Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Canada-Newfoundland and Labrador Atlantic Accord Implementation Act

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Speaker, I think it obviously was that way. I attended some of the natural resource committee hearings and meetings on that, and it seemed that the government members there were totally opposed to considering any other additions that could fix, help or improve the bill. That is obviously not the experience I have had in some other committees. In particular, I am vice-chair of the industry committee, a very collegial committee on Bill C-34, which amended the Investment Canada Act, and the government agreed to many of the amendments the opposition made.

Right now there are many amendments to Bill C-27, perhaps one of the most consequential bills that Parliament has dealing with privacy and artificial intelligence, a complete replacement of our Privacy Act, and we have already passed six amendments to the bill from all parties. The government is operating in a very different way in very different committees, which surprises me, but maybe it should not surprise me that it does one thing in one place and says another thing in another place.

[Mark Schaan]

I'll say three things maybe, and I'll turn to Mr. Chhabra and Ms. Angus for two of them.

One, to your last point, is that it isn't actually possible to necessarily find yourself before the courts in the current model of the bill, because in order to find yourself before the courts, you need a finding of violation by the Privacy Commissioner. That's a ticket to entry, so it does reduce the number of court instances in which this is potentially the case.

In the case of the current model, though, as you note, what happens when people don't like the determination that happens.... Maybe I'll turn to Mr. Chhabra and Ms. Angus to identify again what role we've given the courts as it relates to what they can and can't opine on. I think it's important, because at the core of this is who has interpretation and investigatory responsibilities under the act. In the scheme that's currently provided for under Bill C-27, the role of the courts in their actual consideration of OPC findings is actually relatively limited in certain cases.

I'll turn to Ms. Angus to walk through that.

[The Chair, Liberal, Joël Lightbound]

We were discussing Bill C‑27, specifically CPC‑9. Mr. Perkins had the floor.

As I mentioned, no one else seems to want to debate amendment CPC‑9. If anyone wants to add their name to the list to speak, they can just let me know.

Mr. Perkins, the floor is yours.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

It's so we can get on to Bill C-27.

[Jean-Denis Garon, Bloc, Mirabel, QC]

I have one question. If I remember correctly, we agreed to hold two additional meetings, one on Rio Tinto and one on SDTC, and to hold them outside the committee's normal hours, which requires additional resources. Is that correct? That way, we would be completely on track with the agenda we had planned, without in any way impeding the progress of the study of Bill C‑27, as promised by everyone. Did I understand correctly? At the end of the day, the essence of the debate is whether we should call these people or wait.

[The Chair, Liberal, Joël Lightbound]

I call this meeting to order.

Happy Monday morning, everyone.

Welcome to meeting number 125 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders.

Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C-27, Digital Charter Implementation Act, 2022, and we are continuing clause by clause consideration of the bill.

Before we begin, I would like to remind all members and other meeting participants in the room of the following important preventative measures.

To prevent disruptive—and potentially harmful—audio feedback incidents that can cause injuries, all in‑person participants are reminded to keep their earpieces away from microphones at all times. As indicated in the communiqué from the Speaker to all members on Monday, April 29, the following measures have been taken.

All earpieces have been replaced. By default, all earpieces will be unplugged at the start of the meeting. When you are not using your earpiece, please place it face down on the middle of the sticker for this purpose that you will find on the table, as indicated. Please consult the cards on the table before you.

These measures are in place so that we can conduct our business without interruption and to protect the health and safety of all participants, including the interpreters. I would like to take this opportunity to thank them for their work.

Thank you for your co‑operation, colleagues.

On this Monday morning, we have with us three representatives from the strategy and innovation policy sector of the Department of Industry: Mark Schaan, senior assistant deputy minister; Samir Chhabra, director general; and Runa Angus, senior director. I'd like to welcome you back to the committee.

(On clause 2)

[Samir Chhabra]

I think we've been really clear in explaining our rationale for why we think it would be more efficient in this model. I think we've also been really clear to note that in some cases the provincial commissioners don't have the power to issue administrative monetary penalties.

The previous commissioner was reacting a number of years ago to a different bill and a different approach. The current Privacy Commissioner has outlined an interest in seeing compliance agreements be more flexible in their approach. The government's amendment does in fact propose to make that a feature.

As my colleague Ms. Angus pointed out earlier, the ability to change the level of appeal to the Federal Court of Appeal rather than the Federal Court, which is also something that Commissioner Dufresne has pointed out, is not something that can be done in this proceeding, because Bill C-27 doesn't actually open the Federal Courts Act.

The other approaches that Commissioner Dufresne has highlighted have in fact been taken on board. Our conversations with the Privacy Commissioner suggest that there is an openness and an understanding of why this could be important. In fact, in his most recent testimony to this table, the OPC himself suggested that:

Since the bill provides the authority to issue orders and significant fines, more procedural fairness may be warranted.

