Evidence of meeting #90 for Industry, Science and Technology in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was office.
A recording is available from Parliament.
4:35 p.m.
Conservative
Bernard Généreux Conservative Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC
Like us, you haven't seen the final text of the amendments the minister refers to in his letter, but it's paramount that you share your views with the committee throughout our study of the bill.
Do you plan to do that?
October 19th, 2023 / 4:35 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
What I can tell you is that I saw the proposals in the letter, but at the end of the day, I certainly have to see the actual text of the amendments to know where things stand.
Nevertheless, I can give you my views on what isn't in the letter.
The minister mentioned four issues on which he was prepared to move forward. I talked about the privacy right, which, as it's been described thus far, certainly seems to be more in line with my recommendation. That's also true for the protection of children's privacy, but we'll have to see the actual amendment. I have less information about the voluntary agreements, so I can't really say everything is satisfactory, since I haven't seen all the details. Lastly, he addressed my recommendation on co‑operation between regulators.
Earlier, we talked about the Federal Trade Commission, or FTC, in the U.S. Under the bill, my office can work with the FTC on joint investigations—as we've done in the past—but we can't do the same with the Competition Bureau of Canada. It seems counterintuitive to me that I can co‑operate more with other countries than with my own. That's something that will have to be resolved given the growing overlap between privacy rights, human rights, competition rights and copyright. We see that in the AI world, but elsewhere as well. Working together can be advantageous for everyone, Canadians and industry.
I did put forward eight other recommendations that the minister did not say he agreed with. I want to list them right now, since there's nothing on the table about—
4:40 p.m.
Conservative
Bernard Généreux Conservative Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC
Allow me to interrupt.
Among the eight recommendations that have clearly not been taken up by the minister so far, which are fundamental and should find their way into Bill C‑27?
4:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Of my 15 recommendations, it would certainly be the sixth, which deals with privacy impact assessments. This is fundamental, because without it, we won't be assessing the privacy risks posed by artificial intelligence, even though we know they're significant. So that's the first recommendation I'd stress.
4:40 p.m.
Conservative
Bernard Généreux Conservative Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC
What risks are you talking about exactly? Are you talking about the risks associated with corporate data collection?
4:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I'm talking about all the privacy risks associated with data collection, use, retention, safeguarding, purposes, disclosure for purposes a reasonable person would consider acceptable, etc.
This must be taken into account in the context of artificial intelligence and an obligation must be provided for. The obligation to have a privacy management program already exists, but it needs to be more targeted. I liken it to the tests that are carried out before an airplane flight. You have to check the risks to privacy and the methods for managing those risks. It's very important.
The lack of monetary fines in cases where personal data is used for unacceptable purposes is also a shortcoming of the bill. This needs to be added.
You already have my list of 15 recommendations. I am therefore sharing with you those that have not been adopted by the minister.
4:40 p.m.
Liberal
4:40 p.m.
Liberal
Iqwinder Gaheer Liberal Mississauga—Malton, ON
That's great. Thank you, Chair, and thank you, Commissioner.
Canada's privacy legislation is 20 years old. During that time, we had Facebook come about. We had the iPhone released. We had social media become prevalent. It's actually very alarming that we haven't updated it in 20 years.
I come from the generation that was very young when, for example, Facebook was released. I think individuals—I'm not in that category, by the way; I was very careful—posted information that they perhaps did not want to, especially looking at it in hindsight.
We know that in the new legislation, there's an expansion of the personal information that individuals can request be disposed of. What do current laws cover, and how does the bill strengthen the ability of Canadians to have their personal information disposed of?
4:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
On that point, one of the issues in the bill is that it allows a greater right to disposal of information, so that's a positive thing. In particular, vis-à-vis children, it creates a stronger right to disposal. There's the example you gave of posting something when you're a minor, and then, when you're an adult, wanting to take it down. There's stronger protection there.
One of the things I'm recommending, in fact, is making it even stronger, even for adults, because right now there's an exception in the bill that says the organization does not need to dispose of your information if it's keeping it in accordance with the retention policy and it's informed you of that retention policy. That doesn't apply to minors, but it applies to adults. We recommend that that be removed as an exception, because we feel it is a broad exception. If the organization tells you what its retention policy is, you don't have the right to the disposal of that information.
We haven't seen that type of condition in international models. I feel we should provide a greater right to disposal in this section.
4:40 p.m.
Liberal
Iqwinder Gaheer Liberal Mississauga—Malton, ON
How would the process work? I know what websites I use, for example, but perhaps I don't remember all of them. How would an individual who wants to dispose of some of that information even find out where their information is being stored? What if the company is defunct now?
4:40 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
There are obligations for organizations to proactively prepare privacy management programs and to share some information about them. If it's information online, the idea is that you would see it online, but there are obligations for organizations to make it as useful.... Obviously, if organizations see information about themselves and they have challenges finding where it is, they can reach out to my office and we can assist in seeing what's going on there.
