ETHI Committee Meeting
Notices of Meeting include information about the subject matter to be examined by the committee and date, time and place of the meeting, as well as a list of any witnesses scheduled to appear. The Evidence is the edited and revised transcript of what is said before a committee. The Minutes of Proceedings are the official record of the business conducted by the committee at a sitting.
For an advanced search, use Publication Search tool.
If you have any questions or comments regarding the accessibility of this publication, please contact us at accessible@parl.gc.ca.
Standing Committee on Access to Information, Privacy and Ethics
|
l |
|
l |
|
EVIDENCE
Thursday, May 7, 2026
[Recorded by Electronic Apparatus]
[Translation]
I call this meeting to order.
Welcome to meeting number 41 of the House of Commons Standing Committee on Access to Information, Privacy and Ethics.
Pursuant to Standing Order 81(4), the committee is resuming consideration of the main estimates 2026-27, specifically vote 1 under Office of the Commissioner of Lobbying, vote 1 under Office of the Conflict of Interest and Ethics Commissioner, vote 1 under office of the Senate ethics officer, votes 1 and 5 under Offices of the Information and Privacy Commissioners of Canada, referred to the committee on Thursday, February 26, 2026.
I would like to welcome the Commissioner of Lobbying.
Thank you for being with us today.
In the second hour, we'll have another guest.
Ms. Bélanger, I assume you're ready to make your opening remarks. You have five minutes.
I'll let you start.
Madam Chair and committee members.
It is a pleasure to be here with you today to discuss the main estimates and my office’s plans for fiscal year 2026-27.
As many of you know, the Lobbying Act requires that my office maintain the registry of lobbyists. My team works to consistently improve the registry so that both filing and finding information is as easy and efficient as possible. The registry is the transparency tool that allows Canadians to know who is lobbying federal public office holders and about what.
We provide educational sessions and develop various information products to help people better understand the requirements of both the federal Lobbying Act and the lobbyists’ code of conduct. We also do compliance work to support respect of the act and the code.
The objective of the federal lobbying framework is to ensure that lobbying is both transparent and ethical. This is a cornerstone of a healthy democracy that supports citizen trust in public institutions.
My total budget for this current fiscal year is approximately $6.1 million. Roughly $4.8 million goes to salaries and benefits, leaving an operating budget of around $1.3 million. About $700,000 of that operating budget is spent on obtaining services from other federal organizations, including services related to human resources, finances, procurement and information technology.
This is a very small budget, and not surprisingly we were not subject to the comprehensive expenditure review. However, I am always very mindful of our stewardship of resources. Ever rising costs—including expenses for the information technology, licenses and infrastructure needed to run our office—is increasingly putting pressure on our budget and limits our flexibility in the allocation of funds.
Related to the budget, I would be remiss if I did not take this opportunity to highlight the challenges posed by the current funding model for agents of Parliament. Requiring us to seek funding through a ministerial portfolio undermines our independence. I would urge this committee to consider a new funding model that recognizes and reinforces the independence of agents of Parliament.
[English]
Let me turn to our plans for this year.
Given your current study of the Lobbying Act, you are well aware of one of our current priorities. It is a great pleasure to support you in identifying legislative improvements that can keep Canada at the forefront in lobbying transparency for years to come.
I will say the following in relation to my recommendations. They recognize that the amount of effort required to electronically file and maintain information in the registry of lobbyists is not onerous. Adopting clear, consistent and easy-to-follow registration and disclosure requirements would reduce the amount of time and effort that stakeholders must invest in understanding the current intricacies of the act. Not only would this help stakeholders, but it would also reduce the extensive resources currently used by my office to provide clarifications and explanations. These resources could, in turn, be allocated to other priorities, including providing even greater support to a growing number of stakeholders.
As for other priorities, we continue to develop ways to expand awareness and understanding of the act and the code. In particular, we are updating our online materials, including advisory opinions, always with the goal of simplifying the guidance we provide and increasing clarity for stakeholders.
In addition, we're advancing on 19 ongoing compliance files. As you are aware, the act imposes strict confidentiality requirements, and I therefore cannot discuss the specifics of any particular compliance matter. However, I can say that currently, three files are with the RCMP.
All of this work is accomplished through the contributions of, on average, 35 employees. I am always extremely proud of my team and the work we do. According to a study based on the most recent public service employment survey, our office—and I'm very proud of this—was the top-ranked federal organization. For example, we had leading scores in management and in being a great place to work. This reflects the team's collective sense of shared purpose, collaboration and integrity. Words cannot express how grateful I am for my team's unwavering dedication to lobbying transparency, ethics and compliance.
Thank you again for the opportunity to be here today. I'm pleased to answer any questions you may have.
[Translation]
Thank you, Commissioner. That was exactly five minutes.
Mr. Barrett, you have the floor for six minutes.
[English]
Thank you, Commissioner.
How do you assess whether the current approach of your office on enforcement, audits, referrals and public reporting under the act is delivering good value for money for taxpayers? What metrics do you use?
That's a very good question.
In my view, we could do a lot better with changes to the act, because currently, a lot of resources.... I review everything that comes in front of me. We review every matter. Many matters lead to files to the RCMP. It takes a lot of our time, it takes a lot of the RCMP's time, and then it is returned to me and closed. If we changed the act so that I could impose administrative monetary penalties, so that I could deal with the issues right away, it would take less time, and people would understand how the regime works.
I may not have understood your question—
No, I think that's good.
Typically, when you come before the committee—which is often, and we appreciate your coming—you provide us an update, either in your remarks or, predictably, with the opening round of questions, on how many files are with the RCMP. That number changes. Do you know the change in that number since the last time you were here?
When that happens, is there...? You have reason to believe, when you refer a matter to the RCMP, that the act has been broken.
When it returns to you, with you being of the belief that the act was broken, does the public get to see reports 100% of the time on those files that come back to you?
It's because the way the act is arranged right now, I can't make findings of breaches. If the RCMP and the Public Prosecution Service decide that they can't find an offence, I don't have the authority to do that. All I can do is say that I had reason to believe. Then procedural fairness would have to kick in. Usually, two, three or four years will have passed since the events occurred.
We have some procedural fairness issues here.
Therefore, the solution to that, you believe, would be to change the act to allow you to issue administrative monetary penalties when you have determined that breaches have occurred, and then the penalty would be levied and a public report would be made.
How many times have you found breaches of the act that did not rise to the level to which they were reported to the RCMP?
Well, obviously I had reasonable grounds to believe for the 19 of them, and they pressed charges in two.
Right, but you would find times when the act was not complied with, and then you would seek to have corrective action taken, perhaps compliance retroactively, have people register their meetings. Obviously they haven't followed the law, having not registered, but you haven't deemed it necessary to report them to the police. The act wasn't followed, you advised the individual, you're satisfied with their compliance and you consider the matter closed. Would you be able to quantify how many times that has occurred in your time in office?
Probably not, but I could look into it and see if I can give you a number.
What happens is that the files I send to the RCMP are sent because I open an investigation, because I feel an investigation is necessary to ensure compliance.
There are many times when people will call us and say, “Hey, I'm late.” They volunteer that they're late. Being late is an offence. However, I don't have to investigate. They come and raise their hand, saying they're late, so I just accept their registration for transparency purposes. I do not investigate those matters, and I don't send them to the RCMP.
How often does that happen? Well, I can tell you that, in the last year, at least 8% of registrations were late and 5% of monthly communication reports were late, but I accept them for transparency purposes. I certainly will not send those to the RCMP, because I don't need to investigate. I send to the RCMP only those I've actually investigated.
Any foreign entity that lobbies federal public office holders is subject to the Lobbying Act and should register. The foreign transparency act actually goes broader than the current Lobbying Act, so there will be overlaps in registration, but the responsibility under the Lobbying Act applies even though someone may be a foreign entity or body, and we do have foreign entities in our registry.
Commissioner, it's nice to have you here at committee. I'm a new member to this committee, so I'm looking forward to our discussion.
I do want to congratulate you on your top-ranking status. You should be very proud of that. I think that having a team member who is working so hard, and recognizing that, goes a long way, so congratulations to you and the entire team.
Since I am a new member, as I've shared, would you perhaps elaborate on what types of issues you're referring to the RCMP?
Of the 19 files we have shared, some are organizations and corporations that were not registered, when I was of the view that they met the threshold. Some were consultant lobbyists who were not registered but, in my view, should have been registered. Some were former designated public office holders who should not have been lobbying because they were subject to the five-year restriction, but they lobbied.
For the most part, those are the files. There were some on contingency fees as well, where we found evidence that people were agreeing to lobby based on the success. That's not permitted under the Lobbying Act; therefore, I have sent some of those as well.
