Bill S-4 (Historical)

Digital Privacy Act

An Act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act

This enactment amends the Personal Information Protection and Electronic Documents Act to, among other things,
(a) specify the elements of valid consent for the collection, use or disclosure of personal information;
(b) permit the disclosure of personal information without the knowledge or consent of an individual for the purposes of
(i) identifying an injured, ill or deceased individual and communicating with their next of kin,
(ii) preventing, detecting or suppressing fraud, or
(iii) protecting victims of financial abuse;
(c) permit organizations, for certain purposes, to collect, use and disclose, without the knowledge or consent of an individual, personal information
(i) contained in witness statements related to insurance claims, or
(ii) produced by the individual in the course of their employment, business or profession;
(d) permit organizations, for certain purposes, to use and disclose, without the knowledge or consent of an individual, personal information related to prospective or completed business transactions;
(e) permit federal works, undertakings and businesses to collect, use and disclose personal information, without the knowledge or consent of an individual, to establish, manage or terminate their employment relationships with the individual;
(f) require organizations to notify certain individuals and organizations of certain breaches of security safeguards that create a real risk of significant harm and to report them to the Privacy Commissioner;
(g) require organizations to keep and maintain a record of every breach of security safeguards involving personal information under their control;
(h) create offences in relation to the contravention of certain obligations respecting breaches of security safeguards;
(i) extend the period within which a complainant may apply to the Federal Court for a hearing on matters related to their complaint;
(j) provide that the Privacy Commissioner may, in certain circumstances, enter into a compliance agreement with an organization to ensure compliance with Part 1 of the Act; and
(k) modify the information that the Privacy Commissioner may make public if he or she considers that it is in the public interest to do so.

Bill S-4--Time Allocation Motion

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

Mr. Speaker, the fact remains that half the legislative process in the Parliament of Canada is conducted in the Senate. I know that the NDP wants to abolish the Senate. However, the Supreme Court says that that is impossible, so the NDP's policy is clearly pointless. Bill S-4 did originate in the Senate, but that is because we wanted an efficient approach to the process in order to ensure that both houses of Parliament would have the time needed to do their homework and act responsibly with regard to a bill as complex as this one. That is why we took this approach.

Certainly, in legislation as important as this, the personal information protection and electronic documents act reform, Bill S-4, which is quite technical, it is important that we have a thorough process. It is mandated that Parliament do this review and, as Minister of Industry, it is my responsibility.

I know the industry committee did a thorough study of this. We had all kinds of views that were incorporated prior to us tabling legislation, during the legislative process and deliberation at the committee stage. It happened on the Senate side as well. This legislation is something of which I am quite proud. It is very important for our country. Reporting of data breaches, accountability, the implication of support of the Privacy Commissioner with regard to data breaches, the penalties that are in place for firms that do not inform people about data breaches that take place, all are important. This would be a big step forward for Canada.

Again, it was arrived at after a great deal of consultation, in a non-partisan way, to draw in ideas. We arrived at legislation that would strike an effective balance. When the legislation is adopted and moves forward, the country will be very well-served.

[Françoise Boivin, NDP, Gatineau, QC]

Mr. Speaker, I find it interesting that the Minister of Industry is talking about a Parliament that will have 338 members. It is difficult enough to speak with 308 members in the House. I am not looking forward to what will happen when there are 338 members. My colleague should not be proud in the least about a 97th time allocation motion, a gag order to prevent members from speaking, in this case at all stages. This 97th time allocation motion is really one of a kind.

We are hearing that the committee's work was short-circuited and that no proposals were accepted. The exercise of democracy is at stake on the eve of an election campaign that is going to be pretty tough for the government, according to what we are hearing on the ground.

Is he not concerned about how the government is curbing democracy in our country and not just because Bill S-4, as important as it may be, is a Senate rather than a government bill?

[James Moore, Conservative, Port Moody—Westwood—Port Coquitlam, BC]

Mr. Speaker, I know this is a very well-articulated and long-standing concern of the leader of the Green Party on this matter.

With regard to Bill S-4, the time in the House is precious. I personally have the view that I would like to see Parliament sit later into the evenings. Parliament is going to go from a 308-seat House to a 338-seat House, so affording more members of Parliament the opportunity to speak on more bills is an admirable goal. I would hope the Standing Orders in the next Parliament might reflect that.

