S3-Episode 3: A casual conversation between two Canadian privacy commissioners

Jul 06 2023

Listen to Commissioners Kosseim and Dufresne speak candidly about some of the challenges and opportunities they face and potential areas for collaboration between their offices. Bilingual episode in English and French.

The information, opinions, and recommendations presented in this podcast are for general information only. It should not be relied upon as a substitute for legal advice. Unless specifically stated otherwise, the IPC does not endorse, approve, recommend, or certify any information, product, process, service, or organization presented or mentioned in this podcast, and information from this podcast should not be used or reproduced in any way to imply such approval or endorsement. None of the information, opinions and recommendations presented in this podcast bind the IPC’s Tribunal that may be called upon to independently investigate and decide upon an individual complaint or appeal based on the specific facts and unique circumstances of a given case.

PK  00:28

Bonjour, hello listeners, and welcome to another episode of info matters. My guest today is Canada’s Privacy Commissioner Philippe Dufresne Now this episode is going to be a little different than our usual format, rather than an interview per se. Commissioner Dufresene and I will be having a very casual to a conversation about our work, current topics and privacy and the kinds of challenges we face in our respective offices. So in the next half hour or so we’ll be pulling back the curtain a bit on what gets discussed behind the scenes. So you can all pretend to be a fly on the wall and listen in. As two of Canada’s privacy commissioners chat about what’s on their minds and what keeps them up at night. So get yourself a nice cup of coffee or tea get comfortable and settle in for what I’m sure it will be an insightful and dynamic conversation. Philippe, welcome to the show bonjour et bienvenue.


PD 1:22

Merci. Great to be here Pat.


PK 01:34

So excited to have you here. And I remember when you were first appointed, I took you out to lunch at the Mill Street pub in Ottawa and we had a great conversation that day. So I’m just imagining, we’re going to have a similar convo today only with a broader audience listening in at nearby tables, if you will.


PD 1:43

Perfect, I’m closing my eyes and I’m picturing it.


PK  01:45

My three year anniversary is coming up very soon, just as your one year anniversary is coming up. So congratulations about that. What did you find were some of the biggest challenges stepping into your new role as Privacy Commissioner of Canada?


PD 1:59

Looking back, first of all, it’s amazing how quickly it’s gone by and the first thing I noticed coming in, and I was so impressed, and so grateful. And so relieved, frankly, is what a great team I have here at the OPC. So that was great. And it really helped navigate and get through what has been a very busy, and eventful and challenging year. So you know, in terms of challenges, I think, in the first year, there was a lot it was important to me, one of my focus was really to meet as many stakeholders as I possibly could colleagues, FPT fellow commissioners in Canada internationally. So that took a lot of time and a lot of effort and a bit of a bit of energy too. I’m a bit of an introvert. So these are things that I have to do, and I enjoy doing them. But they do take a lot of energy. So that was a big part of it. But what really stuck with me in terms of challenges is that at all levels of the OPC. And in my annual report, you know, I talked about this year as being a pivotal year for privacy and a pivotal year for the OPC. So in terms of my policy team, well, we’re in the middle of law reform, we have c 27, which was introduced on the day that I was confirmed as Privacy Commissioner. So obviously tons of work, including all of last summer in getting us ready for that and key parliamentary appearances on things like the RCMP is use of on device set investigative tools, testimony on C 11 on broadcasting accurate form. So all of these, you know, really, in short order. And on the compliance front, we’ve had major important precedent setting investigations, whether we think of pandemic investigations, we just issued our special report on that a few weeks ago, the Home Depot case on electronic receipts, and the sharing of information in that context. On the litigation front, we have ongoing litigation, with the major social media platforms raising big ticket issues, both now at the Federal Court of Appeal. On the corporate side of things we were as you were, as all of us were, you know, transitioning from the heavier pandemic phase to sort of the end pandemic phase and going through the hybrid workplace, we had a public service strike, we also have to manage our situation at the OPC in terms of we might be getting more powers and responsibilities, we might need more resources, we have to adapt. So I think it’s dealing with all of those things at once that made it challenging fun at the same time and again, allowed the team to shine and I’m so proud of of what they’ve achieved and what we’ve done together. What about you, you took on the role of Ontario’s information and Privacy Commissioner three years ago. So what are sort of your reflections in that longer period of time? And maybe I guess, maybe there’s been even more change from year one to now.


