Samuelson-Glushko Canadian Internet Policy and Public Interest ClinicCIPPIC calls on the Privacy Commissioner of Canada to commit to targeted reforms in its enforcement practices
For Immediate Release
OTTAWA, Privacy Awareness Week – In recognition of Privacy Awareness Week, the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic (CIPPIC), Canada’s first and only public interest law and technology clinic, calls on the Office of the Privacy Commissioner of Canada to undertake targeted and immediate reforms to its enforcement practices.
“When Philippe Dufresne was appointed Privacy Commissioner of Canada in 2022, Canadians were hopeful he would renew the office’s mandate through robust enforcement of federal privacy laws,” said CIPPIC Director Matt Malone. “Almost three years later, that promise remains unfulfilled.”
“Commissioner Dufresne’s office has become known for launching investigations that span years with little to no resolution, such as those into TikTok and ChatGPT.[1] When pressed, his office issues vague assurances that longstanding files remain a ‘top priority.’[2] Meaningful information is rarely forthcoming. Increasingly, the focus is on the theatre of enforcement, not actual enforcement.”
Through records obtained under the Access to Information Act, CIPPIC has learned that some investigations recently closed by the Commissioner have taken many years to conclude – with many investigations taking three or four years, some taking over eight years, and one even lasting over a decade.[3] This mirrors lengthy investigations conducted by the Information Commissioner of Canada, as CIPPIC recently discovered.[4]
Public records suggest that the Commissioner’s international travel has taken precedence.[5] In just two years, the Commissioner spent over $200,000 in taxpayer funds attending events in locations such as Turkey, Mexico, Japan (twice), Australia, Italy (three times), Bermuda, the UK, Germany, and Singapore. This level of travel activity is not comparable with his peer federal watchdogs.
Meanwhile, at home the Commissioner is fighting yesterday’s battles. Years late, the Commissioner is still examining the ArriveCAN app and continues litigation against Meta over the Cambridge Analytica scandal – a scandal dating all the way back to 2016.[6] That legal fight alone has consumed a significant sum of public funds, mostly on bills for a Bay Street law firm.[7]
“The Commissioner demonstrates complacency at a time when Canadians need an urgent response to the threats they face to their privacy rights,” said Malone. “This comes at a time where the country's standing with European regulators is at risk, which could potentially jeopardize our trading relationship with the EU.”[8] This pattern mirrors a broader failure across federal institutions to protect the privacy rights of Canada’s most vulnerable, especially children and youth. Instead of investing in adequate enforcement resources to combat online harms, the last government introduced the controversial Online Harms Act, seeking to arrogate sweeping new powers.[9]
Disturbingly, all major federal political parties – Liberals, Conservatives, and NDP – have unified to block efforts to impose stricter privacy rules on the use of Canadians’ personal information in their political machines.[10]
Canadians deserve better.
CIPPIC is calling on the Commissioner to take the following immediate steps to restore public confidence in his office’s work:
- Suspend his international travel. CIPPIC calls on the Commissioner to halt all taxpayer-funded international travel until his office achieves tangible reductions in investigation timelines and exhibits better transparency.
- Increase transparency about investigation timelines. Publish quarterly information for all completed investigations revealing, at a minimum, (1) the date the complaint was received; (2) the date the complaint was accepted and an investigation was opened; and (3) the date the investigation was closed. Canadians deserve the complete data so they can have an accurate picture of the privacy watchdog’s track record, and they should not be forced to obtain this information through the Access to Information Act.
- Publish more information about data breaches. As soon as it becomes available, publish the names of all federal institutions that have suffered data breaches and the number of affected Canadians. Stop making vulnerable and under-resourced civil society actors or journalists obtain this information through the Access to Information Act.
CIPPIC also calls on Prime Minister of Canada Mark Carney to direct the Commissioner towards these actions, and to make privacy and data protection reform – along with transparency legislation reform – a priority of his government. It is time for Canada’s leaders to deliver the protections that Canadians expect and deserve.
Media Contact
Director, CIPPIC
Cited Material
[1] https://www.cbc.ca/news/politics/privacy-commissioner-investigation-openai-chatgpt-1.6801296; https://financialpost.com/pmn/business-pmn/federal-and-three-provincial-privacy-commissioners-launch-tiktok-investigation.
[2] https://www.cbc.ca/news/business/government-tiktok-advertising-1.7378849.
[3] A-2024-00062. Notably, the Commissioner did not provide this record in the format requested by CIPPIC.
[6] https://www.priv.gc.ca/en/opc-news/news-and-announcements/2024/an_240319/.
[7] https://theijf.org/open-by-default/24395324.
