Industry Committee on Oct. 24th, 2023

[Daniel Therrien]

Thank you for that.

I think there is a risk of the OPC being undermined—in the following way, at least. The federal office works—and has to, because data flows internationally and within provinces in Canada—with colleagues in Canada and internationally.

As I explained in my earlier answer, there is no other jurisdiction with the type of tribunal that is proposed federally under the CPPA. That would put the OPC in a situation such that when it conducts joint investigations with colleagues across Canada or internationally, its position would be effective later than that of its colleagues. The OPC would then have to wait for the blessing of the tribunal for an order to be upheld or for a penalty to be imposed. That's one thing.

However, even more importantly, Canadian citizens would have to wait longer than others in other jurisdictions, including in Quebec. The CAI in Quebec has order-making and fine-imposing powers. There's a difference in the rapidity with which Canadian citizens would have protection compared to other jurisdictions.

[Brian Masse, NDP, Windsor West, ON]

Thank you.

Thank you, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Vis, you have the floor for five minutes.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you to all of the colleagues for your expertise on this very important bill.

I'm very concerned about children. If you watched my testimony in the last meeting, I'm very concerned about how a child can consent to provide any sort of data that could be used by a business interest.

This is an open-ended question to anyone who wants to respond. Under “Socially beneficial purposes”, how do we define a socially beneficial purpose? It's in the act, in proposed section 39.

[Daniel Therrien]

I think you're talking about the context of children.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Yes.

[Daniel Therrien]

If we look at proposed section 39 and the definition of socially beneficial purposes, one of these purposes would be for disclosure to “a health care institution, post-secondary educational institution or public library”.

Certainly, health care—

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you.

I'm most concerned about proposed paragraph 39(1)(iv), which is “any other prescribed entity”. What's a prescribed entity in the context of a socially beneficial purpose as it could relate to de-anonymized data from a child?

[Daniel Therrien]

That would be a good question for the government, because there has been no regulation.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Okay. That answers my question. We don't know.

What I hear from you today is.... We're talking about consent as well. My concern is the consent of a child. We don't have a definitive age for a minor in this legislation.

Do any of you want to comment on whether we need to define the age of a child, and whether there should be different tiers of consent related to a minor in this legislation?

Again, it all goes back to my kid on an iPad, when I'm sitting on an airplane or driving somewhere. He's in the back and he's clicking on certain things. I don't know where that information's going, and I get scared about that. I'm fearful as a parent. I know every committee member around here has similar concerns.

How can we address that in this legislation to make sure that children are protected?

[David Fraser]

I'm happy to weigh in on this subject with some thoughts, because it's something I have turned my mind to.

In the legislation, it refers to minors, and minors are defined by provincial law. Minors are 18 in Alberta and Quebec and 19 everywhere else, so there's a different line.

One of the challenges that I think exist with children and privacy is that there really are no easily drawn bright lines that say that under this particular magic age, you are completely under the control of your parents and you have no ability to consent in a valid, true way—

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Exactly.

[David Fraser]

—or over this age, you're magically endowed with those particular powers.

As a parent of three young men now, I know that you can tell that at different ages there are different levels of maturity, and it's difficult to determine. The way that it works in practice is difficult to operationalize. You have to take into account the individual characteristics of the young person, and whether they are able to....

[David Fraser]

Mr. Therrien talked about the requirements for knowledgeable, informed consent. Is the child capable of understanding what it is they're consenting to and what the consequences are? It's actually tied pretty similarly to consent to medical treatment, so it's not completely isolated in its own little world.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

I'm going to pass it over to Mr. Kardash. That was a great point.

[Adam Kardash]

The statute expressly sets out that minors' data is sensitive information. It's expressly contemplated in there.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Yes.

[Adam Kardash]

In doing so, what ends up happening is that many of the other provisions in the statute have to look at the treatment of sensitive information. For instance, when you're dealing with safeguarding, safeguarding is implemented appropriately to the sensitivity.

When you consider different requirements—

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you.

Would the provisions related to sensitive information outlined in proposed section 12 override, say, proposed section 38 of the consumer privacy protection act as it relates to the use of information for literary purposes, for example, in the context of children?

[Adam Kardash]

Once you take data, and there's more sensitivity to it, there will be a holistic set of provisions in the act that will be applied. Even currently, the case right now with subsection 5(3) of the Personal Information Protection and Electronic Documents Act—and it's amended now and is even more involved—is that organizations are only allowed to collect, use and disclose personal information that a reasonable person would consider appropriate. That might seem broad, but that's privacy protective in nature because the sensitivity of the data will impact your statutory analysis of what a reasonable person would consider appropriate in the circumstances.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Do we need to define a “child” in this legislation?

[Adam Kardash]

I don't think so. Minors under the age of 13 wouldn't have the capacity to consent. That would be protected. Data would be protected otherwise.

There is an idea about specifying “under the age of 18”. It works right now. I don't think you have to do it.

The key thing in the statute, which goes to the heart of your concern.... I think the concern of everyone in the room, certainly myself, is that the protection of minors is very important, but there's express contemplation already in the statutory framework that this is sensitive data, and that has a flow-through impact and would be treated well, certainly from a statutory interpretation perspective.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Mr. Therrien, do you believe we need to do more to amend proposed section12 to be 100% sure that the rights of children, when we define a fundamental right to privacy, are given the attention they deserve?

[Daniel Therrien]

Minister Champagne has tabled amendments to the preamble and to proposed section 12 that would provide greater protection to children. Again, that is a step in the right direction, but I'm concerned that the terminology used may be too limitative, and that is why I have recommended in the text I provided to you that proposed section 12 be amended to refer to the concept of “the best interest of the child”. That concept has to be interpreted contextually. It is not limited.... Again, the language proposed is a step in the right direction, but it may be too limitative, and I think the concept of “the best interest of the child” would provide fuller protection.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you. That's very helpful.