Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Digital Charter Implementation Act, 2020

[Navdeep Bains, Liberal, Minister of Innovation]

moved that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

Mr. Speaker, it is with great pleasure that I rise today to discuss Bill C-11, the digital charter implementation act, 2020.

As members know, data and digital transformation is completely changing the way we access information, buy goods and services, connect with each other and live in our communities and cities. This digital transformation has been accelerated by the pandemic, and we are seeing more Canadians moving their activities online. Canadians are using more digital services and sharing more data online than ever before. They want to know that their personal information will be safe and that they are protected.

Recently, the Privacy Commissioner surveyed Canadians and found that the vast majority of Canadians, 92% of them, are concerned about the protection of their privacy, so this is an important issue to many Canadians. That is one of the reasons why last year I launched the digital charter, a set of 10 principles that lay down the foundation that will allow us to build an innovative, digital economy that is inclusive, people-centric and built on trust.

The principles of Canada's digital charter give Canadians more control over their data while helping Canadian companies innovate, grow and create quality jobs for middle-class Canadians across the country.

I would like to take this opportunity to remind members that the principles of the digital charter were very clear, and they focused on control and consent. Canadians will have control over what data they are sharing and who is using their personal data and for what purposes, and will know that their privacy is protected. This is one of the key principles we laid out in the digital charter.

Transparency, portability and interoperability will enable Canadians to easily manage access to their personal data and to transfer it without undue burden.

Data and digital for good is another principle that was laid out in the digital charter. The Government of Canada will ensure the ethical use of data to create value, promote openness and improve the lives of people at home and around the world. How can we harness data to solve problems?

Another key element was strong enforcement and real accountability. There will be clear, meaningful penalties for violations of the law and regulations that support these principles so that Canadians can rest assured that their privacy will be protected.

As members will see, the principles of the digital charter are firmly embedded in the legislation before us today. On top of this foundation sits three pillars: consumer control, responsible innovation and a strong enforcement and oversight mechanism.

Let me begin with outlining how Bill C-11 would give Canadians more control and greater transparency in the manner in which companies handle their information. It would do this by introducing important rules for consent, the right to delete information, data mobility and algorithmic transparency.

With regard to consent, Bill C-11 would enhance consumer control by requiring organizations to get meaningful consent from Canadians. This means individuals would get specific information in plain, simple language, not the 30-page legal document that no one reads. This, in turn, would allow individuals to make meaningful choices about the use of their personal information.

To make consent more meaningful and move away from lengthy agreements that, as I said, no one reads, we are introducing a new exception to consent for the collection and use of information for standard business activities that would be reasonably anticipated by individuals.

Here is an example in plain language. When a customer buys something from a company and gives that company their address, the company can give that address to a delivery company so the customer can get the product they paid for.

Under the law, that company would need to be transparent about how it uses personal information so that consumers are made aware of this and that the Office of the Privacy Commissioner can review these practices.

The second element I want to talk about is the right to delete information. Bill C-11 would allow Canadians to withdraw their consent and demand that data be deleted. When individuals no longer want to do business with an organization, that organization must stop using their information and must delete it permanently if it is asked by individuals. This would, for example, allow a Canadian to demand that a social media site delete their profile. It is very simple, but very powerful.

The next area the bill highlights is data mobility. To improve their control further, individuals would also have the right to direct and transfer their data and information from one organization or entity to another organization or entity in a very secure manner. Bill C-11 would do this by enabling regulations that establish frameworks for secure transfer and interoperability. This approach would support innovation in areas like open banking, where a common technical approach could allow Canadians to take advantage of the consumer-directed financial marketplace in a more secure way.

Another area the bill touches on, which was highlighted through extensive consultations, is algorithmic transparency. In the area of consumer control, Bill C-11 would improve transparency around the use of automated decision-making systems, such as algorithms and AI technologies, which are becoming more pervasive in the digital economy.

Under Bill C-11, organizations must be transparent that they are using automated systems to make significant decisions or predictions about someone. It would also give individuals the right to an explanation of a prediction or decision made by these systems: How is the data collected and how is the data used?

This is a brief summary of what is found in the first pillar of this legislation under more consumer control.

The second pillar of Bill C-11 is enabling responsible innovation.

The digital economy creates significant opportunities for Canadian businesses. Digital activity accounts for 4.8% of Canada's GDP, and when it comes to research and development in this country, no other private sector industry outperforms Canada's information and communications technology sector.

Investment and data has climbed as high as $40 billion. Across the economy, Canadian companies' data is worth as much as all other intangible assets, such as software, research and development, and mineral exploration rights combined. Therefore, we can see the potential of data not only today, but going forward.

Globally, we are seeing unprecedented growth in the technology sector, growth that is only going to pick up as artificial intelligence continues to grow and have a more meaningful impact in our lives. According to some estimates, AI is going to contribute an additional $13.7 trillion to the global economy by 2030.

The government also understands the importance of giving companies clear rules that enable them to innovate while still protecting Canadians' privacy.

Trust is the cornerstone of economic growth and innovation. When Canadians are assured that their data and privacy are safe and protected, it creates space for the kind of innovation that benefits everyone.

Our government believes that greater trust and certainty in the digital marketplace will empower small businesses and entrepreneurs to create news jobs and opportunities, expand their operations and better access the global marketplace.

It is also important to note that the new legislation would help small businesses prosper as well by ensuring that rules for data and privacy are fair, clear, enforced and flexible enough to meet the needs of smaller organizations.

One area that does that is the codes of practice and certification systems. To enable responsible innovation, Bill C-11 would create a framework to recognize the use of codes of practice and certification systems. This would help organizations both comply with the law and demonstrate their compliance, which, in turn, would support innovation and provide an important balance to a strengthened enforcement regime.

Organizations would be able to apply to the Privacy Commissioner to approve a code of practice outlining how the act's general requirements apply in a particular sector or activity. This would give businesses some certainty that if they are following the code they are in compliance.

I also want to highlight de-identified information. Bill C-11 would also clarify how organizations are to handle de-identified personal information. This would enable an important mechanism for both privacy protection and innovative uses of data, which would benefit many small businesses.

Lastly is data for good. In this area, it is important to note that under the second pillar of enabling responsible innovation, Bill C-11 would recognize an exception to consent for socially beneficial purposes in order to clearly allow organizations to support innovative data initiatives such as data trust, which is pursued by a range of public institutions, including hospitals, universities and libraries. There is so much potential with data trust because it can enable us to unlock some of the opportunities that exist to solve some problems across our society.

The next element I want to talk about is strong enforcement. Perhaps more importantly, the proposal would significantly strengthen the enforcement and oversight regime. This is critical.

With this proposal, we will have some of the toughest financial penalties in the world for violating our laws.

Currently, the Privacy Commissioner has little ability to enforce his recommendations on organizations that are non-compliant, other than seeking a hearing by the federal court. Under Bill C-11 this would change. The legislation would introduce a strengthened privacy regime that would be overseen by a more powerful Privacy Commissioner, with appropriate checks and balances in place.

The Office of the Privacy Commissioner would have broad order-making power, including the power to force an organization to stop collecting or using information and delete it. If the Office of the Privacy Commissioner found out that data was collected without appropriate consent, he would have the ability to do this.

As well, the Privacy Commissioner would make sure there is strong and meaningful consequences for organizations that do not comply with the law. The Privacy Commissioner would have the power to recommend administrative monetary penalties of up to $10 million, or 3% of global revenues, whichever is higher. The range of serious criminal offences would also be expanded, with a new maximum fine of up to $25 million, or 5% of global revenues, whichever is higher.

The legislation would introduce the new personal information and data protection tribunal, which would review appeals of the commissioner's orders and levy penalties.

This new administrative tribunal will help ensure procedural fairness in how the commissioner applies the new and enhanced enforcement powers. It will provide individuals and organizations with easier access to justice through a less formal mechanism for appealing decisions.

This enforcement regime would recognize that early compliance with the act remains critical and that is the key part. Early compliance will remain critical for the protection of Canadian privacy. We need to build on the commissioner's existing abilities to secure early resolution through compliance agreements. We want to make sure that Canadian companies actually comply with the legislation.

This new regime would see stronger collaboration between the Privacy Commissioner, stakeholders and implicated institutions, including federal organizations. When the commissioner is developing that guidance, it is important to have that level of collaboration. This will ensure there is a strong alignment between the law and how it is explained and enforced, and help avoid confusion for those trying to follow it. Again, this will provide further clarity.

To summarize, the third pillar of Bill C-11, strong enforcement and oversight, would introduce an escalating model that provides incentives for organizations to comply early. The focus is on compliance. Strong penalties will exist if they do not follow through. There will be a new tribunal to ensure the process will be fair, transparent and accessible for businesses of all sizes.

The three pillars of Bill C-11 work together to provide what Canadians need to engage in the digital economy: strong and enforceable protections for personal information, along with clear rules for businesses to follow as they innovate and deliver new products and services.

It is also important to note that the legislation would help protect the privacy of Canadians, while strengthening the ability of Canadian businesses to compete globally. This positions Canada to succeed internationally.

When PIPEDA was introduced in 2000, it was considered a global leader among data protection laws. In 2002, the European Commission found that PIPEDA provided adequate protection relative to EU law. The finding of adequacy gave us an international edge by allowing us to have free flow of data between Canadian and EU companies.

More recently in 2018, the EU brought into force its GDPR, the general data protection regulation. Since then, the EU has been reviewing Canada's adequacy against the GDPR. They have made it clear that we must reform our privacy regimes in order to maintain our advantage when it comes to this status. I believe the legislation would achieve GDPR adequacy while maintaining the made in Canada approach.

Lastly, I want to conclude by mentioning stakeholder reactions. This approach reflects years of public study, consultations and collaboration. It builds upon the fundamental work of the House of Commons Standing Committee on Access to Information, Privacy and Ethics, as well as important deliberations in the other place.

I can tell members the legislation has gained support from a wide range of stakeholders. Goldy Hyder, the president and CEO of the Business Council of Canada, spoke positively about this. Michael Geist, who is well recognized in this area of expertise, said this is “Canada's Biggest Privacy Overhaul in Decades”. OpenMedia calls Bill C-11 “a big win for privacy in Canada.”

We know that Canadians will continue to use digital services that require the use of their personal data, and we know there is no turning back.

I will conclude with this last remark.

As the COVID-19 pandemic continues to increase our reliance on the digital economy, Bill C-11 will help Canadians embrace this new world, knowing that their personal information is protected and safe.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, I saw from the stakeholders that big business certainly likes the bill, but I want to talk about small businesses, like insurance companies, for example. The minister talked about data portability and open banking. Currently, in Canada the insurance arms of banking companies are not allowed to share that information with their mother company, the bank. This creates a competitive playing field for small and medium-sized insurance companies.

I wonder if he can address the concerns of small and medium-sized insurance companies that their business will be severely disadvantaged by the legislation and tell us what efforts the government will take to help those companies.

[Navdeep Bains, Liberal, Mississauga—Malton, ON]

Madam Speaker, as I highlighted in my remarks, the legislation is good for small businesses. It would provide them the ability to work with the Office of the Privacy Commissioner to create codes of conduct to enable them to be compliant with the act. The tribunal process is also less expensive and onerous for small businesses, particularly when we compare it with the lengthy processes they may have had to pursue in the past in the courts.

More importantly, I think the legislation gives control to Canadians, particularly in the area of portability, as the member opposite highlighted, by enabling small businesses to be able to take advantage of the fact that Canadians can now move their personal data from one organization to another. That creates more competition and more choice, which will have a positive impact on small businesses.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I have a question for the hon. minister.

Quebec is currently giving this careful consideration. Personal information belongs to individuals and is a provincial responsibility under the Constitution. The provinces are responsible for property and civil law. Quebec is in the process of modernizing its own legislation.

Knowing that, how do you see the two pieces of legislation eventually harmonizing?

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I would remind the hon. member that he is to address his questions and comments to the Chair and not directly to the minister.

The hon. minister.

[Navdeep Bains, Liberal, Mississauga—Malton, ON]

Madam Speaker, I thank my colleague for the question. He is right. Privacy is essential for all Canadians.

That is why we introduced this legislation, to make sure it is adequate with respect to the GDPR, but will also respect provincial legislation. This law demonstrates national leadership in an area where it is important to have clear rules to protect Canadians, their privacy and their data, and it will respect provincial jurisdiction.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Madam Speaker, I want to thank my hon. colleague for introducing the bill and for recognizing the work of the Standing Committee on Access to Information, Privacy and Ethics, which brought forward a number of these recommendations. It is essential that we move on this legislation.

I have some concerns when I look at the legislation. One of the key concerns I have is that the government has opted to ignore the need to bring political parties and third-party political operators under some form of privacy regime. I am sorry, but a pinkie swear from a party staffer that there is a privacy code does not cut it, not after what we have seen with the Cambridge Analytica scandal and the big data wars going on with political campaigns in the United States. We need to have political parties under some kind of regime.

Is the government willing to put this under a regime if we bring forward amendments?

[Navdeep Bains, Liberal, Mississauga—Malton, ON]

Madam Speaker, I would like to thank my hon. colleague for his active role in this area. I know that the ethics committee has done tremendous work in terms of providing recommendations that have been incorporated into the legislation.

With regard to political parties, it is important to note, as the member has indicated, that the legislation is focused on commercial activities. We are looking at not non-commercial activities but commercial activities, to strengthen the privacy in this area and to make sure that Canadians have more control, not less control, and that there is greater transparency, greater accountability and meaningful fines that will make sure organizations comply with the law. That is the object.

Again, the legislation is focused on commercial activities, not non-commercial activities.

[Gary Anandasangaree, Liberal, Parliamentary Secretary to the Minister of Crown-Indigenous Relations]

Madam Speaker, first of all, I want to congratulate my friend on being featured in this year's LinkedIn Top Voices profile. I offer congratulations on that.

I would like to ask the minister about data mobility and how the bill would assist Canadians and Canadian businesses. Data mobility is an issue that we have heard a great deal about over the years.

[Navdeep Bains, Liberal, Mississauga—Malton, ON]

Madam Speaker, I would like to thank my hon. colleague for his friendship and support. I have sought his counsel on numerous occasions to get his advice on issues he had heard about from his constituents.

He made it very clear that Canadians should have more control over their data and that Canadians should have greater privacy online. As he reminded me, particularly in this pandemic, more Canadians are learning online, working online and accessing information online.

One area we targeted and honed in on to provide greater control for Canadians was around data portability. This will enable, as the member clearly highlighted, the ability for individuals to transfer their data from one entity to another. This will create an enormous amount of activity online. It will empower Canadians, and it will create opportunities in many areas, including, as I mentioned, in the financial sector, with open banking for example.

[Diane Finley, Conservative, Haldimand—Norfolk, ON]

Madam Speaker, it is great to talk about data portability and privacy, but it does not matter if Canadians do not have access.

In the connect to innovate program, the government spent a lot of money, but it did not spend a single penny in southwestern Ontario to connect businesses, residences and Canadians with the Internet in order to give them proper service. This area represents 20% of Canada's economic output. In my own area of Norfolk County, over 30% are still underserved. There is no indication of a carve-out in the new program for funding. However, there are parts built in for financing that would only benefit the big players.

If the minister is serious about his commitment to small business, will the new program be modified to support small business ISP providers and to provide service to southwestern Ontario so that everyone could enjoy the new freedoms and protections that the minister is speaking about today?

[Navdeep Bains, Liberal, Mississauga—Malton, ON]

Madam Speaker, I would like to thank my hon. colleague for her very thoughtful question and for her advocacy on the issue around connectivity. As a minister who served in the previous Harper government, she knows personally very well the importance of broadband connectivity.

If we look at the digital charter, the first principle talks about access. It is an important principle that we put forward in the digital charter, and it highlights the commitment that we recently made with regard to building on the work of the connect to innovate program through the universal broadband fund, as well as looking at low-earth orbit satellite technologies to provide that high-speed Internet connectivity for rural and remote communities.

From our perspective, it is all about more competition, which would provide more choice to Internet service providers, particularly the smaller ones, which would then enable prices to go down and would provide options to many Canadians, including those living in southwestern Ontario.

[Louise Chabot, Bloc, Thérèse-De Blainville, QC]

Madam Speaker, Bill C-11 will not protect personal data under the federal government's own jurisdiction. We saw what happened at the Canada Revenue Agency and how easy it is to steal a person's identity for all sorts of reasons. These are outdated tools when it comes to identity and security.

Why are there no rigorous standards set out for government agencies?

[Navdeep Bains, Liberal, Mississauga—Malton, ON]

Madam Speaker, I thank my colleague for the question.

I understand that there are currently a lot of problems with data breaches. I hope that we can work together to come up with solutions for all Canadians.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, today I am rising on Bill C-11, an act to implement a digital charter for government. This is an auspicious moment for Canada, because we are well under way in the digital age, and the need for clarity and concrete action to protect Canadians' privacy is a paramount need. While it is critically important, we also have to remember the need to protect small and medium-sized enterprises and to ensure that Canada can remain globally competitive as a jurisdiction for technology, data and innovation. I am concerned by some of the trends we have seen over the past few years, with Canada falling behind our global competitors, and I am concerned that some parts of this legislation could put us behind.

