Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Digital Charter Implementation Act, 2020

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I would like to ask the member to present his conclusion. I would like to give him that opportunity, so he can tell us more about the enforcement powers he would give the Privacy Commissioner of Canada.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, I have no specific recommendations on that topic at this time. However, I thank my colleague from Quebec for his question.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, I appreciate some of the thoughtful things the member brought forward about small business, but also, like me, he has raised serious concerns about big banks and how they have not done their part during the COVID crisis.

The Conservatives, like the New Democrats, have been rightly concerned about privacy, especially when the COVID-19 app rolled out and what it meant for privacy. The Conservatives have asked tough questions of government, like we have, that concern privacy remaining ineffective. Could the member talk about how there is no need for a trade-off between privacy rights and other priorities?

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, when we talk about a trade-off, we talk about enforcement more than anything else. If we think about banks, which people often think about when they come to a conclusion about all the disclosure, particularly financial disclosure, they have been under compliance regimes for decades. In effect, when we get down to the ground and the people fulfilling those compliance regimes, we find that it gets watered down to the point where they do not understand those compliance regimes.

Therefore, something that happens at a high bureaucratic level does not necessarily get translated down to the customer level. Getting a real piece of legislation like this down to the level of the clerk and the customer is a monumental task and will not happen overnight.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

We have time for a brief question.

The hon. member for Willowdale.

[Ali Ehsassi, Liberal, Parliamentary Secretary to the Minister of Innovation]

Madam Speaker, I was listening very intently and I am grateful the member has acknowledged that the bill has great improvements and would allow Canadians to feel more secure.

When it comes to the role of government, would the member not agree with me that the Privacy Act does apply to the government that may have some information on Canadians? Obviously that regime is robust—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I do have to allow the member to answer. We are running out of time. When I say a brief question, I would ask members not to provide a speech.

The hon. member for Calgary Centre, a brief answer, please.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, what I saw in the legislation did not indicate any penalties to the government for citizens whose privacy had been breached. I think for most Canadians, their number one provision of data is to the government, the party they trust the most. That is the party that should probably be the most liable to Canadians for any breach of data, yet there is nothing in the legislation that says that the government owes this duty of trust to Canadians.

[Francesco Sorbara, Liberal, Parliamentary Secretary to the Minister of National Revenue]

Madam Speaker, I will be sharing my time with my colleague, the hon. member for Pontiac.

I am pleased to rise today to speak about the digital charter implementation act, 2020.

Digital technology is changing our economy and our society. Data is now a resource that companies can use to be more productive, to develop better products and services, which has unleashed a digital revolution around the world and which is even more evident during this time of COVID-19.

At the same time, the rapid growth of data-driven industries and technologies is opening the doors to the potential of new and innovative uses of data to support the public good. Data drives the development of many of the algorithms and protected models that are key to our understanding of societal challenges. Examples include the use of data to support sound public health outcomes; enable smart city technologies, such as dynamic traffic management; and promote greater energy efficiency and sustainability through smart grid technologies.

In Canada, public discussions around socially beneficial uses of data have focused on the emerging concept of the smart city in light of waterfront Toronto development proposals and other smart city initiatives considered by federal, provincial, territorial and municipal governments.

The COVID-19 pandemic has recentred the discussion on the role of private sector data and innovation in supporting public health objectives. We are witnessing the central role that data is playing in managing the pandemic. Not only is data critical for tracking current outbreaks or predicting future outbreaks, it has also been used to inform how our health professionals manage critical supplies and ensure they are deployed where they are most needed.

While data has proven to be of vital importance, stakeholders have identified the need for greater clarity around the legal frameworks governing data sharing between businesses and public sector institutions in the context of smart cities and public health.

At the same time, Canadians' concerns over the protection of privacy and democratic responsibility underscore the importance of defining the conditions necessary to establish a certain level of confidence in any new framework. Data sharing can lead to innovative solutions that benefit society.

However, Canadians need assurance that their privacy will be respected and that their data will not be misused. That is why the act to enact the consumer privacy protection act introduces a clear framework for privacy protection in data sharing for socially beneficial purposes.

Under Bill C-11, organizations will also be obliged to obtain consent before disclosing personal information to other organizations. This is in line with the existing act and with most of the legislation on privacy protection in the private sector.

However, in order to support responsible innovation, the bill makes one exception that will allow private sector organizations to disclose de-identified information to certain types of Canadian public institutions for socially beneficial purposes, without consent. This guarantees that businesses will be given the opportunity to participate in public sector initiatives that use data to contribute to the public good.

In addition, by abiding by this framework, private sector organizations can take part in these data sharing activities with full confidence that they are complying with the bill. At the same time, the bill underscores the importance of oversight by democratically responsible public authorities.

As I mentioned, information that is disclosed in this manner would have to be de-identified, ensuring that individuals' privacy is completely protected. What is more, the act would prohibit using that information later to try to reidentify the individual. This prohibition would be tied to significant fines.

