Bill S-4 (Historical)

Digital Privacy Act

An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) specify the elements of valid consent for the collection, use or disclosure of personal information;
(b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) preventing, detecting or suppressing fraud, or
(iii) protecting victims of financial abuse;
(c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions;
(e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual;
(f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner;
(g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control;
(h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards;
(i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint;
(j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and
(k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.

Digital Privacy Act

[Lawrence Toet, Conservative, Elmwood—Transcona, MB]

Mr. Speaker, I am pleased to rise in my place today to express support for Bill S-4, the digital privacy act, which was first introduced in April of last year. The digital privacy act would make important changes to Canada's private sector privacy law, the Personal Information Protection and Electronic Documents Act, or PIPEDA, to better protect the privacy of Canadians.

I would like to spend my time highlighting the measures in Bill S-4 that are designed to better safeguard the privacy of minors and protect vulnerable members of our society. In our modern digital economy, it is absolutely critical that we make sure our children have safe and secure access to online resources.

Being digitally literate is no longer merely nice to have; it is now a necessary prerequisite for young Canadians, whether to be successful in school or to find their first job. In fact, a recent survey revealed that in 2013, 99% of Canadian students were able to access the Internet outside of school.

While there are many benefits to being digitally connected, going online can also expose our children to risks. As we have unfortunately seen, young people can become targets of online intimidation and abuse. Our government has acted to protect our children from cyberbullying and other similar threats through Bill C-13, the Protecting Canadians from Online Crime Act. This bill, which came into force on March 9, 2015, ensures that all Canadians can freely access the Internet without fear of victimization.

Bill C-13 protects children and adolescents from online predators and exploitation. Provisions of the bill permit and empower the courts to penalize those who harass, intimidate, exploit, or threaten others online or through telecommunication devices. In other words, Bill C-13 serves to counter cyberbullying in Canada.

The Government of Canada takes cyberbullying very seriously and supports a no-tolerance framework. In January 2014, our government launched the anti-cyberbullying national awareness campaign called Stop Hating Online, which raises awareness of the impact of cyberbullying and how this behaviour amounts to criminal activity.

We have also taken further steps to protect children from online predators. Our government has invested $14.2 million a year through the national strategy for the protection of children from sexual exploitation on the Internet. In addition to Bill C-13, our government has implemented other concrete measures to keep young Canadians safe online and in their communities. Such measures include increasing the maximum penalties for luring a child online, strengthening the sentencing and monitoring of dangerous offenders, and strengthening the sex offender registry, to name only a few. All of these initiatives align with our government's commitment to stand up and protect Canadians.

Bill C-13 was introduced to provide a safe and secure environment for Canadians online, and the digital privacy act seeks to accomplish this as well. In this rapidly growing digital world, we must be aware that going online can expose vulnerable Canadians to privacy risks. For example, minors can be subject to aggressive marketing tactics or can have their personal data collected and shared without them truly understanding what is being done and the potential long-term privacy consequences.

To address this concern, the digital privacy act includes an amendment to clarify requirements for the collection, use, and disclosure of personal information. Specifically, the bill clarifies that when a company is seeking permission to collect, use, or disclose personal information from a group of individuals, such as children, it must take the necessary steps to ensure that, as a group, these individuals are able to understand what would happen to their personal information. In practice, this means that the organization's request for information must be presented in a clear and concise manner and must be appropriate for and easily understood by the target audience. This includes making sure the wording and language used in the request are age-appropriate.

Let me take a minute to give an example explaining to the members of the House how this would work. Let us say that an online service designed for children wishes to gather information about who visits their site. In order to seek consent, the company would be required to design and present its request to collect, use, and disclose information using language that a child could reasonably be expected to understand. If a child could not be expected to understand what the website seeks to do with their information, the child's consent would not be valid. As a result, consent from a parent would need to be sought.

The Privacy Commissioner expressed his strong support for this amendment when appearing before the standing committee. This is what the Privacy Commissioner said:

I think with the clarification that Bill S-4 provides, it is a useful clarification of what consent is, and it has the potential of improving the situation for the issue of consent sought from children....

There are additional amendments in Bill S-4 that are also designed to better protect the interests of other vulnerable individuals. I would like to bring to the attention of hon. members two particular amendments that would allow information to be more easily shared in emergency situations.

The first of these amendments would allow organizations to share personal information in order to contact a family member of an injured, ill, or deceased individual. The importance of this amendment was well summarized by the representative of the Canadian Pharmacists Association in her appearance before the standing committee when she said:

Pharmacists, as well as any health care provider, may find themselves in the difficult situation of having to deal with patients who may be severely ill, unconscious, or incapacitated for any number of reasons. In such circumstances it may be imperative for the pharmacist or other health professional to immediately contact family members or next of kin to inform them of the patient's condition, or to seek valuable information on the patients' medical history. But seeking permission or consent to contact those individuals in advance may simply not be reasonable nor in some cases possible. This clause would provide pharmacists and other health care providers with the comfort and knowledge that in the case of a severe health emergency they will not be in contravention of PIPEDA for acting in the best interests of their patients by contacting next of kin or authorized representatives.

