Industry committee  Yes, I think that's right. Professor Scassa has done a lot of study on that and she is probably ideally suited to comment. I think you answered the question yourself. It does indeed open the door to very broad interpretation, which I think is a source of concern.

Industry committee  I think there's reason for concern based on the load that the commissioner is facing, realistically. We've had a situation for the last number of years with the Privacy Commissioner where findings sometimes run between 12 and 18 months because there simply haven't been the resources to deal with issues.

Industry committee  I'll speak candidly and tell you that with the first bill, with all due respect, the government did not move forward with it in any meaningful way at all under Minister Bains. That's just the reality. With this bill—and I can't speak for other people coming out of the privacy community—I feel it is a source of significant frustration that we get a bill that barely makes it through anything.

Industry committee  First, I'll say that there were improvements made from the prior bill to this bill, so the government did listen, and some of the things that are in this bill are better than the one that was introduced in the first instance and really didn't go anywhere. I will also say candidly that I must admit that this is one of the hardest committee appearances that I've had in a very long time, in part because typically, when you're invited—and I have appeared on omnibus legislation before like the one we get with, let's say, the budget implementation act—you're invited for a specific kind of provision, and we recognize how that works.

Industry committee  That was a reference, and we've heard it regularly, to a desire to strike a balance within these provisions, but let's recognize that, once you get outside and start applying these rules, it's not a balanced playing field. Many individual Canadians don't know their privacy rights or, if they do, the prospect of filing a complaint, proceeding with it and facing all the challenges that are inherent in the system—and this is true for more than just privacy, but it's certainly true with privacy—is enormous.

Industry committee  Sure. I want to speak specifically to highlight the importance of this legislation and how important it is to include far-improved enforcement measures. I think the experience over the last couple of decades is that for many.... If all you're left with are non-binding findings, it is very tough to enforce, and it is, I think, tough for the commissioner to ensure that companies themselves are compliant, because they will naturally engage in a bit of a risk analysis, at least under the current bill.

Industry committee  Thanks for the question. Technically speaking, the bill doesn't address it because we have the bill. What we also have now, as you know, is essentially a memo from the minister that highlights that they've begun to identify what they intend to include within the high-impact systems.

Industry committee  I think Professor Scassa is exactly right. Anyone who's been paying any sort of attention over the last five to 10 years recognizes that in what we once thought of as data that is open and may be used, oftentimes we're talking about data that didn't have the appropriate consent in the first place, and certainly not necessarily the consent for the kinds of reuse that you start to see online.

Industry committee  A conventional way to look at the government-related collection of data is through the Privacy Act lens, which successive commissioners, going back well before even the creation of PIPEDA, have argued is insufficient and inadequate. Government has consistently failed to hold itself to the same standard that it expects of the Privacy Commissioner.

Industry committee  I guess I will start. Part of the problem that I see—and I think it's been echoed by some of the other witnesses, who may want to chime in—is that this omnibus approach that has combined both privacy and AI fundamentally really impairs the ability to have an effective review of the legislation as a whole.

Industry committee  I'll give you a brief answer, but Professor Krishnamurthy, who is one of the witnesses, has done studies and reports on this, so he's probably best suited to answer some of those particular questions. However, I will say two things in response to your opening comments. First, to reiterate, I think there's general disappointment for many in the lack of prioritization of privacy over the last number of years.

Industry committee  It's not whether or not business respects the tribunal. I don't really care if business respects the tribunal.

Industry committee  I think it should be properly constituted and recognized as a credible authoritative tribunal. However, the question isn't whether or not business respects it. It's whether or not courts respect it.

Industry committee  What we want is for the courts to say that a decision that comes out of the tribunal is one they are prima facie going to respect. At the moment, when the commissioner issues a decision, the courts start from scratch. They have the ability to start from the beginning, which is why we see....

Industry committee  I'm not an administrative law expert, but the way a mistrial works, in terms of the deference courts may give to tribunals, is linked to the expertise of a tribunal. Let's say it's the copyright context. It doesn't mean the decisions themselves are always followed. They're definitely not, but at least the starting point is that they recognize there has been expertise brought to bear.