Debates of Oct. 22nd, 2013

Personal Information Protection and Electronic Documents Act

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

moved that Bill C-475, An Act to amend the Personal Information Protection and Electronic Documents Act (order-making power), be read the second time and referred to a committee.

Mr. Speaker, I am having a déjà vu. I feel like I already delivered a speech for the first hour of debate.

I am very pleased to have the opportunity to reopen the debate on an issue that is extremely important for Canadians and our digital industry and that is the issue of protecting personal information.

My Bill C-475 seeks to modernize the Personal Information Protection and Electronic Documents Act, which has not been updated since the arrival of the first generation of iPod. That is an eternity in a modern and ever-changing society like ours. Several million Canadians have never known a world without smart phones. This legislation that governs crucial aspects of our lives does not respond to the challenges of our time.

As I have already mentioned, we use the Internet every day. We use the Web to socialize, share our ideas with others, work, contribute to the Canadian and global economies, participate in democracy and educate ourselves. The Internet is indispensable to our personal, academic and professional development.

The Internet is central to the lives of both children and adults, who use it for entertainment and as a work tool. However, all of our web activities create a digital information footprint, which makes it even more clear that we need to protect our information.

I would like to share some facts that show how big a role the Internet plays in our lives. Quebeckers and Canadians spend about 45 hours a week online More than 70% of Canadians use it daily. Our citizens have more than 18 million Facebook accounts. The digital economy is a sector that is growing exponentially.

Our democracy is becoming increasingly digitized. One example is petitions, which allow our citizens to speak up and become involved in regional, national and international issues. Canada as a country is firmly plugged in.

We are increasingly managing our lives digitally. Because of this major shift, new rules are needed. These rules must take into account the new risks associated with this shift.

Since the beginning of this year, we have seen what a huge impact the loss of personal information has on our communities, for all citizens, regardless of their vulnerability or level of digital literacy. Millions of Canadians are affected by the loss of information, and this is happening more frequently every year, according to the Privacy Commissioner.

A study published in 2011 showed that every publicly traded Canadian company experiences an average of 18 privacy breaches a year. That is a lot.

Two recent reports revealed that 7 million Canadians have lost $3 billion as a result of cybercrimes. The most common crimes are identity theft and privacy and security breaches. Companies should protect against such breaches.

These reports said that 94% of companies say that they have never experienced a privacy breach. These numbers frighten me. In addition, the more information that is shared on the Internet and our smart phones, the more chances there are that our information could be lost or stolen. This only encourages crime groups in the very lucrative phishing market that have managed to scam thousands of Canadians and steal $76 million, last year alone, through 156 million emails sent from all over the world.

This is an international problem and we have to address it immediately. Unfortunately, the current legislation to protect privacy and Canadians' personal information has not been updated to address these risks and put in place appropriate measures for our society.

The current legislation does not provide for Canadians to be notified of a breach of their personal information. In fact, organizations are not required to notify them, regardless of the seriousness of the breach. This means that they cannot take appropriate action to protect their identity or their credit in order to reduce any harm they might suffer.

Compliance with Canadian legislation governing the sharing of personal information is another major problem in Canada. In 2011, the Privacy Commissioner noted that a quarter of the most-visited websites in Canada do not comply with Canadian law; they disclose our data without our consent. What is much worse is that companies that choose to ignore our laws do not currently suffer any consequences.

For more than 10 years, Canadians have been waiting for a better regulatory framework, and they are rightly expecting results. It is in that spirit that I decided to draft Bill C-475.

I would like to quickly remind my colleagues of the two simple and effective mechanisms proposed by Bill C-475 to enhance the protection of Canadians' personal information.

First off, Bill C-475 requires that the Office of the Privacy Commissioner be notified by any organization having personal information under its control when there is a possible risk of harm to users. Experts in the commissioner's office will assess the seriousness of the situation against a criterion for harm that sets a high standard. They will recommend whether or not the organization should notify the users affected. This mechanism allows for an objective analysis of the risk and better management of the risk through an expectation of a high level of security, rather than a subjective analysis based on the interests of the organization, which may differ from the interests of users.

In addition, objective risk analysis will ensure that users are not bombarded with notifications of data breaches that do not affect them at all or present a minimal risk. Indeed, this framework will ensure that users are not bombarded with useless notifications. They will only be notified after a thorough risk assessment by the Office of the Privacy Commissioner. The process will empower Canadians to take steps to protect themselves much more quickly, in addition to reducing the harm done to them.

The second mechanism provided for in Bill C-475 is designed to give the Office of the Privacy Commissioner order-making power when an organization fails to obey the law.

The Federal Court would have legislated authority to penalize organizations that fail to carry out an order issued by the commissioner.

These mechanisms are straightforward and clarify the commissioner's powers. In short, the Office of the Commissioner will now have the power to enforce the law, which unfortunately is not now the case. All too often, the commissioner's recommendations are not being followed, and it is Canadians' privacy that is suffering.