To address that concern, the government could say, yes, more procedural fairness is needed. That's the model used in Quebec and other parts of the world.

Even in his own testimony before this committee, he did in fact raise that issue and acknowledge that there could be good reasons for doing so.

I would also point out that in your commentary earlier, the way it was presented made it seem like the commissioner could not act quickly. In fact, the exact opposite is true under CPPA. The commissioner can act quickly to issue orders, both compliance orders and stop orders.

This notion that somehow this tribunal function would slow down the ability for the commissioner to act in situations that are requiring speed is not the case, and this notion that somehow investigations or joint investigations would be impeded only because of an administrative monetary penalty, which, by the way, would always be set distinctly anyway.... The ability to collaborate on an investigation is not at all hampered by having a tribunal in place. The only thing the tribunal is responsible for is determining the ultimate amount of any given administrative monetary penalty.

[Samir Chhabra]

New powers afforded to the commissioner would include the ability to issue binding orders following investigations. As I mentioned earlier, those could include an order for an organization to do something to comply with the CPPA. They could also include an order that an organization stop doing something that violates the CPPA.

The commissioner would also have the ability to enter into compliance agreements. As I mentioned earlier, government amendments that have been tabled would allow for those compliance agreements to be entered into at any stage throughout the process and also for financial considerations to be included within that compliance agreement. That means, for example, if an organization were found to be in contravention of the CPPA, the OPC would have the power to negotiate a compliance agreement that could include, in essence, a financial payment or penalty.

All of those things are new powers the OPC would have as a result of Bill C-27, which are not currently available to the commissioner.

On the issue of alignment with other jurisdictions, as I pointed out earlier, we should always be very cautious about thinking narrowly about alignment on any one specific issue. We do see tribunals in effect in the privacy space in the U.K., Ireland, Australia and New Zealand, taking an approach that is very analogous to the one being taken here, with some slight variations across them, but again, every jurisdiction has its own constitutional framework and other laws in place that drive those slight variations.

The point is that we are taking into account the best practices and the best approaches that have been undertaken internationally, and we are undertaking significant consultations here in Canada to bring forward a proposal that we think significantly improves the enforceability of Canada's private sector privacy law and gives the commissioner significant new powers to do so.

[Samir Chhabra]

I think we've seen that these issues tend to be quite complex when it comes to personal information, data flows and how information is being utilized. It's not necessarily a straightforward proceeding. It's not necessarily one where a judge would typically have a significant amount of experience in previous case law to build from. There is, obviously, some case law in this space, but not to the level that might be considered a commonly understood approach.

The speed element comes from making sure both that the tribunal's decisions themselves are considered final so that they're not being appealed but also that the degree of expertise resident in the tribunal is specifically designed to respond to stakeholder feedback that was received before Bill C-27 was tabled, about the importance of having at least three members of that group having expertise in privacy and information law. That is a growing field of law where experts have been developing their understanding of the issues and also of how emerging issues in the digital technology space, in terms of how data is being used, could have important effects on individual privacy.

It's understanding the nexus of cybersecurity, understanding the nexus with de-identification or anonymization techniques, understanding the importance of governance approaches taken within organizations and understanding the approaches being taken in other jurisdictions as well. There are a number of reasons that having expertise in the domain of privacy law and privacy and information protection would be helpful for speed and to make the decisions more effective and procedurally fair.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

This is a very important discussion, and I will admit there was very strong testimony received on both sides of the tribunal. If I understand it correctly, right now, the Privacy Commissioner has investigative powers. Those investigative powers would obviously still be retained if Bill C-27 were passed.

I'm speaking hypothetically here. The Privacy Commissioner conducts an investigation. If this bill passes in its current form, the Privacy Commissioner will recommend to the tribunal an administrative fine for a breach of privacy. The tribunal will then have to decide....

Am I correct so far? No. Please, correct me.

[Samir Chhabra]

There are a number of pieces there that I'd like to try to unpack. I think in the context of order-making powers, we've already been clear that the order-making powers in the CPPA would vest with the commissioner, so it's difficult to see how the tribunal would be slowing down the order-making abilities of the commissioner.

The notes that we have here from Ms. Denham include that there is a tribunal system in the U.K. and that administrative tribunals are used across many areas of law. It may seem like a lengthy process, but over time the tribunals become expert tribunals, and the Bill C-27 proposals are aimed at ensuring administrative fairness. That is really what we're talking about here—the carriage of justice, administrative fairness and ensuring that there is an appropriate delineation of powers and responsibilities.

My colleague will take a moment as well.

[The Chair, Liberal, Joël Lightbound]

I call this meeting to order.

