Remarks by the Privacy Commissioner to the Troisième colloque en droit Public du Barreau de l’Outaouais

January 30, 2025
Gatineau, Quebec

Address by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

---

President Dupuis, Mayor Marquis-Bissonnette, dear colleagues, ladies and gentlemen, thank you very much for the invitation to take part in this important public law symposium. I am very honoured to be here with you during Data Privacy Week, which highlights the importance of protecting individuals’ fundamental right to privacy while promoting innovation and the public interest.

As jurists working in the various fields of public law, you perform an essential service in protecting Canadians’ fundamental rights and upholding the rule of law, which we should never take for granted.

We are in a data-driven era. Technology is evolving at a breakneck pace, and it seems as if every week brings dizzying developments, the latest being the new DeepSeek generative artificial intelligence engine.

Personal information is being captured, used, and shared in unprecedented volumes, which is transforming the landscape in which we live and work. This is so true that in its majority judgment in R. v. Bykovets, the Supreme Court of Canada said (at paragraph 78) that “By concentrating this mass of information with private third parties and granting them the tools to aggregate and dissect that data, the Internet has essentially altered the topography of privacy under the Charter [and has] added a third party to the constitutional ecosystem, making the horizontal relationship between the individual and the state tripartite.”

As many individuals are adopting and embracing new technologies, it is essential that our efforts are focused on supporting their best interests and empowering them to understand and make informed choices about how their personal information is used while harnessing new opportunities.

It is equally important to ensure that organizations are equipped with knowledge and guidance to maintain strong data-management and privacy protections as they adopt new technologies. This includes innovating in privacy protection as well.

Today I would like to speak with you about what it means to treat privacy as a fundamental right and also how my Office is working to advance three strategic priorities in areas where I believe that we can have the greatest impact.

Protection and promotion of rights

Like many of you, my professional life as a lawyer has been dedicated to the strengthening of Canada's public institutions and to the protection and promotion of the fundamental rights of Canadians.

As Senior General Counsel at the Canadian Human Rights Commission, I was responsible for the organization’s legal and operational activities pursuant to the Human Rights Act. I have been lead counsel on major cases, including the landmark case on child welfare on Indigenous reserves before the Canadian Human Rights Tribunal. I have also represented the Commission on a number of occasions before the Supreme Court of Canada in important cases involving the interactions between human rights and national security or other public or private interests.

As the Law Clerk and Parliamentary Counsel of the House of Commons, I was the institution’s chief legal officer and led what I liked to describe as the department of justice to the legislative branch, responsible for privacy and for the protection of parliamentary democracy and the rights and privileges of parliamentarians.

I also briefly served early on in my career as a legal officer with Global Affairs Canada, where I was responsible for cases regarding international human rights and criminal law tribunals.

Each of these roles required promoting and protecting fundamental rights while at the same time achieving a balance between protecting these rights and promoting public and other private interests.

This required rejecting the false choice of saying that you can either have human rights or national security; you can either have parliamentary privilege or health and safety; or you can either have the principle of sovereignty of nations or a system of international criminal law.

This approach of protecting and promoting fundamental rights while achieving important interests also applies to my current role as Privacy Commissioner of Canada, where my mandate is to ensure that Canadians’ privacy is promoted and protected, but to do so in a way that supports the public interest and the Canadian economy.

This balance is especially important in the current digital environment.

Finding the right ways of protecting and promoting our fundamental right to privacy while harnessing these new technological opportunities will be a key challenge for Canada’s institutions in the coming years.

When I appeared before the House of Commons and the Senate during the confirmation process of my appointment as Commissioner in 2022, I presented the three elements of my vision for privacy:

• Privacy as a fundamental right;
• Privacy in support of the public interest and Canada’s innovation and competitiveness; and
• Privacy as an accelerator of Canadians’ trust in their institutions and in their participation as digital citizens.

These three pillars reflect the reality that Canadians want and have the right to be able to fully participate as active and informed digital citizens without having to choose between this participation and their fundamental privacy rights.