I am also concerned that we are falling behind when it comes to security. It is great to talk about protecting Canadians' privacy and putting in consent-based rules, but in an age of quantum decryption and computers that can break 120-bit encryption, if our security cannot be protected, then all the consent laws and privacy protections in the world are not going to mean much.

I want to break down this bill into simple terms. They talk about plain language in the bill, and so I am going to try to speak in as plain a language as I can, when dealing with a matter of this technical nature. I want to talk about some of the challenges and, I will grant the government, some of the opportunities that we foresee with this legislation. I want to also thank and recognize the work of the ethics and privacy committee in the previous Parliament, under the able chairmanship of my colleague from Prince George—Peace River—Northern Rockies. Many of the recommendations we have seen in this legislation come from the committee's report, so I think that shows Canadians that committees really do matter in the House, and that they can make a positive impact.

As I said, one of my chief concerns with this bill is its impact on small and medium-sized enterprises. It has been said for a number of years that data is the new oil. For many emerging enterprises, access to data and the ability to use this data will be the determining factor in whether they are successful or not. I do not need to say, but I will, that small and medium-sized enterprises are the lifeblood of our communities, and increasingly we are seeing how vulnerable they are, especially during the pandemic.

We have to consider the context of this legislation within the economy and the economic structures that the Liberal government has created over the past five years. We have seen an unrelenting attack on small and medium-sized enterprises, starting with hikes to Canada pension plan premiums. These hikes will continue even this January, in the midst of a pandemic. When companies are closing their doors and laying off workers, the government is looking at increasing costs even further for employers and employees. It is just not acceptable.

The Liberals in the past accused business people of being tax cheats when they utilized exemptions under the tax code. They decided to take it one step further by hiking taxes and removing these exemptions for many family-owned businesses, including for a lot of businesses and farm families in my riding. With this legislation, they are adding yet another layer of red tape that will force many onerous requirements on small businesses. I recognize that many of these requirements will be very helpful when we are talking about large businesses, and they have the resources to maintain these privacy requirements. I found it interesting that the minister was talking about the right to delete oneself. On many social media platforms that has been the case for a number of years, so it feels like with this legislation the government is trying to catch up to what businesses are already largely doing. However, we see that small enterprises are increasingly reliant on technology and data.

In this legislation, there are a number of new requirements. There is a certification requirement and a requirement for businesses to designate somebody in their business to be the privacy watchdog. Businesses have to maintain databases and be ready to respond to customer requests or investigations. When we talk about very small businesses, which could have only two or three staff or maybe a sole proprietor, to add this new layer of red tape is really going to create a lot of challenges for them.

Ironically, it would actually benefit big businesses because when small businesses have more red tape, they might decide to no longer stay in business. Therefore, we will see even more consolidation among the big players: the Amazons, the Walmarts and companies that are large collectors of personal data. Our thriving, innovative start-up economy will start to be strangled under this legislation.

I hope that when the government is considering amendments at committee, it consults with small businesses. I encourage it to consult with the CFIB to look at the challenges small businesses are going to face, and to try to come up with some sort of threshold to ensure that small businesses are not unduly burdened.

I appreciate that this bill is largely targeted at major corporations and tech giants that use massive amounts of personal data for everyday business. We know that these companies have the capacity to do better in protecting our privacy. I hope that this legislation can spur further commitments to protect Canadians' privacy. However, as I said, it concerns me that these large corporations largely have already implemented a lot of the things that the government is talking about. They have the human resources, legal departments and the endless ability to tap debt markets, bond markets and stock markets to finance these changes. Frankly, small businesses do not.

I asked the minister a question, which he really did not answer, about data portability and the impact on small and medium-sized enterprises. The minister couches it in terms of consumers having the right to ask for their data to be moved from one organization to another. It seems like a really great thing, but I cannot think of too many situations in which a regular Canadian would be the person initiating that conversation. However, I can see where a bank would, for example, when dealing with its insurance arm. Many large Canadian banks also have insurance companies.

There has been a fence put around these companies to ensure they do not become too big and anti-competitive. Information cannot currently be shared between insurance companies and banks owned by the same company, but through this legislation, the insurance company just needs to provide a plain-language document asking clients if they want their information to be shared with its banking arm. With the massive amount of data that insurance companies and banks have on Canadians, we can see how quickly they could possibly use this as a predatory practice to increase, consolidate and suck customers away from small and medium-sized insurance companies.

When I drive through my riding of Sturgeon River—Parkland, I am proud to see about a dozen small and medium-sized insurance businesses for auto, home and life insurance. There are tens of thousands of Canadians employed in this important industry, and they are not all working for the big banks. I really am concerned that this legislation could make our marketplace much less competitive, so I hope the government considers that impact as well.

My next point is about enforcement. I am really skeptical about the government's ability to deliver for Canadians. We see, in spam legislation and other legislation, that a lot of words are not being put into action and there are consequences for actions that are not being followed through on.

Similarly, this legislation packs a lot of firepower. It talks about threatening $10 million in fines, or up to 3% of global revenues. It is the toughest in the G7, as the government has said, but I wonder what power the government really has to compel payment. When we talk about potential serial abusers of our private data, we are talking about massive multinational corporations with billions in revenues.

I wonder if we can anticipate similar challenges as those faced by France when it attempted to collect taxes on digital giants from the United States. These included a challenge at the World Trade Organization and retaliatory tariffs on French products.

I wonder if the Liberals have given any thought to the potential consequences of trying to collect large fines from these companies. Does the government anticipate that our trade competitors are going to let these challenges go unanswered when we try to collect? Have the Liberals considered the consequences that this could have on the Canadian economy, and are they ready to be open about this very real threat? I am not saying that this is not something they should pursue, but we need to know what the potential consequences are before moving too quickly on this.

Canadian innovators are at the forefront of technological advancement, and I think that is something we can all be proud of. However, a concern that has been brought to my attention is the protection of proprietary algorithms by start-up tech companies that rely on data. Some of the provisions in the bill would enforce algorithmic transparency, which sounds great for consumers, but I see that it could be used by business competitors to expose sensitive, confidential and proprietary information.

Has the government considered the consequence of what these actions would do to our start-up companies that want to keep their algorithms proprietary and confidential? A company may be in a situation where it is looking for a buyout at a later date and needs to build up to the point where it can really get the value it believes the company is worth, but if this algorithmic transparency could be used by its competitors to investigate the use of its algorithms, it could possibly be used to steal things that are patent-pending or as leverage in a negotiation for a buyout. I would like to see more stringent protections for our nascent technological sector, to prevent their algorithms from being exposed.

Next, in the bill, the minister sort of alluded to the exemption for socially beneficial purposes. We need to drill down and explore the idea. The minister provided some examples: government, health care agencies and education. I do not think many Canadians could really object to these organizations being exempted, but one point named organizations that exist to promote environmental protection.

We believe in strong environmental protection, but are we possibly talking about environmental charities that may have a political arm or an agenda in an election? Are they going to be exempted to use Canadians' data in any way they see fit? What potential consequences could this have on keeping our elections free from foreign influence or ensuring transparency in political communications? I would really like to get a clearer idea of what the government means when it is talking about socially beneficial purposes, because we are living in an age, as the member for Timmins—James Bay said, when there are data wars. If organizations are misappropriating this data, using it to influence our elections and our democratic process and being provided an exemption, we really need to explore that.

Next I want to talk about the 10 pillars of the digital charter that the government has brought forward. We know that a charter, as any statement of values, is really only as good as the resources and enforcement behind it, so I want to highlight a few of these pillars and address some concerns that I have.

Pillar 1 talks about universal access: “All Canadians will have equal opportunity to participate in the digital world and the necessary tools to do so, including access, connectivity, literacy and skills.” As my colleague for Haldimand—Norfolk was saying, too many Canadians, the fourth coast as some would say, even in relatively urban areas, say that we are far from accessing high-speed and reliable broadband services.

For years, successive governments have pocketed billions and billions of dollars from spectrum auctions. They have been announcing and reannouncing, and in some cases reannouncing a reannouncement, on enhanced rural broadband. The Liberals have promised the universal broadband fund as their solution. They even claimed that they topped it up by another $750 million a few weeks ago, but communities in my riding who recently applied for the universal broadband fund were told that they did not qualify.

I come from a fairly rural riding, and people were basically told that, according to the data, the Internet in their communities is fast enough. That is not acceptable. They should try explaining that to farming families in Sturgeon or Parkland County, or try telling that to people living in Stony Plain, Gibbons and Morinville.

We still have movie rental stores in my riding. I asked somebody how these movie rental stores stay in business, and the fact is, the Internet is so bad, the only way for people to watch movies is to go to their local movie store because they cannot access Netflix and all these other great things.

We are talking about a pandemic right now, and increasingly parents are wanting to supplement their children's education at home. They cannot access their education. A principal of my local high school, Onoway Junior/Senior High School, lives less than one mile away from the high school. The high school has high-speed Internet that is connected by the Alberta SuperNet, but less than a mile away the principal cannot get any Internet services.

The government is saying their Internet is fast enough, and that they do not qualify for the universal broadband fund, but, if we do not qualify, then I do not know who qualifies. This is unacceptable. It is time for the Liberals to put real funds behind real action to deliver broadband access to Canadians in rural and remote areas.

Pillar two of the digital charter is safety and security. It reads, “Canadians will be able to rely on the integrity, authenticity and security of the services they use and should feel safe online”. This is yet another great promise that the Liberals have failed to deliver upon.

I remember over the summer, when scammers used Canadians' personal information on the Canada Revenue Agency website to access CERB payments. These were not foreign actors we were talking about. These were private actors using information that they could get their hands on to breach Canadians' accounts, and this breach was so bad that it even forced the CRA and the Service Canada websites to shut down.

Thousands of Canadians who wanted to were unable to access the CERB, and all the useful services on those websites, because the government has not put security as a priority. Security must be central to digital government and to our digital economy. I appreciate that the government wanted to get those programs out quickly, but we are increasingly seeing the consequences of not building in security from the foundation up.

It was not just the CERB program that was hacked. In February, news broke that the National Research Council systems were hacked, mainly the health research databases. This cyber-attack was caused by ransomware. The hackers used the ransomware to try to extract payment from the government. Every year the National Research Council collects information on more than 25 million health care consumers across the U.S. and Canada. The National Research Council was also hacked in 2017 by state actors.

This continues to be quite a substantial threat. Hospitals and other information technology services are increasingly being targeted by these kinds of crimes. Since 2016, according to a cyber-threat assessment, there have been 172 attacks on individual health care organizations with costs topping $160 million. Those are just the attacks that are known about. It causes one to wonder how many attacks have not even been discovered yet.

It gets worse. Despite the multiple data breaches, the protection on critical infrastructure plan has not been updated in this country since 2009, despite major technological advancements. I alluded earlier to the Manhattan project of data decryption and quantum computing, which we are seeing out of countries like China. They threaten to blow open all of our current encryption technologies. It shows us that the plan is even more critical.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, I object to a number of the comments the member made at the beginning of his speech. He tried to give a false impression that the government has not been there for small businesses, which is really quite inaccurate.

We can see the many ways that this government, virtually from day one back in 2015, has recognized the importance of small businesses as the backbone of our economy through tax cuts. Today we continue to provide wage subsidies, rent subsidies and so forth during this very difficult time.

Having said all of that, my question is with respect to the bill. We recognize that it is going to allow for additional regulation. The member seems to be in opposition to the need for regulation. I am not 100% clear whether the Conservative Party recognizes that there is a need for government regulation to protect the interests of our businesses and consumers.

Could the member just provide his thoughts on whether the Conservative Party will be voting in favour of recommending the legislation to committee?

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, the hon. member sort of reminds me of the character of Cam Brady in the movie The Campaign when he talks about small businesses being the backbone of our economy. They are, but the Liberal government does not seem to recognize that the policies it has put in place have really undermined small businesses. However, I will get to the question.

There a necessity for regulation, but we need to recognize that one-size-fits-all regulations, which are mostly targeted at large corporations while still applying to small businesses, really put small businesses at a significant disadvantage. We are not saying no to regulation. We are saying that we need to put exemptions in, and we need to look at what the consequences really are for small businesses and address their concerns.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Madam Speaker, I thank my colleague for her question.

This is for private businesses, and I understand that my colleague may have a problem with that.

However, during the pandemic we have seen that the federal government itself had problems verifying people's identity. In my riding, some people received the CERB under a name other than their own. These people were on social assistance. They were not entitled to the CERB, received it anyway and will have to repay it when they file their income tax return. That is a serious problem.

I would like to know whether my hon. colleague thinks that we could have applied the provisions of this bill to the federal government itself.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, I appreciate what the member is saying. I have a story from my riding: A couple come to me who had used a third party tax service to apply for their CERB money. The tax service charged them $300 per CERB application, which is absolutely absurd when someone can just go to the CRA website and click a few buttons to access the money.

It just goes to show that sometimes when the government constructs something and does not think through all of the angles while trying to get the money out the door, there are people who will be hurt by that legislation. When I raised that to the government, its response was that it is not illegal. That is not acceptable.

I think absolutely that the government needs to be held accountable. We always need to do better. We as the opposition are always going to fight to make sure that the government does a better job for Canadians.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Madam Speaker, the member's comments are very enlightening. He talked a little bit about his concerns for small businesses and the red tape that would be associated with them. Can he discuss a little bit, in detail, the provisions in particular that he thinks would put too much of a burden on small businesses?

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, there is a provision in the bill that says a small business has to designate a specific person responsible for maintaining these privacy databases. When we are talking about a small business with just a few employees, oftentimes a sole proprietor may be running the books, sales or the website, and they are now being told that they have to also be the designated privacy CO of their company. That is adding red tape for a small business. For a big business, it is not that big, as it probably already has those positions laid out.

Small businesses trying to maintain those databases and having the ability to keep all the data they are collecting, so as to be ready to comply with requests from the consumer and Privacy Commissioner to hand over the data at any time, creates a ton of paperwork for small businesses. We need to look at a better way to do this to ensure that we can protect the privacy of Canadians, but not put too many onerous requirements on small businesses.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, my hon. friend mentioned the dynamics of rural Canada and the challenges it faces with access to something as simple as the Internet. These increase the challenges of small and medium-sized enterprises, whether it is a farmer trying to access the most up-to-date equipment for their farm operation and the increasing data requirements surrounding that, the local insurance companies the member mentioned, or the many other small and medium-sized businesses that exist across rural Canada. It is important that a rural lens is applied to something as important as this legislation.

I am wondering if my hon. friend would be able to provide further comments on the impact this would have on rural Canada.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, it is already hard enough for rural Canadian business people to access the growing digital economy, as I alluded to in my speech when I spoke about the lack of access to high-speed Internet. The hon. member who asked the question is a farmer, and we know agriculture is undergoing a massive shift to data.

I do not think there is anything in this bill that would necessarily impact the farmers themselves, but when we are talking about relations between fertilizer companies, suppliers and transportation logistics, we could be talking about a number of new requirements. The farmers I know just want to farm. They do not want to haggle over data and be purveyors of data, so yes, we have to consider those challenges as well.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, the member did not answer the question regarding the Conservative Party's position on the legislation. I understand the member, as being part of the official opposition, has concerns. I can appreciate that.

I have two questions. One, do the Conservatives see amendments coming forward at second reading? Second, and most importantly, do Conservatives support this legislation ultimately going to second reading, or in other words, will they support it going to committee?

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, I thank the member for giving me a second opportunity to finally answer his question. We do have concerns about the bill, as I said. However, I think I can freely speak for our caucus and say we will be supporting this going to committee.

We will be looking at putting forward some common sense amendments to protect small businesses and ensure this is the best possible legislation. The fact is that it has been too many years since we have had an overhaul. A lot has changed in our society, and we do need to update this legislation.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Madam Speaker, I see in the legislation that there would be some exceptions to the consent of an individual's data and whether that information would be available to them, or if it would be in the public interest.

Who would make that determination? Is the bill clear on that determination and who would make it, and are there any concerns around that particular provision?

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

Madam Speaker, that is a question we are going to be fighting to get the answer to at committee. When we are talking about public interest, it is not necessarily just for the government to decide what that public interest is.

At the same time, we need to ensure this is not blown open to any and all organizations that could be using and abusing this data in ways we cannot know. Obviously we need to put some parameters around this and find a good balance.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, I am honoured to be the first in my party to speak, since this is a topic the Bloc Québécois has been looking at in response to a number of identity theft issues.

I want to take this opportunity to acknowledge my colleagues who have been with me from the beginning of the first session of the 43rd Parliament. We immediately started looking into the matter of privacy breaches and fraud. The Standing Committee on Industry, Science and Technology unanimously agreed to take into account the previous work done to study what action we should urgently take to prevent the kind of situation we are in now.