The second of these amendments would allow information to be shared in situations such as accidents or disasters, in order to assist in the identification of injured, ill, or deceased individuals. For example, this would allow dentists to provide an individual's dental records to authorities in order to identify victims of a natural disaster.

These two amendments are clearly in the public's interest and are long overdue.

The government is committed to protecting the privacy of Canadians. The digital privacy act would take necessary actions to protect the most vulnerable members of our society, including children.

The House resumed consideration of Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, as reported without amendment from the committee, and of the motions in Group No. 1.

[James Bezan, Conservative, Parliamentary Secretary to the Minister of National Defence]

Mr. Speaker, it is my pleasure to be here today to express my strong support for Bill S-4, the digital privacy act. This bill would make significant and long-overdue improvements to Canada's Personal Information Protection and Electronic Documents Act, or PIPEDA.

One question that has been asked repeatedly by members opposite is why the government is not amending PIPEDA in response to the Supreme Court of Canada's decision in Canada v. Spencer. They claim they cannot support the digital privacy act because the bill fails to act on this decision. Those are very strong words and it is clear that the opposition parties have not done their homework before speaking on this matter.

The answer to their question is quite simple. The government is not proposing amendments to PIPEDA in response to the Spencer decision because the Supreme Court confirmed that PIPEDA does not give the police any search and seizure powers. In fact, the whole purpose of the law is to increase the protection of Canadians' personal information.

Given the questions that have been raised around the Spencer decision, it is important that I take time today to clear up some of the misinformation. My hon. colleagues opposite do not need to take my word for it. They can always take the time to read paragraphs 71 and 73 of the decision themselves. The Spencer decision deals with a child pornography investigation carried out by the Saskatoon police department. As part of the ongoing investigation, police identified the IP address of a computer that was being used to access and distribute child pornography.

It is important to understand that the police were able to obtain the IP address simply by going online and interacting with the child pornographer, because computers make their IP addresses public whenever they engage in a file-sharing activity. With this IP address in hand, the police then asked the Internet service provider to voluntarily provide account information for the subscriber assigned to the IP address. The account information included the subscriber's name and mailing address. The police asked for the service provider's co-operation on the good faith belief that the subscriber did not have a reasonable expectation of privacy with respect to his or her basic account information, which is the individual's name and address.

With this information in hand, the police obtained a warrant to search the suspect's house, at which time a computer was seized and found to contain child pornography. Mr. Spencer was charged and convicted of possession of child pornography. Mr. Spencer appealed his conviction on the grounds that he had a reasonable expectation of privacy with respect to the account information obtained by the police. In other words, he argued that the police were required to obtain a warrant before getting his basic subscriber account information from his Internet service provider to make sure that his charter rights were respected.

In its decision, the Supreme Court found that Canadians in general have a reasonable expectation of privacy with respect to their Internet browsing habits and history. This is because the sites we visit and the online activities we engage in can reveal “intimate biographical details” about ourselves, details that we may wish to keep private. Because linking an IP address with a specific account holder enables the police to learn about and observe an individual's Internet habits, the court found in the specific circumstances of the Spencer case that the police should have obtained a warrant from a judge to collect Mr. Spencer's account information.

It is, however, important to note that because the police were acting in good faith, believing that Mr. Spencer did not have a reasonable expectation of privacy in his account information, the court did not exclude the evidence obtained by the police and Mr. Spencer's conviction was upheld.

These are the facts. It is difficult to see how this decision means that PIPEDA, the digital privacy act or Bill S-4 in some way violates the charter rights of Canadians, as the members opposite have asserted at every opportunity. This is blatantly false.

As I stated at the outset of my remarks, the Supreme Court confirmed that PIPEDA does not create any search and seizure powers for law enforcement. Nothing in the law compels companies to provide personal information to law enforcement and the digital privacy act would not change that fact.

Justice Cromwell stated in his decision, “In short, I agree with the Ontario Court of Appeal...on this point that neither...the Criminal Code, nor PIPEDA creates any police search and seizure powers”.

He said, “PIPEDA is a statute whose purpose” as set out in section 3 “is to increase the protection of personal information”. Justice Cromwell further clarified that there are clear restrictions that PIPEDA places on disclosures by private businesses to law enforcement agencies. He stated that even in child pornography cases, the circumstances “cannot override the clear statutory language of...PIPEDA, which permits disclosure only if a request is made by a government institution with 'lawful authority' to request the disclosure”.