PK  04:38

Well, certainly when I look back on that first year I was appointed in July 2020 After 20 years of experience on the federal scene. So obviously one of my biggest challenges was just adjusting to the Ontario scene a bit like you getting to know who the stakeholders were. I was pointed July 1 I started on July Second, in the very first file we were dealing with, we were in the throes of the COVID Alert app, and reviewing that with a view to the launch, imminent launch and making sure that all the privacy protections were built in. So it was a very frenetic time actually, we also were in the throes of the pandemic, the early stages where there was a lot of uncertainty about just where we were heading. When we were getting back to the office, it was still very tentative, and we had no idea that it would go on for three years after that. So it was a great period of uncertainty, I found the most challenging part of it was not getting to see or meet my team in person. For so long, really, by the time I was able to meet, the majority of them, a couple of years would have passed before we were able to get together as a group as a team. And that was outdoors. And that was so hard, because, you know, I recognized after the fact how much of a people person I am, and how important face to face contact is to establishing relationships, and particularly with a group of fantastic professionals that I have the privilege of working with. And it took me much longer than I would have liked, I think to get to know them personally, each one by one get to know their names, their faces. So it was a real challenge. But that certainly didn’t slow down the work. The first year I began, we saw Ontario come out with the most serious proposal for private sector privacy legislation in the province. So that kept us extremely active and busy and giving the best advice we could in terms of what Ontario’s opportunity would be to lead in this space. So all told, the big year of challenge, big year of certainly excitement and opportunity, all in the context of a great deal of uncertainty. Now, when I reflect, I started, of course, right at the beginning of the pandemic, but you started a little bit later, obviously, when we are already back, or at least in the midst of establishing hybrid work arrangements. So how was that for you when you started, probably at the latter stages of the pandemic than I did.


PD 07:30

I think it’s short, I’m sure I can safely say it was a lot easier than it was for you from what you’ve described it when I joined you sort of towards the end of the pandemic, there were people that were on site, certainly not full time, the majority of the OPC employees were teleworking, but people were able to come on site, I remember early days, I really was keen to meet Chief of Staff and the management team and so on. And we were able to do that pretty quickly, even a couple of a day or two, before my official start date, I was able to have a lunch with all of my executive team to meet them in person to have some bilateral in person, obviously, we were distancing and so on, we still had all the measures. But it was great to be able to have that in person exchange, it’s so easier, and the chemistry sometimes flows differently, and the energy flows differently. At the same time, I think I’ve benefited as well, from the pandemic and the hybrid workplace and all the technological advance and know how that we have with virtual meetings. And that was hugely beneficial to be in my ability to have one on ones with counterparts across the country and indeed, across the world. So actually, I think that accelerated my ability, I was able to meet very quickly, a lot of counterparts in Australia, in Europe, across the country, way before I was able to meet them in person, I think we had our first FPT federal provincial territorial commissioners meeting, I think it was in, in the fall. So I had already been a couple of months, but I had met all of you, my colleagues, virtually, so I sort of had the best of both worlds. And, you know, my approach was really has been and is that tried to get the best of both make the best of the in person presents make the best of the virtual presence. And for me what it does, it makes me appreciate both more I appreciate telework more, because I’m in the office part of the time, and vice versa, where I am at home, and then I’m looking forward to the days where I can be in the office and see colleagues in person. So it’s been good. And I’m happy to see that we’re sort of now getting into more stability in terms of the hybrid approach. Now what I’m interested to know speaking of sort of change and approaches and workplaces really, and because you’ve had a longer time you’ve had a better sample than me so far. Are there certain periods of the year that you found that are busier or more challenging? Do you find that it’s the seasons that would ensue? To insert or are there other things factors that you find that maybe I should pay more attention to? Because it might give me tips on what’s coming and the intensity?