Canadians should be able to benefit from the public interest and economic advances brought by new technologies with the reassurance that their laws and their institutions are there to appropriately safeguard and protect their personal information.

As the majority of the Supreme Court pointed out in Bykovets (at paragraph 48), “Canadians are not required to become digital recluses in order to maintain some semblance of privacy in their lives.”

Privacy as a fundamental right

In 2019, my Office and its international counterparts in the Global Privacy Assembly declared in a resolution that “privacy is a precondition for citizens’ other freedoms as well as a keystone right for democracy and personal and social development.”

The resolution said that there is an “indispensable link between the protection of the right to privacy and a society’s commitment to promote and respect human rights and development.”

This description of privacy as a necessary condition for the existence of other fundamental rights is consistent with the Supreme Court of Canada’s long-standing interpretation of privacy law as having quasi-constitutional status.

The Supreme Court reiterated this important principle in the 2013 United Food and Commercial Workers case, where it stated that “legislation which aims to protect control over personal information should be characterized as ‘quasi-constitutional’ because of the fundamental role privacy plays in the preservation of a free and democratic society.”

This also echoes international law and the inclusion of the right to privacy in the 1948 Universal Declaration of Human Rights.

I had the opportunity to reaffirm the role of privacy as a foundation for other fundamental and democratic rights in a joint statement with the UN Special Rapporteur on the right to privacy in December 2023.

Treating privacy as a fundamental and quasi-constitutional right means treating it as we do other human rights. As a priority.

It means that privacy must be legally protected and promoted with a strong, fair and enforceable legal and rights-based regime. There must be meaningful remedies that prevent and address violations and that will act as an incentive for organizations to create a culture of privacy, where privacy is considered, valued and prioritized.

Where privacy is included and embedded at the outset of innovation, not as an afterthought or regulatory irritant.

Treating privacy as a priority means that the collection, use, retention and disclosure of personal information must be limited to what is demonstrably necessary and proportional.

It means that, just as we cannot contract out of human rights, the protection of privacy cannot rest entirely on a model of consent.

In a legal system based on the rule of law and democratic principles, it cannot be left to individuals alone to ensure the protection of their fundamental right to privacy as a purely contractual matter.

Those who trade in, and benefit from the knowledge economy must also be accountable for the ways in which they use information.

The importance of accountability was highlighted in the Federal Court of Appeal’s ruling in September that Facebook’s practices between 2013 and 2015 had breached PIPEDA’s requirement to obtain meaningful consent from users and had failed to appropriately safeguard users’ personal information.

This was an acknowledgement that international data giants, whose business models rely on users’ data, must respect Canadian privacy law and protect individuals’ fundamental right to privacy.

Facebook has sought leave to appeal to the Supreme Court of Canada. We await the Court’s decision in the coming months.

This is not the only recent instance in which the Federal Court of Appeal has weighed in on the relationship between data giants and privacy law.

In response to a reference question, the Court agreed with my Office’s position that Google is subject to PIPEDA.

The Court’s decision brought important clarity to this area of the law.

Treating privacy as a fundamental right means that, in the rare cases of conflict between privacy rights and private or public interests, privacy will prevail.

I say that these cases will be rare because, by creating a culture of privacy and protecting personal information at the front end, we will be able to avoid most conflicts and achieve both privacy and the desired public or private interests.

The second element of my vision is a recognition of the positive impacts of privacy on the public interest and the economy, and a rejection of the false choice between privacy and the public interest or innovation. Just as we can – and indeed we must – have human rights and national security, we can and must also have privacy while fostering the public interest and innovation.

Canada can be an innovation hub and a model of good government while at the same time providing a strong and effective quasi-constitutional legal regime to protect the personal information of Canadians. Privacy is the foundation of a free and democratic society, and protecting it often means protecting other important imperatives.

