Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Digital Charter Implementation Act, 2020

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, I know that the member across the way has lots of concerns with this legislation. I certainly do. They are about the creation of a whole bunch of new categories for data exemption from those privacy protections. I am a bit concerned about that.

I am wondering if she could address the concerns that this giveaway to big tech giants, which the Liberals have been accused of being far too close to, are also worrying. What does she see as something that could fix that within the legislation?

[Rachael Thomas, Conservative, Lethbridge, AB]

Madam Speaker, I think one of the things that has come to our attention over the years is just how buddy-buddy the current government is with, let us say, Facebook. We know the rules are bent. We know that provisions are made. We see evidence of leniencies being granted, and at the end of the day the rules should be applied equally across the spectrum of organizations and businesses.

Certainly, there is a greater need for accountability within this piece of legislation. When it comes to exemptions, that must be thought through very carefully.

[Monique Pauzé, Bloc, Repentigny, QC]

Madam Speaker, in her speech, my colleague said that she had some suggestions to improve Bill C-11. This is also the case for the Bloc Québécois.

On our side, we are very concerned about the issue of identity theft. There are ways to verify someone's identity. In Europe, mechanisms have been put in place. Here, however, the banks have no such obligations and, if it costs too much, they do nothing. We would like to see stricter regulations for banks and greater transparency.

Does the hon. member agree with what we are calling for?

[Rachael Thomas, Conservative, Lethbridge, AB]

Madam Speaker, within the context of this bill, in which we are talking about the protection of privacy and the safety of Canadians, we are really talking about consumer rights and provisions.

When we are talking about identity theft and how our information is being used by organizations or businesses, of course the most stringent rules should be put in place. As I said in my speech, transparency must be granted. That is one thing, but the other is that, in addition to transparency, there has to be teeth.

If our information is being misused, then we must have the right to know that. We must also have the right to hold those organizations accountable for their misuse. As well, it is important to note that misuse is not just what they do with our data. It is also how they are managing it, in terms of keeping it secure.

That is exactly the hon. member's point, and it certainly deserves thorough thought.

[Rachel Bendayan, Liberal, Parliamentary Secretary to the Minister of Small Business]

Madam Speaker, I thank my colleague for her question.

One very interesting element of the bill we are debating is the potential for the legislation to cover artificial intelligence and algorithms, which are used by many companies, including Facebook and other such social networks. I am interested in my colleague's views on these algorithms and the applicable provisions.

[Rachael Thomas, Conservative, Lethbridge, AB]

Madam Speaker, the question was with regard to algorithms, which I went into quite extensively in my speech.

Again, I would certainly applaud the government for taking responsibility and putting within the bill the need for transparency around algorithms, but here is the deal: if, as a consumer or as a user, I ask for the algorithms that are being used when I am on a certain website, and those algorithms come back to me as numerous pages of scattered numbers and letters, what does that mean to me? What good is that to me?

Therefore, in this legislation, we actually need to make sure it is not just the transparency of the information being used and the algorithms being used. We also have to make it accessible to Canadians. They have to understand what is actually being done. They need transparency, and to know, when algorithms are being misused, if they will have the opportunity to take action and to seek justice.

This legislation falls short. It does not provide that for Canadians.

The House resumed consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Rachel Bendayan, Liberal, Parliamentary Secretary to the Minister of Small Business]

Madam Speaker, I will be sharing my time with my colleague from Egmont.

It is with great pleasure that I rise in the House today to speak to the consumer privacy protection act and explain why this reform is important for enhancing the protection of our personal information.

When we talk about consumers, we are talking about all of us. All Canadians deserve the peace of mind of knowing that their personal information is protected.

As the Privacy Commissioner of Canada has said, the pandemic has accelerated the digitization of our lives, which inevitably increases risks to our privacy and the security of our data. This has raised serious concerns about our personal freedoms, our societal values, the public good, and the compliance and oversight measures required to manage this public health crisis.

