Bill S-4 (Historical)

Digital Privacy Act

An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) specify the elements of valid consent for the collection, use or disclosure of personal information;
(b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) preventing, detecting or suppressing fraud, or
(iii) protecting victims of financial abuse;
(c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions;
(e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual;
(f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner;
(g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control;
(h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards;
(i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint;
(j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and
(k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.

Digital Privacy Act

[Matthew Kellway, NDP, Beaches—East York, ON]

Mr. Speaker, I am happy to rise in the House today to speak to Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act. As members know, today's debate turns not precisely on Bill S-4 but on a motion to refer the bill to committee before second reading.

The concerns that I will raise with respect to the bill itself, which go as far as to challenge the constitutionality of the bill, would likely be fatal to the bill at second reading, but we need not concern ourselves with that today. We need not arrive at a conclusion about how fatal these flaws are or how injurious they are to the bill.

The motion before us today would allow us to visit the scope and principle of the bill at committee and make, as required, amendments to those very principles and scope of the bill.

Today, I would argue that this motion warrants support, so that we have the flexibility to properly study, examine and propose amendments to the bill at committee before the principle and scope are set.

Let me set out a few reasons why this is particularly important in these circumstances and relating to this particular legislation.

First, let me address the issue of public opinion that sets the context in which this bill and more broadly the issue of privacy concerns exist.

According to a survey of Canadians on issues related to privacy protection conducted last year, 70% of Canadians feel less protected than they did 10 years ago; only 13% of Canadians believe that companies take their privacy seriously; 97% of Canadians say they would like organizations to let them know when breaches of personal information actually occur; 80% of Canadians say they would like the stiffest possible penalties to protect their personal information; and 91% of Canadian respondents were very or extremely concerned about the protection of privacy.

The current government cannot absolve itself from contributing to this level of public concern about privacy issues. It is not just a matter of legislative lethargy; that is, it is not just about the fact that we are well past the five year mark for the conduct of a mandatory review of the Personal Information Protection and Electronic Documents Act, an act that is by now well behind international standards and has failed to keep up with technological advancements in this digital age.

Part of the issue here is that the current government has itself repeatedly demonstrated insufficient care for the personal privacy of Canadians through its own conduct. I would point to the fact that in one year alone, under the current Prime Minister's watch, government agencies secretly made more than 1.2 million requests to telecommunications companies for personal information, without warrant or proper oversight.

It is a government with a seemingly insatiable appetite and perhaps an addiction to Canadians' personal information. It is a government that needs to be constrained by effective legislation that protects the privacy and personal information of Canadians. It is a government that has no credibility on this subject matter.

This is evident in the legislation that the Conservatives have defeated in this House. In 2012, our NDP digital issues critic, my colleague from Terrebonne—Blainville, put forward Bill C-475, a bill to amend the Personal Information Protection and Electronic Documents Act. It would have applied similar online data protection standards that exist in Quebec's personal information protection act. For example, Bill C-475 would have given the Office of the Privacy Commissioner of Canada the power to issue orders following an investigation. The Conservatives defeated that bill at second reading. They also defeated our NDP opposition day motion on May 5 last year. That motion simply called on the government to close loopholes in existing legislation that currently allowed the sharing of personal information without warrant.

The current government's disregard for private and personal information is also evident by the legislation that it has brought forward.

Bill C-13, the government's cyberbullying law, includes lawful access provisions that would expand warrantless disclosure of information to law enforcement by giving immunity from any liability for companies that hold the information of Canadians to disclose it without a warrant. This makes it more likely that companies would hand over information without a warrant as there are no risks that they would face criminal or civil penalties for such conduct.

There is a thread here that runs through the government's own efforts to access the personal and private information of Canadians through to their conduct and voting record in this place. It goes against the interests and concerns of Canadians and denies the wishes of Canadians for greater protection of their personal and private information.

In other words, the issue before us goes to the principles underlying this bill. They need to be examined and amended at committee. For example, while Bill S-4 would make it mandatory to declare the loss or breach of personal information for the organizations in the private sector and penalize organizations that do not fulfill this obligation, the proposed criteria for mandatory disclosure remains subjective. It would allow the organizations themselves to assess whether “it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual”.