PK 10:10

Well, that’s a great question. Frankly, I think I’ve always found federally and provincially. We’re busy all year round. But I do think there is one difference unlike the federal office, we don’t tend to be as consumed by the Legislative Committee agenda as you are federally. Having said that we are busy all year round. But I do think it’s really important to use the summer time to recharge the batteries as much as possible and summer is a good time to do that, at least self impose some measure of rest and relaxation and encourage the staff to take their well deserved vacation. It’s also time just to have more social events, particularly to reconnect with one another outdoors. We plan our annual picnic in the summer, our commissioners in the park series, we’ve resurrected this year, the traditional baseball game against the Ombuds office, I understand that is exceptionally competitive, but a great deal of fun. So I do think that you could go full tilt all year round, but it’s important at least as much as possible in the summer to try to rejuvenate and get that level of energy needed to sustain all of us throughout the remainder of the year. Je serais curieuse de savoir, Philippe, comment ton poste actuel. En tant que commissaire à la Protection de la vie privée du Canada, se compare à ton rôle antérieur. En tant qu’avocat œuvrant dans le domaine des droits de la personne?


PD 11:50

Oui. C’est intéressant. Il y a beaucoup de ressemblances dans le sens où c’est en grande partie ce qui m’attirait au niveau du poste ici au commissariat, c’est que dans les deux cas, quand j’étais là bas, j’étais avocat de droit de la personne des dossiers de discrimination, on protégeait les personnes les plus vulnérables. Que ce soit des questions de racisme, de sexisme, de la discrimination salariale contre les femmes, la question de l’accommodement des personnes handicapées, la question de la santé mentale, la sécurité, le harcèlement, des dossiers de propagande haineuse, des questions très sérieuses, très importantes. Et pour moi, ce que j’aimais là bas, c’était la défense des droits fondamentaux des Canadiennes et des Canadiens. C’était de faire ça dans un contexte où on devait aussi tenir compte de l’intérêt public, de prendre des décisions qui allaient quand même permettre au gouvernement canadien et aux institutions fédérales d’opérer et d’accomplir leurs missions, mais en protégeant les droits de la personne. C’était un domaine où j’étais responsable du litige, puis j’étais responsable des plaints. So there were many similarities in terms of fundamental rights, public interest, human rights investigations, we had policy functions, we had international role, we had a promotion, there’s even a tribunal. Now there’s a proposal and C 27 To have a tribunal. In the privacy sense, there is one in the Human Rights sense. So lots of similarities, also huge stakes that some of the cases, as you know, because you were involved in some of them as well, there’s a lot of money at issue millions, sometimes hundreds of millions of dollars, because it affects so many vulnerable individuals, and you need to have a remedy. Some of them really will have a huge impact on government operations or industry. So all of that is true in the privacy world as well. I think one of the differences that I found, and I’ve commented upon it a few a few times, is that in the privacy world, the frequency of the issues is much greater in the sense that when I was in the Human Rights world, there would often be big ticket media or public discourse on some of the issues in the media, maybe once a month, maybe once a week. But in the privacy world, it’s many, many times every single day, because privacy touches all of us, whatever age whatever role, whatever interests, whatever our activities, and coupled with the fast moving technology, I found that that is the biggest difference, the sense that it really touches a much broader proportion of the population. Indeed, it touches the entire population. And the way that we’re set up as you know, the collaboration with federal and provincial territorial commissioners is also more integrated. We have joint investigations, we have very, very strong working relationships. And that’s also true internationally. So I think those would be some of the biggest difference but the key elements are similar which made it for me, somewhat of a natural transition. Now in your case, because you were here at the OPC for more than a decade, you certainly a legend here and your reputation is high and it’s So I’m really intrigued and interested in knowing what the differences are in terms of how the IPC would be different from the OPC. Because clearly, I can’t think of a better person to ask that question that I’m very curious.