For example, last year I rendered a decision following a complaint against the business Aylo, which owns the pornographic site Pornhub. The decision reiterates that the use of images and video without consent is a violation of privacy. While other bills aim to combat the sharing of intimate images without consent, I pointed out that privacy laws already offer certain protections and that I would use every tool at my disposal to ensure that the business reviewed its policies to this effect.

This speaks to my third pillar, privacy as an accelerator of Canadians’ trust in their institutions: When individuals trust that their rights will be protected, they feel confident about participating freely in the digital economy. This is good for Canadians, good for business and good for innovation.

Strategic priorities

My commitment to working toward a future where innovation can flourish, and fundamental privacy rights are upheld, is contained in the strategic plan that I launched a year ago to guide the work of my Office. The plan builds on my three pillars and established three strategic priorities that are guiding our work:

• Protecting and promoting privacy with maximum impact;
• Addressing and advocating for privacy in this time of technological change; and
• Championing children’s privacy rights.

Protecting and promoting privacy with maximum impact

The first priority, protecting and promoting privacy with maximum impact, is the bedrock for fulfilling my Office’s current mandate and addressing the growing complexity of privacy protection in this digital era.

Under this priority, we have been working to use business intelligence to identify trends that need attention, produce focused guidance and outreach, and leverage strategic partnerships.

Across this priority is a commitment to collaboration and working with domestic and international privacy regulators, government, civil society, academics, and industry.

It is critical that we work with our partners – nationally and globally – in a world where information flows transcend borders and jurisdictions and where the pace of technological change is unprecedented.

I am grateful for the relationships that I have with my provincial and territorial counterparts, for example, to convene and produce guidance and advice to address important issues such as artificial intelligence and children’s privacy and to leverage expertise and resources to collaborate on investigations.

My Office also works with international partners to develop common rules that will help to avoid a patchwork of regulations. It will also offer citizens peace of mind that their personal information will enjoy similar protections when they – or their data – cross borders.

One of the highlights for my Office this coming year will be hosting G7 data protection and privacy authorities in the context of Canada’s G7 presidency.

Cross-regulatory collaboration is also essential to better protect the rights and interests of individuals. For example, the intersection between privacy, competition, broadcasting, telecommunications and copyright has grown ever more apparent in today’s digital marketplace.

This year, I am Chair of the Canadian Digital Regulators Forum, which my Office helped to establish in 2023 and includes the CRTC, Competition Bureau and Copyright Board of Canada. The purpose of the group is to strengthen information sharing and collaboration on matters related to digital markets and platforms.

Some of the work my Office is doing to advance the priority to maximize impact involves internal changes at the OPC, but we also need legislative changes.

To that end, we must continue to progress on efforts to modernize Canada’s privacy laws – both the private-sector law, as well as the Privacy Act.

I appeared before the Standing Committee on Industry and Technology on Bill C-27 and proposed 15 key recommendations to strengthen the Bill, including recognizing privacy as a fundamental right and protecting children’s privacy and the best interests of the child, and making the privacy complaints process more economical and expeditious.

I will continue to advocate for modernized privacy laws that recognize privacy as a fundamental right while advancing the public interest and a strong Canadian economy.

Canada’s existing privacy laws continue to apply, including for new technologies such as generative AI, and I remain committed to their application until new legislation is adopted.

Addressing and advocating for privacy in this time of technological change

My second priority, addressing and advocating for privacy in this time of technological change, has a focus on artificial intelligence and generative AI.

AI holds incredible promise in advancing innovation, efficiency, and convenience. AI was a major theme earlier this month at the CES 2025 trade show highlighting new technologies and advances in personal tech, transportation, sustainability and health care.

For example, the CES event in Las Vegas showcased emerging AI-powered products such as hearing aids offering real-time translation, and a health-screening smart mirror that provides a 360-degree body scan and health assessment, including lung health and blood pressure, when you stand in front of it.

While people seek to benefit from all that technology affords, AI also comes with inherent risks.

