[00:03.420 --> 00:10.660]  With that in mind, we've always started our symposium with the Commissioner's annual address to the privacy profession.
[00:10.660 --> 00:13.800]  And I'd like now to invite Commissioner Thierry to make his remarks.
[00:13.800 --> 00:14.920]  Thank you.
[00:17.220 --> 00:26.620]  ...year or so after being appointed as Privacy Commissioner with some mixed views and reactions.
[00:27.620 --> 00:44.220]  But I hope that not only I've met expectations and silenced critics, but that there is some hope that the Privacy Office will continue to be a leader in privacy protection in Canada.
[00:44.220 --> 00:45.940]  That's certainly my intention.
[00:47.340 --> 00:56.560]  When I appeared before a parliamentary committee to discuss my nomination for the position of Privacy Commissioner of Canada, I was asked to describe my vision.
[00:57.500 --> 01:04.620]  I said that during my mandate, my goal would be to increase the control Canadians have over their personal information.
[01:05.780 --> 01:18.620]  And so, one of my first initiatives after assuming the role was to launch a priority-setting exercise that would guide the discretionary work my office does towards realizing this vision.
[01:20.300 --> 01:27.800]  Among other things, we held focus groups across the country to gauge what average Canadians think.
[01:28.760 --> 01:32.860]  And at one of these focus groups, a woman stood up.
[01:33.180 --> 01:34.760]  She had an idea.
[01:35.880 --> 01:41.020]  Canada, she said, should appoint someone responsible for protecting people's privacy.
[01:43.100 --> 01:51.700]  Well, ladies and gentlemen, between me, my provincial counterparts, and all of you, it would seem that we're slightly ahead of the game.
[01:53.100 --> 02:00.620]  I'm very happy to be here today among fellow privacy advocates for the annual IAPP Privacy Symposium.
[02:01.360 --> 02:06.460]  Clearly, our work is not always known or fully understood.
[02:06.460 --> 02:15.720]  But over the last year, I can honestly say that I've been very impressed by your dedication to improving privacy protections for consumers.
[02:15.740 --> 02:24.780]  And I look forward to working with you over the course of the next six years as we aim to increase privacy protection for Canadians.
[02:27.140 --> 02:30.220]  So, thank you for the invitation to speak with you today.
[02:30.220 --> 02:44.320]  The bulk of my remarks will be about the privacy priorities that we have defined in the OPC after some amount of consultation and reflection.
[02:44.620 --> 02:51.680]  But before I discuss these priorities, I would like to briefly touch on the first year of my mandate.
[02:52.920 --> 03:04.820]  Some of you may still be wondering what fueled my move from my previous position as a senior counsel of the Department of Justice working in national security issues.
[03:05.680 --> 03:10.380]  Well, a lot of this comes from my family background.
[03:10.380 --> 03:25.460]  My father was a criminologist who spent most of his career as a parole officer and in his later years became Commissioner of the Canadian Penitentiary Service in the 1970s.
[03:26.040 --> 03:35.700]  In that capacity, he championed the rights of inmates during a difficult period which saw riots at the infamous Kingston Penitentiary.
[03:36.480 --> 03:49.580]  Discussions around the dinner table often centered on the importance of public service, the dignity of individuals, even the most disadvantaged, and the relationship between the state and the citizens.
[03:50.400 --> 03:58.220]  Becoming Privacy Commissioner of Canada is an extension of the same passion for human rights that my father instilled in me.
[03:58.220 --> 04:08.960]  A passion that has driven my entire career as a public servant since the day I began advising the government on legal matters shortly after being called to the bar.
[04:10.900 --> 04:18.120]  Now, as for my first year, or perhaps trial by fire,
[04:21.310 --> 04:24.630]  perhaps it was the first week actually following my nomination.
[04:25.590 --> 04:29.750]  An unknown in the privacy world, my nomination raised many questions.
