Industry Committee on Sept. 26th, 2023

[The Chair, Liberal, Joël Lightbound]

This meeting is called to order.

Welcome to meeting No. 86 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in hybrid format, pursuant to the Standing Orders.

Pursuant to the order of reference of Monday, April 24, 2023, the committee is commencing consideration of Bill C‑27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

I'd like to welcome our witnesses today. With us are the Hon. François‑Philippe Champagne, Minister of Innovation, Science and Industry, accompanied by a regular at this committee, Mark Schaan, Senior Assistant Deputy Minister, Strategy and Innovation Policy Sector, and Samir Chhabra, Director General, Marketplace Framework Policy Branch.

I think I speak for all committee members in saying that we have been eagerly awaiting this study and are very keen to begin it.

Without further delay, I invite you to proceed with your opening remarks, Mr. Minister.

[François-Philippe Champagne, Liberal, Minister of Innovation]

Thank you, Mr. Chair.

I am always very pleased to appear before the committee. I have a great deal of respect for my colleagues and for all the work that has been done. I think you will be pleasantly surprised today because I have good news for committee members.

I would say to my colleagues that we listened to you. I'm here to propose a number of amendment, which you will see will allow us to move forward very quickly on that, because we have listened to you.

I would say that, as we start AI, data and privacy for me are kind of a whole. They are so interconnected. We are trying to lead the world in terms of what we're going to be doing.

[An hon. member]

[Inaudible—Editor]

[Voices]

Oh, oh!

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Do you want me to stop?

[The Chair, Liberal, Joël Lightbound]

Hold on one second, Mr. Minister.

Okay. He's been muted by our friends over here.

Mr. Minister, you can resume.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I'll say that Brendan has tried to bigfoot me on that.

Brendan, it's good to see you, sir.

Dear colleagues, I have the honour to present Bill C‑27 to your committee today. I want to stress the importance and urgency of this bill. Let us recall that our laws were last updated more than 20 years ago. The last time we did the necessary work for Canadians was more than 20 years ago, before Facebook, Twitter and iPhones even existed. So you can imagine how important it is to act quickly and decisively.

In my view, we cannot miss out on the opportunity to modernize privacy laws for Canadians, who are waiting for concrete action. I think the bill meets their expectations.

Moreover, technology is evolving quickly, as you know. Since we last met, Canadians have witnessed the advent of various new technologies, such as ChatGPT. We are all grappling with the tremendous power of artificial intelligence, which offers great possibilities, as well as risks, to be honest.

Bill C-27 is Canada's much-needed response to these pressing challenges. It will build a stronger framework for privacy protection, and it will introduce a new framework for the regulation of artificial intelligence, putting into practice the principles of Canada's digital charter.

Bill C‑27 will introduce key reforms to better align our privacy bill with international best practices, including the European Union's general data protection regulation. A large part of that is expanding the powers of the office of the Privacy Commissioner of Canada so it can make orders, require businesses to provide information and recommend some of the strongest sanctions in G7 countries.

It is also urgent to provide guardrails around artificial intelligence technology. AI is advancing at a rapid pace and is quickly being adopted across Canada's economy.

I'm happy to say that tomorrow there's a huge summit that I'll be attending in Montreal. It's the All In summit with Yoshua Bengio. Thousands of people are coming from around the world to listen to Canada and to see what we can do together.

Bill C-27 proposes robust guardrails for the responsible development, deployment and use of AI systems. Part 3 of the bill, the AI and data act, is designed to protect Canadians from the risks associated with AI, to encourage trustworthy innovation and to solidify Canada's place as a global leader in responsible AI.

Canada is one of the first jurisdictions in the world to propose a legal framework for AI. Passing AIDA will make Canada's AI synonymous with safe AI around the world. I can tell you that our Japanese, European Union and American colleagues have all been in touch. They see Canada as taking a leadership role in these regards.

First of all, let me tell you what the future artificial intelligence and data act will not do: it will not duplicate what existing legislation already effectively covers. Nor will it regulate the many creative and useful applications of artificial intelligence that do nor require government intervention, such as checking grammar or deciding what music or movie we might enjoy.

