Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Digital Charter Implementation Act, 2020

[William Amos, Liberal, Parliamentary Secretary to the Minister of Innovation]

Madam Speaker, I am pleased to rise today to speak to this Bill on consumer privacy protection.

The bill, which will replace the Personal Information Protection and Electronic Documents Act, makes consumer protection a top priority to ensure that Canadians have confidence in the digital marketplace and trust that their personal data will be managed responsibly by the private sector.

It is so important, in an era of global online commerce, for Canada to be putting in place a privacy standard that offers consumers increased control over their personal information as they participate in the modern digital marketplace. The act also includes several important changes to enable and support innovation in an increasingly digital marketplace.

I am going to speak today about how our government is supporting business and protecting Canadians' privacy as they actively participate in the digital economy. Our government is working to establish an enhanced privacy framework where consumer protection is strengthened and where businesses are supported in their efforts to innovate in a rapidly changing digital landscape.

Bill C-11 marks all sorts of important changes to the privacy framework for Canadians, and it is long overdue. It sets out enhanced measures for Canadians to ensure that their personal information is protected, and it establishes new roles and new mechanisms for industry in a way that promotes innovation in a digital world.

We understand the need to ensure that Canadians’ privacy is protected. We must also ensure that Canadian businesses have access to the support they need to grow and compete in a global marketplace based on digital technologies and data.

These changes are taking place at a time of great upheaval, namely the rapid evolution of digital technologies. They are also taking place at a critical time for businesses, which must adapt and innovate in a digital world.

The current pandemic has made digital solutions essential to everyday life. At a time when physical distancing is so important, consumers want solutions that give them access to the products and services they need. Moreover, companies must continue to do business and develop. Digital solutions have helped many of them stay afloat.

However, we all recognize that new technologies provide businesses with huge amounts of personal information, the kind of data they need to make business decisions and offer clients new services.

We know that innovation and growth are critical, but we have to stand up for Canadians and ensure that this innovation in a digital world happens in a responsible way. Today I am going to outline some of the key elements of Bill C-11 that enable responsible innovation: innovation that is done right in a Canadian way.

One of the goals of our current law, PIPEDA, which Bill C-11 would supersede, has been ensuring that companies are able to handle personal information to meet their own legitimate business ends. The other is to ensure that companies do this in a privacy-protective way. To achieve this dual objective, PIPEDA's framework is principles-based and technology-neutral. The framework ensures that this law continues to apply, even as technology has undergone rapid change.

Bill C-11, the CPPA, retains this approach, continuing the success of a flexible and adaptive privacy law in the Canadian private sector context, but we have to recognize that “the times they are a-changin'.” To better reflect the realities of the digital economy, and the continued emergence of new big-data technologies and artificial intelligence, the CPPA would allow for a number of provisions that support industry going forward.

The bill would create a level playing field for companies of all sizes by reducing administrative burdens, which is critical for the vast number of small and medium-sized enterprises in Canada. It would introduce a new framework for personal information that is de-identified. It would establish new mechanisms, such as codes of practice and certification, with independent oversight by the office of the Privacy Commissioner, and it would address data for research purposes or purposes deemed to be socially beneficial.

I will outline how the bill would do all this.

The bill before us today includes a new exception to the requirement for consent regarding certain business activities. The objective is to allow Canadians to give meaningful consent by limiting it to specific activities that involve real choice. This is essential to prevent the use of blanket consent and lengthy contracts that—let us be honest—no one reads.

This will also reduce the administrative burden on businesses in cases where an individual’s consent may be less relevant. Let's consider the example of a third-party service provider that ships various goods. The customer wants the goods shipped, and the business should be able to meet that need. The bill should not add to the burden of providing that service.

The bill would provide for new regulations to be developed for prescribed business activities and would introduce the concept of legitimate interests in Canada's privacy framework. This is something that industry has asked for, we have consulted about and the government has answered in Bill C-11.