More and most problematically still, Bill S-4 would add exceptions under which personal information may be collected, used or disclosed without an individual's consent. The bill would make it easier for organizations to share personal information with each other without the consent of individuals if the organizations are engaged in a process leading to a “prospective” business transaction. In other words, under certain circumstances, the bill allows personal information of one organization's clients to be shared with another organization without the consent or knowledge of those individuals.

Here we run into some significant problems with this bill. The amendments proposed contradict the very foundation of the act they seek to amend and serve to defeat what the Supreme Court called in R. v. Spencer the act's “general prohibition on the disclosure of personal information without consent”. As the Supreme Court said in that recent decision, “PIPEDA is a statute whose purpose is to increase the protection of personal information”.

The Supreme Court, in R. v. Spencer, got to the heart of the issue here, understanding what the government has failed to understand about the issue of informational privacy in the digital age. It is worth quoting at length here. It stated:

Informational privacy is often equated with secrecy or confidentiality, and also includes the related but wider notion of control over, access to and use of information. However, particularly important in the context of Internet usage is the understanding of privacy as anonymity. The identity of a person linked to their use of the Internet must be recognized as giving rise to a privacy interest beyond that inherent in the person’s name, address and telephone number found in the subscriber information. Subscriber information, by tending to link particular kinds of information to identifiable individuals may implicate privacy interests relating to an individual’s identity as the source, possessor or user of that information. Some degree of anonymity is a feature of much Internet activity and depending on the totality of the circumstances, anonymity may be the foundation of a privacy interest that engages constitutional protection against unreasonable search and seizure.

So, from subscriber information, the Supreme Court has connected that information through to search and seizure.

We have at least before us a major concern with the principles of this act, but seemingly too a bill that is simply unconstitutional. Leaving aside for the moment this latter issue, let me suggest by way of conclusion that if there is something in Bill S-4 that is salvageable, it can only be so if this bill moves to committee before this House sets in concrete the principles and scope of this bill, and limits the kinds of amendments that can arise out of committee post second reading.

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, the legislation would provide a tremendous amount of protection to consumers and to government to ensure that the right solutions and the right oversight are in place.

The digital privacy act would not force companies to hand over private information to the police, copyright trolls or anyone else. These new measures would place strict limits and tight restrictions on companies that lawfully share Canadians' private information for investigative purposes. Organization to organization information-sharing already exists in Alberta and British Columbia. These changes were recommended by the access to information and privacy committee in 2007 with the agreement of the Liberals and the NDP and these provisions are well entrenched in this new legislation.

[Jonathan Tremblay, NDP, Montmorency—Charlevoix—Haute-Côte-Nord, QC]

Mr. Speaker, Bill C-13 and Bill S-4 give access to personal information without a warrant or any oversight mechanism.

Why does the government want to allow snooping without a warrant by creating these deficiencies with no oversight to prevent abuses in the system?

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, I am pleased to rise today to speak to Bill S-4, the digital privacy act. I support the bill.

The purpose of the digital privacy act is to strengthen the rules for the safeguarding of Canadians' personal information when they shop online or surf the web. The digital privacy act would amend the Personal Information Protection and Electronic Documents Act, more commonly known as PIPEDA, which provides a legal framework for how personal information must be handled in the context of commercial activities.

Last April, our Conservative government introduced the Digital Canada 150, an ambitious plan for Canada to take full advantage of the digital economy as we plan to celebrate our 150th anniversary in 2017. Digital Canada 150 has five pillars and 39 new initiatives that will allow Canada to be a leading nation in the digital domain. One of the most important pillars in Digital Canada 150 is the “protecting Canadians” pillar, which is what we are talking about today. The digital privacy act would introduce new amendments and stronger rules to help protect Canadians' personal information.

As we live in an increasingly digital age, the need to protect our personal information becomes stronger. We use credit cards to purchase items online. We use the Internet to browse websites that may ask us for our personal information, and so on. Just last month, Home Depot was the victim of a massive data breach. The information of 56 million debit and credit cardholders was stolen.