This fact clearly demonstrates that PIPEDA prohibits unlawful disclosure unless the requirements of the law are met, including that the government institution demonstrates the necessary authority to obtain, not just simply to ask, for the information.

In addition to a warrant or court order, what might this lawful authority to obtain information include? Justice Cromwell stated:

“Lawful authority” may include several things. It may refer to the common law authority of the police to ask questions relating to matters that are not subject to a reasonable expectation of privacy. It may refer to the authority of police to conduct warrantless searches under exigent circumstances or where authorized by a reasonable law.

Justice Cromwell clearly noted that issues of disclosure and lawful authority arose in this case simply because the investigation was begun by police. This is simply not the case for private organizations. In his Supreme Court decision, Justice Cromwell wrote that, “...entirely different considerations may apply where an ISP itself detects illegal activity and of its own motion wishes to report this activity to the police”.

To summarize, this is what the Supreme Court said about PIPEDA in the Spencer decision.

PIPEDA does not provide law enforcement with any “search and seizure powers”.

Consistent with the charter, PIPEDA permits businesses to disclose personal information to law enforcement without consent in only the following circumstances: law enforcement have a warrant or a similar court order; the information is required to address an emergency, such as information that is needed to stop a crime in progress that threatens someone's life; the law enforcement agency is acting pursuant to a specific law that gives it the authority to obtain private information without a warrant; in response to a routine inquiry by law enforcement regarding information for which there is no reasonable expectation of privacy; or the organization, on its own initiative, provides the information to police to report a crime.

Clearly, the Supreme Court did not find any part of PIPEDA unconstitutional.

I hope that with this clarification, all hon. members will join us in supporting the digital privacy act Bill S-4, the digital privacy act, in ensuring that Canadians' personal information is protected.

[Jasbir Sandhu, NDP, Surrey North, BC]

Mr. Speaker, I rise in the House today on behalf of my constituents from Surrey North to speak on Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another act. I rise today because I oppose the bill in its current form.

Members from three parties proposed amendments to the bill so that it would stay within constitutional boundaries. However, the Conservatives rejected every single one of those amendments, even the amendments that were drafted according to the comments and suggestions from the witnesses.

As the official opposition, it is essential that we carefully review the legislation and voice dissenting opinions in order to ensure that each bill is thoroughly examined. In this case, as in most cases that I have experienced in the past four years, it is evident that the Conservatives are determined to push through their own agenda on their own timeline.

I feel strongly that it is important for Canadians to know that their privacy is being protected, especially in the digital age that we live in. However, just because the Conservatives have not conducted the mandatory five-year review of the Personal Information Protection and Electronic Documents Act, PIPEDA, does not mean that we should rush through an unbalanced bill.

I feel very strongly that the bill before us was not well studied and needs to be fixed before it is passed through the House. In fact, the Conservatives did not support or submit any amendments to the bill because they did not think that would allow enough time to pass the bill before the election. This sounds politically expedient to me. Canadians deserve better than what the Conservatives are giving them.

The issues surrounding online privacy and safety are not new problems. Rather, they are existing problems that have become increasingly harder to protect against as technology continues to advance. Therefore, given the changing nature of the problem, it is important that the legislation that we create also evolves.

I am glad that after so many years of inaction, we are finally considering legislation to address online privacy issues. My colleague, the member for Terrebonne—Blainville, tried to take action to protect Canadians' privacy back in 2012 with Bill C-475. Unfortunately, that bill, which was stricter and more effective than the bill before us although very similar to it, was voted down by the Conservatives.

The Conservatives have become very good at pretending they know how to do their jobs and protect Canadians. They are actually able to stand up in this House and lie through their teeth in saying that this is a balanced bill, and they believe that.

Online privacy and security breaches have the potential to significantly harm an individual. Protecting these rights is important for all Canadians so that we do not put anyone potentially in harm's way.

Some Canadians may feel that the bill does not affect them in their daily lives, but I can assure them that Bill S-4 would affect every single Canadian.

One part of the bill that I am very concerned about pertains to the sharing of our personal information. The bill contains a provision that would make it easier for companies to share our information without our knowledge or consent, without a warrant, and with zero oversight. It is troubling to me that there is no mechanism in place for oversight.

Do the Conservatives remember the ruling in Regina v. Spencer? I do. In this decision, the Supreme Court of Canada ruled that Canadians have a reasonable expectation of privacy online. More specifically, the Supreme Court stipulated that spyware data cannot be disclosed to a third party without a warrant.

In light of this decision, it is questionable whether certain provisions in Bill S-4 are even constitutional. There are limits on what the government can do, but the Conservatives seem to have forgotten that.

We are demanding that every clause pertaining to the warrantless disclosure of information be withdrawn out of respect for the Supreme Court ruling and the privacy of Canadians.