I salute my colleagues on the Standing Committee on Access to Information, Privacy and Ethics, and I also want to point out that I very much look forward to studying this bill in committee. We had already unanimously adopted a motion to study privacy matters, and today a bill has been introduced. We spent a long time in committee looking into conflicts of interest. I had 40 hours, during which it was difficult to vote on a motion in committee.

That being said, prorogation did not do us any good. If Parliament had not been prorogued, we would not be where we are today. We would already be at the forefront when it comes to protecting our people from fraud and identity theft. I know that this happened to some people who work for the House of Commons. This is a complex and troubling issue. As the Privacy Commissioner said, the accounts of no less than 30 million out of 37 million Canadians were affected.

I would like to tell everyone here and the people watching us at home that their personal information was used. We are talking about a privacy breach. What happens when our personal information is not protected? Obviously, the first thing that comes to mind is the possibility of fraud. The way things stand, fraudsters have quite the opportunity to use the personal information of others.

Madam Speaker, I am sorry. This is my first time without a written speech in front of me and I feel like I could keep talking for an hour. I would like to ask for the consent of the House to share my time with the member for Saint-Hyacinthe—Bagot.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

This being a hybrid sitting of the House, for the sake of clarity, I will only ask for those who are opposed to the request to express their disagreement. Accordingly, all those opposed to what the hon. member is proposing, namely, sharing her time with the member for Saint-Hyacinthe—Bagot, will please say nay.

The House has heard the terms of the motion. All those opposed to the motion will please say nay.

There being no dissenting voice, I declare the motion carried.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Thank you, Madam Speaker.

I provided a brief overview of this issue because safeguards have already been implemented in over 30 countries. Our friends in the European Union have been taking the bull by the horns since 2016, and I think we should follow their example.

I applaud the introduction of this bill. It was about time. I would also like to talk about a few things that I look forward to studying as soon as possible at the Standing Committee on Access to Information, Privacy and Ethics.

It was proposed that the commissioner be given additional powers. This bill proves that this proposal was taken into account. The commissioner will be able to impose major penalties. Currently, as all those who grabbed the bull by the horns know full well, businesses are responsible for protecting personal information or face penalties, which vary from one country to another. This bill introduces a 3% penalty, which means businesses such as Facebook, a company worth several billions, could pay up to $10 million if they do not properly protect personal information.

I am also very happy with another part of this bill, which came up earlier, about consent to use and transfer our data. Businesses and organizations that have our data must always have our consent. That is crucial, and I am happy about it.

Once again, I congratulate the government on giving the commissioner the power to issue orders.

However, there is one thing I am very concerned about, and it has to do with organizations such as banks that are under federal jurisdiction. I think that if there is one organization that should lead by example and demonstrate that it is protecting data and working to prevent fraud, it should be the government.

The first time I read the bill, I did not see anything about the government fulfilling its obligations. My hon. colleague talked about this earlier. Many people in Laurentides—Labelle have told me they are worried about finding out at tax time that someone claimed CERB using their name. People have even told me they tested it. They applied, and their application was approved. These are people who are receiving employment insurance benefits.

There are also those who, upon opening their account, discovered that they were victims of fraud. These people have followed up and filed a complaint. Unfortunately, it takes a long time for them to hear back, and some people never hear back. I feel that this bill should also include a requirement to support those who have been victims of fraud and help them through the process.

Right now, it is about prevention and punishment. Let me explain prevention, which is very simple. Prevention is making sure all the necessary elements are in place to validate a person's identity.

However, this bill does not propose a complete reform of the ID authentication processes for individuals through organizations or the government.

Several countries have already taken action and instituted two ID authentication processes. The first involves confirming what the person knows. However, if an individual's personal information is known and their data are open, anyone can immediately commit fraud using their name.

The second involves confirming what the person has using various tools. Some apps already use text message authentication, for example. Sometimes the person has to place a call from their home. This is another important authentication process.

Several countries use other authentication processes based on even more personal information, such as voice recognition or fingerprints. Close attention will have to be paid to facial authentication to ensure that all rules are followed.

I look forward to taking part in the committee deliberations. I welcome this bill, but it needs to be amended properly.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, just listening to the member's comments on the bill, I suspect the Bloc will be supporting the legislation at least going to committee. It is important for us to recognize the role of the Privacy Commissioner and that it has been incorporated to provide additional support. It will provide more confidence in cybersecurity and show how important data is.

Could the member provide a confirmation of the Bloc's position on seeing the bill go to committee? Does the member have anything else she would like to talk about in regard to the important role the Privacy Commissioner plays in general for Canadians and small businesses?

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, I thank my colleague for his question.

The Bloc Québécois is obviously in favour of a bill to protect the fundamental rights of Quebeckers and Canadians.

That said, it is important that several proposals be presented in committee. While we are at it, we will ensure that nothing is missing. That will surprise no one. Although the commissioner may be very pleased to hear that penalties can be imposed, he is also very aware of what might be missing from this bill.

With respect to personal information, we really have a lot of ground to cover quickly, because Canada is lagging behind in the eyes of the international community. We will have to make quick adjustments to protect our fundamental rights, as 30-plus other countries around the world have done.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, since there are no other questions and comments, I believe that shows that my colleague was very clear. I will try to be clear as well. The bar is high, but I will try to meet it.

Generally speaking, as my colleague said, this bill represents a step forward and addresses several of the Privacy Commissioner of Canada's requests. Quebeckers were profoundly shocked by the Desjardins data breach. It was a very significant event. However, it was not the only one. Similar incidents occurred in 2017 and 2018, and there have probably been dozens more that we are not aware of. In fact, when a bank's data is stolen, the bank is required to inform the police and the Privacy Commissioner of Canada, but it is not required to inform the public or even its customers.

We like this bill because it sets out a series of principles relating to the collection and sharing of personal information by companies: free and informed consent for the collection and use of data; the ability to allow or deny the transfer of data to another company, such as between two financial institutions; the ability to withdraw consent or request that data be deleted; transparency about the use of algorithms that use personal data; and stricter criteria for the use of de-identified data. This bill also gives real powers to Canada's Privacy Commissioner, sets out significant penalties for non-compliance, and creates the personal information and data protection tribunal. All of that is great.

Unfortunately, the problem is that the bill omits one extremely important element, and that is protecting people's identity online to prevent fraud due to identity theft, especially during financial transactions. We know that Europe has brought in a whole suite of regulations to force financial institutions to verify a person's identity before authorizing a transaction. There is nothing like that in Canada, and this bill does not have anything of the kind either.

The federal government is not properly verifying individuals' identity before authorizing electronic transactions. We know that the challenge is to prevent data from being stolen and used to commit fraud. Having personal data stolen is unpleasant enough, so all measures must be taken to ensure that the data are not then used for fraud.

The debate in Ottawa over the massive data breach at Desjardins mainly revolved around social insurance numbers. We know that several people would like to change their social insurance numbers, but under the current system, they cannot do so unless they become a victim of fraud resulting from identity theft.

In addition, the federal government has received a number of requests to redesign the social insurance card to make it harder to counterfeit, similar to what Ottawa did with passports after the September 11, 2001, attacks, at the request of the United States.

These two requests are perfectly reasonable. The Bloc fully agrees and is asking Ottawa to follow up. However, that alone will not stop fraud.

The best way to prevent identity theft is to make sure that the person who is making the transaction is indeed who they claim to be. This goes without saying. There are three ways to verify a person's identity.

First, a person can be identified based on what they know, namely personal information such as their name, address or social insurance number. However, as cases of identity theft are on the rise, it is getting harder and harder to accurately identify someone. In other words, our private information is no longer private when everyone can find out almost everything about us. Fraudsters can simply use this information to create a fake ID, and they are set.

Second, a person can be identified based on what they have, such as their computer's IP address, which the institution can recognize if the transaction is being conducted from the person's home, or their cell phone, to which the institution can send a secret code via text message.

Third, a person can be identified based on who they are. The institution can use technologies that recognize a person's physical characteristics, such as their voice, their facial features, through the use of facial recognition, their digital fingerprints, which are increasingly being used by cell phones, or their handwritten signature.

Europe adopted regulations in 2016 requiring financial institutions to use at least two of these three ways to identify someone before authorizing a transaction. Banks in Canada are under no such obligation. If they believe that the control mechanisms will cost more than the losses they are currently incurring in fraud, they are better off doing nothing. The banks will not pay for controls that would be more costly than the fraud. That is simply profit-driven logic.

Many members have probably had the experience of having a store issue a credit card on the spot, based solely on the personal information we provide. We just have to give our phone number, address, and so on, and that is all it takes. This practice really opens the door to fraud, and it has to stop.

We believe that the banks must be forced to tackle fraud. That is the solution that we are advocating. We are going to propose possible approaches. As my colleague was saying, we are going to support the bill, but we will be bringing forward amendments. We will have concrete, constructive and coherent proposals when the time comes to study the bill in detail.

We will propose ways to combat identity theft, such as by drawing on the European regulations I was talking about, in order to force the banks to bring in robust processes to verify people’s identity before authorizing a financial transaction. We will also propose to increase fines in order to encourage banks to better protect their customers’ personal information. We will propose that banks be required to submit a detailed report, as part of their annual reporting, on the number of identity thefts and the resulting losses.

We will also propose a requirement to contact any person whose identity has been fraudulently used within the organization, regardless of whether an account was opened or not. As I said earlier, there is no such obligation in place and it must be brought in. There is also an obligation to cover the costs paid by victims to recover their identity. These costs must be covered by the banks, which are rolling in a lot more money than individuals and most of their customers.

There also need to be anonymous tip lines for employees who are aware of unreported identity theft, as well as protection for whistleblowers. There is currently a void when it comes to whistleblower protection, as in virtually all areas. I am getting a little off topic, but the House will have to deal with this issue as well.

Ottawa also has to look in its own backyard. Beyond the banks, the same anti-fraud controls need to be imposed on the federal government itself. Bill C-11 applies only to private businesses. It does not apply to the federal government. Currently, Ottawa’s online identity controls are clearly inadequate. Before authorizing a transaction, the government does not take all the necessary steps to ensure that a claimant is who they say they are.

Since last spring, there have been numerous cases of identity theft. These include Canada emergency response benefit claims made in other people’s names and tax refunds being redirected to other accounts. Some people will not find out that they have been victims of identity theft until they file their income tax returns. It has not yet happened yet, but it will soon. In a few months, many people will discover that they have been victims of fraud. Right now, they have no idea. This is absurd, and it is unacceptable.

Again this fall, thousands of taxpayers lost access to their Service Canada account, which prevented them from applying for employment insurance even though they lost their jobs because their region was going back into the red zone.

It is all well and good to introduce a bill on the management of personal data by private companies. I want to stress that we agree on this bill and that we will vote in favour of it. That part is settled.

However, Ottawa needs to clean up its own backyard as soon as possible and take immediate action to combat identity theft. We are saying yes to regulating private businesses, but we are also saying yes to regulating Ottawa and the banking industry.

[Randy Hoback, Conservative, Prince Albert, SK]

Madam Speaker, my colleague mentioned that the government should be looking to include identity theft in the legislation. I agree with him that it should be included, but this is the government that brought in the Phoenix pay system, and we know how much of a fiasco that was.

What would he propose the government do to prevent something like the Phoenix pay system if it was to bring this type of legislation into its own house?

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, the Phoenix pay system is indeed a fiasco, a complete disaster. I completely agree with my colleague, who I want thank for his kind words about my speech.

This is a big problem, but the bill that is before us deals with identity theft. The Phoenix pay system is another issue, but we completely agree that something needs to be done ASAP, as they say.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, it should be noted that it was actually the Conservative government that brought in the Phoenix payroll system. We did flip the switch on it, but it was fairly well established under the previous administration.

Having said that, the member, as well as his colleague, made reference to individuals who collected the CERB but who should not have been collecting the CERB. In hindsight, would the member have any recommendations or suggestions for how the government could have done things differently to avoid that?

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I thank the hon. parliamentary secretary for his question.

I think that I answered that question in my speech. Stricter oversight and monitoring mechanisms like the ones I suggested are the answer to that question.

We could also review the whole matter of the CERB. We warned the government many times from the beginning about the monitoring that should be done and the formula itself. I could talk about those mechanisms again, but I do not really have time. I made suggestions to that effect in my speech.

Looking back, the government should have monitored this more closely in every respect.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Madam Speaker, I would like to thank my colleague for his intervention today. It was very interesting.

Cybersecurity, of course, is a very important issue. As we know, in Canada there are too many victims of cybercrime each year. However, I feel it is not a problem that a privacy law would solve.

I am wondering if the member could speak a bit about why he is bringing forward a criminal law issue that would put more burden on Quebec and some of the other provincial jurisdictions at this time. I would like a few comments on that.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, if I understood my colleague's question about criminal law, the bill in this current form suggests penalties for companies that break the law. That would involve criminal law.

If I understood the question properly, that is the response I have for my colleague.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, I can always count on my Bloc colleagues to explore the relationship between the federal government and the provincial governments.

I am wondering if the member has any comments on concerns he might have regarding the bill and provincial jurisdiction.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I will try to be brief, although I know that is not my strong suit.

The Government of Quebec is currently in the process of modernizing its legislation on this. There is a stereotype about Quebec and I believe it is founded: Quebec generally does very good work and often, or in most cases, does a much better job than Ottawa.

Of course, we also think that the governments have to agree. We hope that this new legislation will not encroach on provincial jurisdictions. Earlier I asked the hon. Minister of Industry that question and he said that would not be the case.

Time will tell.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I am pleased to participate from my office in this important debate on Canadian privacy. The bill would enact the consumer privacy protection act and the personal Information and data protection tribunal act. It would also make consequential amendments to other acts. We are debating a fairly complicated subject, but one that has been warranted for many years.

The New Democrats have been calling for a modernization of our privacy laws and our consumer protection laws for about a decade. Most recently, our efforts have resulted in a digital bill of rights' discussion across Canada in which we have been at the forefront and have pushed hard to have some of these rights discussed, not only in the public forum but also in the chambers of Parliament.

We have witnessed the world move on. We have seen the Privacy Commissioner identify Canada as backwater when it comes to protecting privacy and the capabilities of the modern world. With COVID-19, we see further online activity among Canadians and further vulnerabilities for not only individuals but for our families, schools, businesses and even Parliament.

The New Democrats have a different position from other political parties. We believe that people's human rights are connected to their digital rights. People's online presence and the digital footprint they leave in the wake of the business they have to do is just as important as their physically enshrined rights as a human being.

When we look at what is taking place, even with COVID, and the ability of people to participate online, we have seen the failings of two decades of Liberals and Conservatives to connect Canadians, all the way from Maxime Bernier's program, launched as a Conservative minister, to most recently where we are struggling and scrambling to get Canadians connected.

One of the other things the New Democrats talk about is the affordability of participating in this democracy and not only with respect to one's participation on a regular social basis. As governments have moved more and more services away from brick and mortar to online, we have seen the exposure of Canadian privacy. We have seen that even within government resources, everything from social insurance numbers to other types of breaches that have taken place. We have seen this in the private sector as well.

Canada has often lagged in the private sector, not only in oversight but also in the punishment of those who take advantage of people in the new digital age. In our digital bill of rights, which we presented more than two years ago, we talked about not only personal data being protected, but also how people were being manipulated through the services provided online. For years and years our philosophy has been net neutrality. I will highlight a few new problems with the bill which could derail that type of philosophy and could stream Canadians to more vulnerabilities.

There are all kinds of examples of how Canadians have been abused. Whether it be Yahoo, Ticketmaster, Marriott or Equifax, the list goes on and on. Most recently, a heightened example of this, which created a lot of attention across the world, was Facebook and the outright manipulation of people's personal data. People were being used as pawns without even knowing what their rights were or being protected from that.

Again, Canada's laws do not allow our Privacy Commissioner to come down hard on some of these giants. Governments in the past have been too close with the web giants and have not allowed Canadians to have the proper recourse when data breaches have taken place.

The personal information and data production tribunal act being proposed by the government would create a number of potential false promises for accountability. It has a low threshold of involvement of those who would be appointed to the tribunal.

First, we have to get past the notion that these types of political appointments will be free and clear of all political and business-type leverages to select the tribunal. Second, we have to assume the tribunal can be fair, quick and just in its cases. Third, baked-in problems with regard to the role of the tribunal create some concerns. The first is that the tribunal could overturn the Privacy Commissioner in many respects and it would go to a judicial process, which could take years and years to settle cases that may no longer be relevant to Canadians.

There is also a low threshold for the inclusion of some of the appointments. There is no requirement for a Superior Court judge and only one judge is allowed in maybe a one-to-three-member panel or a one-to-six-member panel. These things need to be fixed.

Something I want to further explore are more powers for the Privacy Commissioner. The Privacy Commissioner has been very clear in asking for more resources and supports over the last number of years to deal with privacy breaches that have occurred and also to bring in more accountability. It is in our business interests, not only our interests as individuals, families and all of the institutions but in business interests, to have a clear process so the bad actors in this environment that are doing harm to Canadians and other businesses are not rewarded.