PK 15:14

There are a number of things that were very different and in a good way, as you know, provincially, commissioners have also responsibility for access to information, whereas federally, both those responsibilities are separated into two different offices. So provincially, having both those mandates within the same office was, I think, a wonderful opportunity for me to recalibrate the values and interests between both privacy and transparency, not that they’re diametrically opposed. But it does happen, in instances, for instance, have access to information requests that raise issues of privacy or personal information, and having to do that delicate balance and sometimes triggering or engaging considerations of broader public interests. So I was very keen to take up both sides of that coin, if you will, in a Provincial Office. And I think that that has really opened my eyes, certainly on the importance of maintaining good balance. The other thing that was different as I moved from the federal space to Ontario was of course, in Ontario, we do have certain order making powers, particularly on the access to information side, and some order making powers in the health and Children and Youth and Family Services sectors. And that was also interesting to see how important it is, with those order making powers to accentuate even more issues around procedural fairness, independence and partiality and the real structural importance of maintaining a separation between our policy functions, and communication and public education functions from our tribunal that make orders and decisions. So that was interesting to see in real life, some of those internal operational functions or operational structures or processes that have to be put in place. Another thing I thought was very interesting is in Ontario, unlike federally, there is a role in the Ontario government of a chief privacy officer, like a enterprise wide CPO. And it makes certainly my job and my role tremendously easier to have that person or that office as an interlocutor, when we want to discuss issues of enterprise wide government, and to keep that two way dialogue going. So I think that, you know, if that’s something of interest for the federal government, I think it’s a huge opportunity to create that center of expertise and that interlocutor for other interested parties and regulators such as ourselves. The other thing I thought was very interesting when I came to Ontario, is discovering maybe by tradition or just by culture, that there are generally much earlier conversations and consultations with my office on proposed programs or initiatives, or even legislative or regulatory proposals in order to get our early views on what some of the privacy and transparency implications are in order to help inform the development of those programs, initiatives or proposals now, as it happened all the time? No. But certainly more often than it did federally. And I thought that was a huge benefit for Ontarians to know that those conversations are happening earlier in the pipeline so that there’s actually opportunity to impact and influence the direction ultimately, that is taken. Now, it doesn’t change the government objective. Many times there are laudable objectives, but there’s certainly opportunity to go about it in a way that is more privacy, protective, and respectful. The last thing I thought really enthused me about the provincial jurisdiction is just how much closer to the ground. I feel we are provincially. Of course, we have less mileage to cover than you do Federally. We are still Canada’s largest province with over 14 million people. But I do still feel closer to the ground just by virtue of the nature of our jurisdiction over matters such as health education, municipalities, just areas that veuvant pas have much more resonance or day to day impact on the people of Ontario. So those are some of the differences that I certainly felt. So in that McGill profile piece that they did on alumni. In this case, they did a joint piece on you and me as both graduates of McGill, I read with great interest that you spoke about this being a pivotal time for privacy protection with technology advancing at breakneck speed in today’s digital world. And I guess I want to know, candidly from you, what keeps you up at night about all of this?


