Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Digital Charter Implementation Act, 2020

[Rachel Blaney, NDP, North Island—Powell River, BC]

I have a point of order, Madam Chair.

I was so enjoying that question, but we have completely lost the sound.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

If he can hear me, could the hon. member summarize that question?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

In summary, Madam Speaker, I believe in climate change and the Conservatives do not, so I could never become a Conservative, and I apologize.

The member keeps talking about an election. We had eight confidence votes last night alone. I asked for a recorded vote on every single one. This member and all of the Conservatives voted against the budget bill, in essence voting down confidence. Therefore, he is actually the one who appears to be interested in an election.

The member talked about a special committee on WE. The Conservatives have a majority, if they go to their friends in the Bloc, to set up that committee. Why did the member not go to his friends in the Bloc and the NDP to set up that committee?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, if the member wanted to join the Conservative Party, his views on climate change would not be the barrier; it would be his casual disregard for the truth that would get him into more trouble if he wanted to join us on this side of the House. I do welcome his joining us on this side of the House, but more in the sort of switch-places type of scenario.

The member spoke about how Conservatives voted last night on the government's spending. Conservatives do not agree with key aspects of the direction of the government, so it is our responsibility in representing our constituents to raise our concerns, to speak about them, and to vote accordingly.

I will note, though, that those confidence votes passed; that a majority of this House supported those measures. Therefore, it would be particularly rich for the government after getting the confidence of the House, which it did not need my support to do, to then pull the plug later.

We think it is important to warn Canadians about the government's plans with respect to an election. The more the member tries to deny it, the more interesting it will be to play back some of those conversations if the Prime Minister does actually do what many people expect him to do in the next few months.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

The hon. member for Victoria has time for a very brief question.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, I want to thank the member for his points on how the Liberals have been scheduling an hour of debate here and an hour of debate on another bill there, without giving them enough time to move forward.

I am thinking in particular of Bill C-12, the Canadian net-zero emissions accountability act. It has been months and the government has yet to really schedule enough time to finish second reading. The Liberals either need to admit that climate accountability is not a priority for them or schedule the time. I hope they do not use their own game playing to delay important legislation as an excuse for an election.

On the privacy bill, does the member agree—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I did ask for a brief question. There are only 20 seconds left.

I would ask the hon. member for Sherwood Park—Fort Saskatchewan to respond.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is an important point that for those who are following the way legislation is normally scheduled, the government's approach is very different. We agree with some of the bills and some we do not, but the normal thing for government to do would be to prioritize legislation it wants to see passed and schedule enough debate for it to move forward. Liberals are not doing that, and they are very clearly setting the stage for something else. They have no interest in passing their own legislation. It is very evident.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Madam Speaker, I am pleased to participate in the second reading of Bill C-11, the digital charter implementation act, 2020. I will be splitting my time today with the member for Davenport.

When Canada's privacy law was introduced in 2000, Parliament intended that it would achieve two objectives, which were privacy protection for individuals and the growth of electronic commerce. Over 20 years later, our government is introducing this legislation to provide an updated strategy for protecting privacy in our new digital world.

I have heard loud and clear from the constituents in my riding of Mississauga—Erin Mills, and they want to see strong privacy laws. These privacy laws not only protect consumers and help build trust in the digital marketplace, but with the consumer privacy protection act, a principled and agile privacy enforcement regime would create a vital safeguard as companies engage in the digital economy.

Today, I would like to provide further insight into a key aspect of the bill that will not only provide guidance for businesses for protecting individuals' personal information, but will also support responsible innovation. I am speaking today about provisions in the new consumer privacy protection act to formally recognize codes of practice and certification systems as a means of demonstrating compliance with the law.

A key strength of our current private sector privacy law, commonly known as PIPEDA, will be maintained in the new consumer privacy and protection act. That strength is a principled approach to rule setting. Our private sector privacy law applies to all organizations in all industry sectors of all sizes and levels of sophistication. This level of general application is crucial in order to establish a baseline of privacy protection that applies across the marketplace.

While comprehensive, this law must also be flexible, non-prescripted and technology-neutral so that it can be applied in all circumstances. These characteristics have long been recognized as a key strength of the existing law and there is widespread support for maintaining this approach. However, it is sometimes a challenge for organizations, especially smaller businesses without dedicated legal resources, to understand how to implement these high level obligations within their specific context.