One thing I am most proud of accomplishing as a member of Parliament was ending the tax deductibility of corporate fines and penalties. That was about 15 years ago. In the past, if a business was caught doing something illegal, it was able to write off part of the government fine as a business-related expense. I was able to champion a change to that.

Businesses that were doing illegal activity and influencing competition were using it as a loss leader. They would essentially get millions of dollars in fines and penalties, everything from drug companies to those getting environmental fines and penalties, and they would apply for that money back at tax time. It was a way for them to undercut the competition that was doing the right thing. That is what I am concerned about with the tribunal. It would have the capability to influence market stability to some degree with regard to penalties and fines for the bad actors.

If it does not work right, if it is not seen as credible and if it does not flow the way it should, it can be an encouragement for some of those committing the breaches to be sloppy with personal information, disrespectful and also manipulative in taking information from Canadians, steering them to different purchases and activities, exposing them and then beating some of the competition. For some young entrepreneurs who have to go up against some of these established giants, it is very difficult for them to get a toehold.

A number of factors are in place, even in our general market economy, for young people and entrepreneurs to get busy and to compete. One most recently was in the retail sector. Businesses are being charged extra to get floor space in the real world. Amazon and other players have also used manipulative practices to steer consumers to particular products and services from preferred customers. That defeats our philosophy of net neutrality. It could also direct people and their families to making purchases or viewing activity with the time they have into different market conditions as opposed to exploring in a free and open Internet society.

Another thing is that Canadian federal political parties are exempt from oversight. We do not understand why the Liberals would allow this to take place. It should be clear and proper that their data and personal information be open and accountable in political parties as well. We will be looking at amendments to this activity because we strongly believe they should be accountable.

To bring faith and accountability to our democracy requires transparency. We have seen the sensationalism that has taken place in political advertising in the last number of campaigns and the favouritism that has been seen online. We have also seen the giant data assembly that has taken place which can manipulate voting and steer people to different discussion points.

The personal privacy information collected by political parties should also be clear. This way there will be more faith in the information that political parties get. More important, our democracy will be strengthened by privacy protection, not weakened or exempted with regard to the model being presented by the government right now.

We also want to be more technical and continue to have commercial activity defined under PIPEDA. This is more related to the business section aspect for fair and open transparency.

We want to deal with a particular issue in regard to algorithmic transparency. Algorithms can help direct purchasing and activity and can also manipulate someone. It will just get stronger because artificial intelligence is being introduced more and more into society in regard to all our products and services. This includes search engine searches, the types of purchases made with different corporations and a number of different activities that take place. It is important there be accountability and oversight for that.

A number of different things have been going on with regard to Canadians and their privacy. There is no doubt there will be more challenges with this bill. We want to go back to a number of different structures that take place with respect to this. Again, the New Democrats championed a digital bill of rights for many years. I want to highlight a few important things.

If we cannot have a fair, open and just society with regard to our digital footprint, we believe our democracy is threatened, our economy is threatened and, more important, investments into this country will be threatened. We will not have the same oversight that Europe or the United States have. That is very important to ensure that investment in Canada will take place

It is important to note that if we are working toward things like access to telecommunication services all across Canada and we are investing in this, we need to think about the billions of dollars already spent on this, along with the additional money to be spent. We want this to be done right and proper, especially with COVID-19.

Over the years, as we have gone to more online services and invested in this, we have had opportunities. When we think about how we use this space for ourselves, whether it be commercial activity, entertainment or business, we sell off the spectrum. The spectrum is the infrastructure we can use. It is above us. It is the radio and capacity to move, most recently, the 5G network. We will see a spectrum auction.

In the past 20 years, $22 billion of revenue has come into the public coffers with spectrum auctions. We have seen a patchwork of activity take place all across the country.

I previously mentioned Maxime Bernier, with the Conservatives, and most recently the Liberals. Several plans have emerged that are more a hodgepodge of applications. It is one program after another that is sought out. They are also providing massive subsidizations for those markets, which costs billions of dollars. Even the CRTC has a fund.

I can list a series of them, but the point is that if we are going through all this trouble and investment to create a society space for our digital world and economy and we are heavily investing in this, then we need to do it right, especially with a geography like Canada, which is so large. This can be a challenge, but given our population size and the fact that we have dense populations along the border and other places, we can turn this into an advantage for business investment as well.

The New Democrats believe this is part of our human right with respect to how people are treated online. This includes accountability from companies with regard to cyber-bullying, privacy protection, speeds and affordability. They are combined. If we do not have this type of approach as a philosophical one, we leave ourselves open to having more winners than losers. It would be no different than having lost education opportunities for people and a requirement for the government to come in and do the right thing, which is to make things more affordable.

I mentioned the concentration of our population. It is important we tie this into the bill as we finally expand to rural and remote locations, and the security and accountability for that information.

We have talked a lot about preserving different cultures and providing business opportunities for areas that have been weakened because of their geography or lack of connectivity to large populations, but if we do not put a rules-based system in place that allows them to compete fairly, then they will fall to the wayside. Specifically, we could have a number of opportunities for smaller businesses to evolve, some scale-ups to take place, communities that could actually have some empowerment in getting to new markets and keeping the community stronger and together, but if it is not done in a way to have online privacy protection and so that businesses can compete in a fair way, then it is going to be lost.

One of the concerns we have in general, not only with regards to ourselves as a country but also the rest of the world with some of the web giants, is the consolidation of services and how online services are used. In Canada, our competition has not been the strongest at some points, but there is an opportunity as we do this, which is why this legislation is so important.

With the spectrum auction coming up, New Democrats have argued that charging as much money as we can to the telcos coming in and then seeing how things go results in what we have right now: less competition and higher prices, and prices that, quite frankly, limit people's participation in the digital world. This is a concern that we have, and so we have suggested to turn the spectrum auction around, like many other countries have done, and use it as a way to connect at lower costs by putting out expectations, such as an RFP-type model. When the bidding comes in, we may get a little less money coming in the front door, but the expectations are going to be higher and the requirements to connect rural or remote communities will be there. The telcos will use it or lose it. That is one of the things we believe could be a real benefit to move along the different programs.

Basically, what we have now is a series of programs out there where communities almost have to go on bended knee to get access, to get support to actually lower the price points to make things more competitive and attractive. Our model would have a reverse role. The business community would already have the expectation that the spectrum is less, but the time frame to connect Canadians is high, with the expectation that they use it or lose it, for those things to happen relatively quickly. In fact, industry has indicated that the NDP plan could take place and connect Canada within four years: 98% in three years and the last little part in the last year, because it is more difficult in some locations.

This is important and critical, because this potential law would lay out the framework on how that activity takes place. It is one of the reasons we believe this tribunal is one of the more interesting curiosities, and there are other things to talk about regarding that. However, if we spend all of this money, time and public policy and then do not get it right, we would have a weak and irresponsible approach to oversight in making sure that Canada does not have problems with regards to this. It is already going to create a skew in the public policy laws that we have. I fear that the bill, in its current form, if it does not sharpen up on those points, would create a skewed market for some years to come.

Parliament most likely will not deal with this again any time soon. It has taken far too long to get to this point. We have to get this through a minority Parliament, we have to get it through the Senate and we have to get it signed off by the Prime Minister at the end of the day. That is going to take some time and commitment, which we have with the New Democrats. We want to improve the bill, we want to make sure that it is stronger, but if we do not get these points right, we are going to undermine things. This is why, when we think about how important this is with our current public policy and our resources, everybody out there has been concerned about COVID-19 and the effects upon the broadband and the experience for education, involvement and commitment.

To conclude, the difference for New Democrats is that we believe that our human rights and digital rights are enshrined just as our physical rights. As we move to this type of engagement, as we see hybrids take place within workplaces, schools and other types of activity, this bill is a step forward, but it needs to be strengthened, and we can be counted on to do that. It is our intent to make Parliament work, but, more importantly, to make sure that we have laws that are going to work to protect Canadians.

[Gary Anandasangaree, Liberal, Parliamentary Secretary to the Minister of Crown-Indigenous Relations]

Mr. Speaker, I want to pick up on the enforcement mechanism in the bill, which would be the establishment of a new tribunal that would be accessible and able to impose significant fines on those who violate the act. I want to take issue with appointments. As a government, since we took over we put in a very robust appointment process that is merit-based and represents the breadth of this country.

I want my friend to comment on what specific issues he has with such an accessible tribunal, which I believe is warranted in this situation.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, I believe the vast majority of appointments, even when controversial ones have popped up, have been good people doing good things for Canadians. However, that type of appointment process lends itself to some degree of political meddling, corruption and also influence from the outside.

I have been in Ottawa for almost 19 years now, and I have seen a number of different stories played out over the years that give me concern. It is a legitimate concern in this bill, and it also can change with the governments that handle the appointment process. It is something of concern worth talking about.

With regard to who is on those committees and tribunals, it is about the length of time and the types of people on it. Only one of three to six tribunal members would need to have privacy law experience, and that is one specific example of my concern. These are very technical things to deal with.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Mr. Speaker, one of the concerns I have, being from a large rural constituency, is the interplay of this bill and the effect it may have on rural Canada, specifically small and medium-sized enterprises within rural and remote parts of Canada. I am wondering if the member would have comments on that.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, it is one of the key components of what we need to do to get right. As we are expanding into rural and remote Canada, we want to make sure there is even more confidence for the personal protection of privacy. Also, there is a bit of cultural change. So many of us in urban centres who have had access to high-speed Internet and other types of services have been used to some of that abuse, whereas we want to put in protections for small and medium-sized enterprises.

Again, there are a number of different things. Net neutrality is a good example, but there are also algorithms and how they direct traffic and different businesses in different ways. When we see there is abuse taking place, it can also come at the expense of small and medium-sized businesses. One of the changes we are looking for is greater accountability to those formats because people literally put their whole life and efforts into small businesses. It was hard enough as it was before COVID-19, and now it is even worse.

As well, businesses are paying for the connections to be able to be compete. Things we need to bring to account are things like the algorithms.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Mr. Speaker, my colleague is a leader within our caucus and is very well-informed on this file and very knowledgeable about this very complex issue.

As he knows, I have been working on the heritage committee. We have also been looking at Facebook and the web giants and that cozy relationship the Liberals have with the web giants. We have seen that lobbying over the last few years tripled since the Liberals became the government.

In terms of personal privacy, I am wondering if the member could talk a bit about what he would like to see improved in this bill to make sure that cozy relationship does not get any sort of prevalence.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, I thank the member for Edmonton Strathcona for her hard work on this, and also for reinforcing the protection and strengthening of the Privacy Commissioner. That office has done wonders for this country. I have seen about four privacy commissioners in my tenure in Parliament, and they have all been strong. I have not always agreed with some of their decisions, but they certainly have been at the forefront of accountability in public policy in pushing for greater protection for Canadians. The U.S. does not have this. This is one of our moments of strength that we as a country have in a structure. The member is absolutely correct. We need to make sure the Privacy Commissioner's office is strengthened and remains independent because it has been an asset, not only for personal information but also for our businesses across this country.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I thank my hon. colleague from Windsor West for his detailed assessment of Bill C-11. It is the first opportunity for me to speak to the bill. I certainly plan to vote for it at second reading to get to committee.

An amendment I hope to pursue at committee is an issue that the hon. member discussed. That is getting the PIPEDA framework in Canada to apply to political parties. Here in British Columbia at the provincial level, political parties have to meet privacy requirements. I commend the member for raising it early in debate, and ask if the New Democratic Party will also support amendments in committee?

[Brian Masse, NDP, Windsor West, ON]

Yes, Mr. Speaker, New Democrats support amendments and we will be proposing several. There is no doubt about it.

I would like to acknowledge that British Columbia's privacy protection for decades has been recognized across North America and different parts of the world. There is no doubt that British Columbia will provide good opportunity for some lessons to strengthen our own Privacy Commissioner as well. That is key.

New Democrats support these changes. We have amendments prepared already, and we will be adding more amendments. We have to get this right. There is only going to be one chance at this in the near future as we are building out and doing things more online than before. We have to enshrine the philosophy that our human rights are connected here. If we do not enshrine that human rights are connected with regard to this, that one's digital rights are like one's physical rights, then we will be lost; and, we cannot do that. We have to win.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Mr. Speaker, I want to ask the member for further comments in regard to the tribunal because that is a critical component here. The member has expressed great concern in terms of the timeliness of decisions being made by the tribunal. I wonder if he could just provide some further thoughts on how that issue could be best addressed. As opposed to focusing his attention on the appointments, are there mechanisms that he could see being put into place that would ensure a more timely response once issues have been raised?

[Brian Masse, NDP, Windsor West, ON]

Yes, Mr. Speaker, the tribunal will be subject to a judicial review, and it could be challenged. The challenge that we are going to be faced with is that decisions could be pushed off down the line. For example, it could take a long time for CRTC decisions to come back and it is one of the most frustrating things. I give credit to our incumbents where they need to be given credit, as they have actually had to deal with a broken system, with CRTC not having the resources and the capabilities to get back in a timely manner. Therefore, the tribunal is going to be critical for that.

Having judicial experience added to it that is stronger than what is currently there and also making sure that some of the powers it has cannot overturn the Privacy Commissioner are some of the things I would like to see advanced in this bill.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Mr. Speaker, I will be splitting my time with the member for Willowdale.

We increasingly live our lives online and our laws need to reflect that reality. Privacy is a human right and it is inextricably connected to our personal autonomy.

The Council of Europe's Convention 108 states, “The purpose of this Convention is to protect every individual, whatever his or her nationality or residence, with regard to the processing of their personal data, thereby contributing to respect for his or her human rights and fundamental freedoms, and in particular the right to privacy.” The GDPR states, “This Regulation protects fundamental rights and freedoms of natural persons and in particular their right to the protection of personal data.”

The incredible scale of data collection can be a powerful force, both for good and bad, so we need strong privacy and digital rights and a strong regulator to enforce them.

There is much in our government's Bill C-11, which is a serious reform of PIPEDA and certainly long overdue. I remember in June 2018, I introduced legislation simply to give the Privacy Commissioner new powers, which our privacy committee had twice unanimously recommended. We have come a long way since then with this substantive bill. OpenMedia said, “Bill C-11 is a big win for privacy in Canada.”

While I have heard some reflections from experts and certainly from some parliamentary colleagues already about how the bill can potentially be improved, or some open questions about what might need to be fixed, it is certainly deserving of our support at second reading. I look forward to working with colleagues across party lines to improve the legislation at committee where we can.

At this point, to work at committee across party lines something of a detour is required. I want to specifically commend my Conservative Party colleagues from Prince George and Thornhill, my NDP colleague from Timmins—James Bay and my Liberal colleague from Kitchener Centre. We worked very long and hard on privacy issues in the last Parliament. We helped found the International Grand Committee, comprised of over 10 countries, to discuss these issues. We hosted the second meeting of the IGC in Ottawa. We tabled the report “Towards Privacy by Design” in February of 2018.

When we as parliamentarians talk about committee work and often the overlooked nature of the committee work, we do not always see that committee work turn into legislation. In this instance we have.

We recommended stronger consent rules and we see stronger rules in Bill C-11. We recommended algorithmic transparency and we see in Bill C-11 a commitment on transparency where systems are used to make predictions, recommendations or decisions about consumers. We recommended data portability and interoperability. We see those commitments in Bill C-11.

We see stronger powers for the Privacy Commissioner. I mentioned that need for a strong regulator, including order-making, auditing and the ability to levy fines. We see order-making powers. We see the ability to audit. We see a new tribunal, and while I understand some of the caution or questions members are raising in respect of this design, it is consistent with the competition commissioner and tribunal operations and worth looking at more seriously to see if it can be approved. However, through the tribunal, we see the ability to levy significant fines, in the magnitude of $10 million to a maximum of $25 million for more serious fines.

In terms of the course of that committee work, I want to reflect on a couple of stories about why this kind of legislation is so important and critical.

I think it was in the fall of 2017, when we were in the midst of the study on PIPEDA reform, that the member for Thornhill, the former member for Skeena—Bulkley Valley, I believe I am getting that right, and I went down to Washington and met with other elected representatives there. We witnessed some of the hearings in relation to the Equifax breach, but we also met with Facebook officials. At that time, when a question was put by I think the member for Thornhill as to what Facebook's views were on the potential new regulations, they said absolutely no new regulations were required in Canada due to the strong framework through PIPEDA and, if there were new rules, that might affect Facebook's willingness and interest in investing in Canada. Certainly, we have come a long way since those kinds of conversations and push-back by big tech companies against stronger privacy rules.

We saw that Mark Zuckerberg unfortunately did not attend before the IGC, though he said he would like to work with parliamentarians around the world, but we can certainly say that the days of self-regulation are over and asking for regulation. Here is that kind of regulation in Canada.