This bill was drafted to address the concerns of Canadians, people in the digital industry, civil liberties organizations, Internet experts and specialists in the protection of privacy, some of whom we heard testify during the study conducted by the Standing Committee on Access to Information, Privacy and Ethics on social networks and privacy.

Bill C-475 is a direct response to requests from the community to adapt the law to suit our digital age by providing some flexibility for people in the industry and protecting the ombudsman's role of the Office of the Commissioner.

The bill therefore takes a very balanced approach, despite what members opposite said last May. On October 9, information and privacy commissioners and ombudspersons from Canada's federal, provincial and territorial governments met in Vancouver for their annual meeting. They voted in favour of a resolution calling for reforms to address a series of measures they are interested in looking at and supporting, including the key principles in my bill. These measures follow up on recommendations Commissioner Stoddart put forward last May with the aim of modernizing the Personal Information Protection and Electronic Documents Act in order to strengthen the authority to enforce the act, including the commissioner's ability to make orders and make it mandatory for organizations to report when information has been compromised.

The bill is also balanced with regard to companies, since clear roles and processes enable them to plan their policies and response. It will be clear for organizations that they are required to report a breach to the Office of the Commissioner, but they will not be responsible for deciding what the ultimate risk is. Companies that are law-abiding will no longer have to compete with companies that are not.

Finally, this bill makes it possible to bring our privacy protection legislation up to the same level as countries such as Germany, Great-Britain, Australia and France, as well as Canadian provinces such as Quebec and Alberta. Canada, as a world leader in technology, must implement international standards. A cross-Canada survey published in April by the Office of the Privacy Commissioner, found that 97% of Canadians would want to be notified if the personal information they had given to an organization were compromised. In addition, 80% of respondents would grant more powers to the Office of the Privacy Commissioner.

The principles defended by my bill have garnered support from all classes of stakeholders affected by these changes, including industry representatives, civil liberties organizations, academics specializing in all areas, consumer protection agencies and even by the Privacy Commissioner and the ombudsman for privacy and information.

This fall, the public consultations I conducted in my riding and the West confirmed the growing interest of Canadians in privacy issues and their support for my bill.

The Union des consommateurs, for example, has stated that:

[it] believes that the implementation of the principles proposed by the NDP, through their private member's bill amending the Personal Information Protection and Electronic Documents Act, constitutes a real advancement to better protect the privacy of consumers.

Michael Geist, the Canada research chair of Internet and e-commerce law at the University of Ottawa said the following:

Bill C-475 is a far better proposal ...Those provisions would do far to ensure a greater respect for Canadian privacy law and give Canadians the assurance of notifications in the event of security breaches.

A few years ago, my colleagues on the other side introduced a bill to modernize the Personal Information Protection and Electronic Documents Act. Therefore, I know they share my concerns about the privacy of Canadians.

Furthermore, in the Speech from the Throne last week, the Conservatives reiterated their willingness to defend the rights of consumers, and the protection of privacy is a crucial part of these rights.

However, Bill C-12 did not receive the serious consideration it needed in the House, and today its principles no longer reflect the reality of our current needs. Moreover, due to the prorogation of Parliament, Bill C-12 has died on the order paper.

My bill is the most up-to-date bill and the only one currently on the table.

I urge my colleagues across the way to reconsider their position on Bill C-475, not only because it meets the current needs of citizens and surveillance authorities, but also because, if we wait for the reintroduction and re-evaluation of an outdated bill, it will take months or even years. Canadians need to be protected now, and Bill C-475 will help restore their confidence in the companies with which they do business, as well as in our institutions.

Canada has a deplorable record on the international front when it comes to privacy, and the increasing costly attacks on our personal information demonstrate beyond a shadow of a doubt that we cannot afford to wait any longer; we must act now.

Canada's Privacy Commissioner, Jennifer Stoddart, said it best on October 9, 2013:

We live in a world where technologies are evolving at lightning speed and organizations are using our personal information in ways previously unimaginable—creating new risks for our privacy. Our laws need to keep up. Canadians expect and deserve modern, effective laws to protect their right to privacy.

By voting in favour of Bill C-475, my colleagues would be meeting Canadians' expectations. If the members of this House truly care about the privacy of their citizens, they have absolutely no reason to vote against my bill.

If the Conservatives take their commitment to consumers seriously, they must vote in favour of Bill C-475.

I would also like to reiterate that I am willing to work with all parties in order to ensure that Canadians have the protection they deserve in this digital age.

We must work together, as parliamentarians, to better protect the privacy rights of our citizens, our youth and seniors.

[Matthew Dubé, NDP, Chambly—Borduas, QC]

Mr. Speaker, my colleague mentioned déjà vu. Because of prorogation, she has to start that hour of debate over again. I would still like to congratulate her, as I was not here the first time around. I am happy to be able to second and support her bill.

The member touched on many points. The file she is working on is very complex. Specifically, only in the very last sentence of her speech did she mention youth and seniors. That is what makes this issue so interesting.