For example, consider a situation where an organization is using a cutting edge technology which has not yet been the subject of a finding by the Privacy Commissioner or where an organization must handle complicated data flows with complex accountability, such as in connected and automated vehicles. These challenges are becoming more commonplace in a data-driven economy.

To help address these problems and to provide assurance to businesses and consumers alike, the consumer privacy protection act would allow any entity to apply to the office of the Privacy Commissioner for approval of a code of practice that provides a specific set of rules for how organizations can operate in compliance with the law. This approval would be particularly useful for organizations using a new technology or operating with a new business model.

This type of regulatory certainty is very much needed in today's rapidly developing economy. It gives organizations and their business partners a level of comfort that they are operating on the side of the law. It also supports a level playing field in areas where there is no jurisprudence or specific guidance for organizations. It also makes it more transparent to Canadians how their personal information is being used in these circumstances. To take it—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

Unfortunately, or fortunately depending on which way we look at it, it is 1:30. The hon. member will have five and a half minutes the next time this matter is before the House.

It being 1:30 p.m., the House will now proceed to the consideration of Private Members' Business as listed on today's Order Paper.

The House resumed from March 26 consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Julie Dzerowicz, Liberal, Davenport, ON]

Mr. Speaker, it is an absolute honour for me to rise in the House to speak on behalf of the residents of my riding of Davenport. I am speaking in support of Bill C-11, an act to enact the consumer privacy protection act and the personal information and data protection tribunal act and to make consequential and related amendments to other acts. It is also known as the digital charter implementation act.

From the earliest days of my first run for office, the residents of Davenport have approached me to tell me how concerned they are about the security of their personal information. They are literally running after me in the streets to say that this is an issue of great importance to them. I can assure members that it is not just Davenport residents who are concerned. The Privacy Commissioner published a survey in 2019 that found that 92% of all Canadians were concerned about their privacy, with 37% of Canadians being extremely concerned. This means that nine out of 10 Canadians are worried about their privacy.

I know that the third wave of this pandemic is the most pressing issue for all of us right now, and rightly so, but it has not made our privacy concerns go away. Indeed, this pandemic has had the opposite effect, given that most, if not all, our lives have moved online, from work to worship to shopping to social gatherings. This is a front and centre issue.

Davenport residents are not comfortable entrusting all their data into the black hole of the Internet, managed mainly by big multinational tech giants. These companies have been operating with outdated regulations and limited transparency. As Canadians right now, we have no choice. We are all used to downloading apps or signing up for things online that come with long privacy policies and consents requests. I do not know about everyone else, but most of us do not have time to read all the online terms and conditions that are often in legalise and not easy to understand. That is why I am happy that Bill C-11 would require plain-language consent requests.

We are also too used to being peppered with targeted ads and content based on the websites we visit, with no consent or even knowledge about algorithms that track our actions. It is impossible to keep track of how our personal data and how our online actions are being used or abused, whether it is to misinform others or even more nefarious purposes like identity theft.

That is will I am glad that Bill C-11 is before the House. It marks a huge leap forward in our privacy laws. Canada must do all it can to protect the data of all our residents, and Canadians should know exactly how their data is used with maximum transparency. We should have the right to manage what data is kept online and what is deleted.

Canada must also keep up with the rapid growth of the digital economy, as hundreds of companies and organizations are now handling our personal data. Other countries have already acted on this. The E.U. passed the General Data Protection Regulations in 2018. Its rules require that other countries meet its standards to do business, to exchange data across borders. This means that if we want Canadian businesses to continue to have an edge in European markets, we have to modernize our privacy rules. It is imperative that we move now, as aggressively as possible, and for all these reasons, we must pass the digital charter implementation act.

What would the bill actually do? First, the bill introduces the new consumer privacy protection act that updates the old PIPEDA act, which was first passed in 2001. Second, the bill introduces the personal information and data protection tribunal act to create an oversight and enforcement body for the new privacy rules. Third, it would retain the measures of part 2 of PIPEDA under the new electronic documents act. The measures in the bill are built upon three key goals: consumer control, responsible innovation and strong enforcement and oversight.

Let me just touch very briefly on how the measures in the bill would meet each of these goals.

First, how do we give consumers more control? Bill C-11 would modernize consent rules and would require companies to ask for consent in plain language, which is great. The bill would also give Canadians the right to data mobility. That means they could direct one organization to share certain data with another for a specific reason. For example, they could direct their banks to share financial information with another bank.

