Industry Committee on April 17th, 2024

[The Chair, Liberal, Joël Lightbound]

Go ahead, Mr. Masse.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

Ms. Angus, I am not a lawyer—I have a BSW, actually. I'm looking at these two amendments here and then what the Privacy Commissioner had. Are you confident that the one that's being proposed by Mr. Turnbull is more consistent with what the Privacy Commissioner had? I just want to be sure about that.

I think the intent of the Conservative motion was to also fold in some of those concerns, and hence we do have another potential thing here where we're going in the right direction together.

[Runa Angus]

I certainly can't speak for the Privacy Commissioner, but as I read his submission on Bill C‑11, which was quoted earlier in the session, it is a test that has an “or” in it, so already it's not a cumulative test. I think the paragraph at the beginning does say “clarity is also required with respect to the impact of...R v. Spencer”.

There are two points there. One, they're asking for R. v. Spencer to be codified. Two, the three things that the Privacy Commissioner lists do have an “or” in them. To me, that's indicative that they're not cumulative, so I think the intent was to codify the Spencer decision, and that is what the motion proposes.

[Brian Masse, NDP, Windsor West, ON]

For us lay people on this, “or” not being cumulative means that any one of these things can trigger that process, but it can be two or it can be one or it can be three. It's as simple as that. It provides flexibility. Okay.

Thank you very much, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Masse.

I have Mr. Williams next.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Chair.

I want to go back to the GDPR. As I understand it, the GDPR does not have a definition of lawful authority, but it does outline the principles for processing personal information lawfully.

Ms. Angus, if we compare adding “lawful authority” to why the GDPR may or may not have that.... Have we looked at the GDPR in this instance and what they've done in place of adding this definition?

[Runa Angus]

The way the GDPR works is a little bit different. There are six bases for processing data, consent being one of them. Legitimate interest is another, and lawful authority as well. I would assume that lawful authority would be defined nationally because, of course, the GDPR applies to all European member states and they would have their own jurisprudence and legislation that define lawful authority. I can't really speak to that.

This is something that's very specific to the Canadian law enforcement and criminal law context. I think a better reference would be the Supreme Court of Canada.

[Ryan Williams, Conservative, Bay of Quinte, ON]

This is my last question.

Besides the Supreme Court case, which was specific, would this apply to anything else, like health care data access or employee monitoring, for instance, where employers have surveillance or webcams to look at employees? Would this look at anything else besides the Spencer decision, or would it be specific to only what was looked at in that individual case?

[Runa Angus]

The way Spencer has been used is that it is the test that any disclosure from a private entity to law enforcement is subject to. Therefore, every organization right now, when they get a request from law enforcement, will look at these Spencer criteria to decide whether or not they will disclose. Again, it's permissive. It does not compel disclosure like a warrant would, for example. This is really the organization making the determination based on the three criteria in Spencer. It would apply to all information. Again, the criteria are “exigent”, “reasonable law” and “reasonable expectation of privacy”.

Therefore, if you're talking about very sensitive health data or genetic information, I think it would be hard to argue that. Unless it's exigent—something's going to explode—or there is a reasonable law that authorizes it specifically, it would be really hard to meet the third criterion, which is that it doesn't attract a reasonable expectation of privacy. It is quite a high bar to meet for lots of those types of information.

[Ryan Williams, Conservative, Bay of Quinte, ON]

I have one last point. In my research, the GDPR outlines the principles for processing personal information “lawfully, fairly”, and it does emphasize the importance of respecting individual “rights and freedoms”. I know that's something we've talked about, but they seem to put that all together when they're using this basis.

Thank you very much.

[The Chair, Liberal, Joël Lightbound]

Before going to Mr. Vis, I have one quick question, Ms. Angus.

You mentioned that the proposition by the Privacy Commissioner for “lawful authority” in Bill C-11 was closer to the Spencer test. Does it resemble what's being proposed before the committee by Mr. Turnbull right now?

[Runa Angus]

The only difference is in the third branch of the test. The Privacy Commissioner uses the words “prescribed circumstances where personal information would not attract a reasonable expectation of privacy”.

I don't have the motion in front of me, but I think it says “pursuant to common law authority”, which is the wording that's used in paragraph 71 of the Spencer decision. In this circumstance, I think that putting “prescribed” in CPPA would probably lead to more confusion because when we say “prescribed”, we typically mean regulation.

Again, assuming that the Privacy Commissioner wants Spencer codified, that's not what Spencer says. Spencer says “common law authority”; those are obviously authorities that are prescribed by the court, not through regulation.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

I'm going to add a brief comment.

Even though court decisions help inform the work of parliamentarians, they don't dictate it. We could decide to go further. However, here in committee, we haven't had many representatives of law enforcement agencies tell us what the consequences of going beyond the Spencer decision would be for their work.

In any case, I don't remember that, and the consequences would be very serious. So we have to reflect on this. I think the government is taking it into account in its proposal.

Mr. Vis, go ahead.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Ms. Angus, can you please define “common law authority”?

[Runa Angus]

What I'm going to do is take Spencer, because Supreme Court justices are smarter than I am.

What Spencer says is that common-law authority is the “authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy.”

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Okay, so it's the discretionary powers of our police forces.

[Runa Angus]

Roughly.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Okay.

What about “exigent circumstances”?

[Runa Angus]

There isn't a definition of “exigent circumstances” that I can see.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

I understand it. It's like doing something urgently.

[Runa Angus]

Yes.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Okay.

The third criterion, “a reasonable law”, would be other acts. Is that correct?

[Runa Angus]

The Supreme Court has defined “a reasonable law” as a law that balances a state purpose—whatever the purpose of that act may be—with the interest of privacy.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Okay.

I understand the basis of the subamendment. I guess it's not a subamendment but a replacement amendment. I guess that's what we're calling it now.

[The Chair, Liberal, Joël Lightbound]

We're calling it “Mr. Turnbull's potential proposal”.