Clearly, this crisis has laid bare the need for a certain use of available data, including personal information. In this context, we have seen many different approaches around the world. Different countries have deployed an array of technologies to support their efforts.

In some cases, their approach has focused on collecting location data for contact tracing or population monitoring or even for tracking an individual's movements. In other cases, telecom service providers have given the government location data from their network. On that, let me make it clear that our approach, Canada's approach, does not use those types of technologies.

This federal government will always defend our privacy and our personal data. Many stakeholders and experts have noted the potential impacts on the right to privacy arising from technologies being used elsewhere around the world. We heard those concerns, and that is why our Canadian approach does not involve these types of technologies.

For example, in the case of the COVID Alert app, our government worked with a variety of partners to support public health efforts to limit the spread of the virus, while also making sure we protected Canadians' privacy. The application was designed with this very objective in mind. As we have said before, the app has no way of knowing one's location, name, address, contacts or other information. In fact, following a review of the app, the Office of the Privacy Commissioner fully supported it.

I hope that this dispels any lingering myths about the app, and as we are very much still in the midst of this pandemic with rising community cases throughout the country, I would like to take this moment to encourage everybody to download the COVID Alert app.

Bill C-11, before us today, would create a strong framework for the protection of personal information in the private sector. The new consumer privacy protection act would impose requirements for obtaining individuals' consent to collect and use their data. Consent must be granted prior to data collection, and consent forms must be written in plain language that absolutely everybody can understand.

While this is extremely important, I know from my own experience, the experience of my friends and speaking to my constituents, and surely this is the case for many Canadians across the country, that not everybody reads the disclosure and consent page before clicking “I agree”. That is why we have proposed in this bill to legislate that organizations can only seek consent for data that are strictly necessary for their purposes. They can collect credit card information if they are selling something; they can collect an address if they will be delivering something.

Critically, this bill also would further empower consumers. It would give us the unfettered right to ask what information has been collected about us, how it has been used, whether it has been shared, and whether it has been sold. We, as consumers, would have the right to access the information that an organization might have on us and request its immediate deletion.

Another groundbreaking provision involves AI and algorithmic transparency. We are all familiar with these algorithms which make predictions and recommendations with the aim of influencing and impacting our decisions. Whether our experience is seeing advertising on Facebook or Google, which, very strangely, resembles some searches we recently did, or recommendations of videos on YouTube, for example, Canadians are constantly being fed information and suggested purchases based on algorithms that we know very little about.

Without going on too much of a tangent, I watched a few weeks ago a documentary called The Social Dilemma. I imagine many of us in this House who are interested in the topic of privacy protection and the Internet are familiar with the documentary. Let me say it scared the you-know-what out of me.

This bill would make it mandatory for companies to provide answers and an explanation, upon request, about how any predictions or recommendations targeted toward us were obtained. Legislating that right, providing that opportunity for consumers, is itself a deterrent for companies seeking to make use of algorithms for nefarious purposes. This is a critical step forward.

This bill deals with a very complex issue for individuals and consumers and for businesses. It recognizes individuals' right to privacy as well as the need of organizations to collect, use or disclose personal information in the course of reasonable commercial activities.

Our privacy bill is flexible enough to allow companies to apply the general requirements to practices specific to their sector. However, I want to make it very clear that good intentions on the part of private-sector organizations are not enough.

We know that for the new protections included in the legislation to really be implemented, we need binding and effective mechanisms to protect the rights of Canadian consumers. That is why this bill includes serious penalties for those who try to get around it. We are talking about monetary penalties of up to $10 million, or 3% of global revenues, for large corporations that break the law. For more serious offences, fines up can go up to $25 million, or 5% of global revenues.

These measures would be among the toughest in the G7. Our government takes the privacy of Canadians very seriously, and the web giants must do the same. We have seen major innovations and digital solutions that not only serve the public interest, but also protect the privacy of our citizens.