There is no doubt that the Conservatives have a dark past when it comes to protecting personal information, and this bill would only add to that darkness. The lack of oversight and the allowance of warrantless disclosure has led to 1.2 million secret requests from Conservative government agencies for personal information from telecommunications companies in one year alone. Under the current Prime Minister, staggering numbers like this show that something needs to change, and it starts with this bill.

The Conservatives' hesitation to accept amendments to this bill makes me question whose interests they are truly protecting. Are they protecting the interests of Canadians, who deserve to trust that their personal information will be protected, or are the Conservatives protecting their own self-serving interests?

We would like to see this bill contain a mandatory data loss or data breach reporting mechanism. However, the bill in its current form would most likely result in fewer breaches being reported. It would be up to the organization that suffered the breach to determine if the breach posed a real and significant risk of harm. Companies want to save their reputation and money, so why would they inconvenience themselves by reporting a potentially embarrassing breach of privacy that could cause consumers to lose trust in them when they could just hide it instead?

There would be no incentive to report a breach and no advantage to doing so. This is a conflict of interest that would deprive Canadians of the information that they need to make informed choices about which companies they decide to share their personal information with.

Furthermore, because of the Conservatives' inaction, PIPEDA, which is supposed to be updated every five years, is falling far behind international standards. Since the first statutory review in 2007, subsequent attempts to amend PIPEDA have died on the order paper. After this long wait to update PIPEDA, the bill would simply not go far enough to protect Canadians in this digital era. We as Canadians are getting the message that the government does not take the protection of personal information seriously.

I, along with my fellow NDP members, truly do not ask for much when it comes to this bill. We have long called for the modernization of Canadian privacy laws. They are not up to date. Instead of making it easy for companies to share our information, the government should put deterrent penalties put in place that would require or encourage these private companies to respect and follow Canadian laws. Following that, we insist that the provisions in Bill S-4 to allow organizations to share personal information without consent or a warrant be removed and that the loopholes in PIPEDA, which do the same thing, be closed.

The point of the Constitution and the Canadian Charter of Rights and Freedoms is to protect the very rights and freedoms contained within them. Warrantless access to our subscriber data and personal information most definitely poses a risk to Canadian privacy.

Modernizing the laws that govern the protection of personal protection is an important issue in the digital age. However, ramming through a bill that has huge holes, such as this bill, is not a fix that can make up for years of inaction by the current government. I urge the Conservatives to accept the amendments to this bill so that we can work collaboratively to ensure that all Canadians can trust that their personal information is being protected to the best of the government's ability.

One of the other things that was very troubling was seeing time allocation moved for the 97th time. Time allocation basically puts closure on this bill. It does not allow for all of the members to bring the views of their constituents into the House, which is one of our primary jobs.

This is the 97th time the Conservatives have done it and I can assure you, Mr. Speaker, they are not going to get the chance after October 19, because Canadians are tired. They have seen democracy and the workings of democracy crumble. These guys are going to be out.

[Paulina Ayala, NDP, Honoré-Mercier, QC]

Mr. Speaker, on June 2, 2014, the Supreme Court of Canada handed down an important decision about sharing personal information.

In their decision, the Supreme Court justices stated that information about customers, including their names, addresses, email addresses, phone numbers and IP addresses, could not be shared with a third party without a warrant.

In light of that decision, does the member believe that some of the provisions in Bill S-4 might not be constitutional?

[Michelle Rempel, Conservative, Calgary Centre-North, AB]

Mr. Speaker, as I mentioned in my speech, the changes in this bill affect private investigations, which, as the bill defines, are investigations carried out by a private sector organization, not a government authority.

With regard to the Supreme Court decision, the Supreme Court itself noted that PIPEDA does not create any search and seizure powers for law enforcement; instead, it allows companies to provide information to police should they choose to do so when—and here is the kicker—the police are legally able to obtain the information, meaning through normal warranting procedures.

The court has clearly stated that this is only when police have a warrant, are acting in exigent circumstances, are acting under an authority granted to them in law, or are obtaining information for which there is no reasonable expectation of privacy.

The Supreme Court decision itself clarifies how PIPEDA works, and it does not mean how the act or Bill S-4 needs to change.

I hope that my colleague will inform himself. I know he is well informed on this bill. He certainly knows the ramifications of the Supreme Court ruling in this regard. I hope that he would actually provide the correct information to his constituents and to folks abroad about this. Indeed, as the member for Terrebonne—Blainville said on April 8, 2014, “We have been pushing for these measures and I'm happy to see them introduced.”

This is something that supports all Canadians and is a common sense measure to help strengthen our legal system.

[Michelle Rempel, Conservative, Minister of State (Western Economic Diversification)]

Mr. Speaker, I am pleased to rise to speak on behalf of Bill S-4, the digital privacy act, which is referred to the House by the Standing Committee on Industry, Science and Technology.