It is surprising that, under the current law, it is not mandatory for companies to disclose to their clients that they have been the victims of hackers or if they have lost personal information. That means that if someone's credit card information was stolen, under current laws, that person may never know his or her information was compromised. It may be surprising to some, but it is not currently mandatory that companies inform their clients if their personal information has been lost or stolen.

Under the digital privacy act, however, if a company fails to notify its clients of a data breach where their information has been compromised, it can face a fine of up to $100,000 for every client it fails to notify. In addition, companies are now required to keep a record of all data breaches, and all documents must be handed over to the Privacy Commissioner upon his or her request.

The digital privacy act would also put in place new provisions that would allow the limited disclosure of personal information when it is in the public interest. One such example is the unfortunate reality of financial abuse. As it stands now, banks and other financial institutions are prevented from reporting suspected financial abuse to the proper authorities. The digital privacy act would give the exception to allow banks to alert law enforcement when they suspect that a senior is being financially abused.

The Canadian Bankers Association has endorsed these amendments. It said:

We were pleased to see that Bill S-4 includes amendments that would give banks and other organizations greater ability to assist their clients to avoid financial abuse.

As our society spends increasingly more time online and on the Internet, it is important that we have the proper safeguards in place for our children. Educational websites and virtual playgrounds are becoming more and more popular with young children. Sometimes, for marketing purposes, these websites will ask for the users' personal information. Under the digital privacy act, there is a clearer set of rules for when companies ask to collect personal information from a child. The request for information now must be written in a way that a child can understand. If the wording is too complicated for a child to understand, the consent is not valid.

The digital privacy act would also ensure that online privacy laws reflect the realities of business, such as allowing businesses to share employees' contact information and information necessary to manage an employment relationship. Businesses also need to be able to use the information employees produce at work as well as the information necessary to conduct due diligence during a business transaction such as a merger.

The digital privacy act also puts forward rules that align with provincial privacy laws. For organizations, it is important that consistent rules for the protection of personal information apply and that wherever they operate their businesses, their obligations would be the same. Consistent rules also provide individuals with confidence that wherever they conduct their business in Canada their information will benefit from the same level of protection. The bill before us takes steps to align our privacy rules with provincial laws.

The bill before us is a much needed update to privacy laws in Canada. It is a balanced approach that includes stronger rules to ensure companies are held to account, exceptions to allow for seniors to be protected from financial abuse, and new rules to ensure our children are protected online.

Now is the time for these measures to be passed into law through the passage of the Bill S-4. I hope hon. members will join me in supporting the digital privacy act.

[Jonathan Tremblay, NDP, Montmorency—Charlevoix—Haute-Côte-Nord, QC]

Mr. Speaker, the Conservatives have repeatedly shown how little respect they have for the Supreme Court of Canada. We have seen various examples of their contempt for our justice system.

Why do they not remove the parts of Bill S-4 that are likely to be considered unconstitutional in light of the Spencer decision?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Mr. Speaker, as the member of Parliament for Renfrew—Nipissing—Pembroke, it is a pleasure to rise in the House today to speak in support of Bill S-4, the digital privacy act. Bill S-4 is an essential part of Digital Canada 150, our Conservative government's plan to confirm our leadership in Canada in the digital age.

Bill S-4 proposes a number of important changes to the Personal Information Protection and Electronic Documents Act, PIPEDA, that will strengthen the protection of Canadians' privacy. The digital privacy act would also set new rules on how personal information is collected, used, and disclosed. Most importantly, this legislation requires organizations to tell Canadians if their personal information has been compromised. Companies who fail to inform Canadians about privacy breaches would be subject to severe fines for breaking the rules.

The digital privacy act is a balanced approach that protects Canadians' personal information. It allows for information sharing when the law has been broken. This balanced approach confirms our Conservative government's respect for personal privacy.

Let us now address any misunderstanding by individuals who have not read our legislation, particularly when things are read into this bill that clearly do not exist, such as claims that this bill expands warrantless disclosure

When all parties in this House agreed to enact PIPEDA over a decade ago, we recognized that there were certain limited circumstances where an individual's right to privacy should be balanced to assist the public interest. For example, PIPEDA ensures that the right to freedom of expression is respected by allowing for information to be collected and used for journalistic or artistic purposes. Another example is that PIPEDA allows people to freely share information with their lawyer, even if it includes the personal information of another individual, to ensure the proper administration of justice.

