of personal information to what is strictly necessary for the verification. Age-verification methods should also prevent tracking or profiling of individuals across visits to websites or services. These are positive and important criteria.

Internationally, various jurisdictions have taken action to prevent children from accessing pornography, but some of these laws have a narrower application than Bill S-210. For example, Texas and Utah only require age verification measures on sites that meet a certain threshold of pornographic content. Some regulators have also worked to mitigate the privacy risks associated with the use of age verification technologies. For example, Spanish and French regulators have worked with researchers to develop and evaluate potential age verification mechanisms.

My Office is conducting further research in this area and is a member of an international working group with other privacy regulators to share information on age-verification methods and learn from each other’s experiences. Notably, members of this working group intend to publish a joint statement of principles for age assurance later this year. My Office is also developing guidance for organizations on age assurance and privacy, and will launch an exploratory consultation on this next month.

Finally, should Bill S-210 be adopted, I would be happy to provide advice on regulations that pertain to privacy and the protection of personal information at the appropriate time.

I would be pleased to take your questions.