When Parliament first enacted the Personal Information Protection and Electronic Documents Act, commonly known as PIPEDA, in 2001, it recognized there were certain limited circumstances in which an individual's right to privacy must be balanced with other fundamental rights and public interest.

One such interest is the need for investigations into breaches of agreements, contraventions of law and for fraud prevention, which in certain circumstances must be conducted by the private sector.

Examples of these are common. They include investigations into professional misconduct by self-regulating professional associations, like the provincial colleges of physicians and surgeons, as well as the law societies. Another example is cross-sector investigations to detect crime and prevent fraud, such as the work done by the Bank Crime Prevention Centre and Investigation Office of the Canadian Bankers Association and the investigative services division of the Insurance Bureau of Canada.

It is not difficult to see that there is a real public interest in ensuring that these organizations have the ability to investigate. In order to do so, they must be able to obtain personal information that is protected under PIPEDA.

The Privacy Commissioner told the committee:

I totally agree that there needs to be provision in PIPEDA allowing organizations to address the issue of fraud or breaches of agreements that they may face.

The need for such a provision is also recognized within the legal community. The committee heard from Eloise Gratton, leading privacy officer and partner at the law firm of Borden Ladner Gervais and a professor of law at the University of Montreal. Ms. Gratton spoke of her own experience as counsel to private organizations conducting investigations into wrongdoing. She said:

The bottom line is that I agree that we need to have a provision authorizing the disclosure of personal information without consent to address these types of situations.

To enable this type of information sharing, PIPEDA currently has a regime that allows organizations to disclose an individual's personal information in order to conduct certain types of investigation.

As it stands right now under the current law, investigators who want to access personal information must be listed as an investigative body in the regulations. This involves coming forward with an application to the government and if the federal cabinet decides that the application is warranted, the organization is added to the list.

This is an extremely burdensome process for organizations. During the first parliamentary review of the act in 2007, the Standing Committee on Access to Information, Privacy and Ethics recommended that this system be scrapped and replaced with a different set of rules based on those that had been in place for a decade in Alberta and British Columbia. The bill would implement this recommendation.

A number of witnesses who came forward at the committee to express support for the importance of the changes within the bill expressed many positive sentiments in this regard.

The Life and Health Insurance Association of Canada told the committee that these amendments would help the industry's effort to detect, deter and minimize insurance fraud, which is stated to be extremely costly to the industry. A witness from the association explained to committee members that there was a current gap in PIPEDA to which he said:

[It] restricts the ability of organizations to disclose information without consent...for the purpose of conducting an investigation into a breach of an agreement or of a law of Canada.

The Central Credit Union of Canada also testified that it supported the proposed exception for consent for fraud prevention. In the words of the Central Credit Union witness it would:

—reduce the administrative burden associated with some of the activities of...my organization's Credit Union Office for Crime Prevention and Investigation.

Finally, the Insurance Bureau of Canada also spoke to the importance of the proposed amendments for the investigation and prevention of automobile fraud. According to Insurance Bureau statistics, automobile fraud cost the Ontario economy an estimated $1.6 billion in 2014 alone.

The witnesses from the Insurance Bureau explained in detail to the committee how Bill S-4 would make an insurance crime easier to detect and prevent as a result of the changes our government was making, and this is great news. However, I should note that during the committee's review of the bill, some concerns were expressed about the potential for misuse of such an exception to consent or resulting in the over-sharing of personal information, as my colleagues opposite have noted today.

However, the bill would protect against this aspect. Organizations can only make use of the exception to consent when a four-part test is met.

First, the disclosure must be made to another private organization, not to the government or to law enforcement. Disclosure to government authorities must follow a different set of rules, for example, when police must obtain a warrant to get private information.

Second, the exception to consent is only available if the information is being shared for the purpose of conducting an investigation into a breach of Canadian law or a breach of an agreement, such as a contract, and it must be reasonable. This means that an average Canadian must be able to see the merit of disclosing the information in question for the purposes of an investigation.

Third, the investigation has to be legitimate. It must pertain to a contravention of law or a breach of agreement that has occurred, is occurring or is imminent. Information cannot simply be disclosed because an agreement might be broken.

Finally, it must be reasonable to believe that seeking the consent of the individual in question to disclose the information would compromise the investigation, for example, by allowing them to destroy or alter evidence.

The intention of this four-part test is to allow legitimate investigations that are in the public interest to take place in a manner that is being balanced with an individual's right to privacy.

My colleagues have brought up the issue of copyright trolling. Certain concerns have been raised that copyright lawyers could abuse the amendment to target Canadian consumers. Let me be clear. This type of activity is not an investigation. Nor is it fraud prevention. Under no circumstances do we believe this proposed amendment provides a backdoor that could be used for trolling, due to these tests. PIPEDA has always provided a legal certainty with respect to the rights of legitimate private sector investigations. Bill S-4 maintains that legal certainty.