On consent, I have to tell one other story that happened at committee. Again, we had Facebook officials there. We were in the midst of going down the rabbit hole of the Cambridge Analytica scandal and the Canadian context of that third-party app, which had shared so much information. I think it was under 300 Canadians who had used the app, but thousands of Canadians had their information shared. I put to Facebook at the time, “How is it that on the basis of meaningful consent thousands of Canadians could have agreed that their friends share their information through this third-party app and then share it with Cambridge Analytica?” With a straight face somehow, a Facebook representative said to me that it was in their terms and conditions.

That speaks to the problematic nature of consent in the existing law and the lack of meaningful consent. Thankfully, our Privacy Commissioner, despite his current lack of meaningful powers, pursued that line of inquiry and found that Facebook violated our current laws and took the matter to court. We know that with stronger consent rules, there would have been no ability for a Facebook representative to say with a straight face that there was meaningful consent.

Plain language is important. I would go further, though, and say that as we think about consent, particularly in a consumer context, I think we ought to be more wary of privacy by default. We have to be more concerned about privacy by default. Where there is a reasonable expectation of the consumer that information is going to be shared and used in a particular way, then explicit consent, obviously, ought not need to be required, but where there are secondary uses, where there are uses beyond a reasonable expectation of that consumer then, certainly, we need explicit opt-in consent. It needs to be very clear to consumers how their information is to be used, if at all.

I want to emphasize the consumer context because it is a curiosity of privacy legislation and a curiosity of consumer protection legislation that when I purchase my phone I do not have to read the terms and conditions. There is no expectation by government that I read the terms and conditions, yet I am protected. There are implied warranties pursuant to consumer protection legislation. I do not need to read those terms and conditions in order for my rights to be protected as a consumer, yet there is an expectation when I download any app on my phone that I read the terms and conditions. That cannot be a tenable state of affairs if we want to protect consumers. We cannot expect consumers to read every term and condition, and every consumer contract in the course of downloading applications, and in the course of living their lives, as I said, increasingly online. Our laws need to reflect that reality.

There are obviously some straightforward fixes for this legislation. The membership of the tribunal should obviously have greater privacy expertise. I think that is a no-brainer. We do have to think more deeply through some of these consent rules and how we can strengthen them potentially further. I would like to see us go beyond algorithmic explainability to some kind of algorithmic accountability.

I know that others have mentioned political parties being left out. I do not know that political parties need to be subject to PIPEDA specifically, but they ought to be subject to privacy legislation. If there is no further effort under way by the government, then I think PIPEDA may well be the place to do that.

Lastly, I think we have to focus on children, in particular, when we look at consent rules and protecting kids on the Internet. Previously, I have written and spoken publicly about my support for our right to be forgotten, but I do think we have to be more focused on our rules and protection for kids as they grow up with the Internet and live their entire lives online.

I will close by simply saying that this is a big bill. This is second reading and, certainly, all of us ought to support this in principle. I look forward to working with experts and colleagues to strengthen the bill at committee and get into the details.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Mr. Speaker, one concern that has been highlighted by a number of other colleagues in this place is the fact that the bill may have the unintended consequence of creating an unlevel playing field for small and medium-sized enterprises, versus the big players. The big players have teams of lawyers and departments to deal with this sort of thing, as opposed to the small and medium-sized enterprises that are going to have to grapple with the consequences of this sort of legislation.

Would the member be able to provide some context about any safeguards that may exist or any suggestions that he would have to ensure that there is in fact a level playing field in that regard?

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Mr. Speaker, I would say a few things. First, the concept of proportionality is really important in this regard. Second, it is a live concern that should be addressed by the committee in some respect, but I would also note and would present some caution in response that there are some small companies that collect mountains of personal information. It is not necessarily the size of the company but the activities of the company that we ought to be most concerned about.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I want to thank my hon. colleague for an excellent speech. I felt I should have written it with him at some points, because we spent so much time together studying this and pushing the government for action. There are some key elements in this legislation that certainly come from our work together on the ethics committee.

I am interested in the issue of algorithmic accountability. I think that is something the ethics committee was way out front on. When I look at the other legislation, about having Facebook and Google under the CRTC, I feel it was the best idea for the 1990s. When we are dealing with algorithmic powers that are pushing extremist content, that are pushing Holocaust denial, and when we have seen how that is the real driver on the big social media platforms, and the inability of parliamentarians to actually look inside that black box, I would like to ask my hon. colleague how he would suggest we actually get some stronger accountability mechanisms on the algorithms that are pushing the content and driving people to certain sites and certain conversations.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Mr. Speaker, I am looking forward to getting back to the ethics committee to work with the member for Timmins—James Bay on these issues.

When we look at the use of algorithms and the use of algorithms combined with just the scale of data collection that we see today, we can narrowly focus in on consumer privacy on the one hand, but on the other hand there are bigger conversations about how that information is used to target messages to us and the implications for our democracy. There is a reason, when we hosted that meeting in Ottawa for the IGC, that it was on big data, privacy and democracy.

In terms of algorithmic accountability specifically, I would say I am not certain yet what the perfect solution looks like, but I have always been interested in the work of the Treasury Board in respect of algorithmic impact assessments. It is clear enough, and I am glad to see in Bill C-11 that there is a commitment to algorithmic transparency.

Going further and having some body, potentially the Privacy Commissioner, able to look under the hood and audit algorithms and their potential positive and negative impacts is important. We need to figure out a way to do just that.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Mr. Speaker, I want to acknowledge the phenomenal amount of work that the standing committee did in order to help facilitate the recommendations.

Could the member provide some of his thoughts in regard to the pre-presentation work involved in the legislation? Does he have any closing thoughts on that?

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Mr. Speaker, I would just say very quickly that this is one of the few examples I have seen in this Parliament, at this scale at least, where parliamentarians from all parties worked constructively and collegially. No one would have been able to tell which member of which party was asking questions of Facebook officials, Google officials and various representatives and other experts.

When we made those recommendations in February 2018, I do not think people were particularly seized with this issue. Then we went down the rabbit hole of Cambridge Analytica and really continued the examination of these issues and this work. Out of that work, I can see our committee work reflected in the legislation. I think members of all parties ought to be proud of that. We ought to now take that and work even more to improve the legislation going forward.

[Ali Ehsassi, Liberal, Parliamentary Secretary to the Minister of Innovation]

Mr. Speaker, I rise today to join my colleagues in speaking to the digital charter implementation act, 2020.

In today's ever-changing digital environment, Canadians have demanded better protection of their personal information. They have also demanded that organizations be held accountable for misusing their information. Stakeholders have told us that they want flexibility to innovate responsibly and want consistency with privacy rules everywhere else in other jurisdictions.

I am proud to say that the digital charter implementation act, which would enact the consumer privacy protection act, or CPPA, represents the most ambitious overhaul of Canada's private sector privacy regime since PIPEDA was first introduced, in 2000. CPPA would introduce significant changes to better protect the personal information of Canadians in the way they have been demanding, including, of course, with strong financial consequences for those who do not follow the law.

Prior to PIPEDA, in the 1990s, other countries around the globe introduced new laws to ensure that privacy was protected and that the opportunities afforded by e-commerce and the flow of information around the globe flourished. In particular, the EU introduced a privacy directive for its member countries to implement into their national laws.

Inspired by the EU law, Quebec introduced the first private sector privacy law in Canada in 1994. This was an important step forward, but it also raised the potential and, of course, the prospect for a patchwork of provincial privacy laws. With the prospect of multiple, possibly conflicting, rules and gaps in privacy protection that could harm Canadians, the federal government needed to act. Canada required a national privacy standard to ensure consumer confidence and regulatory certainty for businesses.

At the outset of the new millennium, PIPEDA was created to address the privacy concerns arising from a period of technological disruption fuelled by the rise of the Internet. It provided a framework with robust privacy protections and the flexibility to support the legitimate needs of businesses to use personal information. It also provided a mechanism by which the provincial private sector privacy laws could be considered substantially similar. This meant that where such a law is accorded that designation, PIPEDA does not apply to an organization's activities within a province.

In 2004, Alberta and British Columbia passed private sector privacy laws that are considered substantially similar, as is Quebec's law. A number of newer provincial health information laws have also passed, since 2005, that have been appropriately designated as substantially similar.

PIPEDA would continue, however, to apply to the federally regulated sector in a province and to any personal information collected, used or disclosed in the course of commercial activities across provincial borders. This provided a stable regulatory environment and flexibility for the provinces, and supported Canada's trade interests for many years.

However, today we are faced with a changed environment. Today, in many ways, history is repeating itself, but the risks have evolved. The role of digital technologies is considerably more central to our lives than it was 20 years ago. Just consider our experience in recent months with the pandemic. To harness all that the modern digital world has to offer, we clearly needed to modernize our federal private sector privacy law.

In a globally connected economy, our laws needed to be consistent with those of other jurisdictions. Internationally agreed privacy rules, such as the OECD privacy guidelines, first introduced in 1980, were updated in 2013. So too, I might add, more recently, was the APEC privacy framework. Indeed, privacy laws based on these international norms have been changing and advancing in Europe, Japan, South America and New Zealand.

What have these changes entailed? Core privacy principles have remained, though some have been expanded, such as accountability and breach reporting. New elements, such as enhancing rights of erasure and mobility rights, a greater emphasis on transparency, more certainty for businesses and consumers through codes certification and stronger consequences for non-compliance, have been the principal hallmarks of many of these evolving changes.

Closer to home, this summer, Quebec introduced amendments to its private sector privacy law, and B.C. recently conducted a study on its own laws. Ontario too is considering introducing a new private sector privacy law. Stakeholders have told us they are worried about the burden of multiple laws with different requirements. They demanded harmonization here at home.

There is a clear need for the progress and reforms included in the digital charter implementation act, 2020. If we do not act, there is a risk of further fragmentation of privacy rules across the country. We need to keep up with changing technology and business practices, and incorporate the best international practices, protocols and safeguards in our own domestic laws. We also need to set a common standard for privacy protection for the private sector across Canada.

Like the current PIPEDA, the new CPPA would be grounded in the federal trade and commerce powers. It recognizes the very importance of doing business on a national basis and in an economy that must work across provincial boundaries. Also, like PIPEDA, it would provide for a mechanism to recognize provincial laws that are substantially similar. These regulations would set out the criteria and process for such recognition or for reconsideration of it, and would continue to provide the provincial flexibility that has been important to PIPEDA's success. CPPA, like its predecessor, would maintain the Privacy Commissioner's ability to collaborate and co-operate with his or her provincial counterparts, an important tool to ensure consistency.

As the minister emphasized earlier today, the focus should always be on compliance. Some ask why we cannot have just one national law. The answer, of course, is that Canada is a federation; there is a division of powers. Indeed, the provinces provide important coverage that a national law cannot, under our Constitution.

I would be remiss if I did not also acknowledge the international context.

We live in an interconnected world. Data are constantly flowing across borders. In 2002, the European Commission recognized PIPEDA as providing adequate protection relative to EU law, allowing for the free flow of personal information between Canadian and European businesses. However, in 2018, a new EU regulation came into effect: the General Data Protection Regulation. It updated many of the existing requirements and added strong financial penalties for contraventions. The EU is currently reviewing its existing adequacy decisions, including the one applying to Canada.

That is why the government launched Canada's digital charter in 2019. Its 10 guiding principles offer a firm foundation on which to build an innovative and inclusive digital and data economy. The principles of ensuring interoperability, a level playing field, strong enforcement and real accountability are clearly reflected in the digital charter implementation act.

I want to thank members for their attention today, and I can assure them that our approach to privacy protection respects the privacy rights of Canadians. It is pragmatic, principled, meets our trading needs and provides a consistent, coherent framework that Canadians and stakeholders can rely on.

With Bill C-11, we will continue to encourage trade and investment and grow an economy that extends across provincial and international borders alike.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, the bill seems to nibble around the edges of, but is never really clear on, the issue of classifying individual sites and social media networks by whether they are content curators or publishers. This is an important aspect. A regular newspaper is held to account by our libel laws, yet many of our online content curators are not.

I am wondering if the member feels this is an appropriate place to answer that question or if it should be decided somewhere else.

[Ali Ehsassi, Liberal, Willowdale, ON]

Mr. Speaker, as I tried to highlight in my remarks, we recognize that it is incredibly important to look at the practices of the provinces and look at the legal regimes and frameworks that have been adopted in other jurisdictions around the world. There are many scenarios in which we had to ensure the bill would provide a fair and stable legal framework for everyone operating within the ambit of the law. We went over many scenarios, and I can assure the member that the result, which is this legislation, has considered them. It has looked at practices in other jurisdictions, and I think we can all be incredibly proud that we will have a privacy law that is the gold standard for the world.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Mr. Speaker, I would like to thank my colleague for his comments. They were very interesting.

I know this has been brought up already today, but I want to hear from the member about it. We know that Bill C-11 does not explicitly deal with political parties, and we have heard members within the government and from the opposition parties ask that it be included.

If the member could comment on why this was not included in Bill C-11, that would be great.

[Ali Ehsassi, Liberal, Willowdale, ON]

Mr. Speaker, I can assure my colleague that this question has arisen on quite a few occasions since this legislation was first tabled by the minister. What I can say is that the pith and substance of this legislation deals with commercial activities. That is the first thing we should all bear in mind.

However, the member raised an incredibly important issue. We should make sure our political parties are acting in a responsible fashion. That is precisely why, as the member is well aware, we recently updated the Elections Modernization Act to ensure that political parties are acting in a responsible fashion.

[Ken Hardie, Liberal, Fleetwood—Port Kells, BC]

Mr. Speaker, I read the legislation with interest. There is one aspect of things that happen online that concerns me, and I am wondering if it will or has come up in conversations. It is the sneaky little personality tests that we see that ask someone to answer questions or enter their birth date. We learned from the analysis of Cambridge Analytica that this is a way it gathered thousands of data points on a huge population. It is a form of privacy invasion, and it is very insidious. It looks like a fun little game, yet people are taking it, scraping it and using it for a commercial advantage.

I am wondering if this is an issue we will consider.

[Ali Ehsassi, Liberal, Willowdale, ON]

Mr. Speaker, as we heard earlier, in the first part we had members of Parliament look into the various machinations that can be found online, and the ethics committee did an incredible job. It looked at Cambridge Analytica and other issues that were of concern to all of us and made some recommendations. In addition to that, as I noted, we looked at the best practices of other jurisdictions as well. We fully came to realize, as the member rightly pointed out, that if a company is to collect data, it is imperative that there be meaningful consent. This is really at the core of the legislation that was tabled by the minister last week.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, it is my honour to rise again today to address Bill C-11. This bill, when printed, is nearly an inch thick. It is a monster bill for around here. It is a timely bill, as well. I am looking forward to delving into it. I have not had the opportunity to read through it in great detail to this point, but I want to speak to it.

This is a top-of-mind issue for many Canadians. One of the things I want to point out right off the top is that when someone is online and a virtual persona, if they think they are getting a free product, they are actually the product. That is the thing to remember and many folks do not seem to realize that. That is something I have not seen in this bill, which is important. I think it is missing from this bill, although this bill may not been seeking to address that specifically.

There could be some sort of public awareness campaign, much the same as we have done with cigarettes. In the past, the public was trained that if someone smoked cigarettes, they would get cancer. We could do this for online profiles and show the dangers and what is going on out there.

As well, the member for Port Moody—Coquitlam mentioned what is actually happening with our data. We think we are filling out a fun game or personality test, but we are actually giving away data. It can be harvested commercially to send advertisements and promote certain products.

We continue to see more invasion of our privacy. I do not know about other members, but the thing that jumped out at me, during my first cursory read of this bill, was the term “algorithm transparency”. That is something I am really fascinated by.

On the weekend, my friend was telling me that he took his phone, laid it on the table and he and his friends talked about white rabbits for three to four minutes. They just said the words “white rabbits” often. Then they opened up his phone, went to Facebook and the advertisements he was getting were about white rabbits. Our phones are listening to us and there are algorithms that are promoting certain things.

We can probably turn that feature off and mute the microphones on our phones all the time if we know how to do that, if we care enough about it or are concerned about that kind of thing. There is a joke that the Chinese are listening to us. It is just an assumption that is being made. I do not think there is actually somebody listening on the other end, but there is an algorithm that is obviously listening to what we are saying and trying push products toward us that we are interested in.

The white rabbit story is interesting. It is not necessarily something that would come up in day-to-day discussions. However, I know that if we connect to someone else's WiFi then suddenly we start getting different advertisements. My cousin has a CNC plasma cutting table for cutting metal. It is really cool, but what is interesting is that when I go to his house and connect to his WiFi, which is also connected to that CNC plasma table, I start getting advertisements for CNC cutting tables. That is wild and fascinating. The algorithm transparency piece is one of the most fascinating pieces of this law.

Sometimes on Facebook, we get ads. We can click on the “X” to get rid of the ad. When an ad comes up, one wonders why they are seeing it. If I could get an answer for that, that would be amazing.

I am interested in that. What is being fed into the system that is promoting this particular ad to me? That is something I am really interested in knowing. At this point, there seems to be no recourse whatsoever to know why these ads show up. In my virtual personality that lives out on the Internet and in the data collected on me, what recent actions in particular have I undertaken that have driven this particular ad into my feed? I am fascinated to see if we are going to be able to bring that transparency with this bill. I am not necessarily convinced we will be able to do it, but I am fascinated by it.

