Industry committee  There are already provisions that are similar to that in PIPEDA and other statutes, but with more safeguards that would a require privacy impact assessment, a research ethics approval, or reporting to the Privacy Commissioner. There are also provisions in the Statistics Act that allow Statistics Canada to compel that sort of information.

Industry committee  I think it will ultimately prove to be a resilient piece of legislation. I don't see potholes or anything else like that, or pitfalls such that we're going to have to come back to revisit it in five or 10 years' time necessarily.

Industry committee  Certainly I agree that it's two different models. We also have, for example, a human rights commission and a human rights tribunal, a competition commissioner and a competition tribunal. There are other scenarios in Canada in which that particular model is applicable. There is the possibility for conflicts, and one would have to have controls and procedural safeguards within the Office of the Privacy Commissioner of Canada to make sure that those conflicts did not arise.

Industry committee  I guess I would start with wondering whether you think that we should have a world without Facebook, ChatGPT and things like that. In my view, this legislation takes what we have existing in PIPEDA and largely, as I said, turns it up to 11, so it puts a greater requirement of diligence on the part of organizations in order to, for example, justify their decision-making, document risks and do those sorts of things, and then it has those substantial penalties.

Industry committee  I'm happy to weigh in on this subject with some thoughts, because it's something I have turned my mind to. In the legislation, it refers to minors, and minors are defined by provincial law. Minors are 18 in Alberta and Quebec and 19 everywhere else, so there's a different line.

Industry committee  —or over this age, you're magically endowed with those particular powers. As a parent of three young men now, I know that you can tell that at different ages there are different levels of maturity, and it's difficult to determine. The way that it works in practice is difficult to operationalize.

Industry committee  Mr. Therrien talked about the requirements for knowledgeable, informed consent. Is the child capable of understanding what it is they're consenting to and what the consequences are? It's actually tied pretty similarly to consent to medical treatment, so it's not completely isolated in its own little world.

Industry committee  Starting with the assumption of having order-making powers and penalties, we do need to have an independent decision-maker, in my view. That could be the tribunal or that could be the Federal Court. I don't see why it couldn't be the Federal Court. I'm concerned that standing up a tribunal is actually going to delay the implementation of this legislation, because it's going to take a number of years simply to hire the staff, rent the photocopiers and all of those other things.

Industry committee  The conclusion I draw on that is that it's simply saying within the legislation, or saying within the bill, that it applies to artificial intelligence in connection with interprovincial activities. The federal Parliament has very little jurisdiction, for example, over a computer science researcher sitting at the University of Toronto.

Industry committee  Thank you very much, and thank you for your kind invitation to appear before this committee to assist in its important study of Bill C-27. I'm a partner in private practice at a law firm where I've been practising privacy law for 22 years. Most of my practice involves advising international businesses on complying with Canadian privacy laws.

Information & Ethics committee  I'm not sure you'd find it a complete analogue, and I would hesitate to bake something into concrete when the technology is going to move and consumer expectations are going to move. But I do think it does make some sense to have some “if these are your default practices”, so “this is your standard terms of use”, or “this is kind of a standard privacy policy”, which is an expectation that you don't need to do anything additional to get additional consent.

Information & Ethics committee  I think all of them face the same issues and the same scrutiny, and I think many of them have addressed them in varying ways in order to incorporate that. Many of them build within their organizations particular firewalls to prevent the investigations from being tainted by the advocacy activities of the organization.

Information & Ethics committee  No, I'm not familiar enough with the structure of the U.K. office.

Information & Ethics committee  Maybe one of the things to address is whether or not it's adequate that only one individual can go to court in connection with any particular complaint. But it's modelled on being compensatory, so a judge, an independent person, with all of the evidence in front of him determined, in that case, that $5,000 was adequate.

Information & Ethics committee  There may, in fact, be a little bit of confusion. When you talk about privacy by default, where automatically, without the person doing anything else, they're going to follow the most privacy-protected thing, that is going to work on a whole lot of services, but it might not work on all.