Appearance before the Standing Senate Committee on National Finance (NFFN) on Main Estimates

September 17, 2024

Ottawa, Ontario

Opening statement by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

Good morning, Mr. Chair, Members of the Committee.

I am pleased to be here to discuss the Office of the Privacy Commissioner of Canada’s Main Estimates for Fiscal Year 2024-25.

As Privacy Commissioner, it is my mandate to protect and promote individuals’ fundamental right to privacy. This includes providing advice, guidance, and recommendations for protecting personal information, and overseeing compliance with Canada’s two federal privacy laws – the Privacy Act, which applies to federal government institutions, and the Personal Information Protection and Electronic Documents Act, or PIPEDA, Canada’s federal private-sector privacy law.

Protecting privacy is one of the paramount challenges of our time, as personal information is increasingly sought after in the digital age, in a world where information flows transcend borders and jurisdictions.

Last week, I welcomed a unanimous Federal Court of Appeal decision which found that Facebook’s practices between 2013 and 2015 breached PIPEDA. This was a critical acknowledgement that international data giants, whose business models rely on users’ personal information, must respect Canadian privacy law and protect individuals’ fundamental right to privacy.

The privacy issues and risks that we face as a society are vast and continue to grow in complexity and scope, creating pressures on my Office’s resources.

To help meet these challenges, I have identified three strategic priority areas where I believe that we can have the greatest impact and where the greatest risks lie if they are not addressed.

These are: maximizing my Office’s impact in promoting and protecting the fundamental right to privacy; advocating for privacy in this time of technological change; and championing the privacy rights of children.

These align with major privacy trends outlined in my most recent Annual Report to Parliament, which was tabled in June. The trends include the proliferation of artificial intelligence; greater concern for the privacy rights of young people; and the ongoing rise in digital connectivity and concern about how digital information is protected.

Another notable observation that is highlighted in my annual report is the increasing threat and severity of cyberbreaches in Canada and around the world. For example, while last year there were just slightly more incidents reported to my Office than in the previous year, they affected twice as many individuals.

An example of the breadth of the impact of a cyber breach is our ongoing investigation into Ticketmaster Canada, which is examining an incident that affected the personal information of millions of individuals worldwide.

I am also prioritizing collaboration with domestic and international partners and stakeholders to amplify our collective impact in protecting and promoting the fundamental right to privacy.

Joint investigations are an important example of how we collaborate.

In the coming months, I will be concluding two important joint investigations, into TikTok and OpenAI, the company behind ChatGPT. Both investigations are being conducted with my counterparts in Quebec, British Columbia, and Alberta.

My Office is also collaborating with my counterpart in the United Kingdom on a joint investigation into the data breach at the global direct-to-consumer genetic testing company 23andMe.

The OPC also collaborates with international data protection partners through global forums and initiatives. For example, in July, I released a report from an international online sweep that found that nearly all – more than 97% of the websites and mobile apps that our organizations reviewed – used deceptive design patterns that could influence individuals to give away personal information.

Next year, as Canada assumes the G7 presidency, I will host the G7 Data Protection and Privacy Authorities Roundtable.

I recently signed a memorandum of understanding with the United States Federal Communications Commission. This will support information sharing and enforcement cooperation between the two regulators.

In addition to international engagement, my Office has joined with the Competition Bureau and the Canadian Radio-television and Telecommunications Commission to create the Canadian Digital Regulators Forum, to share information and resources in areas of common interest across regulatory sectors. Last week, we welcomed the Copyright Board of Canada as a member.

Finally, on the issue of financial matters specifically, in the 2023 Budget, my Office received temporary funding to address pressures related to privacy breaches and a complaints backlog, as well as to prepare for implementation of Bill C-27, the Digital Charter Implementation Act.

While those temporary funds provided necessary and immediate support, it is essential that my Office be properly resourced on a permanent basis to deal with the increasing complexity of today’s privacy landscape, and associated demands on my Office’s resources. To address this, we will continue to present fiscally responsible funding requests, and will aim to maximize agility by reviewing my Office’s governance and processes to ensure that we are as effective and efficient as we need to be.

I would be happy to answer any questions.