Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

[Dr. Teresa Scassa]

I was concerned by the wording in Bill C-11 in the exception for use of data for socially beneficial purposes that referred to the sharing of this data without knowledge or consent. I think that this transparency issue that Dr. Cavoukian has spoken about and that has been debated and discussed is fundamentally important here.

There need to be some transparency mechanisms so that people can understand how their data is being used. There may also need to be some sort of governance framework in place that sets parameters, puts limits on the use and sets an ethical framework for the use, if that's necessary.

[Ya'ara Saks, Liberal, York Centre, ON]

Like all of us, I have one of these with agreements on them and so forth.

Dr. Scassa, through the chair to you, I really appreciated your comments on understanding that the client consumer relationship when it comes to these devices has dramatically changed in terms of the volumes of information that we're dealing with, and also of how they've become a part of our daily lives.

Perhaps you could provide a written answer to this. What recommendations would you want to see us consider going forward in tabling something like C-11, or recommendations for this committee to provide on upcoming legislation?

[Dr. Teresa Scassa, Canada Research Chair in Information Law and Policy, Faculty of Law, Common Law Section, University of Ottawa, As an Individual]

Thank you, Mr. Chair.

Thank you for the invitation to address this committee on this important issue.

The use of mobility data and the reaction to it highlights some of the particular challenges of our digital and data society. It confirms that people are genuinely concerned about how their data are used, and it also shows that they struggle to keep abreast of the volume of collection, the multiple actors engaged in collection and processing, and the ways in which their data are shared with and used by others. In this context, consent alone is insufficient to protect individuals.

The situation also makes clear that data are collected and curated for purposes that go well beyond maintaining consumer or customer relationships. Data are the fuel of analytics, profiling and AI. Some of these uses are desirable and socially beneficial while others are harmful or deeply exploitative. The challenge is to facilitate the positive uses and to stop the harmful and exploitative ones.

The situation also illustrates how easily data now flow from the private sector to the public sector in Canada. Our current legal framework governs public and private sector uses of personal data separately. Our laws need to be better adapted to address the flow of data across sectors. Governments have always collected data and used it to inform decision-making. Today, they have access to some of the same tools for big data analytics and AI that the private sector has, and they have access to vast quantities of data to feed those analytics. We want governments to make informed decisions based on the best available data, but we also want to prevent excessive intrusions upon privacy.

Both PIPEDA and the Privacy Act must be modernized so they can provide appropriate rules and principles to govern the use of data in a transformed and transforming digital environment. The work of this committee on the mobility data issue could inform this modernization process.

As you've already heard from other witnesses, PIPEDA and the Privacy Act currently apply only to data about identifiable individuals. This circumstance creates an uncomfortable grey zone for de-identified data. The Privacy Commissioner must have some capacity to oversee the use of de-identified data, at the very least to ensure that reidentification does not take place. For example, the Province of Ontario addressed this issue in 2019 amendments to its public sector data protection law, amendments that defined de-identified information for the purposes of use by government, required the development of data standards for de-identified data and provided specific penalties for the reidentification of de-identified personal data. The discussion paper on the modernization of the Privacy Act speaks about the need for a new framework to facilitate the use of de-identified personal information by government, but we await a bill to know what form that might take.

The former bill C-11, the bill to amend the Personal Information Protection and Electronic Documents Act, which died on the Order Paper last fall, specifically defined de-identified personal information. It also created exceptions to the requirements of knowledge and consent to enable organizations to de-identify personal information in their possession and to use or disclose it in some circumstances, also without knowledge and consent. It would have required de-identification measures proportional to the sensitivity of the information and would have prohibited the reidentification of de-identified personal information and imposed stiff penalties.

The former bill C-11 would also have allowed private sector organizations to share de-identified data, without knowledge or consent, with certain entities, particularly government actors, for socially beneficial purposes. This provision would have applied to the specific situation before this committee right now. It would have permitted this kind of data sharing and without the knowledge or consent of the individuals whose data were de-identified and shared. The same provision, or a revised version of it, will likely be in the next bill to reform PIPEDA introduced into Parliament. When that happens, some important questions need to be considered. What is the scope of this provision? How should socially beneficial purposes be defined? What degree of transparency should be required on the part of organizations that share our de-identified information? How will private sector organizations' sharing of information with the government for socially beneficial purposes dovetail with any new obligations for the public sector? Should there be any prior review or approval of plans to acquire and/or use the data, and what degree of transparency is required?

I hope the work of this committee on the mobility data issue will help to inform these important discussions.