You send a file to the RCMP, the RCMP investigates it, and if there are charges that need to be pressed, it presses those charges.
Of the files that you're usually referring to them, how many are returned to you, and how many have charges pressed?
Of the 19 files I have sent, they currently still have three. In one, charges were laid, the file is finished and they returned that one. I have closed 14, and there's still one that was just recently sent, which is still suspended, and I haven't decided yet what we will do with that.
The issue is that, when I get the file back, I need to decide whether there is a compliance rationale to.... What is there left to investigate? This file has been investigated by me. I've sent it to the RCMP. They've investigated. No charges were laid. It was sent back to me. What am I supposed to do with that? The only thing I could do, possibly, is a report to Parliament to say, “Here's what I did. Here's what the police did.” I don't know what they did, because they don't tell me. They just return the file. The purpose of that.... Then I have procedural fairness. I would have to let the people know that these events that happened four or five years ago...so I just close the file, because there's nothing left to investigate.
Okay. Our time is limited. The challenge is.... We have people like you in these important roles. Clearly, your team takes the role seriously.
I have no doubt that the police and the RCMP take their role seriously, so matters are being looked at and they are being addressed. A report to Parliament would allow the public to know what's taking place, because it would be a public report. I just don't want the impression that things don't get taken seriously. They are addressed.
Sometimes I have conversations, “I want to determine someone's guilt or innocence,” but that's not how our independent judicial system or independent agencies work. That's part of the strength of our democracy in Canada. I think it's something that's fragile around the world and something that we need to protect a lot more now. Thank you for that information.
I am going to move on to the main estimates, just to make sure that we stay on the topic that you're here for. Can you give us a breakdown and overview of your main estimates for 2026-27, just so that anybody watching can get a bit of a snapshot of what's taking place?
We have a budget of $6.1 million, and $4.8 million is for our staff: $3.6 million of that is actually for my program, and the rest is for internal services. Then I have $1.3 million left for O and M, and then $700,000 of that goes to MOUs with other departments to help us. We're a team of 35, and we have the exact same obligations as other departments.
I'm sorry. It's for our operational budget. Our operational budget is $1.3 million. That's for contract expenditures, and that's outside of salary dollars.
As a follow-up, can you walk us through the difference between the two main components, the regulation of lobbying and internal services?
The program has 27 of our employees take care of advice to stakeholders, the registry, our outreach and our compliance, to make sure that we interpret and apply the Lobbying Act. The rest of internal services is to do our finance, our contracts, access to information requests—the usual corporate internal services that other departments have.
I'm just going to jump back to the top, to investigations and compliance measures. What additional compliance measures are you looking for under recommendation 17?
I'm hoping that I could have a spectrum. It could start from mandatory training to administrative monetary penalties, to a prohibition on lobbying and then, as well, to continuing to send to the RCMP if it's warranted.
[Translation]
Thank you, Madam Chair.
If I understand you correctly, Ms. Bélanger….
First of all, it's a pleasure to see you again. From 2019 to 2021, I was a new member of Parliament.
I am pleased to see that recommendations have been made. My concern is that they are not being acted upon.
Am I wrong to note that you are disappointed that no additional funding was provided to your office as part of the spring economic update 2026, which was issued in April?
Honestly, I didn't ask for money this year, because I saw the financial situation and where we were headed with the fiscal years. Therefore, I decided to work with the team we have and not to submit a budget request this year. I didn't expect anything, so I wasn't disappointed.
That said, I'm sure there are recommendations that you would like to see implemented. Earlier, we talked about public office holders and penalties. A lot of countries are moving forward. Do we have what it takes?
I think there's a lot of work to be done. We need to improve the act because, in the same vein, I get the sense that I don't have the tools to ensure compliance with the act. My options are either negotiation to get people to comply or the Royal Canadian Mounted Police.
If someone is late, continues to be late and is late again, then I have to accept it. I can't do anything except, perhaps, start an investigation and send it to the RCMP. They would send it back to me, because they're not interested in investigating people who are late. It's not important enough for them, which I understand.
I think the Office of the Commissioner of Lobbying needs a range of penalties to ensure compliance.
Basically, in a nutshell, what is your objective as commissioner? My next questions will show you where I'm going with this.
It is clear to me that our objective, our vision, is for all lobbying to be transparent and ethical. You can't have transparency without ethics and ethics without transparency. The two go together.
If we're talking about transparency, then it's not just a watchdog. You also want to have legitimacy and enforcement potential.
Do you feel that, in your impartial role, you have everything you need to do your job properly and achieve your objective?
I think we do our work very well with the very few resources we have, within the current framework of the Lobbying Act. However, the act absolutely needs to be improved.
We asked external people what the main priorities were. Some said that the ban on lobbying by former public office holders should be increased to more than five years. Others said that it should be about legislation and enforcement.
The committee would like you to send us your main recommendations, perhaps the five most important ones.
I find it hard to determine the five most important recommendations, because it's a whole. You can't change one thing without changing another.
In my opinion, registration by default is one. Everyone who lobbies should be registered. Second, we absolutely have to remove the distinction between organizations and corporations. When people call me, the answer is always that it depends on this or that.
It's never clear. We need a much simpler act.
Most of my recommendations are aimed at simplifying things or have to do with a spectrum of penalties related to that.
I like that expression, “spectrum of penalties”. I'm writing it down.
I have one last question. You mentioned the ministerial portfolio. How could everything be adjusted to increase transparency and make it as impartial as possible? If we ask for additional funding and, in the end, we point fingers because it no longer falls through the cracks…. I see that with the 19 files. How should that be managed?
There are about 10,000 lobbyists. I sent 19 files to the RCMP. A lot of people complied with the rules. The ones who didn't are the ones we have to find. Canada is a big country, and I have a team of 35. We're doing the best we can.
In terms of independent funding, I joined the agents of Parliament in 2007. At the time, there was talk of independent funding. Twenty years later, there is still talk. No solution was ever found. It's apparently hard.
I would recommend that Parliament have a committee to determine the budgets of agents of Parliament. New Zealand has a model whereby only one member per party sits on the committee so that it's not partisan. Agents of Parliament are neutral and independent. That way, a parliamentary committee could review our requests and determine the appropriate budget based on our work and workload, and make a recommendation to the people who provide the money.
When there is a new way of doing things, we shouldn't make people afraid of breaking tradition, as we're doing a lot these days.
Thank you, Madam Chair.
Thank you.
[English]
I want to follow up, Commissioner, on a response you gave to one of Ms. Chagger's questions.
When you refer a file to the RCMP, believing that the law has been broken, and the RCMP returns the file to you without laying charges, you have the capacity and the authority to then, should you wish, table with Parliament a report of what has gone on, detailing that you believe a breach occurred, affording procedural fairness to the individual in question and detailing that the RCMP returned it without laying charges. You could, should you believe it would increase transparency or increase compliance with or awareness of the lobbying laws in Canada, file a report in—
I don't think the act stops me from doing that, but I have to decide.... I have to complete an investigation, and I don't know what there is to complete.
I can file reports of what I have done, but to what end? That's what I struggle with: demonstrating that I did my work. I don't know if that is actually appropriate.
We know we've done our work. We've sent it to the RCMP and it has reviewed the matter, and then three, four or five years later, it comes back, and I'm left with this and I'm not sure what to do. Most of the time, I weigh all of the information, and sometimes the issues are already out in the public domain. I will say that.
There is nothing left to be said in the case of many of the files, or the file is on someone who nobody here would know, because I have to send everything to the RCMP.
Not everything is as high profile as you would think.
Certainly. I just wonder about when the question of public interest arises around awareness among the general public about compliance with the act and whether the RCMP or the prosecution service believes there's a reasonable prospect of conviction. That doesn't necessarily mean that your work was done in vain. Perhaps, sometimes, as is often the case in the House, simply the public being aware of who's who in the zoo can serve as a warning to people in government and business about who they're dealing with.
With that, if I may, I'll turn it over to Mr. Ho, Madam Chair.
[Translation]
[English]
Thanks, Madam Chair.
Thank you, Commissioner, for all the work you do in exposing Liberal insider ties to so many of the boondoggles we've seen in the past 11 years.
Commissioner, Canadians expect that when major policy decisions are made, especially ones that affect national security and domestic industry, they're made transparently, yet when the Liberal government moved to increase quotas for the importation of Chinese-made EVs, there was no clear public record of who influenced that decision. A foreign influence agents registry law was passed two years ago, as you know, but the Liberals haven't done anything to actually implement the registry.
In the absence of a foreign agents registry, how can your office determine whether foreign state-linked actors engaged in unregistered or shadow lobbying, as some may call it, in this case?