PD 20:32

Great question. And I think in terms of what keeps me up at night, it’s interesting. I would say, I don’t think they keep me up at night. I sleep very well. I’m grateful for that. But it keeps me perked up during the day, I would answer that question. But that slight twist. And really, what keeps me perked up during the day is for the moment, the three sort of operational priorities that I that I have, as my focus. One is the accelerating pace of technology, in particular, generative AI and all that it can do. Both good. And in terms of risks to privacy. So that is something that is I’m very much focused on wanting to make sure that we can keep up with that. And we can stay ahead of that in terms of regulators, principals, making sure that we can highlight what the guardrails should be in terms of those technologies. And you’ve done a piece recently yourself on that with the Human Rights Commission, which was great and very important. We’ve initiated a complaint jointly with the other provinces which have similar substantially similar legislation to the federal ones. So Quebec, Alberta, BC, with respect to open AI to identify the privacy aspects of this and make sure that’s being done appropriately. And if not, that, we can identify what those are and what that what the corrections need to be. So certainly a big part not just for the OPC in the privacy world, but for everyone. We are hearing about this and all aspects. And my focus is making sure that we get it right from a privacy standpoint. But I’m certainly obviously very engaged on the bias and harms and discriminatory potential impacts that the bill before the House on artificial intelligence and data act would also address with the Minister of Industry, being in charge of that and in collaboration with us and other regulators. So those aspects touch upon all of us. We’ve recently formed a digital regulators forum with the CRTC and the Competition Bureau last week. And there again, all of us, whatever our role was competition, whether it’s broadcasting telecommunication, we’re going to be focusing on this to see how we can work together how we can coordinate efforts and share best practices. Children is another one, that’s something that I’m focused on more and more in terms of how they are using technology, digital world, how do we protect their privacy? How do we ensure that they know about it, that they care about it, and that the law is appropriately designed to protect them online and offline, and you are also obviously playing a strong leadership role in that. And you’ve identified that as a priority as well. And the third is really the issue of OPC readiness. And it’s interesting when I say OPC, readiness, I’m talking about how do we adapt to the potential law reform that we’re going to maybe have, obviously, that’s up to Parliament. But if it happens, it will require some of the things you’ve done and you’ve described, the terms of processes may be some aspects of the process will be need to be a little bit more formalized. There are going to be different steps they’re going to be they need to be more guidance, there’s going to be needing to be identifying potential receiving requests for advice on Codes of Practice certification programs, so lots to do. But even in the absence of C 27. Certainly looking to see how we can be an even more nimble and effective office. Are there opportunities for us to deal with are the length of time for complaints better to have that quicker, any number of things? Can we have a greater reach to our guidance? So these are all huge, important issues, as I say, again, not keeping me up at night, but giving me focus during the day and a lot of energy. What about you? What are some of the biggest challenges that you see in Ontario and perhaps beyond?


PK  24:18

They are very similar in a lot of respects, certainly in the area of AI, as you said, has us all seized and I certainly worry about the potential harms in the greatest sense of the word beyond the privacy harms the harms to individuals to communities to particularly marginalized and vulnerable groups in terms of discriminatory impacts. And not getting a rain over this are the appropriate guardrails. I really worry about the use of these technologies going overboard and really triggering a serious public backlash against them and of course, Is the trust in organizations and governments who use them, which would be a great shame considering their enormous potential. So I do worry about us not being able to get ahead of that with the appropriate guardrails in order to ensure that it evolves in a responsible and ethical way. In terms of our own operational challenges, I do think about capacity building and the kinds of skills we need to be able to deal with emerging challenges. And how do we stay as a learning organization? How do we build ourselves as a learning organization being able to attract the talent we need to contend with many of the technological challenges we have and being able to continue to train up our staff in order to adapt and adjust to the fast changing challenges. Now, like many others, of course, I can talk to you about eliminating the complaints and appeals backlog we have in our office. But I’m much more seized with, of course doing that, but finding a sustainable way of staying ahead of this permanently through process changes, proportionate approaches, and risk taking the kinds of approaches I think we believe, I believe we need as a modern and effective regulator. And as you know, that was the theme of my annual report that we just released a couple of days ago. And I think that that requires a whole other perspective, cultural outlook and way of doing things to really deal with these perennial challenges in a way that is appropriate for the modern day challenges we have. And of course, the greatest worry I have is a particularly in Ontario, is just how our legislation is falling way behind what’s needed to protect people and Ontarians and maintain their public trust. That is Canada’s largest province. It really behooves the government, I think, to look at modern laws and modern governance frameworks that can put Ontario and continue to put Ontario on the map as a leading digital government, and one that I think can deliver on their ambitious programs and goals for Ontarians. There’s a lot of work to be done. And we’re still looking towards government leadership to advance on some of these legislative reforms. Speaking of which, lots happening at the federal level, obviously, with Bill C 27. You talked about practically preparing your office to implement a new law in a continuing state of uncertainty and without firm commitment on resources yet. So how are you doing? How are you dancing on the head of that pin, in order to get ready, without having all of the pieces of the puzzle in place yet?