If we look at other jurisdictions, for example, the U.S. Congress sits very late into the evening, but it also has an approach where it has fixed times for debate of specific bills. It allots to all political parties specific speaking slots and it is done a very different way. Perhaps this conversation needs to be had, given that the House will grow in size by 30 seats this coming fall.

There are other ways in which the government could accommodate, in a meaningful way, people's views on government legislation.

With regard to Bill S-4, which is a technical bill, as well as with the Copyright Modernization Act and other legislation that I have had the responsibility to steer through the House, I suspect the opposition parties would concede that we have tried to approach this in a pretty non-ideological, non-partisan way to draw in opinion from the private sector, from academics and from those who are interested in digital policy and privacy policy to arrive at legislation that would be as effective as possible and would move the country forward in a significant way.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I rise on a point of order and would appreciate your guidance on this, but it is a question of relevance. I understand that the government House leader can at any point rise to put forward such a motion as the one to put time allocation, yet again, on another government bill. However, I find it to be offensive to the principles of examining Bill S-3 to then, in the pretense of speaking to Bill S-3, which is an important piece of legislation to ratify global action on our fisheries, slide into a completely different matter.

On the point of relevance, I think the hon. government House leader should not have pretended to be speaking about Bill S-3 in order to put time allocation on Bill S-4.

Bill S-4—Notice of time allocation motion

[Peter Van Loan, Conservative, Leader of the Government in the House of Commons]

Mr. Speaker, I must advise that an agreement could not be reached under the provisions of Standing Orders 78(1) or 78(2) concerning the proceedings at the report stage and second reading stages and the third reading stage of Bill S-4, an act to amend the Personal Information Protection and Electronic Documents Act and to make a consequential amendment to another Act.

Pursuant to the provisions of Standing Order 78(3), I give notice that a minister of the Crown will propose, at a future sitting, motions to allot a specific number of days or hours for the consideration and disposal of the proceedings at the said stages of the said bill.

[Daniel Therrien]

When the budget remains the same and we are given new responsibilities, such as those we will have to assume in the coming months under Bills S-4 and C-51, a choice clearly must be made. My concern is that we will have to do less in other areas.

I have a specific example. If we were to prioritize monitoring the implementation of Bill C-51 by carrying out investigations and providing government departments with advice, we would have fewer employees available to provide similar advice on immigration, border control and other issues. Some government initiatives would receive less attention because we would have to prioritize Bill C-51.

I would like to be able to do both, as both are important. We will try to do our best with the resources we have and given our new responsibilities. It is certainly possible that we might neglect some other obligations in practice, so we would have to request additional resources to manage to do both.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

That's great. We are looking forward to it. I think Canadians are also looking forward to seeing a bit more transparency around requests for sharing personal information.

In response to Mr. Simms' questions, budgetary constraints were briefly discussed. Your office will eventually have to deal with the implementation of Bill C-51. There is also Bill S-4, whereby your advisory role with companies will increase. Under the legislation, companies are also asked to report privacy breaches to you.

I understand that you are not asking for additional resources today, but that you will eventually. What are your concerns should you fail to obtain more resources?

[Daniel Therrien]

My point is this: we have to deal with complaints, and they're growing. We have a number of means to address them efficiently. That's one side of the picture.

What I'm referring to when I say we have new responsibilities is mostly new statutory responsibilities, under Bill S-4, to receive and advise on reports that we will receive from companies when there are privacy breaches. There is no funding that comes with these responsibilities. Under Bill C-51, we will investigate whether the collection and sharing practices of departments conform with privacy. There is no funding that comes with that.

I'm not asking for money right now. I'm suggesting it's going to be difficult to balance the books with these new responsibilities. Rather than to ask for money at this point, I say we will see, with the experience of implementing these new responsibilities, whether there is a need for additional funding. I think it is extremely possible, but I want to see what history tells us.

[Daniel Therrien]

On the whole, I think Bill S-4 is a positive development. It contains a number of positive aspects, including newly granted enforcement powers. Agreements could be applied more directly. Overall, we feel that Bill S-4 is positive.