PIPEDA allows private sector organizations to disclose individuals' personal information in order to conduct investigations that help protect Canadians from wrongdoing. This provision has always existed within PIPEDA. Bill S-4 does not expand this practice. Rather, our legislation would place tight rules and strict limits on when and how private organizations could share Canadians' personal information.

I would like to emphasize to the House the role of private organizations and how they can play an important role in creating a safe and secure society for Canadians. Consider, for example, self-regulating professional associations, like the College of Physicians and Surgeons of Ontario, the Law Society of Alberta, or the Association of Professional Engineers of Nova Scotia. These bodies have the legal authority to investigate their members and take disciplinary action where required. This may be because a physician is performing procedures that he or she is not qualified to perform; it may be because a lawyer is charging inappropriate fees to clients; or, it may be because an engineer is approving the drawings for a new building without actually reviewing them.

It is not difficult to see there is a real public interest in making sure that these professional associations have the ability to investigate complaints against their members and to ensure they are meeting high professional standards that benefit Canadian society. In order to do so, investigators must be able to obtain personal information that is protected under PIPEDA. For example, when investigating a complaint against a lawyer, the law society may request that the lawyer's firm provides access to his or her client lists, financial records, or calendar. All of these records could include personal information which normally could not be disclosed to investigators without the individual's consent.

Under PIPEDA as it now stands, investigators who want to access personal information without consent must be listed as an investigative body by Industry Canada. This involves coming forward to the department and justifying the need to access the information. This is an onerous process for organizations and for the government. For example, a simple name change by an investigative organization may lead to a year-long regulatory process before the change is reflected in the law.

During the first statutory review of PIPEDA, the House of Commons committee recommended that PIPEDA be amended to change the rules for private investigations and adopt a system that is consistent with both Alberta and British Columbia. Under these regimes, there is a general exception to consent for information sharing purposes of private sector investigations.

In essence, these provincial laws regulate the activity of private investigations rather than the organizations who conduct them. Bill S-4 would introduce similar rules to those that already exist in Alberta and British Columbia. By placing tight rules and stricter limits on when and how private organizations can share a Canadian's personal information, our government is complying with the recommendations made by the all-party committee.

Upon Bill S-4 being enacted, private organizations would be required to abide by four strict rules when sharing a Canadian's private information for the purposes of an investigation. It is important for Canadians to appreciate that despite these rules, private organization information sharing is voluntary. These rules only apply in the event that an organization agrees to disclose information for the purposes of an investigation. These rules are as follows:

First, the information can only be provided to another private organization, not the government and not law enforcement. Second, the information that is requested must be relevant to the investigation. For example, there is little reason that a social insurance number would be released for the purposes of investigating professional misconduct. Third, the investigation must pertain to a contravention of the law or breach of a contract. Finally, it must be reasonable to believe that seeking the consent of the individual to disclose the information would compromise the investigation.

To be clear, organizations that share information would continue to be subject to all other requirements of PIPEDA. The Privacy Commissioner and the Federal Court will continue to have oversight on this matter, and if an organization is found to be using the exemption provisions where it is not necessary, action would be taken by the commissioner or by the court.

The Conservative government always takes the privacy of all Canadians very seriously. Our fundamental beliefs, such as democracy, the right to own private property, and the right of freedom of association, are complementary. They are why we introduced the digital privacy act, to protect Canadians' private information in the digital age.

I look forward to the remainder of the debate and working with the opposition for all Canadians on how we can best protect individuals in the digital world.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I would like to thank my Liberal colleague for her speech.

I am pleased that she raised some of her concerns about Bill S-4, in particular the negative impact it may have on the privacy of Canadians. All of the concerns that she mentioned were also raised by the Liberals during the debate on Bill C-13. However, in the end, the Liberals supported the government bill designed to spy on Canadians.

I would like to know if we can expect the same thing from the Liberals this time as well?

[Judy Sgro, Liberal, York West, ON]

Mr. Speaker, I am happy to be on my feet, adding a few comments on my concerns with Bill S-4.