Second, we are better defining and clarifying how companies are to handle de-identified personal information: personal information that has been processed and altered to prevent any identification of a particular individual. The bill would allow organizations to de-identify personal information and use it for new research and development purposes. Businesses must undertake research and development to improve their products and offer customers the new and leading-edge services they are looking for. This provision would give businesses the flexibility they need to use de-identified data for these purposes, which would add value for customers and businesses alike.

The law would also allow organizations to use data for purposes of serving the public good, specifically by allowing companies to disclose de-identified data to public entities. Such disclosures would only be allowed when the personal information could not be traced back to particular individuals and when there was a socially beneficial purpose; that is, a purpose related to health, public infrastructure or even environmental protection. This kind of provision would protect individuals while ensuring we use all the tools at our disposal to address the biggest challenges of our time.

Included in the bill is a clear set of parameters for institutions, such as hospitals, universities and even libraries that would seek to receive personal information for a socially beneficial purpose. These parameters would help clarify the rules of the road in new and important fields.

These provisions would also permit organizations to share more data in a trustworthy fashion. They would allow the private sector to work with different levels of government and public institutions to carry out data-based initiatives in a privacy-protecting fashion. By taking this approach, the bill would accommodate emerging situations where collaboration between public and private sectors could have broad public benefits, while at the same time maintaining the trust and accountability that Canadians demand and deserve.

Third, the bill would provide the framework for codes of practice so businesses, especially those in specific industries or sectors of the economy, could proactively demonstrate compliance with the law. The bill would do this by introducing co-regulatory mechanisms into Canada's privacy landscape that would have businesses and the Privacy Commissioner working together. For example, there could be a code for de-identification.

I recognize my time is running short so I will simply mention that I would open the door to talking about the process the bill would provide for certification and certification bodies. I think this would be a very important provision that businesses across Canada would use regularly and that the Privacy Commissioner would have the opportunity to work on with businesses.

With that, I am thankful for the opportunity to speak to Bill C-11. I look forward to taking the questions of my hon. colleagues.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I thank my colleague for his speech.

Bill C-11 seems to apply only to private businesses, not to the federal government. We all saw many examples of this during the pandemic. I imagine that all members were informed of the cases of victims of fraud or identity theft reported to their riding offices.

It therefore seems to me that this bill could also be applied to the federal government. Before imposing these sorts of measures, which I agree are desperately needed, on private businesses, perhaps the government should have a look in its own backyard.

I would like my colleague to tell me whether his government plans to do that.

[William Amos, Liberal, Pontiac, QC]

Madam Speaker, I thank my colleague for her question.

Bill C-11 certainly focuses more on commercial activities. That is where there is a real interest, and it is the stakeholders in that area that we have been consulting for several months, and even years, to find solutions that will not only protect consumers but also benefit businesses and SME development across Canada.

That said, with regard to the federal government's work on modernization and the protection of individuals, we have already included protections in the Elections Modernization Act during the previous Parliament and so I think we have made progress on both sides. This time, we are focusing on commercial activities.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, I thank my colleague for his speech.

My question is a fundamental one, to my mind. Our data and personal information are invaluable to the web giants. They use this information for marketing and targeted advertising. They use it to direct users to websites or places where they can purchase and consume products. One of the fundamental aspects of that process is that companies can exchange and sell personal data, even if that data is separated from the person's information and packaged in a set of metadata. Companies rely heavily on selling and exchanging personal data.

Will the government commit to putting an end to this practice, which turns consumers into mere numbers, into merchandise to be exchanged by big companies?

[William Amos, Liberal, Pontiac, QC]

Madam Speaker, I thank my esteemed colleague from Rosemont.

We are well aware that Canadian consumers want more protections. They want to consent to the use of their information, and they want that consent to be informed and to be freely and clearly given. That desire for better control over their personal information is central to this bill. It is very important that people have the right to request that their personal information be destroyed. There are also circumstances where the consumer may want to transfer their data to other organizations.