I will look into matters if I have reason to believe that I should, if I've been given information or if there are allegations. I have a team of 35. There are six people on my compliance team. There is no way for me to ensure and guarantee that everyone who should be in the lobbyist registry is.
However, if I receive allegations, I will look into them.
That's namely because your mandate relies heavily on information that is disclosed to you between those registered lobbyists and Liberal public office holders.
We've heard repeated concerns about shadow lobbying, where influence is exerted outside these formal channels through informal meetings, political staff, and third party intermediaries and events.
Given the Liberal government's failure to implement the foreign agents registry, do you believe Canada is currently adequately equipped to identify and deter this kind of activity?
I don't think I'm qualified to make that determination.
I can talk only about the lobbyist registry and how that is working, and I can tell you that I can rely only on receiving allegations or hearing of or seeing anything. If I do, I'll look into it, and if there's a breach of the Lobbying Act, then I will investigate and I will forward it to the RCMP, but I don't know about the foreign registry. It's not my—
Could the Lobbying Act, in its current state, be amended to sort of broaden the scope of what could be captured so that it could help you identify more of these cases?
I don't know if it would require a broadening of the act, because it covers quite a bit already. Certainly, if I am to be turning every single rock, you will have to triple or quadruple my office. That's what would have to happen.
[Translation]
Thank you, Madam Chair.
Thank you, Commissioner, for coming before the committee today.
It's my first time in ethics. I'm excited to be here.
The Office of the Commissioner of Lobbying is requesting approximately $5.46 million in voted expenditures for 2026-27. The departmental plan also identifies “depth of capacity” as a key organizational risk for the office as a micro-organization.
How is the office ensuring that it can continue to fulfill its compliance, investigative and transparency mandate while operating with relatively stable funding and limited organizational capacity?
That's a very, very good question.
I will tell you it's because of the quality of the staff that I have. I am going to become emotional. I manage a team of 35 who really believe in the mandate, who go above and beyond.
Very often we can't be innovative and we can't be proactive. We're often reactive, because the demand is high.
However, I have a very small team. I have one person who does everything. There is no depth of capacity. We're 35 employees with the exact same obligations as every other department out there, plus our mandate. We work extremely hard, but we love what we do. We believe in what we do. We have fun doing it, which is probably why we were ranked first.
I think the only answer to that is to have the right people in the right jobs. They're all very collaborative and helpful. When someone is away, someone else picks it up. It's a wonderful team.
That's good. I'm really glad to hear that.
I think all of us can relate to the idea of having a team that works together collaboratively. One of my staff members is here, and I don't know what would happen if she wasn't here one day on the Hill. It's the team that holds you together, so I completely understand your being emotional about it.
I just want to go into a bit about artificial intelligence and oversight. The departmental plan notes that the office will consider integrating artificial intelligence features into future registry updates.
Are you able to tell us how AI tools could improve administrative efficiency and compliance oversight while still maintaining fairness, accountability and public trust in the lobbying framework?
It would require great care and a lot of money.
With a team of 35 right now, I can tell you we're not the most advanced in AI. I'm waiting to see where things will go. My staff have all been trained. They know to use Copilot very, very carefully, with no personal information, etc. We've all been trained.
AI could be used. I'm thinking if ever the registry is updated, if some of the recommendations come in, there are ways to possibly recognize the quality of entries through AI that would have been programmed and planned, but I can't anticipate right now that AI could replace people when it comes to the registry. My head just doesn't go there, personally.
If we were to verify what could be done, it would require quite a bit of investment, and we don't have that money to look at it. We'll see what the future holds on that.
I will ask just a bit about accessibility and procurement priorities. I understand that your accessibility plan from 2026 to 2028, under the Treasury Board directive on the management of procurement, required continued investments in accessibility and indigenous procurement initiatives.
How is the office balancing these government-wide commitments alongside its core regulatory and oversight responsibilities within its current budget framework?
Again, we do it. We do it carefully. We know our obligations. We know when they come up.
On accessibility, one of the departments actually reviewed our website and our registry. It gave us some suggestions, and we did them.
In regard to indigenous procurement, we have less than 600,000 dollars' worth of contracts. This year, I think we will be at 12%, so we'll meet the 5% target. We always try to have indigenous contracting. We meet our obligations. We know what we have to do, but I will never jeopardize the core mandate for the purposes of meeting corporate government obligations. So far, we've been able to do both, but it's difficult. It's demanding, but we do it.
Thank you, Madam Chair.
It saddens me when we talk about a foreign agent registry. I've had 70 meetings on foreign interference, particularly by the Chinese. I think that if we want to walk the talk, we have to take action.
Ms. Bélanger, I have a question for you. If there were more prevention in your work, and with all the resources we would provide you, would we today be analyzing the lobbying compliance for 19 files, in your opinion?
On the contrary, I would say that we are very proactive.
The compliance team is made up of six people. This year, we made 196 presentations. We reached over 2,000 individuals. We do a lot of outreach.
We've updated our website. We're on LinkedIn. We're really trying to be proactive. Again, I have a two-person team that does that. I've given over 30 presentations in the last six months. We go to great lengths. We could do more if we had more people and more resources.
If we were to impose more penalties, I might not have 2,000 late files. I believe that transparency delayed is no transparency at all.
If the first two or three people who had registered late had been fined, maybe there would have been fewer than 2,000 late files. Fines would serve as prevention.
I'll ask you my last question.
I understand that you may be concerned about the digital rollout with artificial intelligence. I'm sure you are aware that there is a brand-new joint investigation in which four privacy commissioners took part. My questions in the next round are going to focus on OpenAI and ChatGPT.
You also know that there is a new platform on the horizon. I found out this morning. It's CANChat. Have you heard of CANChat?
Thank you, Madam Chair.
Thank you for being here, Ms. Bélanger. We have known each other for a long time, since 2007.
When I was in the former government, parliamentary secretaries, ministers and the Prime Minister also inherited the title of public office holder. We had more extensive obligations than those of a member of Parliament with respect to lobbyists who met with us. We had to pay special attention to it.
Sometimes, even when we weren't taking part in official meetings, people approached us and talked to us about certain programs or government business. We were all in a pretty sensitive area. Sometimes we had to step back or ask if people were lobbyists or not. It's not exactly written on their foreheads that they're lobbyists. When they come to our offices and we ask them in, we think they are registered. We can ask them if they are registered or assume they are.
Is that still the case today? Do members also have more obligations than they did before 2015?
Designated public office holders include members of Parliament. If a lobbyist meets with you and talks to you at a pre-arranged meeting, they have a duty to prepare a monthly communication report indicating that they have met with you.
You, as members of Parliament, don't have the same obligation, unless I call you to verify the content of the lobbyist's report.
Members of Parliament have the same obligation as ministers. All designated public office holders who meet with lobbyists must answer me when I call them to confirm the content of the lobbyist's report.
Otherwise, they have no obligation except to avoid lobbying for five years after leaving their position.
Thank you, Ms. Bélanger.
I'll go back to 2024. We knew that the current Prime Minister was working as a special adviser to the Liberal government. He was still a vice-president of Brookfield at the same time.
I don't know whether he was registered as a lobbyist. If the answer is yes, all the better or too bad. If the answer is no, he had access to the Prime Minister, the Clerk of the Privy Council and members of the Privy Council. It was a murky area. That worries me a bit.
You talked a lot about transparency and ethics. In that case, is there a way to check the registry of lobbyists to see if he was registered?
Yes, certainly, you can check the registry to see if he was.
There are a lot of criteria for being put on the registry. Again, these are some of the things that need to be addressed in the review of the act. You have to be paid and make representations to a public office holder on behalf of a client or on behalf of their employer. If those criteria are not met, the Lobbying Act does not apply.
We also know that on May 6, 2025, the Prime Minister met with Sam Pollock, the CEO of Brookfield Infrastructure. That was his former employer, directly or indirectly. I don't think he was registered as a lobbyist. Apart from the usual salutations, they might have discussed a few little policies.
How can we know, as gatekeepers of transparency?
Again, if there are allegations of lobbying, I can look into it. However, I have no power to say that someone broke the law. I have to refer the matter to the Royal Canadian Mounted Police.
You can make access to information requests to find out if there is a record of a meeting and to find out what was discussed. That's the other way to do it, by making an access to information request.
Between you and me, we know that a meeting can often last seven or eight minutes. While taking a walk, people can talk or have big discussions, but there will never be a record of it. We are still very limited. The reality is that we can get around our obligations toward lobbying and transparency.
I absolutely agree that transparency is important. That's why I made some recommendations to broaden the obligations and transparency for meetings that are unplanned. Whether they take place in the street, on a street corner or at an airport, those meetings should be recorded in the registry. I agree with you.