I did recommend a few amendments to the bill that were rejected, especially the ones related to legal access and information disclosure to police authorities by telecommunications companies. Of course, I would have preferred it if those amendments were adopted.

That being said, as I indicated as part of the strategic priorities established by my office, since the bill will be coming into force, I intend to strongly encourage public institutions—departments and private telecommunications companies, among others—to produce transparency reports. That way, the public would be able to find out how much personal information those private companies are sending to various police authorities. I hope that will move the debate forward. In light of those facts, some changes might be made in the future.

I am assuming that the bill will be passed as is. I am trying to ensure that the measures to inform the public will be applied as transparently as possible.

[Charmaine Borg, NDP, Terrebonne—Blainville, QC]

I assume it's always good to have as many forums as possible.

I would now like to briefly discuss Bill S-4, which will soon become law. We examined it in committee at second reading. You testified at those meetings. You proposed a few amendments, including to clauses 6 and 7 of the bill. However, those proposals were not accepted, and no changes have been made to the original version of the bill.

Are you worried about the repercussions that may have?

[Daniel Therrien, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair. Good afternoon, honourable members.

I am pleased to address our office's main estimates, and with me today are Daniel Nadeau, our chief financial officer; and Patricia Kosseim, our general counsel.

In my time, I will outline our fiscal outlook, describe how we are managing rising demands, and announce our new privacy priorities, which will influence our work in the future.

To begin now, in the coming years, our resources are forecasted to remain at their existing levels. When looking at our 2015-16 report on plans and priorities, there appears to be a drop from the last two fiscal years to this one. This difference is due mainly to the expenses incurred in previous years with the mandatory move of our headquarters in February 2014. Looking forward, for the next three fiscal years, our resources are set to remain relatively stable, at just more than $24 million annually.

That said, we face rising demands. Over the last few years, we have generally seen increasing levels of complaints, while our investigations are becoming more complex. On top of reviewing privacy impact assessments, we are also increasingly requested for consultations to provide advice earlier as new federal initiatives making use of personal information take shape.

Meanwhile, data breach reports from departments were already increasing before a new Treasury Board directive came into force a year ago, making material breach reports to us mandatory. And at the end of the last fiscal year, breach reports in the public sector hit a record high for the fifth consecutive year.

Facing rising demands, we have taken steps to continue meeting our obligations within our existing resources. For example, we are settling more complaints by early resolution, through which parties are satisfied without the need for a full investigation. We are also managing situations where many complaints come from various people about the same issue by opening one all-encompassing investigation. And, we have also implemented measures for situations where one individual submits many complaints, to better balance the needs of all complainants, ensuring all Canadians have access to our services.

All told, Mr. Chair and honourable members, we are using most, if not all, of the tools available under our acts to manage rising demands. But, today, we are left with precious little room to manoeuvre to meet our obligations. We are nearly one year in after taking on new responsibilities under Canada's anti-spam law.

We also anticipate the passing of Bill S-4, which will make breach reports from private sector organizations to our office mandatory. Bill C-51will also create new work for our office as we are called upon to investigate whether its implementation respects the Privacy Act.

So, while I am not ready to say our office needs new resources today, I think it will be quite difficult to meet our existing and new responsibilities with our current level of resources. After we have some experience fulfilling our new roles and a better sense of the impact on our resources, I may need to appear before you to make the case for an adjustment.

Turning to strategic priorities, when I appeared before you to discuss my nomination for the position of Privacy Commissioner of Canada, I said that during my mandate my goal would be to increase the control Canadians have over their personal information.

One of my first initiatives after assuming my role was to launch a priority-setting exercise that would guide the discretionary work my office does towards realizing this vision in the most efficient and effective way possible. As part of this exercise, our office engaged representatives from business, government, civil society, and academia. We also held focus groups to gauge the views of the public. Today, I am pleased to share our results.

To begin, one of our four privacy priorities will be the economics of personal information. Our discussions highlighted the need for user clarity about the personal information they provide in exchange for online services, how that data is used, and the question of meaningful consent. As a result, some of our key work under this priority will be closely examining the issue of consent in today's digital world, increasingly marked by the emergence of big data and the Internet of things.

The overall goal of this priority will be to enhance the privacy protection and trust of individuals so that they may confidently participate in an innovative digital economy.

