Remarks by the Privacy Commissioner at the Annual Conference of the International Institute of Communications

October 21, 2025
Ottawa, Ontario

Keynote address by Philippe Dufresne
Privacy Commissioner of Canada

(Check against delivery)

Good morning. Thank you for inviting me to speak with you today. It is an exciting time for privacy, and I am very happy to be here to offer an update on the current landscape.

The agenda for this important conference suggests that many issues preoccupying communications industry professionals are the very same that my Office is focused on. To name a few: age assurance, cybersecurity, artificial intelligence, quantum computing, and how to protect consumer data in an evolving digital world.

Data is one of the most important resources of the 21st century. It can support and fuel innovation and how it is protected shapes our ability to thrive and lead in the digital economy.

From the moment that we start our day and check our phones, until the time that we wind down by streaming music or a favourite show, our personal data is being sought. Few know this better than this audience.

New technologies bring new opportunities to connect, to create, and to innovate. But this also brings risks to our privacy.

As this new digital economy unfolds, it is important to be aware of the imperative to protect personal data, and the need to build this protection into projects and initiatives from the very beginning.

Trust in how data is handled is becoming a deciding factor in how people interact with government, businesses, and technology.

Recent public opinion research from my Office suggests that nine in 10 Canadians are concerned about what happens with their data, and fewer than half (40%) trust that business will protect their privacy.

Meanwhile, Canadians are increasingly taking matters into their own hands by refusing to provide personal data, changing privacy settings, deleting accounts, and walking away from companies that experience a breach.

As consumers increasingly consider privacy issues, organizations that prioritize privacy will find that they enjoy a competitive advantage.

Just as data is used to fuel innovation - to improve and tailor services, generate efficiencies and evaluate results - innovation must also be used to protect data.

When individuals trust that their rights will be protected, they feel confident about participating freely in the digital economy. This is good for Canadians, good for business and good for innovation.

At a recent conference focused on artificial intelligence, AI Minister Evan Solomon said that the motto of his office is "adoption moves at the speed of trust."

I agree and would suggest that strong privacy laws would also go a long way to enabling that trust.

Canada needs clear guardrails for responsible data management to support progress in critical areas.

It is why I also welcomed Minister Solomon's recent comments regarding his government's plans to introduce modernized public- and private-sector privacy laws that recognize the realities of today's digital economy.

Through modern, predictable laws that share common standards with like-minded countries, we can create a regulatory environment that makes it easier for organizations to engage and succeed in a globalized world.

In my remarks today, I will talk about my Office's work to protect and promote privacy at this time of rapid technological change, our efforts to champion children's privacy as well as the importance of collaboration and our expanding role on the global stage.

I will also touch on a few initiatives that may be of particular interest to this audience including our recent findings in TikTok and the Google de-listing case, our work with the Canadian Digital Regulators Forum and how a recent transformation of the Office of the Privacy Commissioner (OPC) operations is helping us deliver results for Canadians in a more timely and efficient manner.

Protecting and promoting privacy at a time of rapid technological change

One of my strategic priorities is protecting and promoting privacy at a time of rapid technological change.

New technologies such as AI are fueled by the massive collection of data, including Canadians' personal information.

It is therefore critical that AI and related technologies be developed and deployed in a responsible, privacy-preserving manner.

This means considering the privacy implications at the start of any initiative, being transparent about the use of AI and accountable for any AI-generated decisions about individuals, such as whether to grant someone a loan or a job.

I am working collaboratively with my domestic, international, and cross-regulatory partners to develop and champion privacy principles that will support AI and other emerging technologies so that they are designed and built on a solid foundation that is adaptable over time.

Our work has stressed that, while technological innovation can bring important economic, societal and public interest benefits, the value of this innovation can be jeopardized when it is not accompanied by trust.

It is important for developers and providers of new technologies to embed privacy in the design, conception, operation, and management of their products and services, and to consider the unique impact that these tools have on children as well as on groups that have historically experienced discrimination or bias.

While AI has dominated discourse surrounding technological innovation and regulation around the world ever since ChatGPT launched three years ago, the OPC is also actively working to advance privacy-protective approaches in other areas.

For example, in 2023, I joined other global data protection authorities in signing a joint statement on data-scraping, which involves the automated extraction of data from the web. The practice poses an important risk to the privacy of Canadians as scraped data can be used for targeted cyberattacks, identity fraud, creating facial recognition databases, unauthorized police intelligence gathering, and unwanted direct marketing and spam.

The statement set out our expectations regarding what organizations that house data should do to ensure that individuals are protected from the risks resulting from unlawful scraping and led to an engagement with social media companies and other stakeholders.

My Office was also among 26 privacy enforcement authorities from around the world to participate in the last Global Privacy Enforcement Network privacy sweep in 2024. Collectively, we found that 97% of the more than 1,000 websites and apps we reviewed were using one or more deceptive design patterns to encourage people to give away more personal information online than they wanted to or should.

Following the publication of the sweep results, the OPC wrote to 27 organizations to encourage them to review their websites and apps for deceptive design patterns. I am pleased to report that nearly three quarters of those organizations committed to implementing improvements to avoid the practice.