There are several organizations, and I think our government has tried to find a middle ground and balance public and private interests in this very complex area. We will be pleased to discuss potential amendments to this bill in committee.

[Lloyd Longfield, Liberal, Guelph, ON]

Madam Speaker, when Canada's anti-spam legislation was first brought forward, I was president of a chamber of commerce. I was dealing with the issues, in business, of all the requirements and hurdles that had to be dealt with. They were designed around email spam. We are now into the next generation of spam, and information is shared digitally in different ways other than email.

Could the member describe how this legislation builds on previous legislation such as Canada's anti-spam legislation?

[William Amos, Liberal, Pontiac, QC]

Madam Speaker, that is a great question because privacy law needs to evolve. The spam issue came from an email generation. Now we are into the big data and social media generation. It all fundamentally starts with a better consent regime. It goes to transparency. It goes to a more informed consumer of data.

I am looking forward to the improvements to this privacy regime as the bill passes through Parliament.

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Madam Speaker, I would like to inform you that I will be sharing my time with the hon. member for Lethbridge.

Today we are discussing Bill C-11, an act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other acts, which received first reading in the House on November 17.

I am aware of the importance of the issue addressed in the bill. It is 2020. Who would have thought that, in 2020, we would have to come to grips with technology in such a hurry because of a pandemic?

Technology was already evolving at a fast pace, but I can say that we have had to increase our knowledge at great speed. If someone had asked me three months ago if I was comfortable with teleconferencing, I would have said no, but today it is an everyday occurrence. It is important to address this issue.

I would like to remind the House that I represent the fantastic riding of Portneuf—Jacques-Cartier in Quebec. In 2019, the personal data of 2.9 million Desjardins members were leaked. They were victims of identity theft. Their data were resold to people who wanted to use them to do business in the financial sector. Although the leak did not involve banking information, it still exposed the affected customers to identity theft.

On June 20, 2019, Desjardins revealed that the personal information of 40% of its members had been illegally shared outside the organization by an employee, who had since been fired, of course. On July 8, Quebec's Commission d'accès à l'information and the Office of the Privacy Commissioner of Canada announced that they were launching investigations. On July 15, Desjardins broadened its identity theft protection and offered protection to more than 4.2 million individual members and 300,000 corporate members. On November 1, it announced that all 4.2 million individual members had been affected by the data leak. About 173 of the 350,000 corporate members were also affected.

I will reveal that I am a Desjardins customer and that I was part of this group. Even before the pandemic, digital transactions were commonplace. The current context is speeding things up.

Today's bill comes from a good place, because we do need to keep up with the times, but will we be able to apply and enforce it? Are we not putting the cart before the horse? That is the problem with this bill.

Examples in my riding make me wonder. The government is trying to bring in legislation that would impose astronomical fines on non-compliant companies. The government is puffing out its chest, bragging that our country will be giving the biggest, juiciest, harshest and most lucrative fines, but will we be able to collect?

What do we want? We want to protect Canadians and provide them with the necessary tools. Would it not make more sense to invest in a service that gives these tools to our businesses, so they can help Canadians and consumers?

I have mixed feelings about this bill. It obviously comes from a good place, but are we taking the best possible measures to ensure solutions for the coming days, weeks and months? We need something concrete.

My constituents often tell me that I must find it hard to be a parliamentarian, because I am pragmatic. We need concrete solutions. The goal is laudable, but are we taking the right measures? I am not sure.

I hear from many businesses and citizens. They are still calling me to tell me they are having problems with Phoenix. They are federal employees who are having problems with their pay because of Phoenix. Phoenix is a problem that was never fixed. It has been around since the Liberal government's first term in 2015. It is now 2020, and nothing has been resolved.

I agree that we need to enact a law to protect personal information, but there may be other priorities. We are seeing it now with the Canada Revenue Agency. I have constituents calling my office to ask if I can help them, because the CRA is claiming it sent them money that they never received, which is a sign that they are victims of fraud and their identity has been stolen.