[English]
Thank you, Commissioner, for being here with us.
I noticed that indigenous contracting results were 9.7% in 2023-24 and 3.4% in 2024-25, with a forecast of 9.2% for 2025-26 and a target of 5% for 2026-27.
Can you tell us more about these figures and what is driving the changes?
The way the policy of the Treasury Board works is that we have been assigned a target of 5%. I don't get to pick that. That's the target. It's 5% of the contracts that we award. It's not contracts that we've paid.
If in a certain year we have a contract that's for three years, it's the year it is awarded. Then in year two and year three, the numbers go down, because it's not the year that we awarded it, which is why it fluctuates so much.
We had targeted last year.... I think it's 9% that you said. I think we'll meet 12%, because we were in the cycle of having to buy new laptops, and we bought them from an indigenous company, so we will meet 12%.
We don't do a lot of contracts. I have no money. We do just a little bit. We always try to prioritize indigenous groups. We will likely do an evaluation this year, so we'll see if we can get an indigenous company, but the 5% is the target that's given to us.
Thank you very much for your effort.
Under government-wide priorities, can you speak to the programs that your office is undertaking in relation to the United Nations 2030 agenda for sustainable development?
What we do there is co-operate at the national level. We have a network of colleagues who do the same type of work as I do.
Also, the OECD often invites me to participate in work there, and Canada is seen as a leader, as one of the countries with the longest-standing laws on lobbying. That's how I contribute to them.
Thank you.
Your departmental plan places significant emphasis on education and outreach. How important is proactive education in improving compliance with the Lobbying Act, particularly for smaller organizations, non-profits or individuals who might not fully understand the obligations?
I think it's paramount. The Lobbying Act is extremely complicated. It has a lot of nuance. It's difficult for people to read and understand, so we do a lot of outreach. We highly recommend that people call us.
We've done almost 200 sessions in the past year. We do advertise a lot, and we're proactively telling people to come and meet the commissioner. I do one-hour sessions with people, and I've been able to meet over 2,000 people from across the country. It is absolutely key.
Thank you.
One of the themes in your recommendations is improving the timeliness and consistency of registration and disclosures.
From your perspective, how can we modernize reporting requirements in a way that improves transparency without creating unnecessary administrative burden, especially for smaller stakeholders?
Every time I hear the word “burden”, I.... There has been no evidence that there's a burden to going in the registry. Creating an account takes five minutes, and inputting the information takes 20 to 25 minutes. There is no burden in the registration.
The burden is in trying to figure out if you should register and what kind of information you need to put in the registry, because depending on who you are, the information.... It always depends. It depends on who you are, and it depends on whether you work for an organization or a corporation.
The challenge, and what I think we have to do, is to simplify the act, which is what my recommendations are all about. If that is simplified, it will be very easy for people to go on the registry, to just go in, open an account and put in the information.
Education is important now because the law is so complicated. If it were simpler, we would be able to support people in actually registering a lot more easily, but right now, people need to figure out if they are even subject to the Lobbying Act.
Thank you.
My final question is this. Recommendation six proposes broader disclosure requirements regarding employees who lobby on behalf of organizations. Can you elaborate more on how that recommendation would improve transparency for Canadians while still remaining practical for businesses and organizations to implement?
Right now organizations have to list every single employee who lobbies, but corporations only have to put in the senior officers and employees who lobby as more than a significant part of their work. That means there are people in corporations right now who do not have to put their name in the registry, and if their name is not in the registry, then they're not subject to the code.
I just want.... If you work for an organization or corporation, everyone's name should be in the registry. It's adding names.
[Translation]
[English]
As the Office of the Commissioner of Lobbying, does your office have the authority to proactively investigate potential undisclosed lobbying, or are you limited to acting when formal complaints are filed?
No, I have absolute discretion. I can tell you that for most files that we open, it's because we've observed something or seen something. I don't need to get an allegation.
Based on the resources you have—you said you have 35 staff and a $6.1-million operating budget—how much undisclosed lobbying activity do you think goes on undetected?
I'm hoping it's not a lot. I'm hoping those people who do this as a profession.... They're paid to lobby. I know that they take their obligations seriously, and I'm hoping that those who should be registered are registered.
Some groups are unaware that what they're doing is lobbying. They call our office, and they say, “Hey, I've been doing this, and somebody told me maybe I should register.”
You can't expect everyone to be that honest, to call. There have to be some who slip through the cracks—again, through no fault of yours.
I have one last question. If a senior individual at a lobbying firm or a consulting firm avoids registration by claiming they are providing only strategic advice, while junior registered lobbyists formally conduct communications—like we've seen with multiple former senior Liberal staff, former Liberal MPs and former Liberal ministers—does that undermine the spirit of the Lobbying Act?
Well, the Lobbying Act, right now, regulates communications with public office holders. If you're not the one communicating, and you're hired to give strategic advice, that's not lobbying.
Possibly, but how would we regulate that, and whether or not it belongs in the lobbying office or in conflict of interest and ethics, for those who leave office?
[Translation]
[English]
Thank you.
I just want to get it on the record. Mr. Ho gives the impression that it's just Liberals who are under the act, who you deal with. Could you just remind us of who you deal with?
The party is whoever leaves office, and there are public servants who leave office. It's not a criterion for me. I look at facts, period.
Commissioner, can you share who you consulted with as individuals or organizations before arriving at your recommendations for the Lobbying Act? Can you tell us a little more about the process before you came to your recommendations?
When came here for my first nomination back in 2017, I was asked if I could be ready in the spring of 2018 with recommendations. That gave me four months to get ready. I can tell you that I relied originally on the 2012 recommendations of the previous commissioner, and then I started working from my own experience. It's really based on experience, on what I've heard and what I have observed.
Have I consulted organizations and corporations? No.
They would be able to perhaps share how complicated it is to understand it or not, or do you just have the impression that it's complicated?
I speak to a lot of stakeholders all the time, so obviously I've been hearing their input over the last nine years, but did I actually do a formal consultation? No.
That's excellent.
As a follow-up to the first round, what additional compliance measures are you looking for under recommendation 17?
The compliance measures would be the same as I mentioned previously, which would be possibly mandatory training, administrative monetary penalties, prohibition and continuing to send files to the RCMP.
On recommendation 4, which specifically addresses registration requirements with respect to the awarding of grants and contributions, can you walk us through why you included this as one of your recommendations?
It used to be that organizations and corporations needed to register only if they met a 32-hour threshold, which meant that because most people who applied for grants and contributions didn't meet the 32-hour threshold, they would not need to register. Now that I've reduced it to eight hours, a lot of people who are applying will now meet the eight hours and will need to register.
I can tell you that a lot of people have concerns about that, and I understand that, but right now, the law is written in such a way that if you communicate with public office holders about obtaining a grant or a contribution, you must register as a lobbyist. I think if there's a public process already in place and you know that groups are going to be applying to the public program, it should be excluded from the Lobbying Act.
[Translation]
I just have an offer to make. Tell us the biggest suggestions that you would like to make. You made recommendations, but what would be the summary of our meeting? There were no changes in 2007. There haven't been any since your arrival in 2017, I believe.
You have the floor for the next minute.
There is definitely a need to increase the number of entities that need to be listed to improve transparency. The Lobbying Act needs to be simplified to make it fair and equitable for everyone. Everyone who lobbies would be subject to the same registration criteria. There have to be penalties that are proportionate to the offence, because right now that's not the case. That's all there is to it.
If the act can be simplified, the work of the Office of the Commissioner will be much simpler. Maybe I won't even need to ask for more money to hire more people.
Welcome back, everyone.
I would like to welcome the witnesses for this second hour of the meeting.
I would like to welcome the two witnesses from the Offices of the Information and Privacy Commissioners of Canada: Philippe Dufresne, Privacy Commissioner of Canada; and Marc Chénier, deputy commissioner and senior general counsel.
Thank you for being here.
You have five minutes for your opening remarks.
Mr. Chair, members of the committee, thank you for inviting me to discuss the Office of the Privacy Commissioner of Canada’s main estimates for fiscal year 2026-2027. With me today is Marc Chénier, deputy commissioner and senior general counsel.
My office operates in a rapidly changing environment, one in which unprecedented volumes of Canadians’ personal information are being collected and used. Evolving technologies bring opportunities to connect, to create and to innovate. At the same time, technological advances pose new and complex issues for privacy.
[English]
In this context, prioritizing privacy is more important than ever. Appropriate safeguards are essential to ensuring that Canadians can benefit from new technologies without giving up their fundamental right to privacy.