Thank you.

[John Brassard, Conservative, Barrie—Innisfil, ON]

Thank you, Mr. Chair, and thank you, Madam Clerk, for circulating the motion.

Mr. Chair, this is an incredibly important issue for Canadians. Since news broke prior to Christmas and over the course of the last couple of weeks, Canadians have become more aware of the situation. The purpose of calling this meeting, and the request that came from the opposition parties, is one of accountability.

Here's what we know, Mr. Chair, and I'm not going to take up too much time, because Conservatives are here to work: We're ready to work this morning. To that end, yesterday I notified the clerk, the chair and other parties, including the Liberal Party, of my intent to move this motion, which would call on Ms. Tam as well as a couple of ministers to appear before this committee today if in fact this motion is passed.

There are three things that we really need to focus on and to dig deeply into on this issue. Number one is the data collection contract that existed, whereby the Public Health Agency of Canada was collecting data without the knowledge of Canadians, effectively doing it in secret. We need to know what security measures were in place to protect the privacy rights of Canadians.

It has come to our attention, Mr. Chair, that over the course of the last week there has been confusing information between Public Health Canada and the Privacy Commissioner and his office concerning to what extent the Public Health Agency did contact the Privacy Commissioner to discuss how the safety and security and the privacy rights of Canadians were to be protected as a result of this information. It is critically important that we find answers to these questions.

The second issue we need to focus on, Mr. Chair, is the request for proposal that was initiated by the Public Health Agency to effectively continue this practice of collecting Canadians' data. The request for proposal was published on December 17, the day after Parliament adjourned for the winter break, and was scheduled to close on January 21 of this month, 10 days before Parliament is to return. I'll note that, curiously, just yesterday the request for proposal was amended to conclude on February 4. We have to find out why this occurred, Mr. Chair, and why this request for proposal was put out when there was no opportunity for parliamentary scrutiny.

It wasn't until this request for proposal was found that the Public Health Agency admitted they were tracking the cellphone data of 33 million Canadians. Canadians weren't aware of that, so we have to get to the bottom of that. That's why the study is so important.

Third, it's not just a matter of looking back but also of looking forward, Mr. Chair. This provides a perfect opportunity for this committee to call in privacy, security and surveillance experts from across Canada and around the world to talk about an important issue, and that is privacy and data protection in the digital age. I don't want to just look back. I don't want to just look at what caused this problem, who made these decisions, why it was done and what metrics they were trying and hoping to achieve as a result. I think we also have an opportunity, Mr. Chair, to look at privacy of data in the digital age and to make recommendations in this report.

As I said earlier, many Canadians have become concerned about this issue, and not just this issue, but a pattern of issues of government overreach, of government extension into the privacy rights of Canadians. We've seen it with StatsCan collecting the banking data of 500,000 Canadians without their knowledge. We saw the proposals in the last Parliament of Bill C-10 and BillC-11. If you start connecting the dots, Mr. Chair, it becomes increasingly concerning that government is seemingly using this pandemic as a means of and a cause for massive overreach into the privacy rights of Canadians.

As we are parliamentarians, it's incumbent upon us to make sure that we protect those rights and that there is proper scrutiny and oversight of not just the privacy rights but also the constitutional rights of Canadians, Mr. Chair.

I hope Mr. Fergus meant what he said the other night on Power Play when he was on CTV with Evan Solomon, which was that the Conservatives and the opposition parties are pushing on an open door here, and I hope that we can get right down to the study now and get to work on this very important and critical issue for Canadians.

Thank you, Mr. Chair.

[Daniel Therrien]

Yes. We think that for Canada to be competitive—and the government underlined this in Bill C-11, and I would completely agree.... We have a confidence problem, a trust problem. Consistently Canadians, at the level of 90% or so, have expressed their concerns that privacy is not currently respected. They continue to use the Internet, because frankly you cannot live outside of the digital world in 2021. However, they still have important concerns, so we have a trust issue.

In order to deal with the trust issue, you need to have laws that enhance trust. That means ensuring that with regard to privacy laws, rights and values, consumers and citizens see that the legislation is apt to protect rights and values and produces proportional consequences, penalties, if these rights and values are not respected.

The law should provide for flexibility for companies to use data for legitimate commercial purposes, and our submissions I think go in that vein. There is no opposition really between privacy protection and economic development or innovation. As far as our relationship with the Competition Bureau and other regulators is concerned, it's extremely important that digital regulators are able to co-operate and share information so as to have an effective regulatory framework across all sectors. We have a good relationship with the Competition Bureau.