PD 28:02

It’s interesting, it’s an interesting challenge. And so I, I’m waiting to see what parliament will do. And it’s Parliament’s prerogative to do it, how it wants and when it wants. But obviously, the fact that this has been tabled, and we’re waiting for it to progress it committee does create some uncertainty in the sense that we want to be prepared for potential new responsibilities. But at the same time, there’s a limit to what we can do until Parliament decides that this is indeed what they want to give us in terms of responsibility. So it’s not something that paralyzes us. But it’s something that has to be managed. So how we do it is right now we’re focusing on the best advice that we can give parliament to that law reform bill. And we’ve presented submissions to the committee in writing, and I’m looking forward to appearing before the committee to give my advice and to respond to questions, really, in terms of readiness, we’re looking at looking at all aspects of the OPC and see how can we be ready if and when this happens. So one of the things is, is resources, we need to have appropriate resources. And looking at that we’ve received additional resources from the last budget. And we were very happy to see that in terms of helping us with backlog reduction and helping us deal with privacy breaches and being able to provide more guidance and advice on that. So that’s that was a positive step. We want to make sure that the process in the backlog is as well dealt with us as possible by the time we get your responsibility so that we can sort of hit the ground running. I have good links and good discussions with the CIO federally at the Treasury Board to identify trends and issues, obviously, while respecting the complaints process and there’s things that can be discussed and things that can not be discussed. Same with the Department of Industry, same with the Department of Justice. So I think these this it will be important to continue to have these good means of communications with the relevant depart admits, looking at the investigation process again, are there things that we need to be prepared for when the process is to be more formalized with order making powers or recommendation to read finds, in terms of policy policy is a tricky one, because there’s a desire for us to provide guidance. And we’ve just recently provided guidance on employee monitoring, to provide information in this time with the more hybrid workplace and so on. There’s areas of guidance that will only really be necessary with C 27. So we can’t really do them until C 27 is adopted. But we’re looking to see are there topics that whether C 27 happens or not, they’re going to continue to be relevant. So we can go ahead and provide that guidance. Speak with industry, civil society, try to get as much feedback, are there areas where the OPC could could do better? Can we really make sure that we understand the perspective of industry of government on some of those key things and working with all of you FPT and international colleagues? So as I say, there are things we can’t do, because we don’t know yet what what’s going to happen. But there’s a lot that we can already start to do so that we can really minimize the time that’s going to be needed. If Parliament decides that to adopt C 27. And then what form it decides. And if it doesn’t, then so that we can provide the best support and protection and promotion of privacy under existing legislation. D’un autre côté, on a au niveau ontarien, est ce que tu vois des opportunités de modernisation, soit de ton bureau ou soit au niveau législatif? Je sais qu’il y avait eu le White Paper. Est ce qu’il ya des développements? Est ce qu’il y a des enjeux que vous suivez davantage par rapport à ça, soit au niveau législatif réglementaire, soit au niveau plus opérationnel?