Good Wednesday afternoon to you all, colleagues.

Welcome to meeting number 124 of the House of Commons Standing Committee on Industry and Technology.

Today’s meeting is taking place in a hybrid format. Pursuant to the Standing Orders and the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C-27, Digital Charter Implementation Act, 2022. Today we will continue clause-by-clause consideration of the bill.

Before we begin, I would like to remind all members and other meeting participants in the room of the following important preventive measures.

To prevent disruptive and potentially harmful audio feedback incidents that can cause injuries, all in-person participants are reminded to keep their earpieces away from all microphones at all times. As indicated in the communiqué from the Speaker to all members on April 29, the following measures have been taken to help prevent audio feedback incidents. All earpieces have been replaced by a model which greatly reduces the probability of audio feedback. By default, all unused earpieces will be unplugged at the start of a meeting. When you are not using your earpiece, please place it face down on the middle of the sticker for this purpose that you will find on the table, as indicated. Please consult the cards on the table for guidelines to prevent audio feedback incidents. As you can see, the room layout has been adjusted to prevent this type of incident. These measures are in place so that we can conduct our business without interruption and to protect the health and safety of all participants, including the interpreters. Thank you all for your co-operation.

Without further ado, I would like to welcome the witnesses, who come from the Department of Industry. We have Samir Chhabra, director general, strategy and innovation policy sector; and Runa Angus, senior director, strategy and innovation policy sector. Welcome to you both, and thank you for agreeing to join us.

(Clause 2)

Industry and Technology

[Ryan Williams, Conservative, Bay of Quinte, ON]

moved:

That it be an instruction to the Standing Committee on Industry and Technology that, during its consideration of Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, the committee be granted the power to divide the bill into two pieces of legislation:

(a) Bill C-27A, An Act to enact the Consumer Privacy Protection Act, containing Part 1 and the schedule to section 2;

(b) Bill C-27B , An Act to enact Personal Information and Data Protection Tribunal Act, and an An Act to enact the Artificial Intelligence and Data Act, containing Part 2 and Part 3.

Madam Speaker, I rise today on an important debate that is coming from the industry committee. Right now, we are studying what seems to be the unending study of Bill C-27, which is privacy legislation.

I have risen in this House before at least one other time on this matter, as have other members of the Conservative Party and other parties, including the NDP. We are rising today to request that this bill be split into two parts. One would be the privacy legislation replacing PIPEDA in the tribunal, and the second one would be AIDA, or the AI portion of this bill.

The reason for that is twofold. It is taking a long time to pass this bill mainly because of the government. The government produced a bill that was flawed, and because of this flawed bill, when it presented the bill, it presented 55 amendments to the bill. We have been going through them at committee, and we are now just getting through the definitions part of clause-by-clause on the first part, which is PIPEDA. We are finding there has been 16 table-drops to this bill for amendments.

This bill was not ready to come to the floor. We are looking at the need for privacy legislation, which we do agree with. Conservatives have stood in this House and said we believed that privacy should be considered a fundamental right for Canadians. When we look at that aspect of the bill, and it is very important, the second part of this bill, the AI, the AIDA, portion of this bill, is so flawed that it is holding up the first part of the bill.

The parts never should have been put together; they should have been separate. There were some fundamental reasons why the government wanted to put them together. With 55 amendments and 16 subamendments to the main part of the bill, this bill is so flawed we cannot even get through the first part. We are worried if the bill is not separated into two votes, and we do not have AIDA separated and perhaps have it come back as a whole new legislation, we are not going to get the first part of the bill through, which is privacy legislation that Canadians are desperately asking for.

After nine years, Canadians have never had less privacy. We look at the fact that we have Alexa, or AI of any form, and when our children are on their iPads, that data is being scraped off the Internet and collected. None of it is private. We do not have any privacy with our data.

This week, we are looking at privacy, and we are trying to discern the difference between normal privacy and sensitive data. Sensitive data would be looked at under the act, but would be a bit more heightened. It would be looked at with greater penalties for those who breach it. We are certainly looking at everyone's privacy in the coming years with AI and the advancement of computers.

The one that we are specifically looking at is financial data. All of the transactions that we do through Interac, our banking system as a whole, our bank accounts, and the interactions that we have online, like with Apple Pay or on our cellphones, are all held by the banks. Many Canadians would be surprised to know they do not own their financial data.

A bank has someone's data, and that can mean anything from their credit history, where they spend their money, how they get their income or where they are paying their taxes. All of that data right now is not held as sensitive, and more importantly, it is not held under that person's consent. Financial data across Canada needs to be regarded as sensitive.