The legislation would allow companies to innovate in a responsible manner and enable Canadians to have more control over their personal information. It is true that the digital environment presents many challenges, but we must not let that stop us. There are tremendous opportunities. Back home in Montreal, I am seeing the potential of AI and responsible data usage. I am thinking about Mila, Element AI, Hopper, AlayaCare and all the start-ups and small businesses that are opening every day in Mile End and Mile Ex. We must continue to encourage the development of this sector while ensuring that the public has confidence in the regulatory and legal framework governing these companies.

As legislators, we must give Canadians our assurance that their data is safe and their privacy is respected. This assurance is necessary not just to foster creativity and innovation, which are essential ingredients for building a strong economy, but also to give us all peace of mind.

[Alexis Brunelle-Duceppe, Bloc, Lac-Saint-Jean, QC]

Madam Speaker, I listened carefully to my hon. colleague's speech and I saw that the government did its homework by looking at what is being done elsewhere in the world and learning from the experience before legislating on this issue.

It is a good idea to see what other countries are doing wrong so as not to make the same mistakes, but it is also a good idea to look at what other countries are doing right. The Europeans implemented a whole set of regulations to force financial institutions to verify people's identity before authorizing transactions. That is missing from this bill, so we are failing to protect our constituents. I will repeat that we work for them. This does not protect them from fraud.

Does my hon. colleague not agree that this is a weakness of the bill?

[Rachel Bendayan, Liberal, Outremont, QC]

Madam Speaker, I think what we have before us is fairly comprehensive.

We do need to look at what is being done right elsewhere, but we have also created a whole framework. We have also created a tribunal where consumers can file complaints and appeal their case. I believe that what we are presenting today is quite substantial, but I am of course very open to looking at what other countries are doing if my colleague wants to present specific amendments in committee.

[Kenny Chiu, Conservative, Steveston—Richmond East, BC]

Madam Speaker, we have had a lot of time to talk about the current situation of privacy in Canada. As the member forPortneuf—Jacques-Cartier mentioned, there are many situations in Canada where privacy has already been a problem. I wonder what the member's thoughts are on this. We are like a sinking ship. We have many holes in the Canadian privacy ship. Meanwhile, the government is talking about a scheme that would make it perfect. Why not just plug the big holes, such as the infiltration by Russia, Iran, or even China through Huawei's 5G network? To me that is not the wisest way to handle our current situation.

[Rachel Bendayan, Liberal, Outremont, QC]

Madam Speaker, I did have the opportunity to rise on the Conservative motion with respect to Huawei. As I made clear at that time, there are no providers in Canada at the moment that are using Huawei's 5G infrastructure.

I would also take issue, perhaps, with the word “scheme”. What is presented here in the bill before the House is a very serious framework for the protection of personal information and data on behalf of all Canadians. It is certainly something that I am looking forward to debating more fully today and in the future. If there are specific amendments, as I said, I think we are open to them, but at its core, we have a very sound structure that we presenting in Bill C-11.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, when Canadians' privacy rights are violated, they should be compensated. We have already heard stories about consumers in the U.S. receiving compensation, when Canadians in the same circumstances received no compensation. I think that is a gap in this bill.

I am curious about going a step farther. I am wondering if the member could comment on the idea of consumers being compensated for the data that they are giving, and having more choice around which data and which personal information is going to these big web tech giants.

[Rachel Bendayan, Liberal, Outremont, QC]

Madam Speaker, I detailed, in my speech earlier, the very significant fines that companies would suffer for any contravention to this law.

I understand that what my colleague is asking for is compensation directly to consumers. As a former commercial litigator, I think there are serious issues with identifying what appropriate damages would ensue from what kinds of data breaches.

What I find so interesting about many of the provisions in this legislation is that it provides deterrence for companies not to engage in this behaviour. It would actually eliminate the behaviour that we want to discourage rather than compensating consumers after the fact.

The House resumed consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.