The other piece I do not think this bill addresses at all is the question of social media platforms or Internet platforms being message boards or publishers. This continues to be a sticking point. There have been committee hearings with the major social media platforms, and we have seen countries around the world seek to grapple with this issue. This is precisely what governments ought to be doing.

What it means to govern and to legislate is to come up with a system that balances the interests of all people in a way of our choosing. That is what it means to be in a democracy. That is what it means to be governed by ourselves, so to speak. In many cases we see effective lobbying efforts by organized groups, and in particular commercial interests, that do not necessarily allow the government to get that balance right.

We see in the news how we grapple to enable this. Some large social media platforms have amassed a wealth that exceeds that of many nations. Some of the largest nations in the world are able to compete with this, but many smaller nations do not have the resource capacity many of these large media companies do, so there is tension there. I compliment this bill in that it is attempting to have that discussion.

Do I trust the Liberals to get it right? No, typically not, but I commend them for bringing this forward and beginning the conversation. This is going to be a long conversation. Like I said before, this bill is an inch thick.

The member for Scarborough—Rouge Park just made a comment. I do not quite know what he said, but I am sure he was complimenting me on my speech. I thank him and appreciate that.

Around algorithmic transparency, the piece that is really important, and that I do not think this bill quite grasps, is whether platforms are curating content, publishing it or choosing winners and losers. The algorithmic transparency of that is a big concern for me, and I know it is a big concern for many people across the country. It is interesting this is a concern for people both on the right and the left. It is a concern for all the political parties. It is a concern for ideological differences, and in general for what is curated and what is deemed to be on the platform.

This is also a concern for the platforms themselves, in that one particular message that comes from a platform can then become part of a mob mentality. People could then really go after it.

There is no protection, necessarily, for platforms because there is ambiguity about whether they are responsible for messages on the message board and, if they are, whether they are liable as a newspaper would be. That is the major challenge.

While I am not convinced, at this point, that we will get algorithmic transparency in that sense, it is important to be able to tell people, “This is our algorithm, this is how messages get on the board. We are not responsible for the messages and, therefore, this is how the system works.” There is no human input. It is just a sophisticated method of getting messages in front of people that they want to see, that they think are interesting and that they find helpful.

For the most part, I would say we are getting that right. Where there is some concern is about political messaging. We have already seen that Facebook has worked hard on that, but there is always a spectrum, I would say, of political messaging. There is explicit party messaging, which is relatively easy to monitor and manage, but then there is political messaging that goes farther afield. When it is a random, individual Canadian doing political messaging, how is that managed? That is when it will be really important for us to get the algorithmic transparency piece right.

There is another thing I am interested in seeing and have not seen. Part of the government's rollout on this bill has been pushing freedom from hate and from violent extremism. That is important to me. The managing of the Internet and platforms around violent and degrading sexually explicit material has been something I have worked on in this place. It was in 2017 that the House unanimously passed a motion for the government to study the impacts of violent and degrading sexually explicit material.

This was something that had not been studied since 1985. I was not even born in 1985, so that tells us it was a long time ago. The member for Fleetwood—Port Kells is shaking his head at me. I am not sure what that belies about me or him, but it was a while back, before I was born and before the Internet existed.

A study on the impacts of violent and degrading sexually explicit material was done in 1985. I remember distinctly, in 1991, going to my uncle's house. He had gotten the Internet. I had heard about it and said I wanted to see the Internet, so he showed me where the phone line plugged into the wall. I asked if that was it and he said we should look at it. He turned his computer on. It had a giant monitor and a big tower beside his desk that hummed. Members may remember the sound coming through the speaker of dial-up Internet. I remember, for the first time ever, seeing the Internet. We went to dogpile.com, which was an early search engine. That was the beginning of the Internet for me, in 1991.

Here we are nearly 30 years later, and we are still grappling with how to manage this. It is a public information highway. There are public highways all over the country, and the government manages a licensing system for folks who get to use the public highways and roads. There is no controversy around that. It seems like an effective way to manage it. Given that it is tangible and we can see it in front of us, that is a manageable thing. In reality, we are dealing with the information highway. Up to this point, there has been very little direction on the role of the government in managing the expectations of Canadians.

Many parents who I have talked to are looking for tools they can use to protect their children online, and they are not satisfied with being told they should just be better parents. They say they want help from the internet service providers. They want help from their government. They want the ability to have some recourse with these large platforms. I am interested to see that.

The government says the Internet should be free from hate and violent extremism. That is something that I support notionally. Video imaging is the area where I am most concerned. In the other direction, I am concerned about free speech, and particularly the use of words and typed messaging. That, I guess, is a little harder to manage. However, particularly with images and video content, I think there is a lot of room for the government to operate in, especially with the violent and extremely degrading sexually explicit material that we have seen since 2007.

Since then, we can chart the impacts of those on Canadian society on a number of different indicators, and they have gotten worse. We see this particularly with our children in terms of the loneliness index going up and the isolation index going up. All of these things are exacerbated by the COVID lockdowns.

These are all things that we need to ensure come into this. Freedom from hate and violent extremism is necessary, and we have to get that right. This is what governments are built for. This is what we need to do, and we have to get it right, so I am looking forward to continuing debate around that.

The last thing I want to point out, which I find to be a little interesting, and I am hoping for some answers on from the government side, is this bill, the procedure of the House and how this bill will roll out over time. I must say this bill was unceremoniously dumped on Parliament. I was not anticipating it. I have been working on these issues for a while, and it was not something that was clearly on my radar.

I had written to the Minister of Canadian Heritage around this issue, and I was wondering how he was going to manage it, because I do remember seeing in his mandate letter that he was to try to remove hate and violent extremism from Canada through the Internet. I had some ideas and concerns around that, so I had written to him about it. I did not receive any feedback back saying the bill is coming, so I was a little surprised that this bill came when it did.

The other thing that I am really looking for an answer on is why the rumour around here is that this bill will be going to the ethics committee. I am wondering why the bill is going to the ethics committee. This seems like a bill built for the industry committee. That is typically where this would be dealt with, so I am left wondering. The ethics committee is seized with a number of other issues, and I am wondering why this bill would be rumoured to be headed toward the ethics committee, when industry seems like the committee that would be more in tune with where we would like to go with this particular bill.

I am going to be continuing to monitor the debate around this bill. I am looking forward to having a robust debate. I know that, given the size of the bill, we will be discussing it for a while, whether in this place, in the other place or in the committee, as well as out there in the general public.

I know that this will be a hot topic of discussion. I look forward to continuing that debate, and I look forward to the questions.

[Gary Anandasangaree, Liberal, Parliamentary Secretary to the Minister of Crown-Indigenous Relations]

Mr. Speaker, the member for Peace River—Westlock and I have worked together for a number of years. In fact, I was complimenting him when he was speaking, as he said some decent things about the government, which is quite unusual. In any event, I want to thank the member for his walking us through, essentially, the history of technology to where we are today.

In terms of the enforcement mechanisms built into this piece of legislation, could the member comment on its effects and what elements could strengthen that piece? I believe this is a very important tool. Any legislation without proper enforcement would be a failure, but in this case, we have a very robust system in place.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, the jury is still out on the enforcement piece, given this is a brand new piece of legislation and the enforcement tools would be brand new.

I work a lot in the area of human trafficking and around multi-jurisdictional cases, where many of these players are headquartered in other countries. These multi-jurisdictional cases tend to get very slippery.

I have concerns, and I am sure the member shares those concerns. While this is a good first attempt, I think we will be constantly updating these particular privacy laws to continue to get the results we are looking for, in both directions, whether it is in overly aggressive fines, or where clear perpetrators are just getting away with it. I think we will be fine-tuning this over the long term.

[Louise Chabot, Bloc, Thérèse-De Blainville, QC]

Mr. Speaker, I would like to ask a question to the member who just spoke.

My colleague said that he has numerous concerns that are not being addressed by the bill in its essence. If we take the bill for what it is, and not what it is not, we can see that its provisions currently do not apply to the government. As we have seen, the government has not taken all the necessary steps to protect the identity of people making requests.

What does my colleague think of that?

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, the question is in regard to folks who request their data to be turned over, to be able to see what data a particular company has on them. I think that is a good start.

In terms of the government, I do believe, if my memory serves me well, that that has been a long-standing process for quite a while already. People can request that information from the government and learn what data the government holds.

If the member is talking about political parties, that has not been the case. I do not think the bill is dealing with political parties at all. We deal with that in the Elections Act. I think there is an ongoing discussion with the Elections Act around data and data management there. In terms of the spam legislation that was brought in a number of years ago, there are special provisions for political parties there as well, most of which I agree with.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Mr. Speaker, it is always interesting to hear some of my colleague from Alberta's stories.

There has been some discussion today about new categories of data being exempt from privacy protections. I am wondering if the members feel that is a worrying step, considering that it gives the opportunity for a Liberal government to give away to big tech giants, which we have already seen it is potentially too close to.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, I think the hon. member put her finger right on the issue, which is that the coziness between particular governments and particular media platforms is a concern. I talked about that in my speech as well, saying this is something that is not an ideology from the left or the right.

We see it happening with governments, in particular when they are in power, having a cozy relationship with a particular platform, and how that can sway public opinion on things. I share her concern on that. I think that if she continues to hold her finger on that particular issue, all the rest of the stuff might be spinning around, but that is the crux of the matter.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Mr. Speaker, just because Google and Facebook exist and are on the Internet, one should not make the assumption that there is this wonderful cozy relationship. Whether it is coming from the Conservatives, New Democrats or the Bloc, it is as if they are trying to say that the government of the day is in the pockets of these groups. I find this interesting, as nothing could be further from the truth. We all know that. That is a reality, and one of the reasons we have the legislation that we have before us. There was a great deal of effort to get here.

I wonder if my friend across the way would provide his thoughts in regard to some of the work that was done prior? It was done in an apolitical fashion at the standing committee, where there were members from all political parties actually contributing to what we have here today.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, I do not think the member listened to a word of my speech prior to his question, but I would like to point out that Facebook has met with the government over 140 times. This has been widely consulted, as he says, and widely lobbied on as well. He will have to forgive me for doubting his intervention there.

I know that in some cases a large media company's value can outstrips a nation's value. This is something that we need to manage. In my speech I pointed out that the exact thing the government is in charge of is managing the relationship of its citizens. Corporations are another citizen, and we need to manage the relationships between citizens. I think this is a noble attempt.

I know that this will be an ongoing conversation. I look forward to seeing where that takes us.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Mr. Speaker, I appreciate the opportunity to ask my colleague a question regarding the interplay of public and private data in agricultural circumstances. One of the challenges that I see with this bill is the disparity that exists between urban and rural Canada.

I would be curious to know if my friend has considered aspects of the bill, specifically in regard to the private and public data that is used in modern agriculture for small and medium-sized enterprises associated with the developing industry of our egg producers.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, agriculture and data is a growing area of expertise. I would just point out that if someone goes to a John Deere dealership today, one of the things they will see there is a dirt probe. I used to think that John Deere just sold tractors, but today they sell a moisture probe with a weather station on top of it. They will set that up in the field so that a person, via satellite and cellphone, will get real-time information about the soil conditions, soil nutrients and weather conditions of the fields, which may be scattered around the country.

Martin Deerline, the John Deere dealer in my area, has a whole suite of those data collection agencies. People have to pay a particular monthly fee for that service. Where that data goes and how it is all managed, I am sure, is covered by this bill.

I look forward to hearing from them at committee.

[Gary Anandasangaree, Liberal, Parliamentary Secretary to the Minister of Crown-Indigenous Relations]

Mr. Speaker, I would like to start by saying that I will be splitting my time with the member for Richmond Hill.

I am speaking here on the traditional unceded lands of the Algonquin people.

At the outset, I want to thank the Minister of Innovation, Science and Industry and his team for bringing forward Bill C-11, an act to enact the consumer privacy protection act, CPPA, and the personal information and data protection tribunal act. These are important aspects as we, as a country, address the issues of privacy in relation to the enormous amount of information that is constantly gathered, and exists about all of us.

We are in an age when with a cellphone we have more information at our disposal than several libraries put together. We are able to access personal information about virtually anyone who has a public profile, and certainly about anyone who has created a profile in one of the major platforms, whether it be Facebook, Twitter, Instagram, TikTok or LinkedIn, and the list goes on.

These have posed obvious questions for all of us as policy-makers or even as individual consumers in terms of how this information is used, how it is reproduced, copied and misused. We have seen the worst of it over the years in platforms like Facebook where information may have been reused over and over again.

At the centre of this legislation are three major aspects. First and foremost is consumer control over individuals' personal information that is out there.

Second, it is about innovation. I know the previous speaker spoke about the balancing act that we need in order to ensure free speech and privacy.

The third element is to make sure that innovation continues. Innovation is absolutely important for a country like Canada. I know many innovators in my community who have done exceptionally well. I have spoken about many of them here. The University of Toronto Scarborough campus has a hub in which many local innovators have come forward and have developed in my riding of Scarborough—Rouge Park.

Members may know of the company, Knowledgehook. It is a company founded by my good friend Travis Ratnam. The company was just given additional funding of $20 million to expand the program. It is a platform that allows students and teachers to work together to use AI, devise curriculum and make sure that the weaknesses of each student are highlighted to the teachers so that the teachers can respond.

In all of these new forms of technology, there are questions of privacy. We worry about the relationship between, for example, companies gathering data for the purpose of insurance, whether health, life, or auto insurance, and the data that sometimes is readily captured in our day-to-day use.

All of these issues have become pronounced during COVID. We see that education, for example, is now online for many students whose parents choose to have their kids study from home via the Internet; or for many post-secondary students who are studying virtually. I always go back to the University of Toronto Scarborough campus, which is located in my riding, but there is also Centennial College, where most of the students are learning virtually. These again have complicated the challenges for ensuring that privacy is maintained.

The digital charter that is before us does really allow for consumers to have control over their personal information, and it allows for innovation and a strong enforcement oversight. Sadly, the enforcement aspect has been quite weak in Canada over the years. We do not have adequate enforcement. In fact, technology itself is hard to enforce, whether in Canada or other parts of the world.

The enforcement mechanism that is built into this legislation is critically important for us to look at. It is what makes this legislation accessible to individuals who may have a complaint. The enforcement mechanism looks to have individuals appointed through the order in council process.

I want to speak about the way our government, since taking office in 2015, has managed to put together proper processes to appoint individuals to these important bodies, including judiciary and administrative tribunals, but also other bodies that make critical decisions.

We are focused on ensuring a merit-based system that ensures the individual is fully qualified to make decisions on a particular issue. For me, my work on the Standing Committee on Immigration and Refugees was a great learning experience. I saw first-hand how the IRB was transformed from a patronage-based appointment process to one that is merit-based. We see decisions coming out of the IRB that are fully reflective of the quality of candidates we put on those boards.

When we look at appointments, it is meritocracy, but also diversity. We note that in previous governments, judicial appointments have often been focused on men. In fact, in the last several years, we have now achieved gender parity. We are looking at enhancing that and we are working toward greater diversity among other groups in Canada, including people with disabilities. I believe the enforcement mechanism is critical and we have taken concrete steps in that regard.

To note, there are monetary penalties that this tribunal could issue. For example, there is a penalty of 3% of global revenue or $10 million for non-compliant organizations. For a company like Facebook, Google or one of the major outfits, 3% of their global revenues is significant. The maximum penalty is 5% of global revenue or $25 million for certain types of contraventions.

The government and the Minister of Innovation have brought forward a very important piece of legislation. It appears to have the support of all parties. I am particularly impressed with the data protection tribunal act that is built into this bill and the mechanisms that allow for individuals to access the type of redress that is required.

I look forward to questions from my friends opposite.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Mr. Speaker, this is an interesting piece of legislation. One of the questions that was posed earlier in the debate had to do with the fact that political parties are omitted from this legislation and that their use of personal information is not considered. The response provided by the Minister of Industry earlier was that the bill really deals with commercial uses of data, yet I read in the index of the legislation that it also deals with “statistical or scholarly study or research”, “Records of historic or archival importance”, and “artistic or literary purposes”. These are clearly not commercial uses.

Does the member agree that it is an omission that political parties are not dealt with by the bill?

[Gary Anandasangaree, Liberal, Scarborough—Rouge Park, ON]

Mr. Speaker, I think many of us have been watching elections overseas in the last several weeks, and I am quite impressed with our Chief Electoral Officer and Elections Canada, which is an independent body that regulates elections. I believe that Elections Canada is well suited to be the arbiter of these issues, particularly with respect to elections. It is definitely an area that our Elections Commissioner will take note of in the coming years.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Mr. Speaker, to pick up on that point, whether it is Elections Canada or the commissioner, there is opportunity to ensure that these lists are protected, and there are instructions given out to parties, candidates and people who are recipients of the data.