Certain artificial intelligence systems, such as those that determine whether a person gets a loan or a job they want, can nonetheless have real consequences for Canadians families and consumers. In my view, what we are proposing will allow for responsible innovation, along with a certain number of rules to protect Canadians.

There are also new AI technologies, like ChatGPT. I don't need to tell you—you've all seen it in recent months and even yesterday—that they're new innovations and we don't really know everything they're capable of. You don't need to take it from me, but I would advise you to read the letter that was signed by Yoshua Bengio, and hundreds of people from around the world, warning us that we need to take action.

We know that they can do a lot of useful work for us, but they can also be used to spread fake images or videos on a scale that we have never seen before. Our laws are not currently set up to deal with these kinds of risks, but AIDA will fill this gap.

I know all parties care about these issues, and I know this committee can play a vital role in protecting Canadians. Let's ensure that the technology is fair for all Canadians and that we have trust again.

In short, our bill has solid foundations. I should note, however, that I have also listened to suggestions to improve it, as we must always do.

My office and department have had more than 300 meetings with academics, businesses and members of civil society regarding his bill. We have also heard important contributions from the committee and our fellow parliamentarians. I also spoke directly with the Privacy Commissioner and listened to his recommendations. Not only did we consult and listen to him, we also followed through with amendments based on his requests. I think my colleagues will be pleased to see the amendments we are proposing.

Throughout the last 18 months, we have also taken action to advance the foundation for privacy in Canada, including by increasing the funding of the Privacy Commissioner by nearly $20 million. We have also prepared a companion document for the AI and data act to shed more light on the responsible AI framework.

Now, I want to put on the table specifically what our government will propose to improve the bill. These are the amendments that we are proposing to the bill, and I would encourage my colleagues to pay attention, particularly to that part of what I will be saying.

First, we will propose an amendment to recognize a fundamental right to privacy for Canadians. I think this is a big win for Canada. This is a major step forward, and I give credit to my colleagues, to this committee—you said that to me before—and to stakeholders across the country for enabling us to move forward on this.

The bill already recognizes important new privacy rights, including the requirement for clear language from companies to improve consent, and the right to data mobility and the right to request that data be deleted.

Specifically, we want to assure you that Canadians can be confident that their right to privacy will be respected. So I encourage all my colleagues to vote for the amendment. Let us all guarantee Canadians' fundamental right to privacy.

I think this is a major step forward, and I think Canada will be seen as a world leader in doing it.

Next, you have heard me talk about children. I think we need to take care of our children, especially online. I think there is broad consensus on this across the country.

I have two young stepdaughters and this is important to me, as it is to all parents in Canada. That is why our government will put forward amendments to recognize and strengthen the protection of children's right to privacy. In my opinion, we still have to do more to protect them online, and that is certainly what we intend to do.

Lastly, I want to highlight that, while the bill significantly strengthens the Privacy Commissioner's ability to issue orders for compliance as well as to recommend some of the highest penalties in the world, I understand that it's important to enable him to pursue justice more quickly. That's why we will propose amendments to give the commissioner more flexibility to reach compliance agreements with companies that are non-compliant with privacy law, allowing for quick resolution of matters without implicating the tribunal or the courts. That's also something I've heard from colleagues around this table.

Next, we will work together on the first artificial intelligence bill put forward in Canada. When I introduced the bill in June 2022, we deliberately designed a flexible bill, knowing that artificial intelligence is evolving very quickly. It must absolutely provide the basis for flexible regulations in the future that will enable businesses to continue to innovate and, obviously, to protect Canadians.

Our government intends to put forward key amendments to provide more structure, detail and clarity in the part pertaining to artificial intelligence, while still retaining flexibility. This is what has made it possible for the Personal Information Protection and Electronic Documents Act, which is still in force in Canada, to evolve over the decades. Flexibility is key. This is the Canadian model that has provided for success thus far. The good news is that our bill has been designed to be flexible so that new artificial intelligence categories can be added through amendments.

First, colleagues, let me say that I've heard you. Let me remind you that our bill focuses on only high-impact AI systems. We will propose an amendment to define classes of systems that would typically be considered high impact—for example, AI systems that make important decisions about loans or employment.

