OTTAWA — Canada’s privacy commissioner has renewed his calls for Parliament to give him more power to protect Canadians’ personal information, after he helped uncover serious lapses at 23andMe but was able to do little about it. 

In a joint investigation with the U.K. information commissioner, Canadian privacy commissioner Philippe Dufresne found the genetic testing company failed to take basic steps to protect customers’ most sensitive personal information. Hackers stole the personal information of 7 million 23andMe users in 2023, including 320,000 Canadians. 

U.K. information commissioner John Edwards said it was a “profoundly damaging breach,” and fined the company the equivalent of $4.2 million for its inadequate security systems and slow response. However, Dufresne—who presented the findings alongside Edwards in Ottawa Tuesday—said he has no such power.

“This is something that exists broadly around the world in privacy authorities, and it is something that is necessary. Unfortunately Canadian privacy law does not yet provide this to me,” Dufresne said. 

“You can see in a case like this, in terms of cybersecurity, in terms of things where time is of the essence where there are real consequences, this is a gap.”

The previous Liberal government had been planning to grant Dufresne’s office the power to punish companies that don’t abide by Canadian privacy laws. Its Bill C-27 included privacy law reforms, new powers for the privacy commissioner and regulation aimed at artificial intelligence. 

The legislation died when former prime minister Justin Trudeau prorogued Parliament, and Prime Minister Mark Carney’s cabinet hasn’t yet indicated whether it plans to revive it.

In Dufresne’s view the bill was a step in the right direction, but didn’t go far enough to allow him to penalize companies. 

“I hope and expect that this new Parliament will be turning its attention to remedying this and giving us the ability to issue orders and fines,” he said Tuesday. 

23andMe filed for Chapter 11 bankruptcy in March. Last week, a non-profit founded by the company’s former CEO and co-founder Anne Wojcicki reached an agreement to buy the company for US$305 million as part of a court-approved bidding process. 

The non-profit, TTAM Research Institute, promised to abide by the company’s existing privacy policy that lets customers delete their account and genetic data and opt out of research and take extra steps to protect user data. 

“We certainly expect this to be done,” Dufresne said.

The commissioners said Tuesday they’d be watching 23andMe closely to make sure it respects the privacy laws in Canada and the U.K. Edwards warned the new owners will face further penalties if they don’t address his concerns, but Dufresne said he would have to ask the courts to intervene if necessary. 

That’s what he did in a similar case involving Pornhub’s parent company, Aylo. In March Dufresne asked the federal court to issue an urgent order that the company, formerly known as MindGeek, follow Canadian law. A 2024 investigation found the porn giant’s privacy policies allow users to upload intimate content without the knowledge or consent of the people in the images. 

The case has still not been heard by the court. 

“This takes time. This takes resources. Having order-making power would make it immediate,” Dufresne said. 

Correction: This story has been updated to correct a conversion of pounds sterling to Canadian dollars.