I do not know, but this may be a better question to ask to the members who put forward the question, whether or not Elections Canada has actually solicited this sort of a recommendation. I am not necessarily aware of it, but I would be very much interested if in fact members of the New Democrats or the Bloc, who have raised this issue, have been in talks with Elections Canada. This is more of a comment than anything else.

My question to my colleague is more in terms of getting this type of legislation forward and how it would help individual Canadians and businesses going forward, because through this legislation, we would see new regulations to protect our interests. Would he not see that as a very strong positive for all of us?

[Gary Anandasangaree, Liberal, Scarborough—Rouge Park, ON]

Mr. Speaker, every candidate who puts forward their name signs a declaration with Elections Canada about privacy and on the information that we receive from Elections Canada, and so I think that there are mechanisms in place with Elections Canada to address some of the privacy concerns.

Obviously, with respect to this particular piece of legislation, I do want to reiterate the enforcement mechanism, which is critical, but enforcement sometimes is inaccessible to the average Canadian. I believe that the tribunal process that is set up here would allow individual Canadians to access some closure and support for challenges that they may have with a breach of privacy.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Mr. Speaker, it is an interesting point that was raised about Elections Canada.

I believe that Elections Canada has strong rules around the use of the voters list, but, of course, political parties collect personal information using so many other means. It is the regulation of that other information that is particularly germane and could be covered under this piece of legislation, which is something that we have been pushing for.

Could the member comment on the omission of any treatment of that kind of information?

[Gary Anandasangaree, Liberal, Scarborough—Rouge Park, ON]

Mr. Speaker, I believe these are the types of questions that ought to be brought up at committee, and I do think that it is a valid concern. Again, back to Elections Canada, when we look at the governance of political parties, at third party advertising and all the different measures that our government in the last Parliament and previously has put forward, I do think that Elections Canada is best equipped to address the issues of privacy, which are absolutely valid. I appreciate the question, but I do think it should be within that purview.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Mr. Speaker, I am pleased to rise today to speak about the digital charter implementation act, 2020. I want to talk specifically about the balanced approach to the compliance and enforcement set out in the consumer privacy protection act, also known as the CPPA.

Canadians have told us they want to see strong consequences for those who mishandle their personal information. Financial consequences can be an important tool in protecting Canadians’ privacy, but so is helping organizations comply with the law at the outset.

I am pleased to say that the CPPA takes a very balanced approach to compliance and enforcement. It would help companies get privacy right from the ground up, and takes a phased approach to enforcement to correct problems as soon as they are discovered. The CPPA would incentivize organizations to get their practices right from the start, and the Privacy Commissioner would have a prominent role in supporting these organizations.

Under the CPPA, businesses would be able to approach the Privacy Commissioner for a no-risk review of their privacy management program and help them comply with the law. The commissioner could also ask to review their business programs, without using what he finds in an enforcement action. This is a very important step in early correction of problems. Under the current privacy regime, companies subject to the law are already required to establish a privacy management program, which would be maintained in the CPPA.

Privacy management programs can cover a wide range of issues, such as how companies handle service providers or third parties that support their businesses, how they respond to security breaches, privacy risks assessments, mitigation measures undertaken, and so on.

However, what is new is enabling the Privacy Commissioner to have a look at these policies and practices outside of an investigation. This would provide a safe space in which the commissioner could provide advice and companies could quickly take action. At the same time, the commissioner would benefit from examples of the challenges organizations are facing and their needs in the privacy space.

We know Canadian companies, especially smaller ones and those starting out, will be very interested in these changes.

The CPPA would also recognize not all organizations are the same. Some deal with minimal amounts of personal information, and for others it is central to their business model. Therefore, the CPPA would allow organizations to develop their programs according to the volume and sensitivity of the personal information they handle, as well as a company’s revenues.

The Privacy Commissioner has had a long-standing role in undertaking research and publishing guidance. The Minister of Innovation, Science and Industry has also long had the ability to ask the commissioner to conduct research on privacy issues. This ability would remain in the CPPA. However, the minister would now be able to ask the commissioner to conduct research into the implementation or operation of the act. This would help the government know how well the law is functioning.

The Privacy Commissioner has prepared a lot of guidance materials over the years. We support this vital role. We want to reinforce a long-standing practice of the Privacy Commissioner to consult with stakeholders in guidance development. This practice would now exist in law so that guidance can be informed by what is happening on the ground.

The Privacy Commissioner would also consult with government institutions where relevant. There may be times when government policy may be implicated, such as with trade policies or public health.

These past months have shown us how vital it is for federal organizations to have a unified response on our most pressing challenges. By legislating, we are providing certainty to Canadians that guidance has been discussed with those on the ground.

I have stated how the bill would ensure organizations build privacy considerations from the start. Working with organizations and giving guidance individually is a fundamental role of the Privacy Commissioner. We want to avoid any problems, but there will be organizations that do not get things right.

The law provides individuals with the right to challenge an organization’s compliance with the law, and it allows them to file complaints with the Privacy Commissioner. This is an important exercise of their privacy rights, and the Privacy Commissioner retains his ability to initiate a complaint investigation where there are reasonable grounds to do so. The CPPA would also encourage the resolution of problems as early in the process as possible, and the bill would provide for dispute resolution.

Compliance agreements, a new tool introduced under PIPEDA, would remain in the CPPA. Companies are encouraged to come to the table to work out an agreement with the commissioner, without resorting to more formal measures such as orders. If no resolution is possible under PIPEDA, the commissioner would make recommendations at the end of an investigation and the matter may go to court. The court would then start again, with a new proceeding, and maybe it would issue an order. Few cases have gone that route, however.

Under the CPPA, the commissioner would be able to issue orders as well. To ensure fairness, a new process, called an inquiry, internal to the Privacy Commissioner’s office, would be introduced prior to issuing orders. Once the inquiry is over, the commissioner would issue his findings and decisions and may make orders to an organization to change its practices to bring it into compliance.

The Privacy Commissioner may also recommend administrative monetary penalties, or AMPs, to a new tribunal for certain contraventions of the CPPA. The personal information and data protection tribunal would hear any appeals of the commissioner’s decision and, if required, would decide whether to issue an AMP and, if so, the amount.

In our consultations, many industry stakeholders expressed concern over AMPs, which have the potential to significantly affect an organization’s bottom line and even put smaller companies out of business altogether. By introducing an inquiry phase before issuing orders, and by separating the imposition of AMPs from the commissioner’s other responsibilities, the CPPA would support additional due diligence in decisions to impose AMPs.

We anticipate that some organizations will challenge the commissioner’s orders and recommendations. We do not wish to burden the courts. This is another reason for introducing a new tribunal. It is intended to be less formal than the court and ease access to justice for organizations and individuals. After the tribunal issues a decision, if an organization or individual wants to, they could proceed to federal court and request judicial review.

As my colleagues can see, overall this is a very balanced and phased approach. The CPPA would place strong emphasis on proactive compliance activities, such as reviews of the privacy management programs, guidance development and consultation. When there are possible contraventions, the goal is resolution. If that cannot be achieved, matters would become more formal. This graduated approach to enforcement is built on the foundations of fairness, transparency and meaningful opportunities on all sides to achieve compliance, which is what we know Canadians want.

Many have said that Canada’s private sector privacy law needs more teeth. The digital charter implementation act, 2020, would give it that, and it would do it in a way that organizations that want to do the right thing have the incentive to do so from the start.

I am thankful for the opportunity to speak about how this important bill works to address Canadians' concerns in a measured way.

[Gary Anandasangaree, Liberal, Parliamentary Secretary to the Minister of Crown-Indigenous Relations]

Mr. Speaker, I want to speak to my friend about the enforcement mechanisms. What are the major aspects of them that would allow individual consumers to get results through a complaint process?

[Majid Jowhari, Liberal, Richmond Hill, ON]

Mr. Speaker, first of all, I want to thank the member for sharing his time with me and for his great intervention earlier.

I noticed the member talked extensively about enforcement. He highlighted that the legislation would provide administrative monetary penalties of up to 3% of global revenue or $10 million for non-compliant organizations. Also, it contains an expanded range of offences for certain serious contraventions of the law, subject to the maximum of 5% of global revenue or $25 million.

These are some of the enforcement mechanisms that will be accessible once the process has been completed.

[James Cumming, Conservative, Edmonton Centre, AB]

Mr. Speaker, does the member believe there has been adequate consultation regarding this legislation, particularly with the provinces that have their own privacy acts covered under PIPEDA?

[Majid Jowhari, Liberal, Richmond Hill, ON]

Mr. Speaker, I believe that yes, there has been sufficient consultation. The genesis of the bill goes back to 2000, and through the progress of time, there have been a number of consultations, in 2017 and 2019.

As the member is quite aware, a number of provinces have legislation equivalent to PIPEDA or the CPPA. The most important thing is that all levels of government are working together to ensure that the privacy of individuals' personal information is protected.

[Denis Trudel, Bloc, Longueuil—Saint-Hubert, QC]

Mr. Speaker, I will ask the same question I previously asked another hon. member. It is about data security.

The bill targets private companies. With the CERB, we recently saw that hundreds, perhaps thousands, of people were victims of fraud. When they receive their notice of assessment in April or May, they will learn that they owe money because they did not qualify for the CERB and collected it illegally.

If the government is working on cleaning up privacy laws in the private sector, why not put its own data protection system in order?

[Majid Jowhari, Liberal, Richmond Hill, ON]

Mr. Speaker, this is a very important question for many Canadians, as news continuously provides updates on non-compliance. There are a number of individuals who are non-compliant.

I believe the initial rollout of the program was related to data that needed privacy protection from various government levels. This is a great opportunity for us to explore other dimensions of government bodies that are dealing with the privacy of information and how they will manage it. I am looking forward to hearing testimony about this at committee.

[James Cumming, Conservative, Edmonton Centre, AB]

Mr. Speaker, it is a great opportunity to rise today to speak to Bill C-11.

We are surrounded by data that seems to be out of control, lost by corporations, sometimes stolen from governments. Data that we voluntarily give up about ourselves is being collected billions of bytes at a colossal rate. It has a tremendous impact on our privacy and what is being calculated or inferred about us in our daily lives, such if we have a good credit rating, or if we can buy a car or when we go for drinks with a colleague. All of this is very much apparent today, particularly during this health crisis when people are definitely at home and using the Internet to a greater extent.

Everything we do today has some impact on data. Whether we take an Uber or order a meal, that data is collected. Quite frankly, we need to ensure people's privacy is protected.

Why does privacy matter? It is a question that has arisen in the context of this global debate, made worse by this pandemic, where millions around the world have come to rely on computers to carry out a function for their very lives. When we hear arguments about Internet privacy. A lot of what we hear about this mass surveillance is that there is no real harm due to this large-scale invasion, that people have nothing to hide. Those engaging in bad acts have a reason to want to hide and care about their privacy.

This is presupposed on the assumption that there are good and bad people in the world. Bad people who plot to take down governments and plan public attacks are the people who have reason to care about their privacy. By contrast, there are good people, people who go to work, pay taxes, care for their children and use the Internet, not to plot civil destruction but to read the news and find recipes. These people are doing nothing wrong and have no reason to hide.

In a 2009 interview of the long-time CEO of Google, Eric Schmidt, when asked about the different ways his company was causing the invasion of privacy for hundreds of millions of people around the world, he said, “If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place.” There are many issues with this statement, one being that this is the very Eric Schmidt who blocked his employees at Google from speaking with the online Internet magazine CNET after it published an article full of personal private information, which was obtained exclusively through Google search and Google products.

A few short decades of the Internet, once held as an unparalleled tool of democracy liberalization, have been converted into an unparalleled zone of mass indiscriminate collection. Enter 2018, when the EU has set the global standard for privacy regulation with the flagship general data protection regulations, known as GDPR, signalling to Canada that our 1990s era of the Personal Information Protection and Electronic Documents Act did not have the teeth to take on big tech.

Bill C-11 would bring in additional privacy regulations. Replacing PIPEDA with CCPA would provide an opportunity for greater detail within the law rather than just relying on the interpretations of the Privacy Commissioner. This is a good thing.

The structure will include a personal information and data protection tribunal that will play a key enforcement role by reviewing all commissioner decisions and issue penalties for non-compliance. There will be an expert tribunal composed of three to six members, but interestingly enough it says there may be only one expert, which may be a deficiency in the act.

What are these new privacy rights? One is data mobility. Subject to regulations, on the request of an individual, an organization must, as soon as feasible, disclose the personal information that is collected from an individual and to an organization designated by the individual. Data mobility is a fact of life and this is a good thing. What format that data will be transferred in will need to be discussed.

On algorithmic transparency, if the organization has used an automated decision process to make a prediction or recommendation, then the organization must, on the request of an individual, provide an explanation of the prediction, recommendation or decision and the personal information that was used to make the prediction. It seems like a reasonable intent and is something it should be able to do without giving up the code.

With respect to de-identification, the bill states:

An organization that de-identifies personal information must ensure that any technical and administrative measures applied to the information are proportionate to the purpose for which the information is de-identified...

Then there is the new enforcement. The Privacy Commissioner of Canada will have the order-making power that will enable the office to order compliance with the law and recommend significant penalties.

I should mention I will be sharing my time with the member for Calgary Centre.

In some cases, the recommended penalties are the highest in the G7, so they are significant. The expanded range of offences for contraventions of the law are a maximum fine of 5% for a global revenue of $25 million. There are administrative penalties as well.

One of the issues I see with this is that the legislation and penalties invoke fear, but there will be a question of whether there is adequate teeth for enforcement.

The law includes whistleblowing provisions that protect those who have disclosed alleged privacy non-compliance and a private right of action that will allow individuals to seek damages for loss or injury suffered through privacy violations.

There are new standards of consent. This has been a big issue for individuals. How many people have signed up to a site, with three pages of disclosure to which they are supposed to consent? I would argue that very few people will actually read that kind of detail. Therefore, there is an attempt within the legislation to use clear language and simplified consent. Given the depth of the legislation, that may be a difficult thing to achieve, but is a worthwhile goal.

Deceptive practices to obtain consent with false or misleading information renders the consent invalid and individuals can withdraw their consent at any time. There is the question of whether people are providing consent for multiple activities or just an individual activity. That should be clarified.

The realm of data is largely uncharted territory and we find ourselves asking the question of who owns our data. Our opinion is that people own their data and they should own their data.

The word “consent” is mentioned 108 times in the GDPR. In the first reading of Bill C-11, it was mentioned 118 times. This sounds great. Who could possibly be against the consent of data? Challenging consent seems counterintuitive in the world of privacy because it is so linked to us and our autonomy. However, it is both impractical and undesirable and serves to explain why our privacy law is in such a sorry state. It is imperative the legislation is written with as little room for interpretation as possible.

There are some standards within that bill. It states:

An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for a business activity described in subsection (2)...

Under that subsection, it states:

(a) a reasonable person would expect such a collection or use for that activity; and

(b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.

The issue is this. If that is subject to interpretation, we could have a pretty broad interpretation of what it says. Hopefully this act, with the regulations that follow, will clearly define what is in and what is out.

At the end of the day, if we are using services, many services are disrupting, shaping and helping our lives in ways we could not have possibly imagined mere decades ago. Whether we like it or not, it is big tech that has provided these realities for us and the government should, as with any other key stakeholder, create meaningful, effective and collaborative policy but require consultation. It is one thing to consult in front, but now that we have legislation, we need to ensure we get it right. We need to ensure that industry, particularly small businesses, remain competitive. The bill is being sent for review to the privacy and ethics committee. There is a strong argument that industry committee should have a look at this bill as well.

Therefore, proper consultation must happen. There is nothing wrong with doing that. I hope the government will ensure the bill is properly consulted on.

[Gary Anandasangaree, Liberal, Parliamentary Secretary to the Minister of Crown-Indigenous Relations]

Mr. Speaker, I want to pick up on the issue of enforcement. Could the member talk to us about the elements of the bill that are critically focused on enforcement and what, if any, changes could we look at to strengthen it? It is a very strong starting point, one that will make complaints accessible to the average consumer. I would like my friend's comments on that.

[James Cumming, Conservative, Edmonton Centre, AB]

Mr. Speaker, what is in the act, with the increased fines, certainly provides somewhat of a deterrent. People are going to look at those fines. Then it becomes the reality of how do we ensure we enforce those fines. This is a new system with this tribunal. It looks like there is the potential for it to have more lay persons on it than actual experts in the field, which concerns me. I am concerned that this is the fear of enforcement to try and derive the result needed. There have to be adequate provisions within this act to ensure bad players are held accountable.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Mr. Speaker, the regulation-making power we give the government through legislation, in some sense, requires us to trust the government to put those regulations in place in a way that respects the public interest. The challenge we have when it comes to privacy is the that government does not have a great track record with respect to its own actions and its respect for privacy. This raises some concerns about whether we trust the government to enact these regulations in an effective way and properly enforce them.

Does the member have further comments on that?