When I tour the schools in my riding, I hear young people and their parents express concern about their privacy on the Internet. When I attend the seniors' forum in Chambly, for example, the police always make a presentation on the dangers of breaches of information and its many consequences, like fraud.

I would like to give my colleague the opportunity to expand on the consultations she held. She mentioned several prominent people in the field, like Michael Geist. I know she consulted widely. Along with my colleagues, I would like to hear more about the kind of comments she heard because, as we all know, people are losing confidence. I can feel it in my riding and I am sure several of my colleagues feel it in theirs. I would like to hear more from the member on that subject.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I thank my colleague for his question and for his support of my bill.

He raises an excellent point. In fact, I consulted many Canadians and held information sessions about my bill. I also tried to make both young and old people realize what happens to our personal information when we put it online. Many were very surprised to hear just how widely their personal information is used, and for what purposes. In many cases, it is used in ways people never agreed to.

We do have an existing legislation: the Personal Information Protection and Electronic Documents Act is meant to protect Canadians against unauthorized disclosures of information and other similar problems. However, that legislation is being broken, and therein lies the problem.

Many firms offering Web services are simply huge, which means these issues are becoming more and more international in scope. Unfortunately, these firms do not always comply with Canadian laws.

I believe that as parliamentarians, we have a duty to implement modern protections that both young and old Internet users will be aware of. They will then be protected as the law intended, instead of seeing the law not being followed, as is sadly the case today.

[Raymond Côté, NDP, Beauport—Limoilou, QC]

Mr. Speaker, I would like to congratulate my colleague from Terrebonne—Blainville for her speech and especially for the bill she has introduced.

I trained as an archivist and part of my training dealt, of course, with the protection of personal information. This field has expanded quite a bit over the years. It was an important consideration for more traditional mediums such as paper documents and electronic documents before the Internet era. What is really frightening is the proliferation of means of exchanging this information with total impunity.

Could my colleague give us an idea of how complex this can be, of just how many opportunities for sharing, stealing or distributing personal information there can be?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, in the digital age, the personal information we provide is disclosed and transferred from person to person very quickly. It takes just milliseconds. There is a real risk.

The other thing is that there is so much personal information in such a huge data base as the Internet, and everyone can have a certain amount of access with an electronic hacking tool. That is why it is important to put in place a system that will notify people if an organization is hacked. We have to be able to inform people that their personal information has been stolen in order for them to protect themselves.

[Mike Lake, Conservative, Parliamentary Secretary to the Minister of Industry]

Mr. Speaker, I am pleased to speak to private member's Bill C-475 as presented by my hon. colleague from across the aisle.

Bill C-475 proposes to amend the Personal Information Protection and Electronic Documents Act known as PIPEDA, a law that has been in place for over a decade. PIPEDA has proven its value and retained its relevance in the face of unprecedented technological change.

At its core, PIPEDA gives individuals control over whether and how their personal information can be collected, used or disclosed during commercial activity. This protection fosters trust and confidence in the online marketplace, an important part of the Canadian economy that is growing by leaps and bounds.

The government is committed to updating PIPEDA. In fact, the Minister of Industry met with the Privacy Commissioner only yesterday. However, any changes that are proposed should have been discussed thoroughly with business, consumer advocates and academics or fall within the framework of the existing legislation, as is the case with the former Bill C-12. The proposed new measures put forward in Bill C-475 were not. The proposed amendments in Bill C-475 give the Privacy Commissioner new powers and present a major change to PIPEDA and the role of the commissioner. The impact of such a change on all stakeholders has not been considered.

The Privacy Commissioner's role as defined in PIPEDA is to serve as an ombudsman, a role she has performed impressively to the great benefit of Canadians. Indeed, the commissioner has been internationally recognized and applauded for her success. It was in recognition of this that her term was extended to three years in 2010.

As the commissioner's term enters its final months, the government is pleased to have this opportunity to express its gratitude for the commissioner's dedication to the protection of the privacy of Canadians.

Let us begin by highlighting some of the successes so far. PIPEDA's ombudsman model has proven very successful in setting a high standard for the protection of personal information in Canada. PIPEDA allows for mediated solutions to privacy conflicts that can give both individuals and companies a clear understanding of their rights and responsibilities. A less formal dispute-resolution mechanism is far less intimidating for individuals and easier for them to navigate.

PIPEDA's current oversight and redress regime reflects a deliberate decision by Parliament to adopt a mechanism that avoids litigation when resolving privacy disputes. PIPEDA also provides the Privacy Commissioner with a range of powers to address privacy issues. She can investigate, enter premises and compel evidence, mediate a settlement, make recommendations, publish the names of those who contravene PIPEDA and take matters to the Federal Court.

Bill C-475 would give the Privacy Commissioner new, quasi-judicial enforcement powers. Unfortunately, the enforcement regime proposed by the private member's bill is fraught with procedural failings. As my colleagues will note, the bill contains a list of consequences for non-compliance. This includes a monetary penalty of up to $500,000, a very significant amount.