Should we be enacting a law to punish large companies when we cannot even solve the problem in our own backyard? I am aware of the importance of this bill, but I wonder whether we are taking the right measures.

I mentioned this earlier, but it is worth repeating: I am the member for Portneuf—Jacques-Cartier, which is in the province of Quebec. Quebec has a program to help people who have a baby: The mother or the father is entitled to parental leave.

Here is another example that boggles the mind. One of my constituents meets all of the EI eligibility criteria, but his claim is being reviewed because there seems to be some problem factoring in the parental leave he took in 2019 and the Canada child benefit claim he submitted during the pandemic interfered with processing his claim.

That only happens in Quebec. The Liberal government seems unaware of the existence of provincial programs, and its Canada-wide employment insurance system prevents it from fixing the problem. In this case, is it because it is a Quebecker? Is it because he is a father? I am asking because I want to stress the importance of finding concrete solutions to systems before we consider a bill that will punish big corporations.

I completely agree that those who are at fault should be held responsible, should accept the consequences and should pay if they break the law. I completely agree with my colleagues on that point. However, I wanted to show how bizarre this situation is, a situation that puzzles me.

Clearly, we need to reflect on this and update the legislation, but is the version being introduced today the best one? I think we need to send this bill to committee for further study and consultation with specialists and experts. We did actually notice that there is only one expert regarding the tribunal.

I do not pretend to be such an expert. I am not computer savvy and, as I said six months or a year ago, I was unaware of my skills and adaptability to technology. Many members here in Parliament have managed to learn quickly, at lightning speed.

That is why we need to think about this bill and, as I said in my speech, not put the cart before the horse. We need to do things right to make sure that the bill really meets Canadians' needs. At the end of the day, the goal is the same: to protect society's interests and ensure that Canadians are respected and protected. We are all working toward this goal.

I will now happily answer my colleagues' questions. On that note, let us be vigilant, because fraud is always lurking around the corner.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, big corporate data breaches are becoming more and more common. Canadians are concerned about how big tech giants, like Facebook and others, are using their data.

Privacy rights are so important in this day and age. We have to be clear on where we stand. We need stronger policies than some of the policies presented in this bill on compensation, enforcement and data collection.

Does the member agree that we should not be making it easier for the Facebooks and the Googles of the world to use Canadians' personal information in ways that have nothing to do with their services, in the guise of helping small business? Is that really the right place to stand?

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Madam Speaker, I would like to thank my colleague from Victoria for her question, which is very relevant.

I would not even break it down by category. As I mentioned at the end of my presentation, Canadians must be protected. We could include the banking sector, e-commerce companies, Facebook and all organizations. I say organizations, because there is also fraud in other organizations. That is why I am taking this opportunity to say that the government should ban Huawei from 5G. I am talking about organizations and all businesses that could benefit from exploiting Canadians.

My colleague is perfectly correct: We need a stronger act to protect Canadians, and it must cover all users and possible scammers.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, it is important to recognize what the legislation is doing. At the end of the day, we can take a look at our digital environment and the degree to which there has been a explosion of activity on the Internet, and we can see that in the last couple of years we have probably seen more data put into the Internet than we saw in the previous 10 years. One can only imagine what it will be like two years from now.

It appears as if all parties want to see the bill sent to committee. Does the member have some specific amendments today that he would like to see made to the legislation, or is he more content to wait until it gets to committee and then have the discussion at that point in time?

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Madam Speaker, I would like to thank my colleague, the Parliamentary Secretary to the Leader of the Government in the House of Commons.

In my speech, I raised certain questions. I think that we must act and that the intent of the legislation is positive. Having said that, I will not pretend to present any facts today. I want to hear from computer experts in the field. I think that we need to send this bill to committee in order to study it and to get it right.