I also want to touch on a couple of comments that have been made in light of the bill.

First is the definition of “significant breach”. There has been some doubt as to what this means. As set out in the bill, a significant breach is a breach that poses a real risk of significant harm based on the sensitivity of the personal information involved in the breach, the probability that the personal information has been, is being, or will be misused and any other factor prescribed in the regulations.

The definition of “significant harm” was also brought up. It is defined in Bill S-4 as bodily harm, humiliation, damage to reputation or relationships, loss of employment, business or professional opportunities, financial loss, identity theft, negative effects on a credit record or damaged or lost property.

There was also some doubt about “private investigation”. It is defined as an investigation carried out by private sector organizations, therefore, not a government authority into an alleged contravention of a Canadian law, or an alleged breach of agreement.

Since we are getting to the end of this session of Parliament, should I not have an opportunity to rise again in debate in the next few weeks, I would like to thank all of my constituents in Calgary Centre—North for the privilege of allowing me to serve them in the last four years, as well as my volunteer team and certainly, in a moment of non-partisanship, my colleagues across the aisle and in the House who every day travel away from their families to spend time in the honour of public service. This is not a job. This is service. Certainly, when we all rise here in debate to discuss these issues, we might be passionate opponents one way or the other but we all do it to build a better Canada.

It is a wonderful position to be in to rise to support bills like this, which are common sense measures to make Canada a better place, to support better legislation, better privacy, better access to information and strengthening Canadian laws. These are the things with which we as parliamentarians are often seized.

It is always a great pleasure to speak in this place and it is a great pleasure to be here as a parliamentarian.

[Matthew Dubé, NDP, Chambly—Borduas, QC]

Mr. Speaker, I am pleased today to speak to the very important Bill S-4. It concerns the sharing of personal information in the digital age. It deals mainly with the way in which we legislate against companies responsible for the loss or sharing of information. We know this is a very sensitive issue because we are in the digital age where more and more personal information is found online. We think first of banking information, and also of information that sometimes seems not that important, but that is nevertheless part of peoples' private lives. It is information that we share on social networks, such as photos.

This covers all kinds of of complex issues, such as copyright, that we have addressed in the House since the last election, and the dissemination of information pertaining to national security. We had an important debate on this issue during the debate on Bill C-51. We learned that information technology companies, or startups, had concerns about some of the bill's provisions.

Of course, we are all familiar with the infamous story of Bill C-30, where the minister of public safety and emergency preparedness at the time told us that we stood either with the government or with child pornographers. This example shows just how big an issue we are dealing with and the Conservatives' poor record in this regard.

First, I would like to mention something very important and very simple: the obligation to review the privacy legislation every five years. Obviously, this is very important given how quickly technology changes. Unfortunately, such a review has not been implemented. A number of bills were introduced in this regard, but they died on the order paper when the Prime Minister prorogued Parliament. There was, of course, Bill C-30, which is a whole other story, and there was also the bill introduced by my colleague from Terrebonne—Blainville. That bill, which the government refused to support, sought to implement a robust privacy review process, give more power to the Privacy Commissioner and have clearer legislative provisions.

Bill S-4 includes similar provisions. However, they do not go far enough and there are still worrisome loopholes. One of the grey areas that I am particularly concerned about has to do with organizations, such as banks, that could share private information. These organizations are required to report a loss of personal information to the Privacy Commissioner only “if it is reasonable in the circumstances to believe that the breach creates a real risk of significant harm to an individual”. That may seem clear, but when it comes to legislative measures, we can see that there is a lot of leeway in how this provision of the bill is worded. The company could decide that no one's privacy was really violated and that there was no risk of harm to the individual and simply not report the privacy breach.

One of the flaws in this bill is the requirement for a court warrant, which my colleague from Terrebonne—Blainville brought up earlier and which she included in her bill. The Supreme Court recently ruled that any invasion of privacy by the government and any request that the government makes to a private company that is in possession of our information require a mandate. There is no such requirement in this bill, which is extremely worrisome. That is why I made the link earlier to Bill C-51 and the debate on Bill C-30, which did not end up taking place because we managed to get the government to back down. The government seems to be on the wrong track and does not seem to take privacy seriously.

Its record is a great example of that. How many times does the House need to hear criticisms about mismanagement at the Canada Revenue Agency, for example, during question period or at every possible opportunity, whether it is when bills are introduced and petitions are presented or at press conferences?

This department is in possession of the most sensitive information on Canadians, such as their social insurance numbers and their tax information. The department has been the victim of data breaches, and the government does not seem to be taking any responsibility. That makes it hard for us to trust that the government will require private companies to comply with high privacy standards when it is not capable of doing so itself. This situation is extremely worrisome.