However, should penalties imposed on small firms be as large as those for multinationals? Unfortunately, the bill completely overlooks this matter. The size of the firm or its ability to bear the burden of monetary penalty is apparently not a factor to be considered.

Given the potential severity of the monetary penalty, it is also puzzling to observe that this particular remedy only applies to failure to comply with orders. Indeed, organizations that have been found to wilfully violate the privacy of individuals, including those that have profited significantly from the violation, are not subject to this penalty. They are only penalized if they have failed to change their ways after having been caught. There are many outstanding issues and questions with respect to the enforcement measures that are being proposed in Bill C-475.

PIPEDA already provides the Federal Court with the ability to provide any remedy it deems appropriate, including orders to correct practices, award damages, or order offending parties to publish a notice of corrective action. Clearly, PIPEDA establishes a comprehensive process for taking action against privacy violations. Businesses, both large and small, together with individuals, have found much success in the resolution of their disputes.

We must ask, then, how the proposed enforcement measures are going to affect the level of co-operation that exists between organizations subject to PIPEDA and the Privacy Commissioner. Would the enforcement regime of Bill C-475 change the current dynamic between organizations subject to PIPEDA and the commissioner, making the parties more adversarial and the process counterproductive? These are questions that cannot be taken lightly.

Finally, the implications of these new powers on the structure and resources of the Privacy Commissioner's office do not seem to have been considered during the drafting of Bill C-475. The new powers would place an undue burden on personnel within the Privacy Commissioner's office. One cannot simply add new enforcement powers to a law without thorough study and consideration of the impact on its existing oversight regime or on its regulator.

We cannot support Bill C-475. There are too many omissions and fundamental questions left unanswered in this bill.

In spite of the difficulties with this private member's bill, though, the issue of compliance with PIPEDA certainly warrants further exploration. The government will continue to send a strong message about the importance of complying with PIPEDA, given its critical role in building trust and confidence in the online marketplace. Furthermore, there must be an opportunity for all Canadians with an interest in privacy issues to be comprehensively canvassed and thoroughly heard.

To conclude, the government does not support private member's Bill C-475. Instead, the government remains committed to updating PIPEDA in a more considered and comprehensive manner. Our government will have a balanced approach, one that takes seriously the protection of private information while establishing a regulatory framework that is workable for businesses.

[Scott Andrews, Liberal, Avalon, NL]

Mr. Speaker, it is a pleasure to contribute to this debate today. I listened to the parliamentary secretary speak to the bill. He left out a few interesting facts.

Bill C-12, which was the government's bill, was introduced in 2007. Five long years have passed since then, and the government has not kept its commitment to changing PIPEDA and making the necessary changes. Twice the bill has fallen off the order paper. The government has not been taking PIPEDA very seriously at all.

I commend the member for bringing forward the bill. It would deal with two small measures. First, it talks about reporting the loss or disclosure of unauthorized access to personal information. Where a reasonable person would conclude that there exists some possible risk, the commissioner would have to be notified. The other part would give the commissioner some actual teeth to dig in and fine when personal information is lost.

We, as a government, are falling behind the rest of the world when it comes to protecting people's privacy.

I find it comical that the parliamentary secretary says that PIPEDA has kept its relevance. I am going to quote Commissioner Stoddart with respect to its relevance. She stated:

Back in 2001, when PIPEDA began coming into force, – and even when I became Privacy Commissioner in 2003 – there was no Facebook, no Twitter and no Google Street View. Phones weren't smart. “The cloud” was something that threatened picnic plans. And predictive analytics was largely the domain of tarot card readers.

A lot has changed since 2001, and our PIPEDA legislation just has not kept up.

This is a good start. It would give the commissioner more enforcement powers. Currently the commissioner can only publicly shame a company for breaching PIPEDA. It is time for the commissioner to have the strong enforcement powers needed. Some of that may have been contained in the government's bill, Bill C-12, but that bill has not seen the light of day.

Bill C-475 is with us now. It is something we need to refer to committee. We need to update our privacy laws, and we will be supporting the bill.

[Matthew Dubé, NDP, Chambly—Borduas, QC]

Mr. Speaker, I am very pleased to speak in support of the bill introduced by the member for Terrebonne—Blainville. Earlier, I congratulated her on her work, because we all agree that this is a very complex issue, as I said when I asked her a question.

It is rather amazing to realize that the Personal Information Protection and Electronic Documents Act has not been updated since 2000. At the risk of showing my youth, which I really do not need to do here, the last time this bill was updated I was at the ripe old age of 12. We can see how much the technology has changed, particularly in relation to the legislation as a whole.

In my view, it is completely absurd to claim that we can keep going as we are with Facebook, Twitter and iPhones. We could stay here all night just listing all the changes in technology.