PK  31:51

I think there’s certainly lots of legislative opportunities in Ontario, regardless of the fate of Bill C 27. I’ve stated publicly that it’s important for Ontario to move forward irrespective. And in terms of covering the constitutional gaps that C 27 will leave behind. You talked about employee privacy. But as you know, in our listeners know, that’s only in the federally regulated workplace. So it leaves all of Ontario workers completely in the lurch in terms of statutory privacy protection. So that’s a huge gap that I’m very concerned about for the same reason you are in terms of the increase in uptake of workplace surveillance and remote monitoring, particularly in the kind of emerging workplace of, of the present and the future. And other areas in the not for profit sector that remains completely ungoverned, again, outside the scope of federal jurisdiction, given their non commercial nature, but huge data collectors and lots of risks in that sector in particular, regardless of their best intentions, there is still lots of concerns around that largely unprotected space for Ontarians. Of course, political parties, like every jurisdiction, including your own is very, very important to look at and to maintain the trust of citizens and voters. So I think it’s incumbent on Ontario to move forward in these certainly at a minimum in these areas. There’s also a great opportunity for Ontario to take a more integrated approach to the health sector, we regulate the public sector and the private sector and take less of a siloed approach to these areas. As an example, there’s an important wave or trend going on globally, as you know, around enforcement collaboration, not just between data protection authorities, but different regulators. And right now, Ontario’s laws are not as enabling that inter jurisdictional collaboration and inter sectoral collaboration that I think we need to really deal with these horizontal data issues. And the last area, I’d say that I think every jurisdiction is probably similar in the sense of the need, particularly to take a very hard look at how we regulate artificial intelligence and how it intersects not only with data privacy, but also the broader range of human rights. And that’s why it was really important for us to issue that joint statement with the Ontario Human Rights Commissioner to really emphasize the full gamut of human rights impacted by these technologies with really human dignity as the common denominator underlying all of it. So those are certainly areas where I think less legislatively, Ontario should go and must go, if we’re going to keep up with the kind of challenges that we’ve been discussing. I just want to change tracks for a moment to our one of area that is a strategic priority for our office. And you mentioned it is also a priority for you. And that’s in the area of children and youth privacy, and digital literacy. And so really, I’d like to ask you, what do you think our offices can do together to move the needle in this space of common interest?


PD 35:35

Well, I think the first thing and we are doing it is that collaboration, I think this is a perfect example where the federal territorial provincial collaboration is so important, because we, we all bring different things to the table, you the significant expertise that you have in Ontario, and with the closer proximity to the schools, educators, and all of those aspects are absolutely essential to protecting children. And we’re I’m looking at it is really from a number of angles in terms of, do we have the right laws? Do we have the right framework to protect children? are we protecting children the same way we’re protecting adults? Or should they be protected differently, perhaps more for certain aspects given their greater vulnerability, or perhaps that they would have less awareness in terms of the privacy risks and being nudged in certain directions. So that’s why we’ve made it one of the recommendations we’ve made on C 27, which, in this I agree with, with Minister Champagne, who has included greater protection for children and for the information of minors in C 27. I agree with that. And I’ve recommended going further. And even strengthening the preamble of the Act to recognize that one of the purposes is to protect children’s privacy and the best interest of the child. So really to, to bring these interpretive tools to courts, to say that this is part of what we do that we need to bear this in mind. And this is something that here at the OPC and our guidance on consent, we’ve already talked about that in terms of children, and certain appropriate practices or inappropriate practices. I think education is so critical, whether it’s through a school curriculum, or there enough courses on privacy, should that be more whether it’s in high school, elementary school, universities, law schools, this is something that’s becoming more and more important in our lives that touches all of us. If you talk about AI, I think it’s important that the children have strong knowledge about this, that they can ask the right questions that they’d be sensitized to how, how powerful these tools are, and what are the implications. On the other hand, I don’t want to delegate all of that responsibility on children because they are children. And the systems, I think we need to protect them appropriately so that they can be children, and that they can be protected, online and offline. So I say laws, guidance, policies, education, communications, communications that are targeted and appropriate for kids in your area. What particular areas would you see where we could collaborate in the coming years, given our respective areas of responsibility?


