Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Digital Charter Implementation Act

[Kelly McCauley, Conservative, Edmonton West, AB]

Mr. Speaker, my colleague has brought up a lot of great points, especially around the issue of Huawei.

The House passed a motion requiring action from the government on Huawei, yet we have seen nothing. At the same time, it is bringing in Bill C-11, which has some laudable points in it, but does not address one of the biggest elephants in the room, which is Huawei. The government has refused to ban it from our country. Huawei is well known for stealing information and sharing it with the Chinese communist government.

I wonder if my colleague could tell me why he thinks the government is so reticent to ban Huawei, as the House has demanded.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Mr. Speaker, we continue to see a pattern over and over, where the government delays and decides to not take a principled approach or principled stand on these issues. The issue with Huawei goes much further than just simply whether it is the right company for 5G or not.

Number two in the 10 principles of the charter is safety and security, and we are talking about the safety and security of our citizens in Canada and abroad. We have been seeing a regime in place that is looking to use facial recognition software to persecute its own people. Our government needs to take a very serious, strong and principled approach when dealing with Huawei, respect the will of Parliament to ban Huawei from 5G and take a strong stance and make it known that Canada we will defend our citizens.

[Tom Kmiec, Conservative, Calgary Shepard, AB]

Mr. Speaker, I am pleased to joining the debate on Bill C-11.

“One who wants to know is better than one who already knows” is a Yiddish proverb, and members know I have a great love of them.

However, I want to go through the legislation before us, because a lot of constituents have written to me with major concerns. It is not that they dislike the legislation per se. They agree, as many members have said, with the principles and content, but the bill falls far short of their expectations.

As the member for Cypress Hills—Grasslands has said, it is an issue of control, who controls the information. My personal belief is that property rights are a human right, and our digital presence, our cookies, the way we look is their digital private property and it should really be treated that way. We have a come to time where we should extend our conception of what is a property right to our digital presence.

I remember knocking on doors in Mahogany in my riding. A gentleman who worked for a large IT company was very concerned about deepfakes, the ability for people to create some really lifelike images, voices and mannerisms of other individuals and the possibility for it to be used for a nefarious purpose, to mislead, misdirect and also to get money out of people. Imagine what type of use people could get out of deepfakes. I think of the past few years where we have seen a lot of companies make immense strides in providing a digital picture of people who never existed, but they look so lifelike that it is so difficult to tell if they are actually deepfakes. They trick our eyes and brains to think they exist.

On the issue of control, I have had constituents bring up issues of Clearview AI harvesting through facial recognition technology, the Cambridge Analytica and Facebook scandals. Closer to home in Calgary, is Cadillac Fairview and what constituents have termed “secret mall surveillance”. There was a panel put up in different parts of the mall, one of the biggest malls in Calgary, that were collecting information off the images of people going in. I cannot remember what the purpose was, but it was stopped once many people started to raise issues with what the information was being collected for.

It is an issue of control. There are principles in this digital charter, and I do not want to go over them too much. However, I want to raise issues specific to things like the right to opt out of the sale of personal information. That is a really big one. The GDPR does this already as does the European Union.

Sometimes when people go online, depending on the country source for the product or service purchase, after having clicked through terms and agreements, because many people do not read those, it will ask whether they are opting out of the sale of their personal information. That is missing in this legislation, and it really should have been in there.

Many constituents, like Chris MacLean in my riding, raised this as an issue, saying that they would like to have more control to consent to where their information would go. I could imagine certain situations where people are fine with their personal information being sold, perhaps some of what they give a particular company is not much and they feel it could have some type of purpose or there could be some controls put in place. However, this legislation does not have that.

Then there are the consent exemptions. I want to focus a little more on this one. This issue has been of major concern to people in my riding. As I mentioned, Chris had issues with it, Kevin Silvester, Shelley Bennett and Randall Hicks had issues with it. There is a lot of them. The issue is “for a public interest purpose” is how the government has defined it, that is socially beneficial purposes, clause 39 is one of them.

It kind of lists off government institutions, public libraries, post-secondary educational institutions, any organization that is mandated under federal-provincial law or by contract with a government institution. What if it contracted out a large government youth program, like the WE charity, and then it ran it. What kind of personal information would be collected? I know it has been embroiled in its own scandals of late. The ethics committee met this morning and discussed it even further.

It continues on to point four. This is subparagraph 39(1)(b)(iv) under the disclosures made to any other prescribed entity. Then there is paragraph 39(1)(c), the disclosures made for socially beneficial purpose. That is such a broad definition. Who gets to decide what is a socially beneficial purpose? I could drive two Hummers through that definition, working for a contracted out organization, perhaps collecting information, processing a program, a service on behalf of the federal government. I have major issues with the way that is structured, because it allows so many exemptions to be provided in interactions.

