Industry Committee on May 6th, 2024

[Mark Schaan]

It's about disclosures. It's about the nature of requiring express consent for every use, collection and disclosure of financial information, because the list as constructed says that such information is, by definition, sensitive, which means it cannot rely on implied consent.

Therefore, the processing of financial information, which is often transferred from one collector into the hands of another as part of an accountability chain, will require the express consent of the individual. Each one of those steps puts at a disadvantage the notion of a convenient framework that tries to preserve consent for where it is most important, which is when the privacy of information is potentially at great risk and when information is potentially not understood, in the capacity of an individual, to be transferrable as part of the service they're receiving.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Okay. This will be my last comment, and hopefully we'll get to a vote on this shortly.

I think what that framework does, when we look at the financial sector and open banking, is it allows customers to explicitly grant or revoke consent and makes third party access easier than any other framework we've had in the past. Open banking should be the example of why we're including financial data as sensitive and why Canada wants to protect that data explicitly. As to the second part, we've included “generally” because that word gives flexibility to the Privacy Commissioner to then deem what financial data can be used, given the sensitivity of it, and in what context it should be used.

I think we've given all of that and we've gone around the room on this quite heavily.

Thank you, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you.

Mr. Masse, you have the floor.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

I want to get on the record some of the differences we have.

Here we're talking about the empowerment of consumers with regard to information, but at the same time, we have a government that has not moved on Crown copyright since 1911. For those who aren't familiar with Crown copyright, it was first brought to Canada in 1909 and was amended in 1911. What that means, which is really important to businesses, educators and general society, is that all the information the government has is basically suspended or not provided to the public. That is different from what our U.S. counterparts and other Commonwealth nations have. I find it difficult when the government wants to continue to have control of publicly manufactured and basically publicly expensed information when the United States doesn't do this, Great Britain doesn't do this and the other Commonwealth nations haven't done this.

Mr. Schaan, with regard to Crown copyright, what country out there is equivalent to ours? The argument is being made that the government wants to defeat this amendment to allow the public to have information and control. At the same time, this government continues to block Crown copyright renewal, which is actually providing information to the general public that they've paid for. Where in the world is there a consistency of Crown copyright?

[Mark Schaan]

As it relates to the government's position on Crown copyright, it's not a singular position. I think it's important to look at the Treasury Board guidance that relates to the publicity of information generated by the Crown, including the open-by-default standard and the importance of ensuring that information is actually openly shared. There are a number of particular uses of copyrighted information on the Crown side that need to be understood in their full context.

[Brian Masse, NDP, Windsor West, ON]

Is there a country you can think of that has a regime similar to ours? Can you give us an example of another country?

[Mark Schaan]

I'm not sufficiently familiar, as this hearing today is on the privacy bill, with the full international examples of Crown copyright.

[Brian Masse, NDP, Windsor West, ON]

I appreciate that, but it goes back to the importance of why information is deemed valuable. At this time, we still don't have any comparables.

I'll leave it there, my point being that I find it highly ironic that the government values its information manufactured through public expenses—which would be very beneficial to businesses and academic research—but, because it has control of that information, is not releasing it. Even the former parliamentary secretary for the Liberals in this position, the former solicitor general, was much more open to and was pro the reform of Crown copyright, but we know what happened with that situation.

Thank you, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Masse.

I have MP Van Bynen and then MP Turnbull.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Thank you, Mr. Chair.

It seems to me that the concern here is around privacy of information and the sensitivity of information.

Mr. Schaan, could you just clarify for me what types of protections contained in this legislation address the privacy of information?

[Mark Schaan]

There are a number of provisions we have yet to get to in the CPPA that heighten the level of privacy protection for all personal information collected, used and disclosed by corporate entities in the Canadian context. They include requirements for express consent in a number of areas, as well as limitations on when and how other forms of consent can be relied upon. The CPPA also puts in place a very significant enforcement regime over the uses of both those exceptions, as well as the privacy protection programs that need to be in place. For instance, there's the scrutiny of the security measures that a company must put in place to ensure they're not exposed to breaches or vulnerabilities. There's the enforcement of exceptions. Where an exception to consent, if it's relied upon, is found by the Privacy Commissioner to not have been reasonable, it's moved into an unlawful usage of personal information, which means that it's subject to the most significant fines under the administrative monetary penalties regime.

It's a very robust overall approach to the treatment of personal information, of which sensitive information is a subset that has a heightened level of privacy protections. However, the one that's the most important for this conversation is express consent.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

You mentioned earlier that certain obligations are required to maintain privacy. Can you expand on that, please, and on what the implications are in relation to what's being discussed? Specifically, I'm concerned about the differentiation between “sensitive” and “private”, but more importantly, what kinds of obligations are there to maintain the privacy of the consumer and what's the Privacy Commissioner's role in ensuring that's being done?

[Mark Schaan]

The entire regime is overseen by the Privacy Commissioner, who has considerable capacity, such as the power to make orders and recommend AMPs and the ability to enter into consent agreements to modify the behaviour of those who potentially violate the privacy of Canadians. All of this is interpreted within the broad category of a fundamental right to privacy, which was inserted in the preamble and at the outset of the bill.

The personal information use cases that we've talked about today would be governed by strict obligations for the use of personal information, notwithstanding that it's not sensitive. A company would need to be plain-language clear at the point of collection about what the uses of the information were and what the individual could likely expect for the ongoing transfer of that information. They'd need to have a privacy program in place that would include the safety and security of the information in their disclosures.

Those obligations would pass on to a disclosed entity. If a disclosed entity is a payment processor in this particular use case, notwithstanding the fact that this doesn't obviate the accountability of the original collector, they are required to continue to ensure the trust and security of the information in their possession, notwithstanding that it was transferred to them without express consent.

Each step in that value chain is still governed by an overall approach that ensures that the continued privacy of Canadians remains fundamental in the overall transaction and in the collection, use and disclosure of information.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

You mentioned earlier that by stipulating these—

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Van Bynen. I'm sorry, but we'll get back to you when we come back to Bill C-27. We've reached the end of our meeting.

I appreciate, members, your co-operation during this meeting.

Thank you, everyone.

I want to thank the witnesses.

Have a good day.

The meeting is adjourned.