Second, we will introduce specific and distinct obligations for general-purpose AI systems like ChatGPT. I think it's very timely that we do that. These are systems that, for example, are available for public use, can interpret a wide variety of commands, and generate text, picture and audio.

Third, I've heard that a clearer differentiation of the AI value chain—that is, a person who develops AI systems versus one who manages and deploys AI systems in their business—is necessary to ensure that companies have a clear set of obligations.

Fourth, we will strengthen and clarify the role of the proposed AI and data commissioner, including by enabling them to share information and co-operate with other regulators—for example, the Privacy Commissioner or the competition commissioner.

The fifth one we'll be proposing in terms of amendments that I wish to highlight is to align with the EU AI Act as well as other advanced economies of the OECD by making targeted amendments to key definitions and clarifying requirements. This change will specifically ensure that Canadian AI companies are interoperable with other jurisdictions and that our companies have access to international markets. It is fundamental to the world we live in to be able to be interoperable.

In conclusion, Mr. Chair, I hope these significant proposed amendments are as compelling for you as they are for me. We really put our best foot forward to get the support of the committee to provide a piece of legislation that Canadians can be proud of.

I am optimistic about Canada's potential in the global digital economy. I am keen to work with you to enact responsible privacy and artificial intelligence legislation, because I think Canada can serve as an example to the world. People around the world are watching Canada to see the kind of framework we will adopt to help our businesses innovate responsibly, while protecting the interests of Canadians.

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Minister. Thank you also for not going over your speaking time. That makes my job easier.

With that, Mr. Perkins has the floor for six minutes to get things rolling.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair.

Thank you, Minister. I have a couple of procedural questions to ask at the beginning, if I could.

First, I appreciate that you're going to table those amendments. Hopefully, you will table them here at committee today so that during the witness discussion coming up in the next few meetings we can discuss those amendments and whether they achieve the necessary goals.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I'm not the master of procedure, Mr. Perkins, but I will defer to perhaps the chair and those who manage the procedure. I just don't know procedurally how this is going to be done, but certainly that's our intention. That's why I wanted to explain them to you, so that they can be taken into consideration.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

You can table that document anytime.

Second, given that it was almost 15 minutes for your presentation, I hope you allow us to spend an hour questioning you on this very important bill.

Third, we have organized these committee meetings primarily, for the next little while, on the privacy—parts 1 and 2—sections of the bill. We will be coming back to the AIDA part of the bill further on. I would hope you would be willing to come again to discuss the AIDA part at the beginning of that study, as our next number of meetings are really going to be focused on privacy. I hope you will entertain that invitation.

I'd like to start off on the privacy side, since that will be the focus of my questions today. Do you believe that it is primarily the paramount responsibility of government to ensure that the protection of the privacy of an individual and their data has primacy over the needs of businesses to use that data?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I think it's reflected in the fact that we're going to be qualifying privacy as a fundamental right for Canadians. I think this is a major step forward. You'll see in the law that not only would it do that, but it would also give power for people to at least have more control over their data.

I think Canadians are frustrated by the fact today that, for example, they can't transfer their data from one institution to another. I think it's fair for people to have more power over their data, to transfer it, to manage it and to be able to tell companies what they expect them to do with their data, including, for example, having what we call very open consent. No bundled consent will be permitted. That needs to be in plain English. I think these are really the types of things that Canadians expect from us.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I appreciate that, Minister, but I don't think the bill does that.

I will draw your attention, first of all, to the fact that it does require expressed consent. It also requires expressed consent for new purposes. However, proposed subsection 15(7) says that implied consent is okay. Then proposed subsections 18(2) and 18(3) are issues, because proposed subsection 18(2) contains a list of activities that are exempt from expressed consent. Most disturbingly, proposed subsection 18(3) says that the legitimate interests of a business, in its decision-making process, to use your data for things that you did not give them permission for, even if it harms the individual, is okay. It strikes me that the balance in this act in particular, because of proposed subsection 18(3), is in favour of business over the right of the individual to protect their privacy.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Let me comment on the legitimate interest. A better example would be if you were to order something online and the company needed to give your address, for example, to the delivery service. I think this was to deal with these kinds of situations that I think would be kind of common sense. Canadians expect that if you are ordering something and you want it to be delivered or you click for it to be delivered, then your address is going to be there.