[04:30.030 --> 04:34.170]  I had my fair share of critics before I even uttered a word.
[04:34.870 --> 04:43.350]  And while I cannot say that this was an easy moment, I saw firsthand that there was a real interest and care in who was going to fill that role.
[04:44.230 --> 04:47.730]  But there was no time to dwell on these critics.
[04:47.730 --> 05:03.630]  Almost immediately, and I would say immediately, I was plunged into the debate over the new cyber-bullying bill, also legislation to reform PIPEDA, and a review of the RCMP's lawful access practices.
[05:04.090 --> 05:12.290]  I also had two annual reports in the works, and a policy position on the use of genetic tests for the insurance industry.
[05:14.310 --> 05:23.190]  And then, in October, there were the tragic events on Parliament Hill and Saint-Jean-sur-Richelieu, which led to Bill C-51.
[05:25.470 --> 05:38.650]  While I was not invited to speak to the House committee that studied this bill, I used other means to add my voice to the public debate, so that people have a clearer understanding of the privacy issues at stake.
[05:38.650 --> 05:53.510]  And although the bill was largely unamended, as Chris suggested, public support for it waned, and I hope that further debate will have an impact on politicians in the longer term.
[05:54.390 --> 06:03.790]  As my new colleague Liz Denham said to me early after my appointment, this is not a sprint, it's a marathon.
[06:03.790 --> 06:23.130]  And although comments made on Bill C-51 and other issues have indeed not led to any significant changes to that particular bill, my hope and belief is that with more public debate, politicians will pay attention.
[06:24.870 --> 06:29.110]  At the end of the day, I expect to be judged on my actions.
[06:29.110 --> 06:40.590]  So far, I hope they show that I am thoughtful and thorough, that I like to offer concrete solutions, and that I am outspoken when necessary and have an independent mind.
[06:41.550 --> 06:54.910]  And for those of you who have followed or perhaps even participated in the priority setting exercise, I hope you will also have taken note that I am somebody who very much favors consultation and collaboration.
[06:55.750 --> 07:04.630]  Which brings us to the heart of my talk today, the new strategic priorities for the OPC.
[07:04.990 --> 07:12.730]  The priority setting exercise began with a vision to increase the control Canadians have over their personal information.
[07:13.330 --> 07:18.970]  This is perhaps a lofty goal in the age of big data, but that is our overall goal.
[07:18.970 --> 07:32.290]  Certainly, the digital age has brought huge social and economic benefits, from scientific innovation and marketing efficiencies to increased convenience and opportunities for individuals.
[07:32.990 --> 07:42.330]  Among these opportunities, ease of access to knowledge and communicating with new people, thus broadening our horizons.
[07:42.330 --> 07:44.850]  But it has come at a cost.
[07:45.690 --> 07:54.610]  Increasingly, individuals who want to participate in the digital economy are being asked to close their eyes, hold their noses, and click I accept.
[07:54.810 --> 07:56.890]  It should not have to be that way.
[07:58.310 --> 08:15.190]  In a bid to find better solutions to this pervasive problem, my team traveled out across the country to speak directly with public and private sector stakeholders, academia, civil society organizations, consumer groups, and the public.
[08:15.770 --> 08:25.590]  Through focus groups and roundtable discussions, we sought opinions on six privacy themes that come up frequently in our work at the OPC.
[08:26.470 --> 08:44.770]  We wanted to know if we had captured the issues correctly, which were the most important and why, particularly, and what specific things could be done and by whom, be it by individuals whose information is at stake, organizations who are important actors,
[08:44.770 --> 08:54.870]  regulators like myself and provincial colleagues, or legislators, and to do that to achieve maximum impact in terms of privacy protection.
[08:55.590 --> 08:58.330]  The exercise was extremely insightful.
[08:58.330 --> 09:07.330]  It gave us a much more fulsome understanding of the concerns of different groups and a better sense of where my office should focus its energies.