When we read about these organizations, it is a lot compared with any other prescribed entity. There are no limits on this prescription. There are no limits on what the federal government could prescribe as an outside entity and then our information would be shared with them. That is a consistent concern that my constituents have. They mostly focus on the business angle of it, but we know that the federal government oftentimes has a lot of contracting out of services, including IT services and procurement services. For the construction of ships, for example, the government does not own shipyards; it contracts that service out and asks someone else to do it for the government. When they do that, is there not a possibility, because it is for a socially beneficial purpose, that the federal government could decide just to share information quite broadly? I have an issue with it because I do not think it does a great service for Canadians.

There is another issue I have with one of the definitions provided. It is the definition being used in the law for how personal information is defined. It says, “an identifiable individual”. The example that I gave, that many of my constituents give as well, is an example from Calgary when, years ago, Cadillac Fairview, which owns the Chinook Centre in Calgary on the Macleod Trail, was using facial recognition and surveillance information. Maybe they were just tracking the flow of pedestrian traffic through the mall, perhaps to plan where the doors should be; I do not know this, but if the benchmark being used in the definition is “an identifiable individual”, how much effort is a company going to put in to identify someone? That is what makes it identifiable. When I read through the legislation, I have a hard time grasping how far this could go. Is there an expectation that the companies will not keep this information at all because they did not make it identifiable, so it is okay? Is it because the image is too grainy? Is it because their name is so common that it could be just about anybody? It is an imprecise definition that could have really been beefed up from the beginning instead of taking it to committee in such an incomplete format.

Those are the issues I found, just reading through the legislation and after so many of my constituents wrote to me. They still have major issues. What they want to see is a significant number of amendments brought forward to fix the legislation. There are a few ways to do that. The government could just draft a new piece of legislation and table it again and have it go forward. There are a lot of good things in the bill, like many members have said, that make it salvageable.

At the committee stage, that is where they get into it. I do really believe this should go to the industry committee. It may want to bounce the bill around to the different committees. I used to sit on the Standing Committee on Finance in the previous Parliament, and the government would apportion the omnibus budget bill to different committees and look at the parts in order to have the expertise. So much of this is about corporations and businesses that it should really go to the industry committee. Again, it is the industry minister who has tabled the law.

On the issue of identifiable information, the definition should include such information as people's email address, obvious personal information like location information, gender, biometric data, web cookies, political opinions and any pseudonyms they might use so the company or the organization that is collecting it can combine it all together. It does not have to be a private organization; it could be a public one, it could be a charity doing this; who knows? That could have been a much better definition than simply leaving it very open-ended as “an identifiable individual”.

Another matter that a lot of my constituents have raised is the playing field between a Canadian company based here where Canadian law can easily reach it with the fines that would be levied; and then international companies, perhaps based in Latin America, in parts of Africa, in Australia and other countries that have different privacy laws and how we would be able to find them and also collect the fines on them. That whole mechanism and the fact of a tribunal of three to six people and only requiring one expert is another issue.

I have tried to lay out as many issues as I have heard from my constituents in my riding. I mentioned that some of them had very specific concerns.

Much of the legislation is on the right path, but there are so many shortcomings. Like the previous member said, the issues here are data privacy and control, regarding who controls the information and where it can go and that the legislation is still unclear in certain parts, regarding who can deal with it; and exemptions and exceptions being given. Those two different concepts need to be fleshed out more in the legislation. It should be done at committee. It should be done at the industry committee first. If it needs to go to the ethics committee afterwards, so be it; but the industry committee should deal with it first, immediately.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Mr. Speaker, one of the things at issue, in terms of protecting Canadians from a digital perspective, is that we are seeing a lot more identity theft. We are getting a plethora of scams, where people have obtained our personal information or email addresses and whatnot and come after us. Could the member comment on what this bill would do to address those concerns?

[Tom Kmiec, Conservative, Calgary Shepard, AB]

Mr. Speaker, as far as I can tell, not much new in this legislation specifically deals with those types of issues. We have all seen the phishing scams, even on Parliament Hill, where people pretend to be banks, financial institutions or credit unions. It looks so real and the interaction is so real that people feel it was actually sent by the named institution. There is a lot more that could be done and witnesses could be brought forward at committee who could deal with it, but the industry committee is the right committee to deal with this bill.

[Paul Manly, Green, Nanaimo—Ladysmith, BC]

Mr. Speaker, I noticed that the hon. member highlighted the discussion around privacy rights. Privacy is a fundamental human right and this bill would fail to protect privacy rights. In terms of protecting children, it goes in the opposite direction. It has loosened the regulations when other countries are strengthening the rules around protecting children. It continues with a broken model of consent that pits individuals against corporations and political parties, which is a power imbalance.

I would ask the hon. member whether he thinks political parties should be included in this legislation and bound by the privacy rules.