[Daniel Therrien]

At the beginning of my mandate, there was a lot of emphasis on public and national security issues, and on measures that followed the events of September 11.

The Snowden phenomenon highlighted certain government practices. It's not all perfect, but we have made progress on those issues. Legislation has been passed to raise the bar on which departments [Technical difficulty—Editor] for national security purposes. Most importantly, independent oversight bodies have been established and are now in place within the public service and within Parliament. As I mentioned, not everything is perfect, but significant progress has been made.

In recent years, with Facebook, Cambridge Analytica and all the rest, there has been a lot of focus on what some call surveillance capitalism, where companies collect, process and disclose a lot of information about their consumers to provide services, but also to make money, of course. That is where we are at now, which is why it is extremely important that these issues be properly regulated through Bill C‑11 or its successor.

I have to say that recently we are seeing more and more public‑private partnerships. Clearview AI and the RCMP are just one example among many. This leads me to suggest that you think seriously about the relationship between the public sector and the private sector in terms of sharing personal information, and the idea of the same legislation governing both sectors, which we think would be extremely desirable. If two laws are used, it would be best if they had very similar principles, because data has no geographic borders and no boundaries between the public and private sectors. It is important that similar rules govern both sectors.

I would add that, to maintain the confidence of the public and consumers, it is essential that [Technical difficulty—Editor] result in penalties that are proportionate to the magnitude of the impact of the privacy breach on privacy. Order powers and consequent fines are therefore crucial. The reason for recommending substantial fines is not to be punitive. Rather, it is to ensure that the consequences for people whose privacy has been breached are proportionate to the consequences for the companies involved, so that, over time, imposing such a regime will result in governments, departments and companies properly protecting the personal information of the public and consumers.

[Daniel Therrien]

I would answer with respect to the two relevant clauses.

In terms of the RCMP, to the extent that the principle that we outlined, i.e., that a federal department or institution should not rely on information that was obtained illegally by a third party partner, if that's not clear and the RCMP argue that it is not clear, then what needs to be changed is the public sector Privacy Act. That's point number one.

In terms of the particular use of the Clearview technology, Clearview also was, and I think still is, arguing that its database was created to assist the police and other institutions in law enforcement against crime. The company sees that as a legitimate purpose. There's no question that to develop some tools to assist the police to enforce the law is legitimate, but neither the police nor the private sector can or should do anything they like, regardless of privacy protection. That's point number two.

In our submission on Bill C-11, we ask that Parliament does make clear, with a technology like Clearview, which in our view constituted mass surveillance, that the law be extremely explicit, and that this is contrary to private sector privacy law as well.

[Charlie Angus, NDP, Timmins—James Bay, ON]

In the RCMP documents on Project Wide Awake, they have a [Technical difficulty—Editor] their officers, “You have zero privacy anyway, get over it.” It suggests to me a disregard for the law. As well, the RCMP took the position that they weren't responsible for the fact that Clearview AI, as a private sector partner, broke the law. If they were using it, it wasn't their problem. You stated, “In our view, a government institution simply cannot collect personal information from a third party agent if that third party's collection was unlawful in the first place.” That would seem to me to be a pretty clear reading of what Canadian law should be, and yet they seem to think they weren't obligated.

We have this new law, Bill C-11, which is supposed to clarify the uses of technology, but Minister Bill Blair, when I asked him about this, said they were certainly looking to give the police tools to use. Are you concerned that Bill C-11 would allow the RCMP to ignore these basic principles of privacy law and would allow them to contract with third party operators like Clearview AI?

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

With respect to Bill C‑11, my understanding is that we cannot be against motherhood and apple pie, because steps need to be taken. Clearly, we, as legislators, should quickly put forward the reform. We see reports from other countries that have moved forward, and we are a little behind. What I understand is that, regardless of current events or partisanship, if we are concerned about fundamental rights, we should make this a priority.

There is also the issue of facial recognition, the data and images that are used. I am very concerned as an individual, but also as a legislator. When I'm asked about what we have done to properly protect people, I'm a little embarrassed.

Do you agree?

[Daniel Therrien]

With respect to Bill C‑11, I would refer you to the brief we submitted a month ago.

The current Personal Information Protection and Electronic Documents Act (PIPEDA) is essentially an act that originally incorporated into federal legislation an industry code of practice that was created a little over 20 years ago. So the current wording of PIPEDA is very much a repeat of that code. A code of practice is a code that is intended to improve business practices, but it is not written like a law. Bill C-11 is certainly a step forward. The structure of the bill is adequate, in terms of its content, to raise the appropriate questions.