Just yesterday, I announced the findings of my joint investigation into OpenAI's AI-powered chatbot, ChatGPT. Through this milestone investigation, conducted with counterparts in Quebec, British Columbia and Alberta, we identified privacy issues and made recommendations that led to improved protections for Canadians' personal information. I expect that the findings will also inform and advance the privacy-protective design of other AI-powered technologies.
As Privacy Commissioner, I continue to champion the protection of privacy in support of responsible innovation, setting the standard for a safer digital world for individuals while supporting innovation, economic competitiveness and Canada's digital sovereignty.
Several factors influence my office's capacity to deliver on our mandate and strategic priorities as effectively as possible. These include, for example, a significant increase in the complexity and volume of our work, fiscal constraints, and reliance on the courts to implement investigative findings.
Over the past year, my office has concluded hundreds of investigations, including several high-profile ones, such as those into TikTok, Google and 23andMe. Earlier today, I released the findings of an investigation into breaches at the Canada Revenue Agency.
[Translation]
The number of complaints received by my office in the last fiscal year has increased by 82%, to more than 6,000 complaints. This rise is also placing increased demand on the OPC’s limited resources.
At the time of writing our departmental plan, I noted that the temporary funding that had allowed my office to reduce investigative backlogs had expired. I am pleased that the government has since approved an extension of this funding for five years, as noted in the spring economic update.
Without permanent funding, however, we will continue to face long-term resource constraints that limit my office’s ability to effectively carry out its mission and keep pace with technological developments.
[English]
I welcome the government's recent announcement that it is reviewing the Privacy Act, and I also remain optimistic about movement on private sector law reform. Canada needs modernized privacy laws to reflect this modern world.
In early 2025, I launched a transformation plan aimed at building greater collaboration and cohesion across my office and at streamlining processes to support more integrated, agile and strategic approaches. These changes support my strategic priority of maximizing our impact for Canadians.
[Translation]
The transformation plan includes implementing alternative approaches to full resource‑intensive investigations. This includes promoting compliance strategically and using all the tools at our disposal to better serve Canadians through more timely outcomes.
[English]
I also continue to advance my other strategic priorities: addressing and advocating for privacy in this time of technological change, and championing children's privacy.
I am committed to growing the OPC's internal expertise on emerging technologies. Our team has developed an in-house AI that will deepen our understanding of a technology that we regulate while also helping to optimize our work.
To support the children's privacy priority, we've undertaken a number of initiatives, such as establishing the OPC Youth Council, and earlier this week I announced new guidance documents on age assurance.
Collaboration continues to be an important tool that extends well beyond compliance actions. My role as chair of the Global Privacy Assembly and participation in the G7 data protection and privacy authorities round table ensure that Canada is at the table to help influence the direction and future of privacy protection around the world.
[Translation]
At this time of rapid and unprecedented change, prioritizing privacy must be a collective imperative. Trust in how data is handled is an increasingly important factor in how individuals interact with the government, businesses and technology. This is a significant consideration, particularly during these challenging economic times.
I'll be happy to answer your questions.
[English]
Thanks very much.
I appreciate your being here today.
I'm wondering if you can tell us about.... Going one step beyond your report yesterday about OpenAI, there is much conversation about protecting youth on social media platforms or when they are interacting with AI chatbots. Of course, if age limits were put in place, there would need to be a way to verify users' ages.
What concerns do you have, or what risks does that raise? Are there examples, including in the EU or within any EU countries, of digital IDs or digital passports having been compromised by hacks or through other breaches?
Earlier this week, I launched our guidance on age assurance. That is the result of significant consultation with industry, children's groups and like-minded organizations. We list a number of considerations, and really key to those are the protection of privacy, the safeguarding, making sure that platforms are not getting more information than they need and making sure that the measures are appropriate and are being used not to identify individuals but to vet the person's age.
We also set guidelines and factors to consider in terms of when age verification should be used. It would, of course, be based on laws, but in the absence of laws, it's based on risk. It's based on the likelihood of a significant number of children using the site.
In terms of your question of age verification tools and breaches, the European Union recently launched an app, or made it public. In the early days, there were concerns about a hacker being able to go in and defeat the safeguards. That's a reminder that before you launch your product, you need to make sure that you put in place a sufficient safeguard and do testing so that this does not occur.
I have a couple of other questions.
I want to ask you about Signal, the encrypted end-to-end messaging app, and I want to ask you about TikTok. Before I do, can you tell me what the limitations of use would be for something like Interac, in terms of identifying or providing sufficient age verification?
That's a system that's widely used in Canada. It's tied to bank accounts, which, of course, government ID is used for. It's simple, like a red light or green light being generated through something like banking portals, without having to provide any other identifying factors to the service provider or application.
Would there be anything that would prevent that from being useful in an application to verify the age of users?
I would need to assess the tool technically to see the safeguards and so on.
What you're suggesting is a tool that takes only as much information as it needs and gives only as much information and validation as is needed. This is consistent with the guidance that we're putting forward. You shouldn't be saying, “This is my name and this is my date of birth,” and all of that. You want to find a way to say, “Are you an adult or are you a child?“ and “Are you allowed to use that or not?”
What guidance have you issued on the use of Signal specifically?
You're familiar with the application.
We've not issued specific guidance on Signal. I'd have to know the specific concern that you would have.
In the EU, there have been a string of incidents. There's been a large-scale global cyber-campaign through which Russian-based government-sponsored actors are seeking to compromise the use of this service by government officials in EU countries. If it's not a subject that you're familiar with, we'll move on to the next, but I was curious. This has increased in popular use in Canada. Once people believe something to be secure, their risk aversion to sending sensitive information of course decreases.
Particularly in the company that we're in today, with elected officials.... If you don't have specific guidance, I won't ask you to create it on the spot, but I'm wondering if this is something that you've considered or if it would even be under your purview.
Certainly from a privacy standpoint, if we see concerns related to a specific industry or a specific product, we can issue guidance on it or do investigations, which may lead to findings. If there is a concern discovered about privacy, then there's a role for authorities to flag that.
There can also be concerns on national security aspects, and then it becomes a role for government institutions, either to say that the government and parliamentarians shouldn't use it or to flag those concerns, but I agree with you that if there are known risks, Canadians should be made aware of them.
[Translation]
[English]
Thank you, Madam Chair.
Commissioner, thank you for being here with us.
I have two questions on the main estimates.
Your departmental plan highlights ongoing work related to artificial intelligence, including the creation of internal AI tools. Can you please elaborate on how AI is currently being used in your office and what operational benefits will be achieved by AI?
Also, how will you ensure that its use will remain aligned with privacy and ethical standards?
There are two things on that.
Of course, yesterday I issued my decision on OpenAI and ChatGPT. We had been investigating this, and during that time, I had instructed that we not use the tool during the time of the investigation, other than for the purposes of our investigation.
We have developed our in-house AI tool, called PrivIA, and it's quite contained. It's very safe, and we are taking small steps in terms of how we can leverage this technology and be the best example in saying that we want the safeguards, the use, the efficiencies. We are doing this in a gradual manner, and we hope to expand its use, but for the moment it is very much all in-house.
Thank you. It's good to hear this.
I see that for 2024-25, your actual resource for indigenous contracts was 10.7%, while your planned target for 2026-27 is 5%. Could you explain the factors behind the figures and how your office approaches indigenous procurement as part of the commitment to economic reconciliation?
I don't have the specific details for you on this answer, but I would be happy to provide them in writing.
We do report on the use and the contracting. There have not been major trends or concerns or anything that comes to my mind at this time. If my team here wishes to advise me before the end of the hour, I can report to you; otherwise, we'll report back to you in writing.
Thank you, Commissioner.
I want to clarify the apparent contradiction between your findings and those of B.C.'s privacy regulator. Your office says that the matter involving OpenAI has been resolved, while B.C. says it has not. In practical terms, is OpenAI currently operating in violation of B.C.'s privacy laws? If so, what enforcement mechanisms or consequences are available for regulators? What are the implications for British Columbians who are using ChatGPT today?
Those questions would be better answered by my colleague Michael Harvey, who's the Privacy Commissioner for B.C. However, what our report says in terms of their findings is that because of the specifics of their law and the specific definition of “implicit consent” under their law, they were unable to find that the type of AI training being done by ChatGPT, namely the scraping of information on the web, could be justified under that definition. From my perspective under federal law, I found that federal law was more flexible, and it allowed me to interpret the expectations of Canadians and the safeguards being put in place in a way that would allow both the protection of privacy and also the development of that training of AI, so from a federal standpoint, it is now compliant with federal law.
Thank you.
