Key takeaways
- On October 7, 2026, Privacy Commissioner Philippe Dufresne appeared before the House of Commons Standing Committee on Public Safety and National Security and said federal security screening must clear four tests: necessity, proportionality, effectiveness, and minimal intrusiveness. He was joined by Marc Chénier, Deputy Commissioner and Senior General Counsel.
- He named three areas where the test bites hardest: open-source inquiries (social media and public-record checks), polygraph testing, and security clearance maintenance. He also revealed the OPC has been investigating government institutions’ use of the polygraph since January 2025.
- The Privacy Act, he said, presents “no overarching barriers” to screening collection; section 4 permits collection directly related to an operating program. That means consent and the statute will not rescue a sloppy program. Documentation of the four-part test is what actually protects you.
What Dufresne actually told Parliament
Security clearance is a condition of employment in the Government of Canada, and sometimes a condition of winning a government contract. Applicants consent to the collection, use, and disclosure of their personal information, with the depth scaled to the clearance level. Dufresne described the OPC’s two hats: employer, applying screening rules to its own people, and regulator, overseeing how federal institutions handle employee personal information, investigating complaints, and advising government on policy.
Then the part that matters beyond the public service. The OPC has been feeding input into the Treasury Board Secretariat’s Directive on Security Screening, the instrument setting the high-level parameters for screening people seeking or holding clearances. The Commissioner’s ask is not less screening. It is screening that can show its work: test every personal information collection against necessity, proportionality, effectiveness, and minimal intrusiveness. He urged TBS to give institutions real, detailed guidance on assessing and mitigating risks, not just high-level parameters.
Note the qualifier: the means must yield accurate information (the effectiveness limb) and no less privacy-invasive way may reach the same answer. Accuracy and restraint, paired. That pairing is the whole game.
The three flashpoints he named
Dufresne did not speak in generalities. He called out three practices where the four-part test will be hardest to pass:
| Practice | Why the OPC is watching it | The question to ask of your own program |
|---|---|---|
| Open-source inquiries | Social media and public-record checks sweep up vast, context-free personal information that may be wrong or stale | Does this check yield accurate information about suitability, or just more information? |
| Polygraph testing | Accuracy is contested, and the OPC opened a formal investigation into government polygraph use in January 2025 | Can you demonstrate the technique works for your purpose, or are you relying on tradition? |
| Security clearance maintenance | Ongoing vetting turns a one-time collection into continuous monitoring | Is the monitoring tied to a current, specific risk, or is it screening on autopilot? |
The polygraph line deserves a second look. The Commissioner reminded the committee the Act lets him open an investigation whenever reasonable grounds exist; he has had one running on polygraphs since January 2025. He said he looks forward to sharing the findings. Any organization using polygraphs, or considering them, should be watching what lands.
Consent is weaker than you think here
Applicants consent to screening collection. Dufresne said so plainly. The rest of the statement quietly deflates consent’s importance: in an employment context, where clearance is a condition of the job, consent is not freely given in any meaningful sense, and the Commissioner did not pretend otherwise. The real legal footing is section 4 of the Privacy Act: collection is permitted when it directly relates to an operating program or activity, and the Act imposes “no overarching barriers” to screening-related collection or disclosure, in his words.
That should make privacy practitioners slightly uncomfortable, in a productive way. The Act is not the constraint you hide behind; the four-part test is. If your program collects broadly and documents nothing, section 4 does not save you. It just means the statute was never your main risk. A complaint to the OPC, and the effectiveness question, are.
Why this reaches beyond the public service
Dufresne’s mandate stops at federal institutions. The logic does not. Banks, critical-infrastructure operators, and federal contractors run screening programs of the same shape. The four-part test travels well because it is not really about the Privacy Act. It is about defensible collection.
Read the statement as a regulator previewing a future investigation. For each data element in a background check: necessary (tied to the role’s actual risk, not the template?), proportionate (scaled to the position’s access?), effective (does it produce accurate, decision-worthy information?), minimally intrusive (is there a narrower way to answer the same question?). If you cannot answer all four in writing, you have a gap, and this statement is notice of what it will be judged against.
Actionable takeaway: Run your background-check template through Dufresne’s four parts before a regulator or tribunal does it for you. For each element (ID verification, criminal record check, credit check, open-source sweep, references), write one justification line per limb: why necessary, why proportionate to the role’s access, the evidence it is accurate, and the less intrusive option you considered and rejected. Tie collection depth to position sensitivity, in writing. And watch the polygraph investigation: its findings will reset the effectiveness bar for deception-detection techniques.