I have to begin by saying that I am disappointed that the bill had to come from the Senate, rather than being introduced in the House as part of the ongoing committee work that we would have been doing. The government chose to have it introduced in the Senate and brought in through the back way.

On this side of the House, we will support sending the bill to committee. We have some very serious concerns when we combine the impact of Bills C-13 and S-4, but in order to ensure that we are being open and fair on this issue, that we understand it thoroughly, and that it does keep Canadians' interests in mind, we will support it going to committee. Hopefully, at that point, we will have sufficient time to get answers to the various questions of concern.

We are back discussing the Conservatives' type of approach, which is that one is either with them or against them. If we vote against the bill, it means that we are not interested in privacy rights, and if we vote for the bill, there is another side.

It is another one of those bills that continue to be very divisive in the House at a time when these are the kinds of privacy issues that we should be trying to work out together. I do hope that when we get to the industry committee, we have a good group there so that we can do some serious work in a non-partisan way. Maybe we can strengthen the bill in the end, by listening to some of the experts who have sincere concerns about it.

I do not mean to start out on a negative, but the truth is simple. We all need to be part of the debate today.

The way that the government looks at personal information, protection and privacy has already been subject to a Supreme Court ruling, and we have to give consideration to that. It is one thing to play partisan politics in the House and think that we are playing to the political base, but it is important that we listen to the rulings of the Supreme Court on privacy issues.

There are clearly those who have tried to make it sound like anyone who does not support the government is supportive of criminals. We have heard that before. However, the discussion is not as simple as that. The government's record on information protection has been embarrassingly negligent, so forgive me if I am not convinced that the recent scheme is worth passing without intense scrutiny.

We should all remember the matter of that lost hard drive, which held the social insurance numbers, medical records, birthdates, education levels, occupations and disability payment information of about 5,000 Canadians. That was lost. Perhaps the government wishes to plead incompetence on that side, or maybe it was an accident. We always like to be fair, so maybe it was an accident. Either way, the way that the government manages information needs extra study, which is why I am speaking on this today.

We are now looking at Bill S-4, but one cannot look at Bill S-4 without considering the implications of its companion legislation. Bill C-13, which is also before the House this week, would make it a crime to transmit pictures without consent, and it would remove barriers to getting unwanted pictures removed from the Internet. The stated intent of the bill is positive, but I have serious concerns with the provisions that would grant immunity to telecom companies that provide subscriber information to the police without even so much as a warrant.

I raise the issue, given that last April, Canada's interim privacy commissioner revealed that nine telecommunications companies received an average of 1.2 million requests from federal enforcement bodies for private customer information every year. That amounts to nearly 3,300 requests each and every day.

Those are shocking numbers, and it could be argued that the bill has, in effect, already been rendered unconstitutional by the Supreme Court. Last June, in an unrelated case, the court declared that law enforcement requires a warrant to get even basic subscriber data. Bill S-4 would allow private companies to share telecom subscriber data between themselves, something that would seem to contravene the Supreme Court's ruling.

How could that possibly be? Did the Senate miss this detail or did it fail to consider the implications of the Supreme Court's ruling? The truth is that the Senate passed Bill S-4 just days after the Supreme Court ruling, without even studying the implications. I guess the government is less concerned with that than pushing ahead with both Bill C-13 and Bill S-4. It is a lack of respect for the Supreme Court as well as Parliament.

Put simply, the legislation represents a paradigm shift in the way we deal with the release of private information. Traditionally, privacy laws outline the rules and procedures needed to protect information and personal data, but in this case, the legislation sets out circumstances under which that material can be released. Clearly, the implications of this change have not been fully considered and should be explored by the committee prior to passing final judgment on the pros and cons of the measures contained within Bill S-4.

My party and I will be voting to send it to committee for what we would hope is a thorough examination. Liberals want to ensure that law enforcement officials have access to the information they require to keep us safe, but a blank cheque approach is inappropriate. A blank cheque approach has been ruled unconstitutional by the Supreme Court and promises limited success in advancing societal protections when considered holistically. Why not take the time to do this right?

In a world where crimes involving data theft, identity fraud and online stalking are on the rise, protecting data is crucial. Data is not simply information. It is a commodity, it is power, and it is the doorway into the private lives of so many people. Liberals are deeply concerned that the government's commitment to safeguarding the personal information and privacy of Canadians is less than absolute. I am not suggesting the government is malicious. I do not believe that, but I fear it just does not understand the implications of Bill S-4.