Commissioner, the review of the Privacy Act comes at a time when Canadians expect both strong privacy protections and modern, efficient public services. In your view, how can Parliament strike a balance between protecting personal information and enabling better service delivery across government?
I think that the government's consultation is a very good start in doing that, because it highlights a number of things. It highlights, first, that you need to have strong and stronger privacy protection. Privacy is going to be the basis for trust, whether for the strong economy, whether for innovation, or whether for government services. That's number one.
Reinforcing things like order-making power, the obligation to report breaches, the obligation to have safeguards and treating privacy as a fundamental right are all key, but the consultation also talks about the need for departments to be able to share more information with each other, in appropriate cases, to deliver better services for Canadians. I think that is something that needs to happen in appropriate cases, with appropriate safeguards.
In some cases you need more flexibility, but as long as you have strong privacy protections, then you have both, and Canadians deserve to have both strong, effective government services and strong privacy.
Can you speak to the importance of amending the Privacy Act to recognize that privacy is a fundamental right in Canada, underscoring the importance of enabling service delivery and advancing reconciliation with indigenous people?
These are all elements that I agree, with the government, that we have to achieve. We need strong, effective government services. Canadians deserve that.
In terms of how to make sure that the law isn't too strict and forcing Canadians to start over every single time they need to do something, there's perhaps a need for more flexibility there.
You need to take into consideration, as well, the perspective and interests of indigenous people. There's been lot of discussion on privacy, about whether it's only individual rights or whether there should be a collective component to this, and recognize that in the interpretation.
Also, privacy, as a fundamental right, is something that is more important than ever. It is the recognition that privacy has to be protected. It is not something that should be sacrificed in the name of innovation or in the name of the public interest. It's not a zero-sum game, because privacy is what makes us free. Privacy is what enables all of the other fundamental rights that we hold dear.
I think those three pillars are absolutely key.
[Translation]
Thank you, Madam Chair.
It's good to see you again, Mr. Dufresne. I have many questions for you, but I think that we'll get through them.
Let's get back to OpenAI. You were there, and there were four of you. Could you give us an example of non‑compliance that OpenAI denies?
In this investigation, we saw that, when OpenAI first developed its models, it didn't comply with the legislation. It obtained too much information from Canadians—about all of us—through everything on the Internet, social media and discussion forums. All this was used to train the models. They could obtain confidential information, medical information or information about young people.
There was also misinformation and disinformation. The statements made on social media weren't always true, but the responses could give the impression that they were. We found that transparency in this area was necessary and that tools were needed to determine where a response was coming from.
We also found that the consent process wasn't good enough for users and for Canadians in general. Work was needed in this area. This investigation gave us the opportunity to bring all these factors to OpenAI's attention, and we persuaded it to make these changes.
That said, the current tool is quite different from the one originally launched. This is largely in response to our recommendations.
It's compliant at the federal level in keeping with the recommendations.
It must take certain steps in the coming months, such as making the information more user‑friendly and providing more explanations on certain things. We'll be following up, because it made the commitment to do so. That said, it will be compliant at the federal level.
On another note, given the components of their legislation, my colleagues in the other provinces were unable to find it compliant.
I would like to digress for a moment.
Have you heard of the CANChat application, or have you analyzed this application that will soon be available to all federal public servants?
It's coming, I'm telling you. I think that an analysis would be a good step. I'm concerned about privacy and national security.
I have other questions.
What about your ability to conduct an investigation?
Your current role is mainly to give advice. What are your recommendations for getting the right tools?
I've made a number of recommendations for legislative modernization. Good progress is being made on this consultation for the public sector. We're waiting for a new bill, I hope, for the private sector.
One thing missing is enforcement power. I don't have the power to issue orders or to impose fines. Canada falls far short of the rest of the world in this area. The vast majority of data protection authorities have this power. We don't necessarily need to use this power, but it must be available. To convince companies to invest in solutions, it helps if we can tell them that, if they don't, they're running a financial risk too.
We're in agreement. I think that a fine amounting to a few thousand dollars, as opposed to a percentage of sales, reduces the incentive to break the law.
Exactly.
Bill C‑27 in the previous Parliament included this possibility. It was a good step, and I hope to see it in place before long.
We hear you. It's important.
Madam Chair, in 2019, we were far from this. I recommended that we decorrelate our social insurance number. Once again, I feel that our legislative role is obviously out of step with the situation, and this worries me.
Mr. Dufresne, since you're impartial, the greater your powers, the more we members of Parliament can play our partisan games in a different manner.
I see that I still have two minutes left.
We said that the percentage was relevant, and that there are indeed responsibilities.
The commissioner involved in the investigation pointed to OpenAI's co‑operation during the process. Without this co‑operation, would your authorities have had the tools and powers to compel the company to provide the information needed to do their job?
Personally, I certainly wouldn't have had them. I'll give you a concrete example.
This happened during our investigation of Aylo, the company that owns Pornhub. We made recommendations. We said that, for explicit sexual videos, you need everyone's consent. That consent must be explicit, because this information is obviously extremely sensitive.
In terms of sexual videos uploaded without consent, we wanted them to be easily removable.
The headquarters are moved and then it's off to play with the Five Eyes and our legislative rules. That's what happens.
Yes. However, even if the headquarters aren't in Canada, we can still have the necessary jurisdiction. That's important. If Canadians are affected by this, we can and will act.
However, the difficulty is that not all organizations will co‑operate. To its credit, OpenAI did. The co‑operation has been good in this area.
That said, if we had had these tools from the start, such as the obligation to carry out privacy assessments or to provide clearer definitions, some of these things could have been done even more quickly. There are many things of this nature.
Rather than having an investigation, I hope that these things don't happen or that they're resolved quickly.
[English]
Thank you, Madam Chair.
It's good to have you back, Commissioner.
Commissioner, in a report today, your office confirmed that the CRA reported more than 42,000 material privacy breaches, dating back as far as 2020.
Canadians hand over their most sensitive financial information to this Liberal government under the threat of fines and penalties. In your view, does the sheer scale and duration of these breaches demonstrate a systemic failure of governance and oversight inside the CRA under this Liberal government's watch?
Our investigation found that there had been a significant number of privacy breaches since 2020. There were 42,000, more or less.
Our investigation looked at the safeguards, the detection mechanisms and the tools being used. You can't always prevent breaches. They will happen, but you need to have the appropriate safeguards, especially if you are a very attractive target.
We looked at a number of aspects, and we found that there was a lot of goodwill and there was a lot of effort being made, but there were gaps given the very sophisticated bad actors who were fraudulently making those claims, and we have made a number of recommendations to be put in place.
Back in 2024, because of these breaches in 2020, the Liberals announced that they would be implementing new measures within the CRA to protect Canadians' privacy.
Since 2024, how many times have you met with the Liberal minister responsible for the CRA regarding implementing these measures?
I have not met with the minister responsible for the CRA, but in the context of the investigation, we have had many meetings with CRA officials, and I have had meetings with—
To get it straight, we had you at the science and research committee a couple of weeks ago, and you testified there that the Liberal government had not consulted you when they were thinking about importing more Chinese-made EVs.
Now, the Liberal government has not consulted you in implementing these changes. It's a pretty serious concern, and the Liberal ministers can't even find time in their day to meet you even once. I mean, that really goes to show that the Liberals don't take Canadians' privacy seriously. It's not a one-off. We're seeing a pattern here.
Commissioner, according to your office, these unauthorized disclosures within the CRA involve taxpayer information being improperly accessed and even modified by unauthorized bad actors over a period of years before being fully reported. How is it possible that a federal agency as large as the CRA failed to detect, contain and report tens of thousands of breaches—I understand a couple of breaches—in real time? Does this point to a culture inside the Liberal government where privacy compliance is treated as an afterthought?
To your previous question, I did have meetings with the Minister of Artificial Intelligence, and I did have meetings with the commissioner of the CRA. There have been discussions. In this case, we found that—
I'm sorry. Did you meet with the Minister of Artificial Intelligence about these breaches, though?
That's what I'm talking about. We're talking about the breaches. I understand there were other initiatives. There were no meetings with Liberal ministers or secretaries of state regarding these breaches during this time.
Continue with your answer.
What we found in this investigation was that there were insufficient measures put in place. There were efforts that were being put out, and there were improvements that were being made, but it wasn't enough.
Multifactor authentication is one example. Back in 2021, it was not mandatory. It was optional. It was made mandatory in 2021, but we know that multifactor authentication is an important tool to prevent these fraudulent claims. Now it's mandatory, but we found that the types of multifactor authentication are not all equal. Some are stronger than others. Some are weaker. We identified that despite improvements, more had to be done. We made recommendations to that effect and look forward to this being put in place.