Indeed, all we had to do was listen to the news this morning, not to point fingers. Of course, there are all kinds of practices, but there was one news item about what Bell does with the personal information of its customers. I am not necessarily blaming the company. I think it falls to us, the elected politicians, to assume our responsibilities—but more particularly to the government to assume its own—and implement legislation that will provide better protection of our personal information in the digital age, which is also an age of uncertainty.

What I have found in discussing this issue with my constituents is that there is a lot of confusion. There is a lack of knowledge, and it is not because my constituents are uninformed on the subject. On the contrary. It is difficult to keep the legislation in line with what the Privacy Commissioner, among others, has already said about what should be done. There is quite a hodge-podge of information.

My colleague is proposing we update the law and bring it in line with recommendations from the Privacy Commissioner, for one. I know that this is not the only element, but it is a striking one because we often see the commissioner's proposals in the news. Obviously, this one jumps out at people who are following this issue.

I really appreciate an important component of this bill, which addresses the idea of coordinating our legislation with that of other countries to ensure that we are keeping up with what is happening around the world. In the digital age, privacy knows no boundaries.

Consider this scenario: someone could subscribe to an Internet service that is based in the United Kingdom. Imagine that the individual's information is compromised; questions are raised about the Canadian government's power to protect that individual's private information. We need to recognize that borders are disappearing in the digital world. We need to take that into account when we update our laws. That goes without saying.

In the question I asked my colleague earlier, I spoke about another aspect that I want to touch on in my speech, and that is the fact that this issue is not bound by age. It is not limited to a single generation.

There is a tendency to think that Facebook is for young people. Similarly, we think that seniors are the ones maliciously targeted by fraudsters. However, it is not that cut and dried. Just as there are no borders—as I said when I was talking about the international component—fraud and privacy breaches are not limited to one generation more than any other.

I want to come back to the example that I gave in my earlier question. While discussing various suggestions with students, for example, we often ask them what they can do to better protect themselves on the Internet.

Canadians can and must have proactive habits, both on the Internet and elsewhere. However, the federal government must also enact legislation that has more teeth in order to allow for more appropriate punishments for businesses that do not perform their due diligence. We put our trust in them when we give them our personal information, which is vulnerable to fraud. Unfortunately, for a few years now, people are realizing that trust and good faith are not enough. The federal government has a duty to legislate in this regard, which is what this bill does.

In my speeches, I often give examples of all kinds of issues raised at the seniors' forum in Chambly, which I attend every year. This event really captures a wide range of issues that matter to seniors. For me, as a member of Parliament, it is an excellent way of knowing what is going on with seniors and of understanding their concerns. Every year, there is always a portion of the event that addresses fraud and elder abuse.

Considering the world they grew up in, seniors do not always know how to protect themselves online, despite their best efforts. I do not think it is unkind to say so. As I said, seniors recognize this themselves and are demanding that the government do something in order to ensure that, when they hand over their personal information to a website or company, it will be protected.

This also applies to cellphones. More and more seniors are using this technology, which is a good thing, because we want them to be able to participate in this technological aspect of our society. We need to do our duty, as elected representatives, to ensure that they can do so safely, while recognizing that they need to be proactive, just as younger people need to be. The need for citizens to be proactive does not relieve legislators of their responsibility to do their part to ensure that laws are in place and that companies cannot run around with people's personal information, since this could lead to bad situations.

I would even say that this issue has been one of the government's weak points. I would also like to point out that privacy is a very hot topic at the moment. Many of my constituents really care about privacy. My colleague for Terrebonne—Blainville has often raised other issues related to the digital age. Clearly, the government has not done enough when it comes to improving the legislation or acting proactively as federal MPs to take advantage of the digital age.

Consider the lack of information about the lost student loan data and other situations at Service Canada. These situations show that the government is not proactive enough and is not making necessary improvements.

Luckily, my colleague is being proactive by introducing her bill as digital affairs critic for the NDP. She is also working on our digital strategy. I commend her on her work and I am proud to support her. I know my constituents will feel much better knowing that at least one party is taking a firm stand on this issue.

[Peggy Nash, NDP, Parkdale—High Park, ON]

Mr. Speaker, it is a pleasure for me to to speak on Bill C-475 on the issue of privacy and digital communications.

The whole privacy issue has been a thorny one for the Conservatives. Last year they had Bill C-30, the online snooping bill, which triggered a huge countrywide backlash. Many Canadians were concerned about that bill because it proposed some very serious invasions of privacy and was an attack on the fundamental rights and freedoms of Canadians.

Privacy is also an issue because increasingly we have seen that many federal government departments, including HRSDC and Indian affairs, have lost personal information they have collected from Canadians. However, the good news for Canadians is that the NDP digital affairs critic, the MP for Terrebonne—Blainville, has been on the job defending the interests of Canadians. We thank her for introducing Bill C-475, which is an excellent response for our times to the issue of digital privacy and personal information.