We know that this is a complex issue because more and more things are done online. As far as matters of national security are concerned, we know that as legislators we have work to do. We wanted to propose amendments to ensure that this bill went further and complied with the Supreme Court decision. Like a number of witnesses in committee, we question the constitutionality of this bill in its current form.

If I am not mistaken, the 18 amendments the NDP proposed were all rejected. True to form, the Conservatives did not listen to any of the testimony or pay any regard to the amendments proposed by all the parties. The amendments proposed by the NDP were all based on what the public had to say and on the very hard work of my colleague from Terrebonne—Blainville, who was trying to get suitable provisions for 2015, not 2000. Technology changes and so does our reality, and we have to adjust accordingly.

In this context, there are a number of troubling aspects. First, this bill was introduced in the Senate, which, naturally, we criticize every chance we get. The Minister of Industry made an announcement about how he wants to proceed in the digital age, but instead of introducing this bill in the House himself, he introduced it in the Senate. That is one problem.

The second problem is that the Conservatives wanted to skip second reading and send the bill straight to committee. That is not a bad idea in and of itself. The NDP has asked for the same in order to study certain extremely complex files.

For example, we asked to take this approach for Bill C-23, which we called the “electoral deform” bill. Since the government wanted to go straight to committee, we thought it was willing to accept amendments and listen to witnesses, but that did not happen.

The third problem concerns another of the government's bad habits: the honour of the 97th time allocation motion was bestowed on Bill S-4 in order to limit debate. Unfortunately, at this rate, the Conservatives will have moved 100 such motions by the time the election is held. To be blunt, that is pretty shabby.

Although it is important to protect Canadians' privacy and to do what it takes, in 2015, to implement an approach appropriate for the digital age, recent Supreme Court decisions have cast doubt on the constitutionality of this bill.

This bill does not go far enough, and since the government wants to limit debate and does not accept the amendments and the work done in committee, we cannot and will not support this bill. I am very pleased to rise in the House to say that.

The House resumed from May 12 consideration of Bill S-4, An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act, as reported (with amendments) from the committee, and of the motions in Group No. 1.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

Thank you, Mr. Chair.

I would like to support my colleague's motion to increase the funding for those three commissioners. When they testified last week, they told us they were making as many cuts as possible, but that they have run up against a wall. Their current funding no longer enables them to fulfill their mandate.

The Office of the Information Commissioner even went through a crisis. At the end of last fiscal year, the commissioner made an urgent request for a funding increase. She had only 0.2% of her budget left. She was worried, not about her office, but about Canadians' right of access to information. I repeat that the right is quasi-constitutional. By failing to allocate our commissioners the funding that enables them to continue to operate and do everything their mandate requires, we are letting Canadians down. That is the key issue.

The Privacy Commissioner, who has been assigned new responsibilities, told us that he was managing for now, but that he could not get through another fiscal year after the implementation of Bills S-4 and C-51. Many bills directly affect his activities. He will be asked to carry out more and more tasks with less and less funding, and that's unreasonable. He said that he could not go on much longer with the current funding. The Lobbying Commissioner also said that it was becoming increasingly difficult for him to deliver on his mandate with the funding he receives.

In closing, I would like to say that the commissioners are there to implement an accountability system, so that someone oversees our actions as parliamentarians, and those of lobbyists, and to ensure that regulations and acts are being complied with. Their actions are being limited when they are not given an opportunity to carry out their activities properly. It's as if we were saying to those tasked with overseeing us that we no longer want their oversight. It is really disgraceful.

I would really like us to give serious consideration to this motion and not to cast it aside as we have others. As my colleague said, I think it would be good for the future Parliament to provide the commissioners with the funding they need to deliver on their mandate properly.

Thank you.

Business of the House

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, when it comes to reducing taxes everyone knows these are Conservative ideas and Conservative proposals. In fact, when we reduced the GST from 7% to 6% to 5%, saving Canadians billions of dollars, the NDP voted against that measure to benefit Canadians. Therefore, we know who is delivering on lower taxes for Canadians.

This afternoon we will start the report stage of Bill S-7, the zero tolerance for barbaric cultural practices act. Needless to say, I am disappointed to see on today’s notice paper some 17 report stage amendments, which, all told, would eviscerate the content of the bill. From these proposals, the opposition are clearly signalling that they do not support this Conservative government’s efforts to send a strong message to those in Canada, and those who wish to come to Canada, that we will not tolerate cultural traditions that deprive individuals of their human rights. Early and forced marriages, “honour”-based violence, and polygamy will not be tolerated on Canadian soil, so Conservatives will be voting against all of these opposition amendments.