[09:08.050 --> 09:25.950]  Today, I'm giving you a preview, a detailed preview, of the priorities of the office, but if you want to know more, still in June, in mid-June, my office will issue a report outlining in greater detail the four priorities that emerge from these discussions,
[09:25.950 --> 09:35.370]  the strategies that will help us reach our goals, and some of the concrete activities we plan to launch in the weeks, months, and years ahead.
[09:35.750 --> 09:38.390]  But let me now give you a bit of a preview.
[09:39.750 --> 09:53.190]  Based on our discussions, we've narrowed the themes from six to four, which I had a chance to share with Parliament earlier this week when I appeared for main estimates.
[09:53.310 --> 10:02.410]  Parliamentarians, after all, are my bosses, so I gave them the first crack at this information.
[10:02.410 --> 10:05.710]  So the priorities, the four priorities, are the following.
[10:06.950 --> 10:10.590]  First, the economics of personal information.
[10:11.030 --> 10:13.590]  Second, government surveillance.
[10:14.550 --> 10:17.810]  Third, reputation and privacy.
[10:18.150 --> 10:21.590]  And fourth, the body as information.
[10:23.670 --> 10:43.430]  Ultimately, we seek to better understand privacy in each of these areas, in turn inform organizations and the public of the issues at stake, then influence behavior, and also use our regulatory powers most effectively.
[10:43.950 --> 10:47.970]  So what will success look like vis-à-vis these four priorities?
[10:47.970 --> 10:52.030]  We have an overall goal for each of the four.
[10:52.970 --> 11:06.950]  With respect to the economics of personal information, our goal will be to enhance the privacy, protection, and trust of individuals so that they may confidently participate in the digital economy.
[11:07.930 --> 11:30.070]  Our goal with respect to government surveillance is to contribute to the adoption – it's a bit late for some of that, but you never know – and implementation – there's more hope in the short term there – so adoption and implementation of laws and other measures that demonstrably protect both national security and privacy.
[11:31.290 --> 11:46.130]  On reputation and privacy, we want to help create an environment where individuals can use the Internet to explore their interests and develop as people without fear that their digital trace will lead to unfair treatment.
[11:47.150 --> 11:59.530]  And finally, when it comes to the body as information, our goal is to promote respect for the privacy and integrity of the human body as the vessel of our most intimate personal information.
[12:00.950 --> 12:03.250]  Now how will we do this?
[12:03.270 --> 12:08.350]  Our plan is to focus on activities across five cross-cutting strategies.
[12:08.770 --> 12:17.570]  Two of them were themes that we suggested perhaps would be priorities as such during consultations, i.e.
[12:17.570 --> 12:26.990]  accountability and privacy governance on one hand, and the international nature of privacy on the other.
[12:26.990 --> 12:50.470]  These two themes, which were suggested to be priorities, we've transformed into strategies, essentially because people we consulted told us these are less priorities in and of themselves than cross-cutting issues that will influence how privacy protection occurs across the board.
[12:50.470 --> 12:51.550]  So that's what we've done.
[12:51.550 --> 12:55.050]  We've transferred them into cross-cutting strategies.
[12:55.050 --> 13:02.610]  Three other strategies that emerged from our consultations are that innovation.
[13:02.610 --> 13:06.570]  We will explore innovative and technological ways to protect privacy.
[13:06.570 --> 13:10.780]  That was an important theme of our consultations this winter.
[13:12.830 --> 13:15.230]  Enhancing our public education role.
[13:15.230 --> 13:17.450]  That was also an important theme.
[13:17.450 --> 13:38.470]  People were telling us that although the OPC has done over the years excellent work in terms of outreach and public education, we still are in a country, in a world, where individuals are somewhat at a loss in terms of understanding what happens to their information,
[13:38.470 --> 13:41.910]  their personal information on the internet.
[13:42.210 --> 13:45.970]  And that we had a greater role to play still in informing the public.