That touches upon a point of transparency and making sure Canadians can understand what's going on, because not everyone is an expert in technology, yet we are living lives that are very much digital. Understanding what's going on, certainly with respect to AI, the notion of algorithmic decision-makers and....
We hear a lot of comments about that. We have our surveys of Canadians, and we see that Canadians are concerned about the protection of their privacy. I think part of the solution to that is communication, making sure that Canadians can understand what's going on, what the institutions are that protect them, what their rights are and what is being done with their information. Sometimes, we can have an impression that's worse than reality.
That's why I'm recommending that there be strong transparency. In the bill right now, organizations that make AI decisions about Canadians—if they have a significant impact—have to proactively explain the general processes of those decisions. They also have to answer questions if there's a request, but that's only if that decision has a significant impact on Canadians.
My recommendation is that if a Canadian asks for an explanation, they should receive the explanation, even if it doesn't have a significant impact on them. It still has an impact on them. They want to know what's going on. I think it's beneficial for Canadians to understand what's being done with their data.
4:45 p.m.
Liberal
Iqwinder Gaheer Liberal Mississauga—Malton, ON
That's great. Thank you.
My colleague, Mr. Turnbull, asked about the example of Tim Hortons, and how the app was tracking the data.
The example I want to reference happens all the time. I am in a room, and there might be a device in the room, and I am talking about a particular product with my friend. I'll go into the other room, where my computer is, and I'll go online and see an ad for that very product. It could be a very particular product at that time, so you wouldn't normally expect to see that ad appear.
What is this bill doing to protect Canadians from that? What penalties can companies face if they don't comply with these new laws?
4:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
That raises the whole issue of consenting to being tracked, and privacy by default. What are organizations doing, and what are they telling you those default provisions are? In my view, the default provisions should be privacy protective, certainly if you're dealing with minors. It's about making sure you have these protections in place, that you understand what they are, and that you can ask.... Again, it's that transparency. You gave a perfect example. You see this, and you want to know why you are receiving this. It's being able to get that explanation and to understand whether you have consented to this and how your consent is interpreted.
This is what we've seen in some of the investigations that my office has done, whether it's Tim Hortons, Home Depot or, more recently, Canada Post. It is the sense that Canadians don't know what's being done with their information, and sometimes there is a disconnect between what organizations believe Canadians agree to and understand, and what actually is going on.
That transparency that the explanation.... Again, it's the privacy impact assessments and consulting my office to make sure you develop these reflexes. Privacy is a priority. It's not something you do after the fact. You're designing and thinking. You need to think about innovation, absolutely, but they're not mutually exclusive.
When I was appointed, I said that privacy is a fundamental right, but it's also not an obstacle to innovation. It's not an obstacle to the public interest. We can have both. Canadians deserve to have both, and tools like this will help organizations get it right. My office will be there to help organizations get it right, particularly small and medium enterprises.
4:45 p.m.
Conservative
Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC
Thank you, Mr. Chair, and thank you to the witnesses.
The last time I spoke to you, I brought forward a motion to get some of the answers as to why the government presented a broken bill. I think we got some results, and we're seeing some productivity now: Some of that information has been provided, and I can see that it's been very useful to you as well, Mr. Dufresne, so that's positive.
Some of my colleagues already touched upon the changes the minister has mentioned regarding section 12 of the proposed act. I want to dig into that really quickly.
However, first off, as I understand it now, when the current form of the bill, which is broken, is amended, we're going to see a children's right to privacy defined in the bill. Is that correct?
4:45 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Again, we'll wait and see what's being done, but what is proposed is to recognize in the preamble the importance of protecting children's privacy, so that will be there.
As well, the proposal is in section 12—
4:50 p.m.
Conservative
Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC
We already know that it's going to be included in the preamble, but will a fundamental right to privacy based on the information we've been provided with be defined in the text of the proposed act?
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
What I understand the minister to propose, based on his letter, is to amend the preamble to recognize privacy as a fundamental right, and to amend section 5 of the proposed act to recognize that privacy is a fundamental right in the purpose provision of the act, which is stronger than the preamble—
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
In terms of children, it's a similar approach, as I understand it, recognizing the importance of protecting the privacy of children in the preamble, but also in the proposed section 12, which is the “Appropriate Purposes” provision.
4:50 p.m.
Conservative
Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC
Can we properly amend the proposed section 12 of the act without having a clear definition of what a “minor” is, and what constitutes a “child” in this legislation as well? Do we need those provisions to be amended before we can look properly at making changes to section 12?
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The issue of the definition of a “minor”—and I know the question was asked in earlier meetings—is something that could be included in an amendment, perhaps with reference to the provisions—
4:50 p.m.
Conservative
Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC
I'm sorry, I have only a little time.
Would it be your recommendation that we define “minor” in this legislation, to provide greater certainty for the protection of children when it comes to their privacy rights?
4:50 p.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I would support that, to remove uncertainty. If you're not saying anything, the presumption to me would be that you use provincial ages of majority, but I don't see a harm in specifying it here.