Championing children's privacy

Championing children's privacy is another strategic priority for my Office. It recognizes the unique sensitivities around young people's privacy and the need to ensure that their rights are protected so that they can benefit from technology without compromising their privacy and well-being.

Our work over the last year has focused on research to deepen our understanding of the privacy issues that impact young people and applying a children's privacy lens to our enforcement activities.

For instance, last month I released the findings of a joint investigation into TikTok with my counterparts in Quebec, British Columbia and Alberta.

The investigation found that the measures in place to keep children off the popular video-sharing platform and to prevent the collection and use of their sensitive personal information for profiling and targeting purposes were inadequate.

The lessons from this investigation can apply to many businesses - for example, our findings underscore the need to identify and prevent risks to vulnerable groups, including children. It is important to consciously think about putting children's best interests at the forefront of services and activities such as marketing.

This is consistent with the Canadian Marketing Code of Ethics and Standards, which requires that special attention be given to the question of marketing to children and teens. The Code says that the best interests of the child should be a primary consideration when dealing with this group.

Although our joint investigation focused on children, it also found that TikTok did not adequately explain its data practices to teen and adult users - the result was that it did not obtain meaningful consent for the collection and use of vast amounts of user data, including sensitive data of younger users, as required under Canadian privacy laws.

In response to our recommendations, TikTok made or committed to make a number of improvements to its privacy practices during the investigation. This included changes to effectively stop allowing advertisers to target users under the age of 18, except based on broad categories such as language and approximate location.

TikTok has also agreed to strengthen its privacy communications to ensure that users, and in particular younger users, understand how their data could be used, including for targeted advertising and content personalization. In addition, TikTok agreed to enhance age-assurance methods to keep underage users off the platform and thus better protect them from privacy harms.

This case offers lessons for other businesses: For one, building strong data management frameworks is key to fostering an environment where your business can thrive, innovate responsibly, and earn public trust.

Responsible innovation means making sure that you have consent if you are collecting customers' personal information and that you only collect what you need for your business purposes.

It means being open about the information that you collect and what you are using it for. And it means establishing safeguards to protect personal information and mitigate privacy risks, including the risk of collecting, using or disclosing more information or sensitive information that you do not need.

Establishing a proper data management framework will allow you to continue to use data safely. My Office is always available to discuss your planned initiatives and help you to innovate in a privacy-protective way.

On the broader subject of age assurance, my Office held last year a consultation to gather input on how and when online services should confirm the age of a user in order to restrict young people from accessing certain content. Based on the feedback we received, including from some organizations in this audience, we are now developing guidance that I hope you will find useful.

In other work on this priority, my Office is developing a Children's Privacy Code to create practical guidelines for organizations that handle children's personal information. Established codes of practice and special protections contained in privacy legislation can empower children to exercise their privacy rights and protect them against potential harms as they navigate online spaces.

During an international symposium on children's privacy that I hosted in June, I also announced the establishment of a Youth Advisory Council to create a space for young people to share their insights, experiences, and ideas on the privacy challenges that matter most to them. Their voices will play an important role in deepening our understanding of how these issues impact young people. This will help to inform our efforts where they can have the most impact. We are now in the final stages of getting the council underway.

Collaboration and the OPC's expanding role on the global stage

As you may have gathered from the examples of our work that I have discussed thus far, collaboration is a central component of my tenure as Privacy Commissioner of Canada.

Privacy is a global issue requiring global leadership. As personal information flows across borders at unprecedented volumes and speed, working together with domestic and international partners and stakeholders has never been more important.

Sharing knowledge and expertise, jointly examining emerging issues, and working together to advance common standards provides greater consistency for organizations operating across jurisdictions, and better privacy protections for individuals at this pivotal time.

I have been working hard to further increase Canada's national and international visibility and leadership in this area. I believe that Canada must be at the table to protect Canadians' privacy as this new digital economy unfolds.

Last month, I was honoured to be elected Chair of the Global Privacy Assembly, an international forum that brings together more than 130 data protection and privacy authorities from all over the world.

As Chair, my vision will centre around collaboration on three main themes:

• Addressing the privacy impacts of technology,
• Championing youth privacy, and
• Continuing progress towards strong economies and a high level of data protection in global frameworks, including through data free flow with trust.

As the flow of personal data plays an increasingly central role in today's modern digital economy, having the Privacy Commissioner of Canada in this global leadership role represents a significant opportunity to help shape the future of data protection on the world stage.

An example of collaboration to maximize results is my joint investigation with the United Kingdom Information Commissioner's Office into a breach at 23andMe. Our investigation found that the global direct-to-consumer genetic testing company had failed to implement adequate security measures to protect the personal information of 7 million customers, including nearly 320,000 Canadians. The investigation results serve as a cautionary tale for all organizations about the importance of data protection in an era of growing cyberthreats.

Joint investigations like this demonstrate how regulatory collaboration can more effectively address issues of global significance. By leveraging our combined powers, resources, and expertise, our Offices were able to more effectively protect and promote the fundamental right to privacy of individuals across jurisdictions.