Tomorrow, we will resume the third reading debate on Bill C-42, the common sense firearms licensing act. I am optimistic we can pass the bill soon so the Senate will have adequate time to consider these reductions in red tape, which regular, law-abiding Canadian hunters, farmers and outdoor enthusiasts face.

Monday shall be the sixth allotted day. The New Democrats will provide a motion for the House to debate when we come back from a weekend in our constituencies.

We will complete the report and second reading stages of Bill S-4, the digital privacy act, on Tuesday. Earlier today, the House heard my colleague, the Minister of Industry, explain the importance of this key legislation.

Wednesday, we will see the House return to the report stage of Bill S-6, the Yukon and Nunavut regulatory improvement act. This legislation is clearly both needed and wanted north of 60. Bill S-6 would modernize regulatory regimes up north and ensure they are consistent with those in the rest of Canada, while protecting the environment and strengthening northern governance.

Next Thursday, June 4, will be the seventh allotted day, when the House will again debate a topic of the New Democrats' choosing.

Finally, for the benefit of those committees studying the supplementary estimates, I am currently eyeing Monday, June 8 as the final allotted day of the supply cycle. I will, however, confirm that designation at this time next week.

Bill S-4--Time Allocation Motion

[Blaine Calkins, Conservative, Wetaskiwin, AB]

Mr. Speaker, I certainly appreciate the comments the minister has made. I will just use my time to ask a substantive question about the piece of legislation.

When I sat on the ethics and privacy committee for a number of years, we did have substantive debates about these kinds of issues. We have had previous versions of this legislation, which has come forward in previous sessions of this Parliament.

I am very glad to see the government moving forward in getting the bill passed. It has already been through the Senate and is now here in the House. We have the opportunity to have this debate and get this legislation passed in a timely fashion.

As a parent, something that concerns me is the amount of time my children spend online and the lack of rules and regulations in some instances that we know are there, some of the risks and some of the issues that are online, and the lack of clarity and the lack of standardization. We know full well some of the issues that pertain to that.

I am wondering if the minister could speak to how Bill S-4 actually improves the online world insofar as protecting young people, vulnerable people, and especially children.

[Laurin Liu, NDP, Rivière-des-Mille-Îles, QC]

Mr. Speaker, I would like to correct some of the false information the minister has spread. First, he said that we had enough time to debate Bill S-4 on Canadians' privacy. Unfortunately, we had just one day to debate this very complex bill that Canadians consider controversial. We have unfortunately not had enough time to study this bill thoroughly in the House.

In his speech he showed contempt for the official opposition. He is wrong: all of the recommendations were proposed by the official opposition. This is not how our Parliament should work. He also mentioned the Information Commissioner. There has been a flagrant lack of respect for the Information Commissioner during this Parliament.

Not only did the government not accept any of the recommendations that the Information Commissioner made during the study of Bill S-4, it also prevented the Information Commissioner from testifying before the committee during the study of Bill C-51, a bill that, as we all know, is even more controversial than Bill S-4.

This is the 97th time they have invoked closure in the House of Commons. That is not something to be proud of. The government keeps breaking records when it comes to gag orders in the House.

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

Mr. Speaker, I completely disagree. That is what we did with Bill S-4. We had a very respectful and serious debate. We spoke about this bill in depth and talked about the implications of a bill as complex as this one.

In the debate in the House and in committee, and outside the House of Commons, we have had respectful exchanges with the government's partners that are affected by this bill, such as lawyers, representatives of the private sector and the Privacy Commissioner. We carried out analyses, we took part in debate, and presentations were made to the government. We made decisions after truly listening to the people who had concerns about the status quo.

We listened to them and that is why the chamber of commerce, former privacy commissioner Chantal Bernier and Daniel Therrien support this bill. I have a long list of people who support the bill. A large group of Canadians pointed out that our government listened. We did our analyses, we did our homework and we came up with a balanced bill that not only meets the interests of our commercial and electronic future and Canadians' needs, but also meets the government's need to have a really effective bill on Canadians' privacy.

That is what we did. There was debate here, in the House, at committees and outside the House of Commons, before we introduced the bill and while it was before the House. We continue to follow an approach that is democratic and effective, as part of a process that truly achieves results.

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

Mr. Speaker, as the Speaker and a member of the House of Commons, you are well aware that this is always a very important discussion to have at the beginning of each Parliament.

In the future, it will be very important for every one of us to discuss the serious nature of our work in the House of Commons and the way that we are all going to participate in debate that is respectful to our constituents. We need to have that conversation not just here in the House, as an institution, but also within our political parties.

That discussion will be even more important when the number of seats in the House of Commons goes from 308 to 338 this fall. This is always a topic of discussion within the parties, particularly with regard to the House of Commons.

In my opinion, our government is very serious about meeting the needs of Canadian taxpayers and having effective and respectful debates about the content of our bills. That is what we have done with Bill S-4.