Your report mentions the multifactor authentication and industry best practices, which you just discussed right now. As you also discussed, the CRA was unable to provide details of every confirmed breach that it had reported, due to limitations of the tracking system—I'm reading that from the report. Also, somehow, attackers were successful in bypassing the authentication process to access...and the CRA was not able to explain that.
It's not just that there's a problem. They don't even know how to fix the problem. The Liberals frequently lecture Canadians about misinformation, cybersecurity and digital trust. What message does this send to Canadians about the federal government's own competence at protecting sensitive data?
[Translation]
[English]
We found that there were things that had to be improved, and they included some of what you described in terms of identifying the threat, finding the reason and being able to track. All of those are part of our recommendation.
[Translation]
Hello, Commissioner, thank you again for appearing before our committee. Just to maybe offer you a chance to further explain a line of questioning that my colleague across the table was just raising, can you describe in the course of your investigation pertaining to the CRA the type of involvement, co-operation or input that you would have had from the CRA?
It's been a very good collaboration, and we talk about that in the report. We note the work of the public servants we've interviewed, their dedication, and the challenging situation that CRA is in. It is a very attractive target for bad actors.
We held them to the high standard because this is very sensitive information of Canadians, and the system has to be robust. We found that it wasn't sufficiently robust, but with the recommendations that we made, I am encouraged by the steps that will be taken and have been taken.
That's great, and I would note that I think the CRA has welcomed your report and very much thanked you for recognizing the CRA's commitment and its efforts in aligning its security, identity and governance practices, specifically with respect to containment, mitigation and the work that's being done to, of course, continually improve protections for Canadians' information.
Commissioner, I'd like to actually take you back to your other study, around age assurance. I do think that there is a very important conversation that's taking place right now between efforts to reduce online harms for children and youth, while at the same time being very cognizant of the need to reinforce, recognize and even enhance children's privacy online.
Can you tell the committee a bit about the key privacy considerations that study...the conclusions that you came to on age assurance?
We talk about the best interest of the child. We talk about the fact that age assurance will be appropriate and will be a legitimate approach to mitigating those risks in appropriate cases, and also that you should look at the risks that are there for children in making sure that you are not using it too much in terms of preventing children from having too much access to certain sites and making sure that you are not leaving bad practices on websites.
It shouldn't be, in our view, the first reflex to say that we're not going to allow children to have access to it. We should try to fix the underlying problems, but in certain cases, you won't be able to fix them quickly enough, and limiting access to children then will be appropriate. We talk about how we have to make sure that whatever tool is being used is proportionate, that there are necessary safeguards and that it's not collecting too much information.
At the end of the day, we find that it is possible, and in certain cases appropriate, to have age verification, because we need to protect children from the harms they can experience in the online world.
This connects quite a bit to the work you've been doing around a children's privacy code as well in terms of other means of protection: a wraparound of the whole experience of children's information and data, both online and across media.
It has to be part of how we look at everything. The best interest of the child was something that I recommended be strengthened in Bill C-27. It was already a big part of the law in terms of recognizing minors' privacy.
This is very much a frame through which we're looking at those things. We will be coming out with our children's code soon. We have just published a what we heard report based on our initial consultation. That's going to set out, beyond age verification, how we want to see privacy law looked at. We will be having my own youth council look at this, in fact, to give us their views on how we can communicate better with children.
In 30 seconds, very quickly, do you have any guidance for us in terms of some of the design considerations you would offer as we think about how to move towards age assurance?
Well, the design considerations have to emphasize safety and data minimization and make it easy for the users to use. They have to be able to trust it. It has to respect privacy and not keep information longer than it needs to, and you have to avoid situations where this is going to be used or perceived to be used to reidentify individuals or to track individuals. This will protect privacy, and it will generate trust.
[Translation]
I have so many questions for you.
I would just like to talk to you about PrescribeIT. I don't know whether this matter has come to your office's attention. There has been a transition. The PrescribeIT platform wasn't used. It was for drug prescriptions. Basically, we want to use Telus Health. We realized that Telus kept about 85% of the intellectual property tied to the platform.
That's my first question.
It's part of a system. The amounts for PrescribeIT were increased. The figure now stands at $300 million. We'll be migrating to Telus, but Telus gives us absolutely no guarantee of privacy.
What happens when a situation directly violates the legislation? Are you familiar with this transition?
I'm not familiar with the details of this transition. However, I would say that, if any concerns arise regarding the measures in place to protect privacy, they should be raised here. This is where privacy impact assessments come into play. These organizations are normally aware of their obligations in this area. I would raise the concerns. Again, we need to reap the benefits of technology and innovation, but we must ensure that privacy remains protected.
It seems that the race is always on for the best application and technological development. It saddens me to hear that no consultations took place beforehand.
Take CANChat, for example. You might have already analyzed and studied this tool. We don't have a date yet, but it's coming. I'll tell you in advance that communication is key. We've met with Treasury Board officials and deputy ministers. Before launching a tool, we need to make sure of certain things.
Seriously, since my arrival here in 2019, I've found that we need to find ways to give you leverage in cases of this nature where the legislative system can't keep up.
Would you do things differently if you had the proper levers?
One of my recommendations concerning the Privacy Act for the public and private sectors was to introduce the obligation to carry out a privacy impact assessment at the start. I also recommended that this be accompanied, where appropriate, by the obligation to consult the people in my office. I think that this provides real protection, but also a perception of protection. People feel reassured knowing that a check was carried out before the launch.
You're right. There's often a great deal of pressure from both companies and the government to act quickly. Sometimes, we don't act fast enough. Speed is important. That said, if we ensure privacy from the start, this will build trust. If we move too fast, but the trust isn't there, the process may slow down.
I think that privacy protection has been a driver of innovation.
Madam Chair, when the data is collected in advance, we often have the information by the time a child reaches the age of majority. That's when the damage occurs, such as fraud and cyber‑attacks. Seriously, this is a major problem. I hope that, now that you're a majority government, you'll take action. The situation is urgent. I could provide a list. I hope that, after our meeting, you'll raise some red flags to ensure that we act as quickly as possible. We should submit this matter for priority consideration.
I see that I still have enough time to ask one more of my many questions.
As a privacy expert, what do you think is the main concern today, given the breakneck speed of technological development?
Obviously, all our recent work on artificial intelligence and privacy was a high priority. It highlights our focus on this matter. We're building models of this nature that contain a great deal of data, not just in the field of artificial intelligence, but in general. The data is highly coveted. The issue is how to protect this data, and how to do so pragmatically. We want to encourage innovation. We don't want to hinder the development of these tools, which can help us in many areas. In fact, the technology can even contribute to the protection of privacy itself, particularly by helping to prevent privacy breaches, fraud and other threats.
Many technologies are developing at a rapid pace. Quantum information brings cybersecurity into play in a major way. A great deal of work is being done on this topic. People must be made aware of it. However, this development mustn't come at the expense of privacy.
We're now shifting towards artificial intelligence agent models, which raises other issues. What do we give these agents, what are their mandates and how do we hold them accountable? This is a major concern.
Children's privacy is also a concern. They're increasingly exposed to these technologies. We're also seeing the damage caused by social media, which is now recognized in some court rulings.
This raises the issue of balance. How much should we restrict access to certain content? Some want to ban social media and others want to ban artificial intelligence tools. How do we do all this and how do we take this into consideration?
Lastly, the issue of cross‑border trade comes up. We're having many discussions on digital sovereignty. Given the geopolitical situation, there are concerns about what other countries will do. We see a strong tendency to want to keep strategic data at home, in our own country, in order to protect it. This can, in some cases, affect international trade. Privacy protection can provide solutions in this area. One of my recommendations for modernizing the act is to establish a clearer framework for determining privacy protection expectations when Canadians' personal information leaves Canada.
Thank you, Mr. Dufresne. I gave you a lot more time, because your comments were quite informative. You were on a roll.
Mr. Gourde, you have the floor for five minutes. If our guest gets on a roll again, I'll give you more time too, don't worry.
Thank you, Madam Chair.
Thank you for joining us, Mr. Dufresne. This is very important.
I'd like to share three cases from my riding which also concern you.
This week, I met representatives from the Canadian Mortgage Brokers Association. They explained that consent is required when a person's file is opened. They want that person to consent to providing their T4 slip and financial information to their broker for prequalification and file review. However, they asked me for something more: they want to verify the accuracy of the T4 slip with the Canada Revenue Agency, because they said some people might falsify their T4 slip in order to prequalify. I admit I was surprised. I thought there's no way the Privacy Commissioner of Canada would ever accept these requirements. They told me there was no problem, that they'd already checked, and that the answer was yes.
Is this true?