Notwithstanding certain faulty or short-sighted legislative measures introduced by the government in the past, Canada is facing a genuine paradigm shift with respect to privacy protection, but privacy protection cannot be taken lightly. Whether protecting personal information from unscrupulous business interests, Internet stalkers and identity thieves, or rogue states bent on economic espionage, information security is crucial.

With these concerns in mind and as a leap of faith and confidence that our committee will have a chance to thoroughly examine this, I will be voting in favour of sending the bill to committee for further study. However, in return, I am also asking the minister to allow the committee to do its work honestly and freely without the involvement of the leadership so that the committee is allowed to really examine it thoroughly to ensure that if this goes forward, it goes forward with what I would hope would be unanimous support in the House on something as important as Canada's privacy rights. I believe that is quite doable, because at the end of the day we have the same objectives, to ensure Canadian privacy laws are strong and that Canadians are protected.

[Dany Morin, NDP, Chicoutimi—Le Fjord, QC]

Mr. Speaker, I thank my colleague for her excellent response. Members of my party and I are aware that in some emergency situations, there has to be access to information without a warrant. The problem with sharing information that way is that it seems to happen more often than circumstances can justify. The government has to strike a balance between protecting privacy and security. Bill S-4 does not strike that balance.

Can my New Democratic colleague tell me about her concerns with respect to that failure to strike a balance?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, the motion we are looking at today is unique in that it is the first of its kind in Parliament.

We have to wonder whether it is worth sending this bill to committee before it is passed at second reading, since that is not in keeping with the usual legislative process. While I have numerous concerns about Bill S-4, I still plan on supporting today's motion because I think that we can work together to improve the bill. However, that does not mean that I support the bill, and I must make that distinction.

As parliamentarians, we have been elected to work together and find effective solutions. That is what I am hoping to do today. I want to reach out to the government in the hopes of improving this bill because some of the elements are a step in the right direction.

As the hon. member for Chicoutimi—Le Fjord said, I introduced Bill C-475 in the House. That bill was designed to make significant changes to the Personal Information Protection and Electronic Documents Act, PIPEDA, to ensure it reflected the reality of the digital era. Unfortunately, the Conservatives voted against it. There could have been better protections in place, but we were unable to work together. This time around, I hope that will be possible.

It is extremely important that PIPEDA be updated, since it has not been updated since the very first iPod was introduced. Technology has evolved. Facebook did not even exist yet at the time. Things have really changed, and the law must reflect the current reality. This bill is a good first step, but it does not go far enough.

For instance, it is important to introduce a mandatory system for notifying users of data losses and data breaches. However, the model proposed by the government is subjective: organizations can decide whether the data breach is significant enough to report. In some situations, these organizations will not have the best means or knowledge to do this, especially the really small organizations. Is it really in their interest to disclose such data breaches? Probably not.

Bill C-475 proposed a model that was objective. That is one aspect that must absolutely be improved in order to better protect Canadians' privacy, and I hope this change can be made in committee.

It is important to implement a system that will ensure greater compliance with PIPEDA. With international digital mega-corporations in the picture, our laws are too frequently broken because there are currently no penalties. That is why we need a system of penalties to enforce corporate compliance with PIPEDA and Canadian privacy laws.

Unfortunately, Bill S-4 does not go far enough in this respect. It creates the option of putting together a committee that will act in good faith. Sometimes everyone acts in good faith and is happy, but that is not always how things work.

The commissioner has to be able to issue orders earlier in the process, but that is not what the government has proposed. That is what I proposed in Bill C-475, and that is another change that will have to be made to Bill S-4 before we can support it.

However, what really bothers me about this bill is the provision that would allow organizations to share personal information without a warrant and without the consent of the individual concerned. That is a huge problem. Even though this bill is called the digital privacy act, it contains a provision that could really interfere with the protection of privacy. I find that deeply contradictory.