PK  38:31

Well, one area that I think is obvious, given our complementary and respective jurisdictions is just around the whole public sector, private sector interface. So many times, we get to notice or reports of data breaches that involve the pipeline of data flows from public institutions to the third party, service provider or vendor. And being able to address just half that equation, in terms of our jurisdiction over the public sector institution, oftentimes is not sufficient to really get to the heart or the root of the matter, because we also have to look at the other half of the equation, which is the private sector, vendor or processor that was involved. And so certainly an area I think of important federal Ontario collaboration is in enforced enforcement cooperation in these kinds of cases that involve both public sector and private sector in dimensions. Now, I said that within the constraints of the current law, some of our laws allow more information sharing and collaboration and enforcement cooperation than others. And certainly that’s an area where, as I mentioned, I think legislatively, that’s a really important area to address it. In order to be able to leverage one another’s jurisdictions and one another’s resources and insights in order to really get to the heart of the matter, or the underlying issue in data breach and other cases. So that’s an area where I think not only within the constraints, as I said, of current law, but hopefully, within the more enabling legislative changes, I think we can continue to have great impact, ultimately. And I would add to this public education broadly, you you spoke of children, but I think in all aspects of public education, we all whether it’s federal Ontario, or frankly, any FPT jurisdiction. We all have public education within our mandates, and are all really seeking to relay the similar kinds of guidance information to Canadians writ large. And I think by leveraging our resources and pooling together, our expertise and our access to different audiences, federally provincially, territorially, even municipally. I think we can really make broad and more impactful changes in terms of raising public awareness.


PK  41:18

So what a great thing to end our conversation on collaboration. It’s already the end of our time together went so fast. I think we could have kept the conversation going all afternoon. Encore une fois, merci Philippe pour cet entretien fort intéressant. Ce fut un énorme plaisir d’avoir eu la chance de charger nos idées et nos expériences et d’avoir discuté plusieurs sujets d’intérêt en commun. I hope our chat has provided value to our audience as well and that you were able to listen into a real candid conversation between federal and Ontario privacy commissioners, and to give you a real insider sense of the kinds of things we talk about. For listeners who want to learn more about some of the topics mentioned in this episode, please go to the show notes for links to various resources. Well, that’s it folks thanks for tuning in to this special episode of info matters and until next time!

Philippe Dufresne, Privacy Commissioner of Canada, is a leading legal expert on human rights, administrative, and constitutional law. He previously served as the Law Clerk and Parliamentary Counsel of the House of Commons. The Office of the Privacy Commissioner of Canada (OPC) oversees compliance with the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act (PIPEDA), Canada’s federal private-sector privacy law.

  • One-year anniversary, stepping into a new role as privacy commissioner of Canada [1:45]
  • Three years as Ontario’s information and privacy commissioner [4:26]
  • Adapting to the hybrid workplace model [6:34]
  • Rhythms of work throughout the year [9:02]
  • From human rights lawyer to privacy commissioner of Canada [10:46]
  • The fast-moving dialogue about privacy issues [12:24]
  • Making the switch from federal to provincial regulator [14:02]
  • Why it’s a pivotal time for privacy protection [18:52]
  • Artificial intelligence, Bill C-27, Digital Charter Implementation Act [19:34]
  • Harnessing the power of AI for good [22:37]
  • A modern and effective regulator for a digital Ontario [23:39]
  • Preparing to implement a new law in a continuing state of uncertainty [25:52]
  • Closing gaps in privacy protection for Ontario workers [29:45]
  • Federal-provincial collaboration: education, privacy protections for children and youth [33:21]
  • Federal-provincial collaboration: enforcement and investigations, raising public awareness of privacy issues [36:19]


Info Matters is a podcast about people, privacy, and access to information hosted by Patricia Kosseim, Information and Privacy Commissioner of Ontario. We dive into conversations with people from all walks of life and hear stories about the access and privacy issues that matter most to them.

If you enjoyed the podcast, leave us a rating or a review.

Have an access to information or privacy topic you want to learn more about? Interested in being a guest on the show? Send us a tweet @IPCinfoprivacy or email us at [email protected].

This post is also available in: French

More Info Matters Episodes

Media Contact

For a quick response, kindly e-mail or phone us with details of your request such as media outlet, topic, and deadline:
Telephone: 416-326-3965

Social Media

The IPC maintains channels on Twitter, YouTube and Linkedin in its efforts to communicate to Ontarians and others interested in privacy, access and related issues.