[Tom Kmiec, Conservative, Calgary Shepard, AB]

Mr. Speaker, I will speak about the first part of his observation on privacy rights. Privacy rights should be property rights. That is where we should go and expand it, and that is the way it should be understood. I talked about, for example, deepfakes and the concerns I heard at people's doors, specifically in Mahogany. I had a constituent who spent a lot of time explaining it to me. It has panned out in public media about the misdirection and ability of people to be misinformed on something that looks so absolutely real. It tricks one's eyes and ears into believing the person is actually saying what is being said.

The member talked about algorithms. Many of us have children. I have three kids and they just love YouTube, but sometimes I wonder where the algorithm leads them based on the choices they are making as they are clicking. More than once I have had to stop them because the algorithm has gone completely out of control and showed them things that no child who is 10 years old should ever be able to see.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and Minister of Intergovernmental Affairs and to the Leader of the Government in the House of Commons]

Mr. Speaker, I see Bill C-11 as legislation that offers world-leading privacy and data protection. It also has some of the strongest fines among the G7 privacy laws. This is legislation that Canadians would support and it even seems that members on all sides support the legislation.

The government does not have a process like opposition days where things are voted on automatically. We are very dependent on opposition parties recognizing the importance of legislation and allowing it to get to the committee stage. I wonder if my friend could provide his thoughts on whether he believes the bill should move forward. We have had many days of debate, for example—

[The Deputy Speaker, Bruce Stanton]

The hon. member for Calgary Shepard.

[Tom Kmiec, Conservative, Calgary Shepard, AB]

Mr. Speaker, the member is the parliamentary secretary to the House leader. He is participating in setting the agenda. It has been months since this legislation came to Parliament to be debated. He should perhaps look at his own schedule to determine how many more days the government could do this. I read directly from concerns of my constituents, and I invite all members to do that. That is exactly what I did. I printed off the emails because I wanted to discuss their specific concerns. That is what each of us should be doing and that is what matters the most.

This is not world-leading legislation. The GDPR in the European Union is world-leading. This is not that.

[Mario Beaulieu, Bloc, La Pointe-de-l'Île, QC]

Mr. Speaker, Bill C-11 imposes obligations with regard to the collection, retention and disclosure of personal information, which is good. However, it does not require businesses to verify that the person they are dealing with is who they claim to be before authorizing a financial transaction.

In the interest of regulating banking practices and reducing fraud, should we not be requiring financial institutions to institute robust identity checks to prevent fraudsters from stealing someone's identity and using their personal information? Should banks not be required to include the number of fraud cases due to identity theft in their annual statements? Should they not be required to contact anyone whose identity may have been used fraudulently?

[Tom Kmiec, Conservative, Calgary Shepard, AB]

Mr. Speaker, I thank the member for La Pointe-de-l'Île for his comments.

I agree with the first part of his question and his idea. I think people need to provide valid and informed consent. Many of my constituents have the same concern about private businesses sharing their personal information.

I agree with the first part, but as far as the second part is concerned, I would like to hear more debate on the matter before taking a position.

[Michael Barrett, Conservative, Leeds—Grenville—Thousand Islands and Rideau Lakes, ON]

Mr. Speaker, it is a pleasure to join the debate on Bill C-11. It is important to start with the conversation that has been had around where this legislation is going to be debated. The legislation belongs to the industry minister, so we would expect the industry committee would deal with it. In spite of an offer from the opposition by way of unanimous consent to have this sent to the industry committee, the government will instead send it to the ethics committee.

What else the ethics committee has been dealing with and will be dealing with this spring are germane to the rationale for the destination of this bill. Up to this point, the ethics committee has looked at the pandemic spending, particularly the issues around the failed Canada student service grant and the half billion dollars destined for the WE organization. That study has faced some significant obstruction: first, by way of Parliament being prorogued in the midst of a pandemic; and, second, upon returning from prorogation, the committee was filibustered for the equivalent of 20 meetings, more than 40 hours. When the agreement on having witnesses appear was finally reached in December, many months followed where the witnesses would not appear. Finally, summonses were issued.

The potential damage to the government and the Prime Minister the testimony that the committee is looking for is great. Not only did the Prime Minister prorogue and the Liberal members filibuster for the equivalent of more than 20 meetings, but when an order of this House was issued for witnesses to appear, which passed with majority support, the Liberal members said they did not like the decision, they did not support that Canada's Parliament had spoken that it was within its powers to exercise an order for people to appear at committee and instead wanted others to go, so they told those individuals to defy an order of Canada's Parliament. Who told them that? Ministers of the Crown told individuals to dodge, to duck an order—

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Mr. Speaker, I rise on a point of order. The debate we are having today is on Bill C-11, the digital charter implementation act. Although I thought at the beginning that the member was going to briefly reference the ethics committee, he is now completely talking about an unrelated matter. I guess he trying to justify why this is going to a certain committee, but that is certainly not the content of the bill, which is what we are supposed to be discussing now. Perhaps you could—

[An hon. member]

Debate.