It is also extremely important to point out that between the time that this bill was drafted and the debate today, the Supreme Court reiterated in its ruling that information such as data from Internet service providers on their clients, including their IP addresses, email addresses, names, telephone numbers, and so forth, are personal information and cannot be obtained without a warrant. Obviously, I am paraphrasing, but that is more or less what the Supreme Court ruled.

I have major reservations about the constitutionality of this provision of the bill. I asked the government to reassess it and withdraw it. Unfortunately, my request was not favourably received.

I think we could work together during review in committee on withdrawing this provision, which may violate the Canadian Constitution. I hope that is why the Conservatives want to send this bill to committee.

Obviously this is a Senate bill. During review in committee, a number of witnesses shared their concerns over this very provision. The Privacy Commissioner said the following in a brief:

Allowing such disclosures to prevent potential fraud [as provided for in clauses 7(3)(a.1) and 7(3)(a.2)] may open the door to widespread disclosures and routine sharing of personal information among organizations on the grounds that this information might be useful to prevent future fraud.

Indeed, the government wants to protect personal information, but allowing access to that information without a warrant, without consent, without any judicial oversight and without transparency is very problematic.

On many occasions, the government has used PIPEDA and its loopholes to call on Internet service providers and ask for Canadians' personal information. Why? We do not know. We do not even know exactly how many requests have been made, because this information is not available to the public. However, based on what the Privacy Commissioner revealed, we know that in a single year, government agencies made at least 1.2 million requests to Internet service providers to obtain personal information about their customers. That is a huge problem.

The government could have taken this opportunity to truly protect Canadians' privacy and to fix the loopholes in PIPEDA that allow this kind of information to be transmitted without legal oversight, without consent and without any transparency. It could have done that. I hope it will do so during the study in committee. That is very important. I am just making a suggestion.

We are debating the motion today. We are prepared to agree to study this bill before it passes at second reading, as is usually the case. I hope that this will be a gesture of good faith, and that the Conservatives will take this opportunity to fix the loopholes in PIPEDA and to eliminate the clause allowing organizations to share information without a warrant. We cannot support a bill that contains provisions that violate Canadians' privacy.

[Dany Morin, NDP, Chicoutimi—Le Fjord, QC]

Mr. Speaker, I thank the two previous speakers.

My colleague from Terrebonne—Blainville had some good questions for the parliamentary secretary. She even introduced Bill C-475, which proposed a number of provisions that can be found in Bill S-4.

Why did the Conservatives not vote in favour of the bill introduced by my colleague from Terrebonne—Blainville, even though several of the provisions in her bill are in Bill S-4, which they want to pass?

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Mr. Speaker, I appreciated the parliamentary secretary's speech; however, today we are debating a motion to send Bill S-4 to committee before it is even debated in the House of Commons. That is a rather exceptional measure. This is the first time this measure has been used since 2011. However, the parliamentary secretary did not provide an adequate reason for why the government wants to speed this process up. I hope it is to fix the mistakes in the bill, and to fix the fact that this bill violates our privacy by allowing organizations to share personal information with each other, without a warrant and without consent.

Can the parliamentary secretary provide a better explanation of why the government wants to send this bill to committee? If it is to make changes, what kinds of changes does the government have in mind?

[Mike Lake, Conservative, Parliamentary Secretary to the Minister of Industry]

Mr. Speaker, I am pleased to rise today to speak to Bill S-4, the digital privacy act.

The purpose of the digital privacy act would be to strengthen our private sector privacy laws and to increase protection for Canadians when they surf the web and shop online.

The digital privacy act would provide a foundation on which the government would hold businesses to account on behalf of consumers. It would establish a new framework and new rules for how private businesses handle, use, and collect the personal information of Canadians.

This past April, the Minister of Industry launched Digital Canada 150, a comprehensive plan for Canada to take full advantage of the digital economy. It is a plan that has clear goals for Canada to be a competitive connected country by the time we celebrate our 150th anniversary in 2017.

Our government understands that when Canadians shop online or make purchases with their credit cards, they want their information to be safe. That is why we introduced the digital privacy act which would improve Canada's private sector privacy laws.

It is the unfortunate reality, in today's digital age, that we need to be more and more wary of hackers and electronic data theft.

Just this past year, businesses like Target, Home Depot and Kmart in the United States, had the credit card information of millions of people lost to hackers.

