The committee studied the privacy impacts of division 23 of part 5 of Bill C-15, the budget 2025 implementation act, which would amend the Personal Information Protection and Electronic Documents Act (PIPEDA) to introduce a right to data mobility. The sole witness was Philippe Dufresne, Privacy Commissioner of Canada.
Dufresne supported the data mobility provisions, arguing they would give Canadians greater control over their personal information, make it easier to switch service providers, and promote competition and innovation, including in consumer-driven banking. He stressed that his office must be consulted as the government develops the regulations that will define key aspects of the framework, such as safeguards, technical parameters, and which organizations are subject to it, and he said he was optimistic about being consulted despite no statutory requirement to do so.
Dufresne repeatedly called for modernizing PIPEDA to give his office order-making powers and the ability to issue fines, noting that he currently can only make recommendations and must go to Federal Court to enforce them, as in the Pornhub investigation. He argued this enforcement gap makes Canada an outlier internationally and that financial penalties would incentivize organizations to invest in privacy protections.
On cross-border data transfers, Dufresne said the current framework could be more robust, as contracts cannot prevent foreign governments from accessing data, and he recommended strengthening rules around data sovereignty while allowing for trade. He also emphasized the need for better collaboration among regulators like the Bank of Canada, the Competition Bureau, and the CRTC, and for proactive measures rather than a purely complaints-based model.
Dufresne noted that his office has resource concerns amid budgetary restraint, even as privacy challenges grow, but he did not anticipate that the data mobility framework would require significant additional resources. He also highlighted the importance of improving Canadians' data literacy, citing surveys showing high concern and the creation of a youth council to better understand young people's perspectives.
In response to a question about the government's ability to waive laws for technology testing, Dufresne said such sandboxes should involve regulator participation, which is not present in the current bill. He also confirmed that the legislation does not mandate that data reside in Canada, though that could be added through regulations, and he noted that express consent requirements in the open banking provisions are a positive step.
AI-generated summary — may contain errors; verify against the official evidence.