I would just point out to you on that, sir, that if someone were to overstep legitimate interests, if you look at the fines that are proposed under the law, those could go up to imprisonment. This is very serious business. On one hand, we appreciate that there could be a legitimate interest. On the other hand, we're going to be looking at that very carefully. That's why we have increased the power of the Privacy Commissioner to act and to make orders so that this is proportionate. The intent of the bill—and perhaps you have some suggestions—was to allow for, obviously, the circumstances in which you have almost implied consent. When you buy something online, you want it to be delivered. Obviously, your address will have to be transferred.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I think that's a poor case, because when you sign up and agree for eBay or for any of these things, you already agree to have the things delivered. That is one of the boxes you check when you sign up for the app and become part of it.

The issue is that you have provided a situation in which essentially you have self-regulation. The private sector self-regulates on its own initiative about what it thinks is a legitimate interest. You've given them a legal defence to say, “We believe that it is in our legitimate interest to use data in this way, even though it harms the individual.”

On that last phrase, basically directly from the bill, it is very curious how the department and you as minister and the government would think it would be okay to use data to harm the individual and give the legal authority to a private company to do that.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

It's equally surprising, coming from a Conservative member, that you would not allow businesses to have a legitimate interest in sharing that information for valid business purposes. You have to understand that under the bill you have the Privacy Commissioner with very significant fines, up to imprisonment and—

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Why does an individual have to apply to the Privacy Commissioner to protect their privacy? Is that what you're saying?

[The Chair, Liberal, Joël Lightbound]

Mr. Perkins, we'll let the minister respond to that.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I'm trying to answer.

I disagree with you. I think the legitimate interest is necessary in some cases. I gave you an example, which is very clear.

I'm saying that we have a lot of work framed around that, and if anyone were to abuse that or take measures that would go against the intent of the bill, they'd be subject to criminal penalties. This is very serious business.

The fundamental right that we say we recognize is the privacy of Canadians. This is a very limited exception. This is very limited in its scope, and it's going to be supervised by the Privacy Commissioner.

I'd be happy to hear from you, sir, if you have any other ways you would suggest that we address that. The intention is to protect the consumers, but at the same time to allow legitimate business to happen. There are a number of examples people gave us in testimony. If you want to buy a watch and you want to measure your pulse, you're not going to consent every time you measure it.

There are a number of things we need to allow for businesses to function and for small and medium-sized businesses to be able to operate. However, at the same time, I can assure you that my resolve and the resolve of this team are that there would be significant guardrails around that and that we would protect the interests of Canadians.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Minister.

I will now turn it over to Ms. Lapointe.

[Viviane LaPointe, Liberal, Sudbury, ON]

Thank you, Mr. Chair.

Welcome, Mr. Minister.

It has been more than 20 years since the last update of act that will be replaced by the future consumer privacy protection act, which was before the advent of the iPhone and Facebook.

I think we need to strike a balance in amending the act. The bill must reassure Canadians that their data and privacy are protected, while also encouraging responsible innovation to support of a strong economy. Given the scope of the bill, I think consultations are needed.

In your remarks, you said that you had heard from stakeholders and that you and your department had listened to the concerns of hundreds of individuals and organizations. Can you tell us more about those conversations which led to the amendments you are proposing?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Thank you, Ms. Lapointe.

I think the bill shows that we have listened to Canadians and parliamentarians, as we have done for other legislation. I gather there were more than 300 meetings or consultations with individuals who provided input into the process. Based on what we heard, we have proposed many amendments. People asked us—

[Brian Masse, NDP, Windsor West, ON]

I have a point of order, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

You have the floor, Mr. Masse.

[Brian Masse, NDP, Windsor West, ON]

Thank you.

I'm sorry, Mr. Minister. I haven't seen amendments. We have some ideas that have been presented, which I'm really encouraged by, but if there are actual drafted legal amendments, I would like to have them in front of me if they are also being used by the minister and my colleagues right now.

I don't have those amendments. Amendments are legal context that go to the legislation—or are we at ideas right now? I want to get that clarification, because it's really important. If we have amendments, I would like them to be tabled in front of us. That's all.