It is surprising, but under our current rules, it is not mandatory for companies to disclose the theft of this information to their clients.

Under the digital privacy act, companies would now be required to tell their clients when their personal information has been lost or stolen.

In addition, businesses would now need to report these harmful breaches to the Privacy Commissioner. Further to this, companies would need to keep a record of all privacy breaches that have occurred within their organization and the Privacy Commissioner would now have the ability to request information on any of these breaches.

The digital privacy act would also set out hefty penalties for companies that deliberately break the rules and try to cover up a data breach. Organizations would face fines of up to $100,000 per client they fail to notify that the data breach has occurred.

Let me now outline a few more ways the bill would help protect Canadians.

The digital privacy act would introduce stronger rules to protect vulnerable Canadians, like children and seniors, when they surf the web.

Many websites are focused on children, like educational online playgrounds or learning websites. Many times these websites, for marketing purposes, ask to collect personal information from the person using the website.

Under the digital privacy act, we would establish stronger rules and clarify that the wording that these companies use to request personal information needs to be simple enough that a child, or any target audience, can understand.

This means that if the consent required is too difficult for a child to understand, the consent would not be valid.

In addition, the digital privacy act would introduce limited and targeted exceptions where personal information could be shared without an individual's consent.

An unfortunate factor in our society is financial abuse. Currently, banks and financial institutions do not have the ability to alert the appropriate authorities when they suspect a senior is a victim of financial abuse.

The digital privacy act would now give an exception to banks and financial institutions to be able to alert law enforcement when they suspect someone is a victim of financial abuse.

Finally, the digital privacy act would give the Privacy Commissioner new powers to help enforce the law and make companies accountable when the rules are broken.

The Privacy Commissioner would now be able to negotiate compliance agreements with organizations that break the law. This would keep organizations accountable to their commitments to correct privacy issues.

In addition, the commissioner would now have one year, instead of 45 days, to take organizations to court if they do not play by the rules.

The digital privacy act would also give the commissioner a new ability to name and shame organizations that are not co-operating either with an investigation or with their commitments to fix their privacy issues. This would also allow Canadians to become more knowledgeable about issues that affect their privacy.

As technology and the marketplace evolve, we need to be more and more aware of how we can protect ourselves and our information.

The digital privacy act is common sense legislation that would help update our private sector privacy laws and would hold organizations to account when they lose personal information.

The Privacy Commissioner would now have increased power to help enforce the law and would also hold companies to account when they do not play by the rules.

I look forward to the continued debate in this House and to when the bill is referred to the Standing Committee on Industry, Science and Technology where we will hear from expert witnesses as we continue to discuss how to best protect Canadians in our digital world.

I hope all hon. members will join me in supporting Bill S-4.

(Bill S-4. On the Order: Government Orders)

June 17, 2014--Second reading and reference to the Standing Committee on Industry, Science and Technology of Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act--the Minister of Industry.

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, this afternoon we will continue with today’s NDP opposition day.

Tomorrow, we will debate Bill C-13, the Protecting Canadians from Online Crime Act, aimed at combating cyberbullying at third reading.

When we come back from our constituency week, on Monday, October 20, we will consider a motion to refer Bill S-4, the Digital Privacy Act, to the Standing Committee on Industry, Science and Technology prior to second reading. If we have extra time available that day, we will return to the second reading debate on Bill C-21, the Red Tape Reduction Act.

Tuesday, October 21, shall be the fifth allotted day. The Liberals will offer the day’s topic of discussion.

Starting on Wednesday, October 22, the House will consider Bill C-42, the common sense firearms licensing act at second reading. This bill would cut red tape for law-abiding firearms owners and provide safe and simple firearms policies. I would note that this legislation has already been endorsed by a number of key groups, such as the Ontario Federation of Anglers and Hunters, the Saskatchewan Wildlife Federation, the New Brunswick Wildlife Federation, the Canadian Shooting Sports Association, la Fédération québécoise des chasseurs et pêcheurs, the Manitoba Wildlife Federation, and the Nova Scotia Federation of Anglers and Hunters, among others.

Mr. Speaker, I do want to wish you and all members a happy Thanksgiving, and I hope that all will share that with their families.