[13:45.970 --> 13:51.450]  So we took that on board and we will seek to enhance our public education role.
[13:51.830 --> 13:58.830]  And finally, another cross-cutting strategy will be to pay special attention to vulnerable groups.
[13:58.830 --> 14:06.050]  The youth and the elderly were mentioned to us as groups that needed to receive special attention.
[14:06.550 --> 14:17.890]  So we will do that and there may be more new citizens, handicapped people perhaps, would be among those that we will try to assist particularly.
[14:18.570 --> 14:27.010]  To make good on our priorities, I intend to ensure we make full use of the tools, resources and authorities at our disposal.
[14:27.010 --> 14:32.310]  And where we see gaps, we will not hesitate to press for legislative changes.
[14:33.290 --> 14:38.270]  Let us now delve a little bit into the priorities a little further.
[14:38.410 --> 14:42.230]  So the first priority is the economics of personal information.
[14:43.730 --> 14:51.110]  That theme certainly provoked some of the liveliest debates among both the public and stakeholders that we spoke with.
[14:52.750 --> 15:07.190]  Some stakeholders felt that the power relationship skews currently in favor of industry and since being online is becoming less of a choice for individuals, that more regulation is needed.
[15:07.970 --> 15:20.310]  Others emphasized the benefits of the online business model such as access to free and innovative services, convenience, economic growth, fraud prevention and economies of scale.
[15:21.390 --> 15:26.930]  Online behavioral ads were one of those love it or hate it issues that were discussed.
[15:28.630 --> 15:44.110]  Certainly there can be benefits to online behavioral ads and personally I can say that when OBA ads pop up on our shared computer at home, this is usually the way I find out what to buy my wife at Christmas.
[15:46.290 --> 15:53.170]  The issue of consent meanwhile was raised by almost everyone as a key area of concern.
[15:53.410 --> 16:02.830]  Many noted that privacy policies were incomprehensible and they longed for a clear explanation as to how their information would be used and by whom.
[16:03.270 --> 16:11.470]  Others questioned whether it's realistic to seek consent in the age of big data, the Internet of Things and the mobile environment.
[16:12.230 --> 16:19.770]  So this is a huge challenge and I agree that this is an issue that needs special attention on a priority basis.
[16:20.470 --> 16:37.690]  To get down to specifics, what we intend to do then with that issue of consent under the priority of economics of privacy will be to start by drafting a paper outlining the current challenges and potential solutions.
[16:37.690 --> 16:44.010]  For example, self-regulation, greater accountability or enhanced regulation.
[16:44.450 --> 16:53.810]  We will then engage in a dialogue a little bit like we did when we consulted on the potential priorities of the OPC.
[16:54.530 --> 17:00.950]  We'll seek the views of stakeholders and the general public and then we will communicate our position.
[17:01.810 --> 17:15.770]  This would include identifying any improvements to enhance the current model, applying those solutions that are already within our legal framework and, if necessary, recommending legislative change.
[17:15.890 --> 17:32.050]  Through this work and by initiating this important discussion, we want to ensure that privacy remains protected in a manner that gives individuals meaningful control over their personal information while at the same time respecting innovation.
[17:34.750 --> 17:45.750]  Actually, the last thing we want to do is for privacy protection to become a barrier to technological advancement, which is why we too need to be innovative in our search for solutions.
[17:46.070 --> 17:54.370]  For example, just-in-time privacy notifications and pop-ups are a great way to obtain consent for the collection of personal information online.
[17:54.530 --> 18:03.690]  We also want to explore anonymization so that researchers can use data without fear of inadvertently identifying individuals.
[18:04.090 --> 18:11.590]  We want to encourage creative, cutting-edge ways to use technology to enhance privacy protections.
[18:13.880 --> 18:17.620]  The second priority will be government surveillance.