The “body as information” will be another privacy priority. Whether it is biometric information tied to a trusted traveller card or that generated by medical devices, genetic testing, or wearable fitness trackers, this data may be used in many ways that could compromise people's privacy. This issue concerned the experts we engaged, and it is one about which we will learn more and raise awareness among both developers and users about the potential privacy risks of these new technologies.

The goal of this priority will be to promote respect for the privacy and integrity of the human body as the vessel of our most intimate personal information.

Of course, one of the hallmarks of today's information technology is sharing information with the world in a click, and as the saying goes, “the Net never forgets”, which means youth growing up today may no longer get to outlive their past mistakes. These are among the reasons why reputation and privacy will be one of our priorities, and one under which we will work to help enhance digital literacy among vulnerable populations, while also examining the right to be forgotten.

Our goal with this priority will be to help create an environment where individuals may use the Internet to explore their interests and develop as persons without fear that their digital trace will lead to unfair treatment.

Fourth and finally, government surveillance will also be among our priorities. As mentioned, we will be directing investigative resources to ensure the Privacy Act is duly respected by the information sharing made possible by Bill C-51. We will also give advice to departments, through privacy impact assessments or otherwise, to prevent privacy breaches. We will also work with private organizations and government to establish appropriate standards for transparency in accountability reports.

Ultimately, our goal with this priority will be to contribute to the adoption and implementation of laws and other measures that demonstrably protect both national security and privacy.

In order to make progress on these priorities, we will focus our activities around five cross-cutting strategies: first, exploring innovative and technological ways to protect privacy; second, enhancing accountability and promoting good privacy governance; third, taking into consideration the fact that privacy knows no borders; fourth, enhancing our public education role; and fifth, paying special attention to vulnerable groups.

In closing, our new privacy priorities will help hone our focus to make best use of our limited resources, and further our ability to inform parliamentarians and to protect and promote Canadians' privacy rights. Having identified what we believe are the 21st century's most pressing privacy concerns, our office will now chart a course to address them, in partnership with individuals, organizations, legislators, and fellow oversight bodies.

With that, I look forward to your questions.

Thank you.

Motions in Amendment

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, the committee heard many witnesses. They provided views and testimony from both sides of the spectrum.

It is important to note, as per my colleague's question, that the digital privacy act would require organizations to tell Canadians if their personal information has been lost or stolen. As well, heavy fines of up to $100,000 would be imposed on companies that deliberately break the rules. The legislation would place strict limits on the type of personal information companies can disclose; establish new rules to protect the privacy of vulnerable Canadians, particularly children, as I just discussed; provide provisions to protect seniors from financial abuse, something we have spoken about extensively this afternoon; include measures to allow the use of information to help find missing children; and give the Privacy Commissioner of Canada more power to enforce the law and help hold offenders to account.

Bill S-4 meets those objectives more than adequately.

[John Carmichael, Conservative, Don Valley West, ON]

Mr. Speaker, I am pleased to speak to Bill S-4, the digital privacy act, which was recently reviewed by the Standing Committee on Industry, Science and Technology.

Bill S-4 introduces a number of important improvements to the Personal Information Protection and Electronic Documents Act that will increase the level of privacy protection for Canadians.

PIPEDA is privacy legislation that has been in place for more than a decade now. Under the law, organizations are expected to apply stronger protection in situations that are privacy-sensitive. As an overriding rule, businesses must limit what they do when it comes to the collection, use, and disclosure of personal information to activities that one would consider reasonable and appropriate in the circumstances.

Not all individuals have the same capacity to understand what is reasonable and appropriate, nor can they necessarily appreciate the immediate or long-term consequences of providing information about themselves to a commercial enterprise. This is particularly true of minors. The range of online activities today's kids engage in is astounding. They take part in multi-player games with people from all over the world. They explore virtual worlds. They join chat rooms and post comments, photos, and videos about themselves and their friends.

Today's kids have grown up with the Internet and digital technologies. Social networks, gaming consoles, and smart phones have always been a part of their lives. When kids interact with their friends and when they play games, more often than not it is through technology.

According to a survey conducted in 2013, more than 30% of grades 4 to 6 students have Facebook accounts. By grade 11, 95% of students have such an account.