I also collaborate regularly with my provincial and territorial counterparts. Earlier this month, we met to discuss key priorities like children's privacy, AI, cybersecurity and the protection of online data.

During the meeting, I took on the role of co-chair of this group for the next year, alongside Information Commissioner of Canada Caroline Maynard.

Beyond fellow privacy regulators, I also frequently consult with industry, academia, and civil society. I believe that it is important, when we are writing guidance materials for organizations, institutions and individuals, that we take steps to ensure that our guidance is as helpful and clear as possible.

Indeed, I am interested in hearing about how we can make our consultation processes more effective. To that end, my team will launch an initiative in the coming months aimed at gathering feedback from stakeholders on our consultation process and I would invite you all to share your views.

Cross-regulatory collaboration

It has also become clear that cross-regulatory collaboration is essential if we are to better protect the rights and interests of Canadians in the digital space.

This recognition led to the creation of the Canadian Digital Regulators Forum in 2023. Comprised of the Competition Bureau of Canada, the Canadian Radio-television and Telecommunications Commission, the Copyright Board of Canada and my Office, the Forum's goal is to strengthen information-sharing and collaboration on matters of mutual interest so that we may better respond to the scale, speed and global nature of digital markets.

A recent initiative was the publication of a paper exploring the impact of synthetic media - artificially generated images, video, text, or audio content, which includes deepfakes - on Canadians and Canadian organizations.

The report is especially timely given the widespread use of synthetic media and how increasingly realistic these technologies are. For example, deepfakes of Canada's Prime Minister or notable journalists promoting financial scams in videos have been used to con Canadians. Scammers have also used synthetic media to impersonate banks and government agencies to mislead individuals.

Google investigation

I mentioned my Office's joint investigations into 23andMe and TikTok. Another file of interest to digital media companies is our recently concluded investigation into a complaint against Google.

The case involved an individual who faced a criminal charge that was dropped shortly after it was laid. Many years later, news articles about the charge continue to be made available online through searches for the individual's name. These articles revealed highly sensitive personal information that the individual said has caused them direct harm, such as physical assault, lost employment opportunities, and severe social stigma.

In our report of findings released in August, we found that individuals have the right, in limited circumstances, to have certain information about them de-listed so that it is not displayed in search engine results when their name is searched online.

The investigation found that Google had violated Canada's federal private-sector privacy law. To bring itself into compliance, Google must de-list the articles in question, so that they no longer appear when the individual's name is searched. While the articles would continue to exist online and could still be found on the websites where they were originally published, they would only be searchable on Google's search engine through searches for terms other than the individual's name.

Google has declined to de-list the articles and my Office is now considering all available options to secure Google's compliance with the Personal Information Protection and Electronic Documents Act (or PIPEDA).

The case underscores the need for updates to Canada's privacy laws. I have recommended that there be a clear and explicit right to have personal information de-listed or removed from search results returned from search engines as well as from other online sources. I am hopeful this will be included in the next iteration of a modernized private-sector privacy law.

OPC transformation

While continuing to advocate for law reform, I also want to ensure that we are doing everything we can within the OPC itself to adapt to the growing complexity of our environment and to make our services to Canadians as efficient as possible.

To that end, I introduced a reorganization and transformation plan early this year that marks the beginning of a change journey to a modernized OPC that delivers on its mandate and strategic priorities in the most efficient and impactful way possible.

The plan will allow my Office to respond more rapidly and effectively to emerging issues, and it reframes the compliance function as a continuum that will allow us to put greater emphasis on engaging with organizations, proactively as well as reactively, to promote compliance.

The change is a recognition that not every matter requires a full, resource-heavy investigation. Sometimes, there are more efficient ways of achieving the desired result. Going forward, we will aim to resolve as many cases as possible through early engagement and resolution, focusing our in-depth investigations on key priority issues or incidents.

Our response to the breach at PowerSchool this year is a good example of this new approach. My Office engaged with the company to achieve a timely resolution, by focusing on its response to the incident and its implementation of measures aimed at strengthening protection for the personal information of students, parents, and educators across Canada. My Office will continue to monitor to ensure that all of PowerSchool's commitments are fully met.

Conclusion

Before I conclude, I will leave you with these final thoughts. Privacy is a fundamental right that reinforces the freedoms and trust that underpin our democracy and unites us as Canadians.

It is particularly relevant at a time when more and more personal information is being collected, used, and shared in new and unforeseen ways.

All of you in this audience are well-positioned to champion and guide important work across your own organizations and institutions that reflect the significance of the task at hand.

Organizations that factor in consumers' reasonable expectation of privacy, that invest in robust safeguards to protect the data in their care, and that react quickly to contain and respond to data breaches, will benefit in today's digital marketplace. When individuals can see that their privacy is a priority, they are more inclined to place their trust in a new technology or service that you may be offering. This is an important consideration, particularly in challenging economic times.

Prioritizing privacy helps create conditions for a resilient Canadian economy and a more secure and enriching digital society. When Canadians have confidence that their data is protected and used responsibly, it supports their well-being today and that of future generations while fostering an environment where businesses can thrive, innovate responsibly, and earn public trust.

Thank you again for inviting me to speak to you here today.