[18:18.540 --> 18:23.300]  We don't need to look very far to find threats to our national security.
[18:23.300 --> 18:36.260]  As a result, governments around the world are collecting more and more information about their citizens, and new technologies are enabling the collection and analysis of previously unimaginable amounts of information.
[18:37.040 --> 18:46.620]  I'm, of course, very much tuned into the reality of both the threat and government responses, given my previous role at the Department of Justice.
[18:47.000 --> 18:52.180]  Finding the right balance is absolutely critical, for obvious reasons.
[18:54.760 --> 19:11.700]  What we heard during our consultations was that while Canadians are somewhat comfortable with some surveillance for the purposes of national security and crime prevention, they are concerned about how surveillance might infringe on their basic rights and freedoms,
[19:11.700 --> 19:13.840]  including their right to privacy.
[19:13.960 --> 19:24.180]  We also heard repeated calls for more transparency with respect to government information-sharing agreements and warrantless access to telecommunications data.
[19:25.420 --> 19:37.760]  Given that Canadians don't have a choice when dealing with the government, stakeholders told us that they want leadership from us on this issue, particularly as the government moves to implement several related bills.
[19:38.740 --> 19:49.880]  So, as you know, and as I've confirmed, we were unsuccessful in our attempts to encourage parliaments to amend Bill C-51, the Anti-Terrorism Act of 2015.
[19:50.120 --> 19:53.220]  But we are not done with that file.
[19:53.220 --> 20:08.460]  Going forward, under this priority of government surveillance, we will commit significant resources towards compliance activities to ensure the provisions contained in the Bill are implemented in accordance with the Privacy Act.
[20:09.180 --> 20:18.420]  That includes provisions related to the collection of large amounts of personal information and the sharing of that information between departments and agencies.
[20:18.420 --> 20:23.380]  We will report to Parliament and to the public on what we have found.
[20:23.840 --> 20:30.620]  And if our investigations confirm problems or shortcomings in law or practice, we will call for amendments.
[20:32.000 --> 20:54.780]  My sense of the debate on Bill C-51 up until now has been one of groups positioning themselves based on what they believe the reality to be, either the need to take exceptional measures to counter threats or the fact that these measures are creating huge problems in terms of privacy.
[20:55.140 --> 21:03.040]  But there was not really a lot of information about exactly what kind of information would be shared and for what purpose.
[21:03.040 --> 21:20.020]  And the purpose of the investigations and reviews that we will undertake starting as of now, when the legislation will be in place, will be to confirm on the ground what kind of information is in fact shared between departments.
[21:20.160 --> 21:26.420]  Point one, as the Privacy Act provides, to ensure that this is done lawfully.
[21:26.420 --> 21:37.120]  But point two, to fill a gap that I think existed, a huge gap, in knowledge in the discussion about Bill C-51.
[21:37.120 --> 21:54.640]  So my hope and intent is that through these investigative measures, we will bring more concreteness and clarity, realism and evidence to the future discussions on this important area of public policy.
[21:56.440 --> 22:00.380]  I see that I'm about to run out of time.
[22:00.800 --> 22:05.360]  The third priority, reputation and privacy.
[22:08.960 --> 22:13.280]  There are many issues under that theme.
[22:13.280 --> 22:39.660]  In part, the risk posed by the collection and use of information by organizations with a view to their commercial purposes, which can sometimes lead to misinformation, mistakes and missing context, which can put reputations at risk, sometimes with devastating consequences.
[22:39.920 --> 22:49.220]  So what we want to do there is to, again, launch a dialogue through, for example, research initiatives on reputation and privacy.
[22:49.220 --> 22:56.920]  We will then establish a position on the right to be forgotten, or other recourse mechanisms in a Canadian context.
[22:56.920 --> 23:15.920]  We will build on initiatives such as this year's children's privacy sweep of websites and mobile apps, and we will conduct education and outreach initiatives with the public and with vulnerable groups, such as youth and seniors in particular, to help improve digital literacy.