Perhaps the biggest breach of that within the last two years was when the government enacted the Emergencies Act and bank accounts were frozen under the act. The government has the ability to freeze bank accounts because that data is not sensitive. Through the government, when it took away the rights of Canadians, that data was then held by those banks against consumers' will.

In this country, we want to be able to have open banking. The idea with open banking is to have Canadians control who owns their data, and, with their consent, who can have their data. That is really the crux of this bill. When we talk about sensitive financial data, it is the ability for someone, as a consumer, to control where their data is and where it goes.

Open banking, of course, brings competition to our banking sector, which allows not only the six big banks to have our business, but also hundreds of other financial tech organizations that want to have our business and right now are only able to get it through screen scraping. This is taking data off screens or having their clients take screenshots of their financial history in order to get it to a financial tech organization so it can compete for their business. However, financial data should be sensitive information, and when we look at how that relates to AI, well, it is a whole different component of the bill. Also, when we look at location data, and the ability for someone to know from a person's phone where that person is right now, that is also sensitive data. However, the advancement of AI has allowed all of that information to be out in the open and to be emulated.

When we look at the AI bill, the most important part that we are going to be standing up for, as Conservatives, is to ensure that computers cannot emulate human beings without their express consent. However, when we look at privacy as a fundamental right, AI allows the ability of one's image, likeness and voice to be replicated and used all over this planet, which, of course, is bad when we talk about fraud. We have all the heard stories of parents who thought that their children were calling them for help and to ask for money. It sounded like them, they laughed like they did, but at the end of the day, it was an AI program that emulated an individual to cause an act of fraud.

Right now, Scarlett Johansson is in the news. If anyone has used ChatGBT lately, version 4, which is the new version, they would find that Sky apparently uses Scarlett Johansson's voice without her permission. AI does this right now. It can scrape images and likenesses off the internet, and there is no recourse to ensure that it is taken care of. However, having this AI bill attached to Bill C-27, the privacy act, is slowing this process down and, because of that, Canada is falling further and further behind. It should be a separate bill, and we are asking that the bill before us, of course, be put into two separate votes, as we have before.

I am splitting my time today, because I have some knowledge, but we have greater expertise coming from the member from South Shore—St. Margarets.

I will end with where we are with AI in general. It was announced last week on the budget bill, Bill C-69, that the government is going to put money into AI, figuring that, finally, Canada should have been a leader and should be a leader on this. However, another article, just released yesterday, effectively said, “Ah, too late”, and that the money the government wants to put into AI and infrastructure, Meta Llama 3 has just made obsolete. Of course, Meta, Microsoft, Google and so many other companies have already put money and resources into AI, and Canada is falling further and further behind because, after nine years, Canada has lost almost all of its IP in AI to the rest of the world. China had 13,000 patents in AI just last year, which was more than all patents filed in all sectors in Canada. The U.S. had close to 20,000 patents. So, now, when we put money into IP for AI in Canada, it is not Canadian IP. Once again, we are just investing in American and international companies in Canada. Canada is becoming a branch-plant state. We take our taxpayers' hard-earned money and we put it into intellectual property and multinational corporations that do not provide the GDP that Canada needs but just jobs, which is what we are left with.

We have a bill that was not properly done. It has 55 amendments from the government side and 16 subamendments. I could not believe that, the other day, the government was filibustering its own bill. We were in committee, and the government was talking it out. It did not like that we were talking about financial data as sensitive information. I had never seen this before. However, the bill is flawed and it needs to be split in two. We are happy to make sure that happens and that we get the bill right. Do not worry, a Conservative government will get it right.

[Philippe Dufresne]

Bill C-27 was introduced by the government. It would provide me with the ability to issue orders, and it would provide for the ability for fines to be issued. That's on the private sector side.

In terms of the public sector, there is no bill to modernize it.

Currently, the Department of Justice has done a consultation paper in which that was a recommendation in terms of a greater compliance mechanism, and I would certainly encourage that moving forward.

[Philippe Dufresne]

In terms of the sandboxes for organizations, we're not currently resourced to offer this, but my international counterparts are, and they are doing it with business, so they will say, “You can come over, and you can test this new technology in a safe space where the regulator can provide input, can provide risk. We're able to provide proactive guidance and to be consulted, and we have services for that, but not to the extent of offering sandboxes. This is something I'd like to be able to do. I think it would be good for Canadians and good for industry.

We've identified that we would need ongoing annual funding, an increase of about $25 million for Bill C-27, to optimally provide those services based on those new authorities.

In terms of the sweep that you made reference to, with our partners we look at various numbers of websites and see.... I don't have the randomized formula that was used by the team, but the goal is to say that we're going to do some spot checks and see.... Are there trends? Are there concerns? Are we seeing some websites that are using what we call deceptive practices or dark patterns, which are communication tools that will lead people into making bad decisions and will sometimes trick them?