The bottom line of my speech today is that we need to get it right in order to protect Canadians in the technological world. That is how I would put it. As my colleague said, we need to take a comprehensive look at the bill.

I fully agree with him; we need to take a comprehensive look at it in order to protect Canadians.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I thank my colleague for his speech.

A bill on the same subject is currently working its way through the Quebec National Assembly: Bill 64. It provides fairly significant penalties for organizations that fail to meet their privacy obligations.

Does my hon. colleague think that this bill is strong enough in terms of penalties?

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Madam Speaker, I thank my hon. colleague from Avignon—La Mitis—Matane—Matapédia.

I would rather not see stiffer penalties and fines as a way to get results. I think that we have to be smart and strategic about it. We need to think carefully and pass legislation that will yield concrete results and protect Canadians.

[Rachael Thomas, Conservative, Lethbridge, AB]

Madam Speaker, citizens are increasingly concerned with the information that is being collected about them, how that information is stored and how that information is used. When they like or dislike something on Facebook, where is that information stored and how is it utilized? When the bank asks them three important questions, to which they provide a security answer, where is that information stored and who has access to it?

As the digital world has advanced and expanded exponentially, regulations and oversight, unfortunately, have been rather lax. Now Canada is in a position where it needs to play catch-up. Like an untamed beast, bad actors have been given access to our information and now we are having to pull back in an effort to protect Canadians.

The digital charter implementation act, which seeks to protect the country's aging privacy regime or bring it up to international standards, is much needed and I commend the government for that. However, there are a number of concerns I wish to address as we bring this to a vote. Of course, my hope is that appropriate amendments are made once this gets to the committee stage.

Technology provides us with incredible opportunities for connectivity, influence and prosperity. However, in the midst of all of these positive components, there is also a dark side. By not seriously enforcing transparency and security measures, we run the risk of perpetuating our nation's technological vulnerabilities and we fail to protect our citizens' privacy.

I want to commend the government for acting on this file and crafting legislation that attempts to right some of these wrongs. It is unfortunate, however, that it took five years to bring this time-sensitive bill forward, but it is definitely a step in the right direction. The Privacy Commissioner has been calling for many of these changes, but the Privacy Commissioner would also urge the House to go further. It is no secret that Canada is lagging behind other countries and we need to get going.

If we want Canada to be a leader in technology and artificial intelligence, it is important that we invest the time and resources to get this right. While some measures in the bill meet international standards, others are lacking. Therefore, it is absolutely vital that we do not just pass legislation that checks off a few boxes and makes a few provisions, and then pat ourselves on the back as if we accomplished something great. What we are dealing with is very complex, sometimes confusing and merits keen attention, as well as bringing all the experts to the table.

Jim Balsillie, the founder of Centre for International Governance Innovation and an expert in the realm of digital privacy, has rightfully flagged this for us. He has flagged the call for algorithmic transparency in the bill as something that is inadequate and ineffective in addressing the real problem. We do not just need transparency. He is saying that we need to go a step further. We also need full access to the information and an understanding of what it means, as well as teeth in the event that something needs to be done about it.

In order to better understand the problem, let me take one moment to talk about algorithms. In simple terms, an algorithm is a set of codified instructions followed by our computing devices, whether that is our smart phone or television, etc. Basically, it instructs the device or the site that we are on to do something that the creator would desire it to do in order to anticipate our digital decisions and to direct us to the places it would like to direct us to go.

We know that algorithms are being used especially on social media platforms to affect our shopping habits, as well as our human behaviour. They are used to evoke strong, primarily negative emotions from the platform user, which produce harmful results both mentally and emotionally. Algorithms determine what is shown on our Facebook timelines or Instagram feeds and the advertisements that come up on the pages we look at. Companies and organizations use patented algorithms to push their agendas, whether that is to boost sales or to elicit support for a specific cause. They study us, they follow us and they direct us.