[23:16.800 --> 23:19.940]  The fourth priority, the body as information.
[23:20.460 --> 23:25.700]  During our consultations, there were two general views on this question.
[23:25.980 --> 23:33.800]  The body as information is, of course, important because information derived from the body is particularly sensitive.
[23:34.200 --> 23:39.180]  It cannot be changed, contrary to other types of personal information.
[23:39.180 --> 23:53.900]  While others, a minority, thought, isn't this just another variation on the theme of the collection of information, and should it be subsumed under, say, the economics of policy or government surveillance?
[23:54.040 --> 24:05.080]  Well, because this information is particularly sensitive, and because it is cutting edge in terms of technology, we think that it deserves to be a priority in itself.
[24:05.080 --> 24:25.980]  And here, we will essentially research the area, try to develop new relationships with technologists and others to understand not only the risks created by these technologies, but hopefully how technology can assist in providing greater privacy protection.
[24:27.380 --> 24:34.440]  So, in conclusion, after much discussion, we've now identified our priorities and we have set clear goals.
[24:35.080 --> 24:44.020]  We've developed a strategy for reaching those goals, and over the next five years, you will see and hear more about our efforts on all these fronts.
[24:45.280 --> 24:50.180]  The last several months have been both interesting and inspiring, to say the least.
[24:50.320 --> 24:54.220]  And now, as they say, this is where the rubber hits the road.
[24:54.220 --> 25:11.920]  I am energized when I think of the path ahead, and I very much look forward to working collaboratively with all of you in this dynamic field to produce the kind of concrete results that will give Canadians more control over their personal information.
[25:12.320 --> 25:13.380]  Thank you.
[25:23.110 --> 25:27.570]  Now, I believe there's not much time, but there is a bit of time for questions.
[25:27.570 --> 25:33.130]  I would be happy to take questions from people in the audience if there are any.
[25:34.630 --> 25:37.250]  Raise your hand if you want to ask a question.
[25:37.590 --> 25:39.470]  The mic will come to you, I think.
[25:47.700 --> 25:49.060]  Hi.
[25:49.620 --> 25:52.200]  Thanks, Daniel, for your presentation.
[25:52.200 --> 25:55.560]  David Elder speaking, Stikeman Elliott.
[25:55.820 --> 25:59.220]  As you know, I also have a role with the Canadian Marketing Association.
[25:59.220 --> 26:07.440]  I'm obviously very interested in one of the priorities that you identified, that being economics and personal information.
[26:07.440 --> 26:18.500]  And I think I heard you say that the way it would play out was there would first be a paper developed, which would then be shopped around to interested stakeholders.
[26:18.500 --> 26:28.120]  I'm wondering whether there's going to be any sort of pre-consultation or input from interested stakeholders as that paper is being drafted.
[26:30.200 --> 26:49.360]  We'll certainly be influenced by discussions that occur everywhere about privacy issues, where the OPC attends conferences and symposia with private sector and others as we develop our paper.
[26:49.360 --> 26:57.740]  The bulk of the consultations would take place after the paper is prepared.
[26:57.740 --> 27:06.560]  It is very much a consultation paper, so we're not going to come in with predetermined views.
[27:06.560 --> 27:15.940]  And as the priority setting exercise, I hope, showed, we will reflect what we have heard.
[27:15.940 --> 27:17.340]  I hear you.
[27:17.340 --> 27:24.900]  There will be some consultation during the preparation of the papers, but it will be mostly after.
[27:24.900 --> 27:36.240]  And we will obviously need to give sufficient time for these consultations to occur before positions are actually developed by the office.
[27:36.560 --> 27:38.220]  So I take your point.
[27:46.730 --> 27:52.870]  So I'll be glad to engage in further discussions with you today and tomorrow during the conference.
[27:52.870 --> 27:53.930]  Thank you very much.