I'd have to see the file's details. What I can say is that, additional verification was among the measures we've asked the Canada Revenue Agency to implement, specifically to ensure there are no fraudulent cases, for example, requests where data in an account is changed or benefits are obtained to which people aren't entitled. On that point, I think we need security measures. The more sensitive the information, the more it needs to be adequately protected.
With regard to the specific file you're referring to, I'd need to be more directly involved. It might be under provincial jurisdiction. More broadly, it's important to have the necessary safeguards that are proportional to the confidentiality of the information in question.
I have another question for you.
We're currently in the first phase of the census. Statistics Canada sent door hangers to people letting them know they need to fill out the form by entering an access code. People came to my office and told me they were unable to do so or that they didn't want to send their personal information online. They told me they would have preferred to use the old method, with the paper form. They had the impression that their personal information would be better protected and that it would be safer to send their form by mail, rather than online. People are worried. On the other hand, I'm sure Statistics Canada has taken all possible security measures.
That said, are people required to fill out the form online, or can they still send a paper version if they prefer? Is that a right Canadians still have?
Statistics Canada officials would be in a better position than I am to say whether that's permitted or not. I think it's important to ask them. If citizens have concerns about the system, I think we need to ask questions and make sure we get satisfactory answers.
I expect both Statistics Canada and the Canada Revenue Agency to have robust security measures in place. These are questions that should be put directly to them.
I'm not worried about the robustness of the measures. That said, people want to send in a paper form. During the last census, we had blank forms at our offices. Those no longer exist.
Do people still have the right to simply send their information on paper?
Once again, that falls under Statistics Canada's mandate and governing legislation. It's less a matter of privacy protection and more about the tool the agency prefers to use to transmit information.
When it comes to privacy protection, the method offered must be secure. That's what matters. If Statistics Canada only offers the option of submitting the form electronically, it must be done in a very secure manner. However, I have no information to suggest that the agency has completely banned the paper-based option. I don't know.
I have one last question for you, since I still have some time left.
Can the commissioner's office offer assistance with financial fraud targeting seniors? Sometimes, seniors hand over their banking information or get involved in scams, and then they get caught up in it. They're made to believe they have to send $1,000, then $1,500. After that, they're sending $10,000, $20,000, and so on.
One of my constituents withdrew $100,000 from his RRSPs. After all that, that's the amount he sent. However, he lost that $100,000. Then, he had to pay taxes on money he no longer had. Some might say he was unlucky.
Is there any way the commissioner's office can help these people, at least during the investigation?
On our website, we have information tools available for the public so that people know how to protect their personal information and what the right and wrong approaches are. That said, organizations that help seniors should also have tools in place.
For example, in our investigation into the Canada Revenue Agency, many of our recommendations were aimed at improving security for citizens who provide information. In fact, the discussion we had with the agency focused specifically on multi-factor authentication. However, the approach they adopted was designed to make the process more user-friendly for seniors. The agency didn't want it to be overly complicated or for seniors to be obliged to use an app and so on. It therefore allows verification to be carried out via text message or by telephone. We understood that. In terms of user-friendliness, it makes sense. We did, however, ask the agency to provide clearer warnings to people so that they know this isn't the most secure method. For example, people should know that, if they really want the most secure method, they would be better off using something else, such as a separate app. At that point, people can make the choice.
[English]
Thank you, Madam Chair.
Thank you, Mr. Dufresne and Mr. Chénier, for being with us today.
I come at topics like these quite distinctly, because I've seen the challenges regarding data privacy and data collection developing over my entire life, quite literally.
I've also lived through all that is artificial intelligence differently from many on this committee. I've seen its progression in an academic context, in the workplace environment and, certainly, socially. It's clear that its usage is growing rapidly across the world.
There are expectations that government will make use of it to better Canadians' lives through increased efficiencies. At the same time, it's important that we make sure it's used in a safe and responsible way in the public service.
As you know well, Commissioner, our government launched the first public AI register, which provides information about the use of artificial intelligence across federal institutions. It goes without saying—but I will anyway—that it is a significant step toward transparency and responsible AI governance.
Treasury Board is now looking to elevate the directive on automated decision-making into law through the Privacy Act. Could you speak to the importance of this directive being embedded into law? What does this increased level of transparency mean for Canadians?
This parallels a recommendation I have been making, and it has been reflected in the government's consultation. There have been many exchanges between my office and Treasury Board, and I spoke to the minister. Those recommendations are largely reflected in the consultation.
I've advocated that privacy impact assessments be a legal requirement because, currently, it's a requirement in the Treasury Board policy and directive. It's the same as the algorithmic impact assessment you're referring to. That's good, but it's not enough.
When something is required by policy, we see more instances of it not being complied with because the consequence is less than if you were to break the law. Raising this to the level of a legal obligation makes it more transparent. It's more visible when it's in the law. It focuses and gives it a higher priority, so I support both the privacy impact and the algorithmic impact assessments being legal requirements.
This is a follow-up. I'm sure you know that we're looking to strengthen privacy notice requirements, including when automated decision systems are used. Could you speak to the importance of this? What does it mean for Canadians to have something like this easily accessible to them?
It's important for Canadians to have a better understanding of artificial intelligence, decision-making and how it impacts them. This is an area where I agree with the consultation. We need to have explanations for why the decision was made and what type of information was used to make the decision. That not only protects Canadians by telling them what's going on but also generates trust.
It's important now. I made this recommendation in the private sector two or three years ago. I thought it was very important in the early days of AI. In a way, there's still a lot of development, and it's moving very quickly. Having more information, the ability to ask questions—not to get the technical details, but to know the types of information and decisions—and transparency are important.
Canadians are more sensitive, now more than ever, to this notion of trust, specifically in relation to how their data is used. I'd like to get your thoughts on theme one, this notion of “Enabling integrated services”.
At times, I think Canadians view government as “one organization”. That is, of course, not the case. It is several institutions, at times operating in silos, admittedly. I think we'd all agree that there is significant importance in ensuring that services are connected and easy to navigate.
I'm still relatively new to this committee, but I understand that, under the current Privacy Act, it can be difficult for federal institutions to share personal data seamlessly. I also understand that this leads to delays, duplications and, at times, frustrations.
As the government looks to modernize its operations, could you speak to the importance of ensuring there are integrated services while also ensuring that privacy protections remain fundamental?
It is important to have both. Government needs to be more nimble. There's a lot of importance to that. Canadians expect that, but we have to make sure we're doing it with the appropriate safeguards.
If data is going to be shared.... Perhaps there's not enough ability to share data now. If there is too much ability to share it, without enough safeguards, then there is a risk. For example, if I give my information to one department, say, for a health reason, then there wouldn't necessarily be a need for this to be used in a completely unrelated department without my knowledge or awareness.
Those guardrails are important. That's going to generate trust. Canadians are going to be happy that they don't have to send nine or 10 different forms to different places. They also don't want situations where there's a privacy breach or where public servants—many people in other departments that have nothing to do with their files—now have access to their information. It needs to be very well built and have those other measures to protect privacy. The order-making power and strengthening the privacy regime are opportunities to show that they go hand in hand. That's how you generate trust.
In the government's pillars for AI, the first pillar, “Protecting Canadians and Safeguarding our Democracy”, talks about trust. That's how you're going to encourage AI. In order to do that, you need modernized laws.
[Translation]
Thank you. You have indeed slightly gone over your allowed speaking time.
Dear witnesses, thank you for joining us. This was all very informative. We're very grateful to you.
We'll now proceed to the main estimates 2026-27. I'd therefore like to thank the witnesses. We will now continue with our work.
Unanimous consent is required when all votes are taken together.
Do I have unanimous consent?
A voice: Yes, absolutely.
“On division” is a new term for me.
OFFICE OF THE CONFLICT OF INTEREST AND ETHICS COMMISSIONER
Vote 1—Program expenditures.......... $8,284,644
(Vote 1 agreed to on division)
OFFICE OF THE SENATE ETHICS OFFICER
Vote 1—Program expenditures.......... $1,507,801
(Vote 1 agreed to on division)
OFFICES OF THE COMMISSIONER OF LOBBYING
Vote 1—Program expenditures.......... $5,463,805
(Vote 1 agreed to on division)
OFFICES OF THE INFORMATION AND PRIVACY COMMISSIONERS OF CANADA
Vote 1—Program expenditures - Office of the Information Commissioner of Canada.......... $15,737,098
Vote 5—Program expenditures - Office of the Privacy Commissioner of Canada.......... $33,232,604
(Votes 1 and 5 agreed to on division)
Shall the chair report these votes, less the amounts voted in interim supply, to the House?
Some hon. members: Agreed.
[English]
Publication Explorer
Publication Explorer