That being said, we clearly have a lot of concerns about the content and the answers that the bill gives to those questions.

For example, what should the rules be on consent? What should the rules be on corporate responsibility? What should the powers of the commissioner's office be?

The starting point of the structure of the act is good, but a lot of work remains to be done. Looking at it broadly, I would say that the work before you, and before us, is to protect the right to privacy as a human right, as it should be. That's my view.

Beyond that, we need to find the right methods to help Canada ensure that data, including personal data, can be used in the public interest while protecting privacy. I think that's the overall goal. Public authorities have a responsibility to ensure that, in the 21st century, laws are drafted in such a way that we, as a society, can enjoy the benefits of the digital age, but in a way that protects privacy. That's how—

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Thank you, Mr. Chair.

Mr. Therrien, let's continue in French. I have a few comments to start with.

First, I would like to thank you for your impartiality and to congratulate you on your role as commissioner. We need your input to do our work. I am very grateful for that.

I am also grateful for your co‑operation with our counterparts in other provinces, for going to see what is going on elsewhere and also for seeking to understand legislation in other countries.

In 2019, I did hear your request about fundamental reform. As a committee, we clearly had to adjust.

However, I am very concerned. Yes, [Technical difficulty—Editor] in the first part of the session, my motion had been clear that we need to stop checking people's social security numbers and make sure that we use other means to check identity. Many private companies are already doing this.

We didn't get to see Bill C‑11 go through, but how would that bill have contributed to your desire for reform? At the same time, how do you see the coming months, as your precious time is running out in the coming year?

Those are the first questions I want to ask you.

[Daniel Therrien]

In the submission that we presented to your committee about a month ago, we addressed that important issue. We recommend the addition of preamble and purpose clauses in a new law that would firmly ground the federal legislation in trade and commerce. This could be done by having explicit language in a preamble or purpose clause to indicate that the purpose of the federal private sector law—Bill C-11 at this point—is to ensure viable and sustainable digital commerce by protecting privacy.

That would set the purpose of the federal law squarely in the jurisdiction that Parliament has under trade and commerce. Once that is done, then Parliament can legislate to protect privacy in the best way that it feels should be part of that law. If Parliament so decides, that could include, without infringing on provincial jurisdiction, a rights-based law.

[Patricia Lattanzio, Liberal, Saint-Léonard—Saint-Michel, QC]

Would you not say that our fines are among the highest in the world? That would be a subsequent question I have for you.

More importantly, I would also like to ask you the following question. You've called for Bill C-11 to be grounded as a law in human rights. Should Parliament wish to amend it to do this, how can it best do so without infringing on provincial jurisdiction and the risk of constitutional challenges?

[Daniel Therrien]

First of all, it would be that most if not all contraventions of the law should be eligible—let's put it that way—for administrative penalties, as is the situation in most other countries that have penalties. There are modalities that we can discuss if we have time, but the rule should be such that essentially all violations lead to fines if the proper authority determines that the law has been violated.

In terms of who decides between the OPC and the appeal tribunal that is proposed in Bill C-11, it is certainly possible for Parliament to create an appeals tribunal, but in privacy matters this would be, to our knowledge, exceptional. We do not know of any other jurisdiction that has such a tribunal, which is not to say that I am not concerned, obviously, about the fairness of the process under which companies would have to pay fines. If the OPC had that authority and there were no administrative appeal as proposed, the courts could intervene and control the legality and fairness of the process undertaken by the OPC. That system of the privacy regulator being authorized to impose fines subject to judicial review by the judicial courts is the normal structure in privacy laws, and we would recommend that it be adopted.

[Daniel Therrien]

Bill C-11 includes the authority to make orders and, as you say, to recommend fines. Is it a step in the right direction? I think the overall goal should be to ensure that Canadian consumers have access to quick and effective remedies when their privacy rights are breached or violated, and as we tried to explain in our submission, in most cases we think that the imposition of administrative penalties would result, on average, seven years after the violation has occurred. Is that a step forward?

Personally, I don't think so, particularly when the list of violations that can result in fines is extremely limited, contrary to the laws of other countries, and excludes the most central provisions in privacy law, which are obtaining consent meaningfully and for organizations to be accountable in the way they handle information. The extreme narrowness of the scope for offences and violations and the extremely long period leading to the potential imposition of a fine makes me say that this needs to be reconsidered completely.