Bill C-475 responds to a number of calls for greater security for public information. In the ethics committee last year there was a study on social media and privacy, led by the NDP. That committee and that study heard numerous calls from the Privacy Commissioner of Canada, legal experts on Internet security, consumer protection groups, and concerned citizens for the need to update the Personal Information Protection and Electronic Documents Act, a lengthy act that is commonly known as PIPEDA. There are many ways this act can be updated, but the fact is that it has not been updated since the year 2000.

If we think back, the year 2000 was a long time ago, before the era of iPads and smart phones. It was a time when Canadians voluntarily shared much more of their information. Times have changed dramatically, but because our laws have not changed and have not offered Canadians more protection during that period, it is not surprising that more and more Canadians are losing confidence in the ability of the government to be able to protect their privacy when it comes to PIPEDA.

Before going into it in more detail, I will summarize what this bill would do. It would ensure, first of all, that Canadians would be notified if there was a breach in security with respect to their personal information if that breach could cause them harm.

It would also add new strengths to the compliance section. Right now the Privacy Commissioner does not have much in the way of power to enforce compliance, which is unlike the situation in many other countries in the world, so it would bring Canada onto a level playing field with many other countries.

The issue of online privacy is one of growing concern. We are now in the age of big data. Companies are data mining, gathering personal information from a variety of sources, and using it for marketing, for advertising, for personalized ads, for all kinds of measures. There is nothing to protect the privacy of Canadians. There is nothing to protect the personal data of Canadians when there is a data breach that could cause them harm.

What we found in the ethics study of this issue was that there is increasing commodification of this data, called big data, by companies online so that they can do marketing, in which this personal information is often collected, used and disclosed to other parties. The person whose information is collected often does not have any idea that this is even happening. They certainly did not give consent, and it is in violation of PIPEDA.

Throughout the ethics study, there were repeated calls by Internet and privacy experts and civil society groups to empower the Privacy Commissioner of Canada with enforcement powers and to introduce mandatory data breech notification. That is exactly what Bill C-475 would do.

I want to thank my colleague from Terrebonne—Blainville for her excellent work on this issue and her tailoring of the bill to really respond to this very recent study in updating this legislation.

Again, what Bill C-475 would do is give enforcement powers to the Privacy Commissioner of Canada. It would allow the Privacy Commissioner to order an organization that is found to be in violation of PIPEDA to undertake actions to comply with the act. If they do not comply with the orders within a timeline established by the commissioner, they could be liable to a fine of up to $500,000, as determined by the Federal Court. It is a very serious penalty if they are given the opportunity to comply with the act and fail to do so.

Second, it would introduce mandatory data breach notification where there is possible risk of harm to individuals whose information has been compromised. Individuals must be notified.

If anyone thinks these are by any means radical measures—I am sure they sound like a lot of common sense to Canadians—many other jurisdictions already have such measures in law. Countries such as the U.K., France, Germany and Australia and some provinces have this provision in law. British Columbia, Alberta and Quebec have commissioners responsible for data protection or privacy. They are equipped with enforcement powers to force organizations to comply with the law. It seems like good common sense. These enforcement powers for all of these other jurisdictions include administrative monetary penalties. Canada is behind the times when it comes to PIPEDA and the lack of enforcement and the lack of notification.

What are others saying about this legislation brought forward by our colleague from Terrebonne—Blainville? OpenMedia.ca executive director Steve Anderson said, “We welcome...[the MP's] online privacy bill.... This bill is a useful stepping stone to safeguard our privacy”.

Michael Geist, chair of Internet and e-commerce law at the University of Ottawa, a renowned public affairs commentator who often has a column in my local newspaper in Toronto, said:

Bill C-475 is a far better proposal.... Those provisions would do [sic] far to ensure greater respect for Canadian privacy law and give Canadians the assurance of notifications in the event of security breaches.

In conclusion, the people I represent in Parkdale—Hyde Park include many young artists, young communicators and people who work in digital media. I have heard many calls for this kind of privacy legislation. It is long overdue, and I would urge all members of the House to vote in favour of Bill C-475.

[Rosane Doré Lefebvre, NDP, Alfred-Pellan, QC]

Mr. Speaker, I am very honoured to rise today to speak to Bill C-475, which I will support at second reading.

First, I would like to speak to the work ethic of my colleague from Terrebonne—Blainville when it comes to digital issues. As the digital issues critic, my colleague has done a lot of work on a policy to better protect our personal information on the Internet. I appreciate the work she has done.

My colleague held a number of public consultations, which is important to note with this bill, since it has been well received by the public. If there is one thing that is very important and that the NDP puts a lot of emphasis on, it is public consultation. I know that most of my colleagues have held their own consultations in recent weeks and months on several issues that affect the Canadian public.

Digital issues, and privacy in particular, are extremely important issues that affect all Canadians. Later on in my speech I will talk about what the people of Alfred-Pellan, in Laval, have told me. It shows a good work ethic to consult the public, and we can create excellent bills that reflect what the public wants.