This framework would allow Canadians to participate in initiatives directed at socially beneficial purposes without compromising their privacy. It would also ensure that Canadians benefit from the full power of data to create better solutions to some of the most complex policy challenges of our time.

The scope of socially beneficial purposes would focus on areas of public interest that provide broad public benefits supported by use cases and lessons learned that have been identified through years of engagement between government, business stakeholders and civil society organizations.

For example, ride-sharing and transportation service companies could potentially disclose de-identified aggregate data on the movement of their users to municipal authorities as modelling traffic patterns to help improve traffic flow, plan for better public transit initiatives and to improve road user safety.

The law would set clear parameters on which public institutions could receive information under the new consent exception, such as health care bodies, post-secondary institutions, public libraries and other public institutions or private organizations with the mandate to carry out a socially beneficial purpose. Many of these public institutions already have robust data governance systems in place to ensure the integrity of information and protection of privacy and would be ready to take on new responsibilities that would be in the public interest.

The framework for socially beneficial purposes would also cover situations where different levels of government direct public institutions or certain private sector partners to carry out data initiatives. As highlighted in the reports of our colleagues on the policy implications of connected and automated vehicles, this type of public-private sharing of information would be critical to ensuring the safety and security of technologies that would bring incredible benefits to all Canadians.

The approach proposed in the bill would ensure that the law would be adaptable as new use cases emerge and pave the way for innovative new uses of data that could provide broad public benefit while retaining trust and accountability.

Canadians can also rest assured that the new act will protect their information before and after they communicate with these institutions. All personal information transferred will first be de-identified, which will ensure that privacy is protected in these data sharing activities. The consumer privacy protection act also contains clear rules that will prevent the identification of this information, as well as severe penalties for organizations that break these rules.

The framework for socially beneficial purposes will allow innovative Canadian businesses and public organizations to take part in resolving the greatest social challenges in areas such as health and environmental protection. This could improve research on the pandemic, enhance environmental sustainability and conservation efforts, and make our roads safer for users.

These actions will be based on clear democratic responsibility and the protection of Canadians' privacy, and will maintain the flexibility needed for future innovative uses of data for socially beneficial purposes.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Madam Speaker, I thank my colleague and friend from Vaughan—Woodbridge. I am very happy to see that his French is getting better every month.

Here is the full title of Bill C-11: an act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other acts.

It is a long title, and I would like to ask my colleague a question. In connection with this bill, does he think his government needs to take rapid, if not immediate, action to stop fraud and identity theft?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I thank the member for Rivière-des-Mille-Îles for his question.

COVID-19 has brought many things to the forefront, and data protection and identity protection are first and foremost. What Bill C-11 brings forth is the idea of consent and also the idea of data destruction. If someone is moving their information from one provider to another, they would be able to indicate to the first provider that they wished to have their data and personal information destroyed so it would not be leaked or hacked.

There are several protections built into this. Consent is one of them, and I am happy to see this. I am happy to see the update to a number of laws within Bill C-11 for the protection of data and information for all Canadians from coast to coast to coast.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, we know that since the government was elected in 2015 tech giants have tripled their lobbying efforts. Google and Facebook account for half of the increase in terms of the lobbying efforts. We know privacy rights are an important part of life, especially in the digital age. However, when they are violated, individuals need to be compensated.

During the government's time in office, there have been many data breaches, including at Equifax. In the United States, victims of the Equifax data breach were compensated $425 million as part of the settlement. In Canada, for the same breach, consumers were not awarded anything.

This bill has no provisions to take notice of settlements in the United States to ensure there is parity in the treatment of victims on either side of the border. Should this bill be amended to make sure Canadians are treated equally for the same violation that is happening in the United States?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I hope to see Bill C-11 come to committee in an appropriate fashion. We are having a vigorous debate here in the House on the merits of the bill, and when it comes to committee suggestions can be put forward.

What I am very happy to see in the current form of the bill is that we would have some of the highest fines in the G7 under the CPPA, which would be introduced with this bill and ensure organizations are maintaining and controlling the data of Canadians in an appropriate and safe manner. It is great to see the bill has highlighted the fines and penalties that could be instituted on organizations if they fail to do so.

[Paul Manly, Green, Nanaimo—Ladysmith, BC]

Madam Speaker, there are much-needed updates to the privacy legislation in this bill. In particular, I like the right to erasure, which would allow consumers to demand that organizations delete information about them.

The Greens believe this privacy legislation should apply to political parties, as it does in the B.C. legislation. I am wondering whether the hon. member would support an amendment to that effect.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I hope to see this legislation brought forth to, I believe, the ethics committee, where it would be sent from the House and we would see a vigorous debate on the bill.

I am very happy that for the first time since 2001, when PIPEDA was introduced, we are seeing the modernization of our privacy act, if I can use those terms. It is great to see because we know data, technology and the importance of data have grown exponentially throughout the years and even more so in our daily lives. We need to ensure laws are updated and revamped to protect Canadians. That is what we are doing with Bill C-11. I will be happy to see it go to committee, and as a member of that committee I will be involved in that vigorous debate.