Next, it would give Canadians the right to withdraw their consent for the use of their data. It would allow people to direct a company to delete whatever personal information it has about them, including on social media platforms, which would give control of personal data back to Canadians. The bill also clarifies that even information that has been de-identified is still personal information. Even if a company removes people's names from its data, this bill would ensure that the data still belongs to those people. It has to be protected, and companies need their consent to use it.

Finally, the bill requires transparency for use of algorithms and AI. It would give every Canadian the right to request an explanation of how and why an automated system made a choice or prediction about the individual. I am hoping that at some point, we are allowed to relay what companies can and cannot do with that information.

The second goal is enabling responsible innovation. We want our country to stay globally competitive, support innovation and unlock the potential of data to create incredible value and improve our lives, but we need to support that innovation in a way that guarantees the right to privacy. The bill would simplify consent rules so that companies are not burdened by seeking consent for every use of information, even when consumers reasonably expect it. This is good for business and also helps Canadians make meaningful choices. Rather that being bombarded by consent requests full of legal jargon, consumers will see plain language requests when it really matters.

Bill C-11 would also allow Canadians the choice to contribute their data for the common good. It would allow businesses to share de-identified data with certain public institutions to power social benefits like public health and infrastructure. Lastly, the bill would allow businesses to submit their codes of practice to the Office of the Privacy Commissioner to ensure they comply with the law. This kind of transparency and streamlined regulation is both good for businesses and good for Canadians.

The third goal is strong enforcement and oversight. With any new regulations, we absolutely need stronger enforcement and oversight. Indeed, I know that is something the Office of the Privacy Commissioner has long requested. What would this bill do? It would give the commissioner that power, including forcing an organization to comply with privacy laws and ordering a company to stop collecting data for personal information. It would also create the personal information and data protection tribunal, and the Privacy Commissioner could also ask the tribunal to impose fines. We would have the stiffest penalties in the G7. For small transactions, the fine would be 3% of global revenue or $10 million, whichever is greater, and for more serious violations, the penalty is up to 5% of global revenue or $25 million, whichever is greater.

I mentioned earlier that Davenport residents have been raising this as a concern to me for five years now. I have received a number of letters, so I want to pay tribute to all those who have written to me through the years to indicate that this continues to be an issue. I know they will be very happy to hear that we are moving forward on this legislation.

This bill is the first of many steps our federal government will take to protect Canadians' privacy and harness our country's potential in the digital age. Our current privacy laws were passed in 2001, and in 20 years the pace of change has left those laws badly out of date. We will need to keep doing more to stay on top of rapid changes, looking at both the threats and the opportunities. Davenport residents and, indeed, all Canadians demand that we continue to do all we can to keep our privacy and data security laws updated in a way that protects them, while still enabling data to be used for innovation and economic growth.

In 2019, we set out a vision for the Internet in the digital charter. That vision is of an Internet that serves the public good and guarantees certain rights, like the right to control and consent, the right to transparency and portability, the use of data for the common good and the need for strong enforcement and accountability.

I am proud that our government has introduced this bill to implement the digital charter and guarantee these rights to Canadians. We have seen big new challenges, and we have stepped up with real solutions. I ask all of my colleagues for the speedy passage of this bill.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Mr. Speaker, I am very glad that we are trying to update the legislation to reflect our digital reality.

The member commented on the Privacy Commissioner and the additional powers that would be given. We have seen quite a number of privacy data breaches from the federal government, especially from the Canada Revenue Agency. Would the Privacy Commissioner have the ability under this legislation to fine the government or order the government to stop collecting private information because it is not adequately protected?

[Julie Dzerowicz, Liberal, Davenport, ON]

Mr. Speaker, I can assure the hon. member that it does not matter whether it is the federal government or any level of government; we are all really concerned about any type of these breaches. The honest answer to her question is that I actually do not know if the Office of the Privacy Commissioner is able to. I will ask about it.

My sense is that it is what we are trying to do, so I would hope it would also incorporate the federal government and the different levels of government. I do not know the answer. I hope it would be the case, but I know it does have the power to order businesses to do that. I will look into it and get back to the hon. member.

[Yves Perron, Bloc, Berthier—Maskinongé, QC]

Mr. Speaker, I thank the member for her speech.

What our Conservative colleague said is true. This bill does not seem to apply to the government.

I have another question. There is another flaw with respect to the identification of individuals. There is nothing in the bill to force banks, for example, to institute a strict policy for the identification of individuals, nor is there any kind of fine system that would compel them to do so.

Is the government open to a series of amendments on this issue?