It is sad to see that, unfortunately, the federal government is not consulting the public about digital issues and our privacy. This issue is very topical and we must take it seriously. That is why public consultation is so important.

Bill C-475 would create modern protections for an issue for which it is extremely difficult to set parameters. I think that Bill C-475 achieves a very important objective: improving protections on the Internet.

The Privacy Commissioner has called for measures to be implemented on many occasions. My colleague from Terrebonne—Blainville included them in Bill C-475.

Therefore, we can say that we are listening to consumers. In fact, the Union des consommateurs supports this bill. I believe that it is very important to point that out. We have to crack down on Internet fraud and abuse. It is really important.

A little earlier, I heard a Conservative member on the other side of the House say that they are on the right track when it comes to protecting consumers and people's privacy on the Internet. Unfortunately, I doubt it. I will not give the Conservatives free reign, especially when it comes to consumer protection. Unfortunately, their record to this point strongly suggests otherwise.

We have a golden opportunity to have all parties in the House, no matter their political affiliation, work together to protect the privacy of Canadians, to all come together to work on a bill that I believe is extremely well researched.

Most people might think that the protection of privacy is assured and that we have a great deal of protection, especially when navigating the Internet. Unfortunately, that is not the case. There are no guidelines and we do not take action against the big companies that will take advantage of the system in order to use our personal information.

In that regard, I would like to talk about a few things that happened to us in Laval this past summer. I went door-to-door a great deal this summer in order to find out about the concerns of the constituents of Alfred-Pellan in Laval. Many issues were discussed during my visits. We talked about this earlier today. Many people talked to me about the Senate and abolishing it, and they told me that it will be a good thing when the NDP government abolishes the Senate in 2015.

People also talked to me about the bill introduced by my colleague from Terrebonne—Blainville. In fact, they raised questions about what we were doing to improve people's safety on the Internet. I found that extremely interesting and we had some good discussions about that.

I talked to a young man who is in a relationship and who just bought a house. He was very interested in our policies on Internet protection and not just consumer protection. He was extremely pleased to see that the NDP had a substantive bill on the subject.

During the summer, like many of my colleagues probably, I toured a number of old age homes. People were very happy to see us. We talked about protecting personal information. That is something that is very important to our seniors because, unlike a young woman like myself, they have not been immersed in all things Internet and social media since they were young. Many people do not have access to that and it is all new to them. These are things they have to learn. It can be hard for them to understand. I can see how it might be hard for them to use social networks and to cope with the fast pace of the Internet.

Often seniors tell me that they tend to be trusting and give out their personal information. Unfortunately, there are cases in my riding of people who have lost money and are being harassed because they gave out their personal information somewhere. They suddenly receive information they did not ask for from all sorts of people. It is upsetting to them.

These people were extremely concerned about protecting their information. I talked about this bill with them and they were glad to see that there is a party in the House of Commons that wants to review the rules and cares about their safety and protecting their personal information.

I think it is important that we reach out to them in this case because they are the ones who are affected the most.

My colleague from Chambly—Borduas talked a lot about seniors. I will not elaborate on that, but I will say that we must include them in this process.

As the hon. members for Chambly—Borduas and Terrebonne—Blainville said, the federal government has a responsibility to set parameters without necessarily being too tough. At some point enough is enough. There are ways to go about this that we need to oversee. The government has a responsibility and it must step up to the plate.

I studied what this bill contains in more detail because it addresses so many items. I found that it changed some very interesting things.

I saw that Bill C-475 granted, for example, powers of enforcement to the Privacy Commissioner of Canada, which is extremely important.

As I mentioned at the beginning of my speech, the Commissioner called for many changes and measures that we are dealing with right now. Any organizations that refuse to implement these measures within a timeframe set by the Commissioner would risk a fine of up to $500,000, according to a Federal Court decision.

At this time, there are no fines for a company or anyone who abuses on our social networks or the Internet. Putting these guidelines in place today prove that we are serious and we take privacy protection seriously.

There is also the fact that Bill C-475 would make it mandatory to report any data breaches that could harm the people involved.

I believe that this is another important item that we should pay special attention to.

I see that I am almost out of time, so I would like to list the stakeholders that have given us their support. As I mentioned at the beginning of my speech, the hon. member for Terrebonne—Blainville found during consultations that the Union des consommateurs supports our position. Aubrey LeBlanc, president of the Consumers Council of Canada, has come out in support of our position, as has Steve Anderson, executive director at OpenMedia. The National Association for Information Destruction Canada and the University of Ottawa's Canadian Internet Policy and Public Interest Clinic also agree with our position.

The list goes on and on. I believe that proves, as I said earlier, that we need to work together, tackle this problem, put partisanship aside for once, make the right decisions and support Canadians.

[The Deputy Speaker, NDP, Joe Comartin]

The time provided for the consideration of private members' business has now expired, and the order is dropped to the bottom of the order of precedence on the order paper.

A motion to adjourn the House under Standing Order 38 deemed to have been moved.