Digital technology offers tremendous benefits to children's education, development, and social lives. In today's digital economy, children must be able to safety and securely use network technologies and access the online world if they are to develop the skills they will later need to find jobs in the digital marketplace.

What children may not be aware of is that the information they share in the context of online play or learning can actually have unintended consequences. Online personal information has become an enormous source of revenue for companies. Kids are able to play online games, download and use apps, and talk to their friends at no cost because companies offering these services generate revenue by harvesting and using personal information for profiling and marketing purposes.

This government does not wish to prevent today's youth from fully realizing the benefits of the digital world. The skills they develop through these many online activities will provide them with significant advantages when they enter the job market as young adults. This government fundamentally believes that digital literacy and skills are at the core of what is needed for individuals to succeed in today's digital economy.

However, with an increased online presence comes added risk. Strong protections for children's online privacy are needed.

PIPEDA already contains defences that safeguard the personal information of minors. For example, the act prohibits organizations from using deceptive means to obtain consent. Most importantly, it requires companies to limit the purposes for which they collect, use, or disclose personal information to reasons that individuals would consider reasonable and appropriate in the circumstances.

Bill S-4 enhances these protections by clearly setting out requirements that organizations must meet when obtaining consent. These new provisions will have a positive impact, especially when it comes to the protection and the privacy of children.

The new measure will require organizations to clearly explain why they are collecting information, what they will do with it once they have it, and what the consequences of providing it will be.

What is more, they must provide this explanation in a way that can be understood by the audience they are targeting with their product or service. This means that any business targeting children must pay very close attention.

The amendments in Bill S-4 mean from a legal perspective that when a company is seeking permission to collect, use, or disclose personal information from a group of individuals such as children, it must take steps to ensure that these individuals are able to fully understand what would happen to that information.

In practice, this would mean that the organization's request for information can be easily understood by the target audience. This includes making sure that the wording and language used in the request are age-appropriate. For example, a video game designed and marketed to preteens would clearly need to take a different approach to obtaining the consent of players to collect personal information than a video game marketed to adults.

We heard from a number of witnesses during the committee's consideration of the bill, and the majority were supportive of our government's proposed amendments in Bill S-4 to enhance consent.

The Privacy Commissioner of Canada repeatedly expressed his support for the amendment. This is what the Privacy Commissioner told the committee:

Consent is a big part of PIPEDA, and I think it's useful to have this clarification of what actually is consent. We obviously know that it is a huge challenge for organizations to properly advise individuals of the reasons they collect information and they use it, so any tool that enhances, that provides an incentive for organizations to be clearer, and to take into account the context of the individual or consumer I think helps Canadians.

The commissioner further emphasized:

So, when the individual is a child, if your product is addressed to children, you should think about what is reasonable to expect of a child in understanding the consent being sought. Overall, I think, again, the definition of consent in Bill S-4 will assist generally and will assist particularly groups that are more vulnerable, like children.

Privacy information must be clear to the user. The privacy policy should be specific to whatever service the child is using and not be a one-fits-all privacy policy.

The standing committee also heard support for this amendment from a number of other witnesses, including from business. For example, the Marketing Research Intelligence Association, a national self-regulatory body that represents Canada's survey research industry, wrote in a submission to the committee that it fully supports the enhanced consent requirements of the bill.

The association noted in particular that the amendment provides “added clarity for organizations when they seek the valid consent of an individual” when collecting, sharing, and disclosing their personal information. It went on to say:

We believe that specifying the elements of valid consent will go a long way to protecting the most vulnerable Canadians, such as seniors and children.

Our government has already taken significant action when it comes to protecting children online. We have made important progress to shield our children from online intimidation, cyberbullying, and other similar threats and abuse through amendments to the Criminal Code of Canada that were passed under the Protecting Canadians from Online Crime Act.

The amendments put forward under the digital privacy act build on those actions taken to address cyberbullying and represent additional real and tangible measures to protect Canadians and their families from online threats.

PIPEDA has been in force since 2001. Concerns about the protection of children's online privacy were raised with Parliament in 2007 during the first statutory review of this act. There was general consensus among witnesses that children warrant extra privacy protection, given their particular vulnerability to deceptive and privacy-invasive practices. Indeed, at the conclusion of its review of the act, Parliament recommended that the government examine the issue of consent by minors to determine if PIPEDA should be amended.