I have emphasized the importance of developing and deploying AI in a responsible, privacy-preserving manner. It is critical to leverage innovation to protect and promote individuals’ fundamental right to privacy, while harnessing new technological opportunities.

A Gartner study says that by 2026, more than 80% of enterprises will have used generative AI application programming interfaces or models, and/or deployed generative AI-enabled applications in production environments. That is up from less than 5% in 2023.

Meanwhile, we see predictions that, by 2026, 90% of all online content could be at least partially synthetically generated.

In other words, AI could soon be involved in almost everything that we touch online.

The timeline of this transformation is incredibly short.

Regulators, including my Office, are working steadily to keep pace with emerging and rapidly evolving technologies and to identify best practices for regulating them.

My Office is forging strategic partnerships, fostering technological knowledge, and establishing concrete privacy standards for existing and emerging technologies.

When we talk about AI governance, we talk about ensuring that this technology is designed and built on a solid foundation, and adaptable over time.

By fostering a culture of privacy, encouraging the use of privacy-by-design principles, and establishing privacy standards, my Office can promote innovation while also leveraging innovation to protect the fundamental right to privacy.

Collaboration is central to our work on this issue.

I expect in the coming months to release the findings of our investigation into OpenAI, the company behind ChatGPT, which my Office is carrying out jointly with my counterparts in Quebec, British Columbia and Alberta.

A little more than a year ago, in December 2023, I hosted my first international privacy symposium. bringing together regulators, academics, industry and civil society to discuss privacy and AI. At the symposium we launched a set of principles for responsible and trustworthy generative AI that my Office developed jointly with my provincial and territorial counterparts.

AI is also a focus for the Canadian Digital Regulators Forum. Members are currently studying the proliferation of synthetic media – that is, online content generated by AI – each from our particular perspectives. I expect to produce a report on the issue later this year.

I have signed on to collaborative initiatives related to privacy and AI alongside both my international and domestic counterparts.

Much of our work on the technology priority has stressed the need for developers and providers of generative AI to embed privacy in the design, conception, operation, and management of new products and services.

We have also called on developers to take into consideration the unique impact that these tools could have on vulnerable groups such as children and have reminded players in this field that existing privacy laws apply.

Championing children’s privacy rights

My third priority is championing children’s privacy rights.

This priority recognizes the unique sensitivities around young people’s privacy and the need to ensure that their rights are protected so that they can benefit from technology without compromising their privacy and well-being.

The OPC will also apply a children’s privacy lens to enforcement activities and leverage investigative findings to inform and incentivize organizations to develop products and services with stronger privacy protections for children.

Again, collaboration will be key to advancing this priority.

My Office is undertaking a research project this year to deepen our understanding of the privacy issues being experienced by young people, including their understanding of their privacy rights and the security of their personal information.

The project has several facets, including focus groups and outreach with young people, parents, educators and other stakeholders.

Other work related to this priority includes an investigation into the privacy practices of TikTok as they relate to young users. I expect to release the findings of this investigation, which my Office is carrying out jointly with our counterparts in Quebec, British Columbia and Alberta, in the coming months.

In June, I will host my second international privacy symposium, this one focusing on Youth Privacy in the Digital Age. It will convene experts and young persons to share on topics ranging from youth’s experiences and needs regarding data privacy, to the impacts of AI on youth, educational technology, and the “best interests of the child” in the digital space.

As I have said, for all three strategic priorities, we place immense value on working with diverse partners, networks, and experts, including members of the bar, to collectively navigate the opportunities and challenges ahead and to protect and promote the fundamental right to privacy.

Conclusion

These are exciting times, but also challenging and uncertain ones. With the rapid development of data technology, it is more important than ever to protect our privacy. Not only is this essential for maintaining a free and democratic society, but I would add that in this age of AI, privacy protection will help maintain a more humane society.

Thank you for your attention and for the role of the Bar and its members in protecting the public and the rule of law.

I would be happy to answer your questions.