Intergovernmental Relations

[Jean-François Fortin, Bloc, Haute-Gaspésie—La Mitis—Matane—Matapédia, QC]

Mr. Speaker, I rise here today to speak to the government's decision to challenge the Quebec National Assembly's Bill 99.

The Government of Canada has chosen a path of confrontation by trying to invalidate this bill, which is fundamental for Quebec. Bill 99 states that only Quebeckers can decide their future. In fact, Ottawa is denying this decisive prerogative, because by challenging this bill, the federal government is going after the recognition of the Quebec nation and its inalienable right to self-determination.

However, the government should recall that, in 1995, the House of Commons voted to recognize Quebec as a distinct society. In addition, in 2006, the House also voted to recognize the Quebec nation.

Unfortunately, it was all just lip service. The Clarity Act, 2000 and today's direct attack on Bill 99 fly in the face of those statements of principle. In fact, those principles, which should guide this Parliament's policies, both in theory and in practice, are actually nothing but smoke and mirrors meant to mollify Quebeckers and their government. When it comes time to defend Quebec beyond empty rhetoric, actions will speak louder than words.

Bill 99 includes a number of provisions. The best known one is the absolute majority: 50% plus one. The refusal to abide by the 50% plus one rule is outright discrimination against individuals and is contrary to the principle of equality of votes. The votes of one option would have more weight than those of the other option in the decision making process.

However, the absolute majority rule was good enough for the other referendums on Quebec's sovereignty, for Newfoundland joining Confederation, for the vote on the Meech Lake accord and so on.

There are other provisions of Bill 99 that no one talks about much, but probably bother the federal government quite a bit, including on the sovereignty of Quebec's jurisdictions, which Canada has systematically violated. There is the Gérin-Lajoie doctrine to extend Quebec's jurisdiction internationally, which Canada has always refused to subscribe to, the protection of the territory and the freedom to develop it without the unilateral interference of the federal government.

The part that the federal government is interfering in today involves issues that are important to Quebeckers. What Canada is afraid of with Bill 99 is that Quebec not only has the right to legislate, but it also has the moral obligation to do so, in response to the federal government imposing an increasingly predatory, subjugating, mind-numbing and childish federalism, with no respect for the Quebec nation.

This bill also contains section 10, which upsets the federal government:

As regards the exercise of the fundamental and inalienable right of the Quebec people to decide its own destiny, the State of Quebec and the National Assembly are bound only by the provisions of this act and by other acts applying to the National Assembly. No other parliament or government may reduce the powers, authority, sovereignty or legitimacy of the National Assembly.

That is what is upsetting the federal government. The Minister of Intergovernmental Affairs, who is a bit uncomfortable with the whole thing, agrees with it on a personal level. All of the political parties in the National Assembly recognize this legitimate right for Quebec.

This brings me to a fundamental issue for the government. If parties of all stripes in Quebec agree on the powers of the National Assembly, on the terms and conditions surrounding a referendum, including the rule of absolute majority and the wording of a question, does the federal government think that the federal Parliament can override all of the National Assembly's bills?

[Paul Calandra, Conservative, Parliamentary Secretary to the Prime Minister and for Intergovernmental Affairs]

Mr. Speaker, I think the Prime Minister said it best today when he said that the process for dividing the country is best left up to the courts.

More importantly, we know that all members on this side of the House, in fact I would suggest all members on both sides of the House with the exception of the Bloc members, believe in a united, strong Canada. We will continue to move forward with policies that will do just that.

What we really know is that the people of Quebec do not want a referendum. They want to continue down the road to hope, prosperity and new economic activity that comes with the Canada-European Union free trade agreement.

[Jean-François Fortin, Bloc, Haute-Gaspésie—La Mitis—Matane—Matapédia, QC]

Mr. Speaker, the saddest thing is that all federalist parties in the House agree that the power, authority and legitimacy of the Quebec National Assembly should be reduced. They have all agreed to impose their own clarity act. The Conservatives have joined with the Liberals on the current clarity act. The NDP has introduced Bill C-470 and is using it to impose on Quebec a referendum question chosen by the federal government. It wants to block a future referendum by referring the matter to the Quebec Superior Court and, ultimately, the Supreme Court. As I said, no other parliament or government can reduce the powers, authority, sovereignty or legitimacy conferred by the people on the National Assembly of Quebec.

[Paul Calandra, Conservative, Oak Ridges—Markham, ON]

Mr. Speaker, we know that the people of Quebec are not interested in a referendum. What they are interested in is jobs and economic activity. They want us to focus on that, not referendums.

We will let the courts decide on the process of how the country should be divided. In the meantime, members of Parliament on both sides of the House, with the exception of the Bloc members, will continue to work hard for a strong, united Canada.

[The Deputy Speaker, NDP, Joe Comartin]

The motion to adjourn the House is now deemed to have been adopted. This House stands adjourned until tomorrow at 2 p.m., pursuant to Standing Order 24(1).

(The House adjourned at 6:40 p.m.)