Our government heard stakeholder concerns and is responding to the recommendations of committee by introducing enhanced protection for the privacy of minors that is now before the House. This is an important amendment, and along with all other measures in this bill, it should be passed quickly.

The digital privacy act takes real and tangible steps to protect society's most vulnerable individuals. I hope hon. members will join me in supporting this bill so that these new protections can come into force quickly.

[Mark Warawa, Conservative, Langley, BC]

Mr. Speaker, why is my hon. colleague across the way opposed to the position of the Privacy Commissioner? The Privacy Commissioner came to committee. The fact is that almost every witness agreed. Some did not agree with Bill S-4, and as we have heard, there were diverse opinions. However, the vast majority supported the changes that Bill S-4 presented, and the Privacy Commissioner was part of those.

Why does the NDP ideology get in the way of recommendations from the committee and the Privacy Commissioner?

[Djaouida Sellah, NDP, Saint-Bruno—Saint-Hubert, QC]

Mr. Speaker, I am pleased to speak about a topic as important as privacy protection.

We need to amend the Personal Information Protection and Electronic Documents Act to bring it in line with the reality of the digital era. The bill seeks to impose new requirements for the collection, use and disclosure of personal information by a company or organization.

What really bothers me about this bill is the provision that would allow organizations to share personal information without a warrant—yes, I did say without a warrant—and without the consent of the individual concerned. That is a major problem.

Even though this bill is called the digital privacy act, it contains a provision that could really interfere with the protection of privacy. I find that deeply contradictory.

Once again, this Conservative government has proven that it spends more time coming up with grandiose titles than working on content. It is also extremely important to point out that between the drafting of this bill and today's debate, the Supreme Court ruled that information such as the data that Internet service providers have on users and clients—IP addresses, email addresses, names, telephone numbers, and so on—is considered personal information and cannot be obtained without a warrant. I am not the one saying that. It was a Supreme Court ruling.

I have some serious concerns about the constitutionality of this provision. The government must comply with the Supreme Court's ruling and remove all the provisions enabling the disclosure of personal information without a warrant.

During the study in committee, a number of witnesses expressed concerns about this very provision. For example, the Privacy Commissioner said the following in a submission:

Allowing such disclosures to prevent potential fraud may open the door to widespread disclosures and routine sharing of personal information among organizations on the grounds that this information might be useful to prevent future fraud.

We want to protect privacy, but it is questionable to allow access to personal information without a warrant, without consent, without any kind of judicial oversight and without transparency. The Conservatives have a poor record when it comes to protecting privacy, and Bill S-4 will not erase the past.

In one year alone, government agencies secretly made at least 1.2 million requests to telecommunications companies for personal information, without a warrant or proper oversight. Why did they ask for this information? We do not know.

The government should have taken advantage of Bill S-4 to close the loopholes in PIPEDA that allow this kind of information transfer without legal oversight, consent or transparency.

There is another provision in the bill that made my jaw drop. This bill would require companies to declare a data loss or breach if and only if it is reasonable to believe that the breach creates a real risk of harm. In other words, it is up to the company itself to determine whether or not it should notify the authorities in the event of data loss. That is crazy.

This measure will actually give companies less incentive to report data breaches by leaving it up to the company whose data were breached to decide whether the breach creates a real risk of significant harm to an individual.

This blatant conflict of interest is what really kills the purpose of this bill because a company will see no benefit to reporting a data breach and every benefit to hiding it. Deciding that a breach is benign will save the company money, damage to its reputation and inconvenience

It will also help the company avoid being put under the microscope by the Office of the Privacy Commissioner of Canada for an audit or investigation. It will create a culture of non-reporting because the commissioner would be nothing more than an observer.

In conclusion, the Conservatives say that their bill is balanced, but we can do much better. We are increasingly aware of the harm that data breaches can cause, so we cannot create a bill that will barely be useful.

We need a bill that will do an excellent job of giving Canadians better protection from data breaches. This bill has not been looked at carefully enough, and we need to fix it. Canadians deserve better.