As we navigate online, our behaviour is constantly monitored. The data is stored, commodified and then it is even monetized, often without our consent. That information is then used to manipulate and control future behaviours through other algorithms. This pattern is particularly harmful to young children, as well as young adults, who are susceptible to these tactics.

Algorithms are now using artificial intelligence, which means that they are in some ways scarier than ever. They can learn how to trigger negative emotions and keep the user online for hours upon hours by targeting them with enticing images, stories or videos, things that would be of interest to them, because, remember, these individuals have been preyed upon and studied for many years.

The legislation before the House would give Canadians a right to transparency, but it fails to provide a mechanism for action. It is like being able to see that someone is harming a child but not actually being able to take any action. Again, transparency is there, but what is the good of transparency if the wrong cannot be righted?

Robert Mazzolin is the chief cybersecurity strategist for the RHEA Group. He explained that legislators must insist that AI systems are made comprehensible to humans. In other words, make them understandable. He went on to say, “Enhanced transparency is a precondition for the acceptance of AI systems, particularly in mission-critical applications impacting life and death”. Algorithmic transparency is not enough. Canadians must be able to access not only the algorithms that are being used but what the code actually means. They must also be able to act when the algorithms are being used in a harmful manner.

Furthermore, when it comes to requesting information about the algorithms that are being used, the bill actually fails to legislate or give direction as to how the contact information for companies can be easily accessed. This might seem simple, but when was the last time members were able to just phone Google or contact it to inquire about something? It is not very easy. When was the last time members were able to get a hold of customer service at Facebook? Again, it is not very easy.

There is an opportunity within this legislation, a bare minimum within regulation, to tell companies where the information needs to be located and how it needs to be accessible to the Canadian public. For example, make it so that it has to be accessible on the home page, that it has to be size 12 font, that it has to be a certain type of font or that it has to be a certain colour of font. Make it so that the phone number, email and mailing address have to be listed. Make sure that we are caring for the consumer if this legislation is truly about Canadians.

If we want to keep children safe on their way to school, we do not just reduce speed limits in the area. We put in a crosswalk, lights, signs and crossing guards. We issue speeding tickets and we might even have police control. The objective here is to protect the kids, not just put up a speed limit sign. It is imperative that we take a very comprehensive approach to protecting Canadians' privacy, their digital safety and their security. It is not just about transparency. It is about so much more.

If the bill were to pass today, it would already be out of date. We are seriously behind in protecting Canadians' data, and foreign countries are certainly aware of that. By only addressing certain aspects of digital privacy and ignoring others, the government is leaving Canadians vulnerable and putting our national security at risk. AI technology is upending the international balance of power and shaping the geopolitical competition between nation-states. It would be naive for us to assume that foreign governments are not looking at Canada's vulnerabilities as an opportunity to upset information systems from within. This is extremely alarming and deserves for our attention.

For example, there is Huawei. Countries like China are seeking to obtain information superiority by acquiring massive amounts of data and using it to their advantage. The Chinese Communist Party has been pushing for greater civil-military fusion, as it calls it, which is evident in numerous sectors but especially in telecoms and data harvesting. The Chinese president has stated that AI, big data, cloud storage, cyberspace and quantum communications were among “the liveliest and most promising areas for civil-military fusion”.

It is perplexing then why this government has not yet taken steps to limit the impact that Huawei can have on our nation. In fact, we are the only country out of the Five Eyes alliance that has not limited Huawei or banned it altogether. This is perplexing and troubling.

The legislation is akin to building a security wall around a city, but only one section of the wall is built high enough to keep enemies out. Meanwhile, the rest of the wall is only built maybe a few feet high. If enemies are looking at the part of the wall that is actually built to the correct height, they are intimated by it and stay out, but the moment they take a peek around the corner and realize that the rest of the wall is only built a few feet high, they are in. That is what the legislation is like. It means well, but it is not nearly as comprehensive as it needs to be.

In closing, I am asking for an opportunity to work across party lines to address the concerns of Canadians to adequately serve their safety needs.