Statement by the Privacy Commissioner following release of committee report on the federal government’s use of technological tools capable of extracting personal data from mobile devices and computers

October 11, 2024
Gatineau, Quebec

Privacy Commissioner of Canada Philippe Dufresne today issued the following statement regarding a new report from the Standing Committee on Access to Information, Privacy and Ethics (ETHI) on its study into the federal government’s use of technological tools capable of extracting personal data from mobile devices and computers:

---

I welcome the committee’s report, which confirms the importance of amending the Privacy Act to ensure that privacy implications are appropriately considered and addressed as technologies are increasingly changing the ways in which personal information is collected, used and disclosed by federal institutions.

The committee supports the need for new legal obligations for federal institutions that would better protect and promote Canadians’ fundamental right to privacy. These measures would also serve to foster trust in government institutions.

Privacy Act reform is a pressing need, as the legislation has not been significantly updated since it was passed 40 years ago.

The committee report supports the need for a number of critical measures that I have advocated for, including:

• Amending the preambles of both the Privacy Act and the Personal Information Protection and Electronic Documents Act (PIPEDA), the federal private-sector privacy law, to indicate that privacy is a fundamental right.
• Granting my Office the power to make recommendations and issue orders in both the public and private sectors when I find violations of the laws for which I am responsible.

Amending the Privacy Act to:

• Create an explicit requirement for government institutions to conduct privacy impact assessments (PIAs) before using high-risk technological tools to collect personal information and to submit them to my Office for review.
• Include the concept of privacy by design and an obligation for federal institutions to meet this standard when developing and using new technologies.
• Require federal government institutions to consult my Office before they launch an initiative, activity or program that could have an impact on privacy.
• Include explicit transparency requirements for government institutions.
• Include the concepts of necessity and proportionality by requiring federal government institutions to demonstrate that any activities and programs they pursue that could have an impact on privacy are necessary to achieve a pressing and substantial purpose and that the intrusion on privacy is proportional to the benefits to be gained.

Related links

• ETHI report: Federal government’s use of technological tools capable of extracting personal data from mobile devices and computers
• Opening statement by Commissioner Dufresne before the ETHI Committee, February 1, 2024
• Letter to ETHI on its study on the federal government’s use of technological tools capable of extracting personal data from mobile devices and computers
• OPC submission to Justice Canada’s public consultation on modernization of the Privacy Act

Media contact

Office of the Privacy Commissioner of Canada
communications@priv.gc.ca