[James Cumming, Conservative, Edmonton Centre, AB]

Mr. Speaker, I have the same concerns. The track record is not there with the government as it relates to privacy. We have seen this in a variety of different areas where it has not taken this sort of thing serious. That is all the more reason the bill needs significant review to ensure we get it right.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Mr. Speaker, on that particular point, I would remind the member opposite that the legislation before us today went through a lengthy process of having all forms of consultations with many different stakeholders, industry leaders and even our standing committee, which has also incorporated many thoughts within the legislation.

I have heard that in the last two years information on the Internet has almost doubled. We can only imagine what it will be two or three years from now. This type of legislation is badly needed and it is a good starting point at the very least. Would the member not agree?

[James Cumming, Conservative, Edmonton Centre, AB]

Mr. Speaker, absolutely, it is valuable, but it really raises the question about why the Liberals would prorogue Parliament. Why would we not get on with these things? This is the kind of legislation that has been delayed. The government has been studying it. It is one thing to take consultation before developing legislation, but it one's interpretation of what was heard from the consultation. Until we actually hear from people on what they think, now that they see this legislation in writing, we cannot necessarily determine if it will get to the goals to which we aspire.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Mr. Speaker, another concern I hear from Canadians is about threats to their privacy from foreign actors, perhaps foreign state actors, and the need for the government to respond to that threat.

Does the member have a comment on how the legislation would impact concerns about foreign threats to our privacy?

[James Cumming, Conservative, Edmonton Centre, AB]

Mr. Speaker, there are no specifics in this particular act that would deal with that directly. That is all the more reason this particular piece of legislation needs more study.

The House resumed consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Greg McLean, Conservative, Calgary Centre, AB]

Mr. Speaker, today, I rise to give my input on Bill C-11, the digital charter implementation bill. I am happy to give this input. It is a timely bill for Canadians because this bill is about access to people's information and, more important, how that information is monetized by others. At a time when big corporations around the world are earning billions of dollars very quickly from information, getting in front of this issue right now for Canadians is very important.

What is being sold? Canadian information is being sold. What do Canadians privately own of their own data? This is the question that should be addressed in this bill. The converse of this, of course, is the targeted marketing and what Canadians get from the fact that they are giving away their information so they are getting back more services that might be tailor-made to them. It is one of those areas where the intent of Canadians not to give away their data and the result of that data that they willingly gave away, in many instances can be very contradictory. Let us tell Canadians first, as my colleague said here earlier, that they are the product.

Phones are listening to us. Computers are listening to us. Sometimes, computers are watching us. Sometimes, when my sons at home have Siri on, they say, “Siri, turn on”. Siri comes on and I tell them, “Siri was listening the whole time because it just turned on when you told it to turn on.” A lot of information is being culled. We do not know which of that is resting with us, and which of that is public information to be monetized by somebody else.

When I read this bill, I saw a bureaucratic solution designed by bureaucrats for use by bureaucrats, with what will be minor effect for the Canadian population in general. As much as we would like to make sure that we actually do deal with the issue around Canadians' private information that is provided online, we do need to make sure that it applies consistently across our country. It is a bubble created by a bureaucracy, and that bubble is lacking any consequences for mistakes and those mistakes will happen within the bureaucracies of the Government of Canada. In essence, from the Government of Canada's level, everything in this bill shows a complete lack of accountability for the government about how it might misplace or misuse Canadians' data.

I recall, years ago, the government's approach to what was the no-call list. There was a lot of telemarketing going on at the time and the government came out with a solution. If people registered their phone number it would ensure they did not receive telemarketing. We all jumped on that because on our land lines at the time we were getting a lot of telemarketing. When that registration came up, of course my land line was registered and it said to put in my cellphone number too. I put in my cellphone number, and the next day I started receiving telemarketing on my cellphone where I never had before. What apparently happened is the Canadian government's site had been hacked and all that information was sold to telemarketers. It is a shame because it got no money for it. My information was given away for free and a whole bunch of telemarketers got something from the Government of Canada that was literally stolen from Canadians. Therefore, my data was somebody else's, without my consent, as a result of my contribution to the Government of Canada.

Consumer pricing protection is something that would fall in the same type of realm. How do we make the Government of Canada accountable for what might happen with the data that we willingly give the Government of Canada? Will there be fines? Do we actually tell the Government of Canada that if it does not protect this information the Canadian government is going to fine the Canadian government and therefore the taxpayers are going to have to contribute to the government's fining itself? It is a bit of an around-the-world kind of trip, much like quantitative easing.

The problem is, who has this information about me? I do not know, but the party I am forced to disclose the most information to, that I know about, is the Government of Canada.

Let us discuss how stopping that government body in charge of the information I provide is mishandled. That would be the Canada Revenue Agency more than anybody else. It has my financial information, all kinds of dates and my social insurance number. Frankly, having dealt with it for years, it is a disaster of an organization. It has the wrong information. It processes information badly. It is the worst organization to try and fix bad information. That is the Canadian government.

Let us look at what happened in the last handful of months here with the CERB. Data was pilfered and Canadian payments during a pandemic were misdirected. How much of the $400 billion spent is legitimate and how much is as a result of data hacks that went to the wrong entities? Canadians are paying for these mistakes. Canadians are paying now and Canadians are going to continue paying for generations.

The legislation looks like it is designed for large organizations. Let us start with banks. Banks are another organization that we provide a lot of information to and they have a lot of information about us because they handle our financial information. They know how much we are worth, they know how much we have on deposit and they know how much we owe on our mortgages. They are pretty deep as far as what they understand about us.

There are all kinds of small businesses here, as well, that we need to apply. I want to read from this legislation something that should scare any small business person. This is about privacy management programs as required under this legislation. It states:

Every organization must implement a privacy management program that includes the organization's policies, practices and procedures

It further states:

the organization must take into account the volume and sensitivity of the personal information under its control.

What does that mean and how do we interpret that? Further, an organization:

must ensure, by contract or otherwise, that the service provider provides substantially the same protection

They have to ensure something nebulous is provided by their service provider when forwarding information.

Let us get on the ground here. Someone can walk into a pharmacy and that pharmacy wants the Alberta health care number, which is private government information. The retailers want that information so they can continue to track certain things someone does. They know how much of a person's spending they have and they know how much they can market other products to that person if getting some kind of prescription. Government data is quickly translating over into retail data. That is not exactly something we want to provide.

I will go further here because seniors are the people most affected by this. There are so many seniors who are bearing the brunt of the pandemic. There are issues we go through as we age, including financial institutions, insurance companies and all service provides. Many take advantage of seniors in many respects because things get very complex. We want to make sure our seniors are taken care of in a system that continuously evolves, advances and gets more complex. That is something this legislation should take care of more than anything else.

I do not like being just critical. There are also good things in this legislation and I am going to point them out. The purposes of this legislation are that an organization must determine:

each of the purposes for which the information is to be collected, used or disclosed and record those purposes.

The information for consent is also required. Forms of consent are also defined within. The withdrawal of consent is there, as is the disclosure to cease that actual consent.

Another good thing is there is a period for retention and disposal of data that we provide organizations. An organization must not retain personal information for a period longer than necessary. These are very good advances in the legislation. I thank the drafters of the legislation for that.

I have questions on some of the other parts of this legislation as well. On the transfer of information to service providers, organizations may transfer an individual's information to a service provider without the client's knowledge or consent. They would still be monetizing data that gets collected by one retailer or provider and—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

Unfortunately, time is up. I have been giving the member a bit of leeway.

The hon. parliamentary secretary to the government House leader.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, I am encouraged that the Conservative Party has seen the value of the legislation to the extent that it wants the bill to go to committee, at which I anticipate amendments will be brought forward.

Could the member provide further thought about the implications that have been suggested with respect to the Government of Canada. Does he feel there needs to be specific amendments related to the Government of Canada? Does he want the Privacy Commissioner to do more? What specifically is he thinking about? He referenced programs like the CERB and so forth.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, there are significant penalties in the bill, such as $20-million, $25-million or $30-million fines or 3%, 4% or 5% of global revenue from an organization. These are going to be pretty significant organizations if we are talking about global revenue. To this point in time, I have not seen how the government calculates global revenue, but I am curious. These types of things do not apply to ma and pa shops and people on the ground collecting information. It is geared toward large organizations.

A question arises from that. We are talking 3% or 5% of global revenue that would flow to the Government of Canada for a transgression as opposed to an individual who lost data. Who still owns the data would be the big question.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I would like to ask the member to present his conclusion. I would like to give him that opportunity, so he can tell us more about the enforcement powers he would give the Privacy Commissioner of Canada.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, I have no specific recommendations on that topic at this time. However, I thank my colleague from Quebec for his question.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, I appreciate some of the thoughtful things the member brought forward about small business, but also, like me, he has raised serious concerns about big banks and how they have not done their part during the COVID crisis.

The Conservatives, like the New Democrats, have been rightly concerned about privacy, especially when the COVID-19 app rolled out and what it meant for privacy. The Conservatives have asked tough questions of government, like we have, that concern privacy remaining ineffective. Could the member talk about how there is no need for a trade-off between privacy rights and other priorities?

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, when we talk about a trade-off, we talk about enforcement more than anything else. If we think about banks, which people often think about when they come to a conclusion about all the disclosure, particularly financial disclosure, they have been under compliance regimes for decades. In effect, when we get down to the ground and the people fulfilling those compliance regimes, we find that it gets watered down to the point where they do not understand those compliance regimes.

Therefore, something that happens at a high bureaucratic level does not necessarily get translated down to the customer level. Getting a real piece of legislation like this down to the level of the clerk and the customer is a monumental task and will not happen overnight.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

We have time for a brief question.

The hon. member for Willowdale.

[Ali Ehsassi, Liberal, Parliamentary Secretary to the Minister of Innovation]

Madam Speaker, I was listening very intently and I am grateful the member has acknowledged that the bill has great improvements and would allow Canadians to feel more secure.

When it comes to the role of government, would the member not agree with me that the Privacy Act does apply to the government that may have some information on Canadians? Obviously that regime is robust—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I do have to allow the member to answer. We are running out of time. When I say a brief question, I would ask members not to provide a speech.

The hon. member for Calgary Centre, a brief answer, please.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, what I saw in the legislation did not indicate any penalties to the government for citizens whose privacy had been breached. I think for most Canadians, their number one provision of data is to the government, the party they trust the most. That is the party that should probably be the most liable to Canadians for any breach of data, yet there is nothing in the legislation that says that the government owes this duty of trust to Canadians.

[Francesco Sorbara, Liberal, Parliamentary Secretary to the Minister of National Revenue]

Madam Speaker, I will be sharing my time with my colleague, the hon. member for Pontiac.

I am pleased to rise today to speak about the digital charter implementation act, 2020.

Digital technology is changing our economy and our society. Data is now a resource that companies can use to be more productive, to develop better products and services, which has unleashed a digital revolution around the world and which is even more evident during this time of COVID-19.

At the same time, the rapid growth of data-driven industries and technologies is opening the doors to the potential of new and innovative uses of data to support the public good. Data drives the development of many of the algorithms and protected models that are key to our understanding of societal challenges. Examples include the use of data to support sound public health outcomes; enable smart city technologies, such as dynamic traffic management; and promote greater energy efficiency and sustainability through smart grid technologies.

In Canada, public discussions around socially beneficial uses of data have focused on the emerging concept of the smart city in light of waterfront Toronto development proposals and other smart city initiatives considered by federal, provincial, territorial and municipal governments.

The COVID-19 pandemic has recentred the discussion on the role of private sector data and innovation in supporting public health objectives. We are witnessing the central role that data is playing in managing the pandemic. Not only is data critical for tracking current outbreaks or predicting future outbreaks, it has also been used to inform how our health professionals manage critical supplies and ensure they are deployed where they are most needed.

While data has proven to be of vital importance, stakeholders have identified the need for greater clarity around the legal frameworks governing data sharing between businesses and public sector institutions in the context of smart cities and public health.

At the same time, Canadians' concerns over the protection of privacy and democratic responsibility underscore the importance of defining the conditions necessary to establish a certain level of confidence in any new framework. Data sharing can lead to innovative solutions that benefit society.

However, Canadians need assurance that their privacy will be respected and that their data will not be misused. That is why the act to enact the consumer privacy protection act introduces a clear framework for privacy protection in data sharing for socially beneficial purposes.

Under Bill C-11, organizations will also be obliged to obtain consent before disclosing personal information to other organizations. This is in line with the existing act and with most of the legislation on privacy protection in the private sector.

However, in order to support responsible innovation, the bill makes one exception that will allow private sector organizations to disclose de-identified information to certain types of Canadian public institutions for socially beneficial purposes, without consent. This guarantees that businesses will be given the opportunity to participate in public sector initiatives that use data to contribute to the public good.

In addition, by abiding by this framework, private sector organizations can take part in these data sharing activities with full confidence that they are complying with the bill. At the same time, the bill underscores the importance of oversight by democratically responsible public authorities.

As I mentioned, information that is disclosed in this manner would have to be de-identified, ensuring that individuals' privacy is completely protected. What is more, the act would prohibit using that information later to try to reidentify the individual. This prohibition would be tied to significant fines.

This framework would allow Canadians to participate in initiatives directed at socially beneficial purposes without compromising their privacy. It would also ensure that Canadians benefit from the full power of data to create better solutions to some of the most complex policy challenges of our time.

The scope of socially beneficial purposes would focus on areas of public interest that provide broad public benefits supported by use cases and lessons learned that have been identified through years of engagement between government, business stakeholders and civil society organizations.

For example, ride-sharing and transportation service companies could potentially disclose de-identified aggregate data on the movement of their users to municipal authorities as modelling traffic patterns to help improve traffic flow, plan for better public transit initiatives and to improve road user safety.

The law would set clear parameters on which public institutions could receive information under the new consent exception, such as health care bodies, post-secondary institutions, public libraries and other public institutions or private organizations with the mandate to carry out a socially beneficial purpose. Many of these public institutions already have robust data governance systems in place to ensure the integrity of information and protection of privacy and would be ready to take on new responsibilities that would be in the public interest.

The framework for socially beneficial purposes would also cover situations where different levels of government direct public institutions or certain private sector partners to carry out data initiatives. As highlighted in the reports of our colleagues on the policy implications of connected and automated vehicles, this type of public-private sharing of information would be critical to ensuring the safety and security of technologies that would bring incredible benefits to all Canadians.

The approach proposed in the bill would ensure that the law would be adaptable as new use cases emerge and pave the way for innovative new uses of data that could provide broad public benefit while retaining trust and accountability.

Canadians can also rest assured that the new act will protect their information before and after they communicate with these institutions. All personal information transferred will first be de-identified, which will ensure that privacy is protected in these data sharing activities. The consumer privacy protection act also contains clear rules that will prevent the identification of this information, as well as severe penalties for organizations that break these rules.

The framework for socially beneficial purposes will allow innovative Canadian businesses and public organizations to take part in resolving the greatest social challenges in areas such as health and environmental protection. This could improve research on the pandemic, enhance environmental sustainability and conservation efforts, and make our roads safer for users.

These actions will be based on clear democratic responsibility and the protection of Canadians' privacy, and will maintain the flexibility needed for future innovative uses of data for socially beneficial purposes.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Madam Speaker, I thank my colleague and friend from Vaughan—Woodbridge. I am very happy to see that his French is getting better every month.

Here is the full title of Bill C-11: an act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other acts.

It is a long title, and I would like to ask my colleague a question. In connection with this bill, does he think his government needs to take rapid, if not immediate, action to stop fraud and identity theft?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I thank the member for Rivière-des-Mille-Îles for his question.

COVID-19 has brought many things to the forefront, and data protection and identity protection are first and foremost. What Bill C-11 brings forth is the idea of consent and also the idea of data destruction. If someone is moving their information from one provider to another, they would be able to indicate to the first provider that they wished to have their data and personal information destroyed so it would not be leaked or hacked.

There are several protections built into this. Consent is one of them, and I am happy to see this. I am happy to see the update to a number of laws within Bill C-11 for the protection of data and information for all Canadians from coast to coast to coast.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, we know that since the government was elected in 2015 tech giants have tripled their lobbying efforts. Google and Facebook account for half of the increase in terms of the lobbying efforts. We know privacy rights are an important part of life, especially in the digital age. However, when they are violated, individuals need to be compensated.

During the government's time in office, there have been many data breaches, including at Equifax. In the United States, victims of the Equifax data breach were compensated $425 million as part of the settlement. In Canada, for the same breach, consumers were not awarded anything.

This bill has no provisions to take notice of settlements in the United States to ensure there is parity in the treatment of victims on either side of the border. Should this bill be amended to make sure Canadians are treated equally for the same violation that is happening in the United States?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I hope to see Bill C-11 come to committee in an appropriate fashion. We are having a vigorous debate here in the House on the merits of the bill, and when it comes to committee suggestions can be put forward.

What I am very happy to see in the current form of the bill is that we would have some of the highest fines in the G7 under the CPPA, which would be introduced with this bill and ensure organizations are maintaining and controlling the data of Canadians in an appropriate and safe manner. It is great to see the bill has highlighted the fines and penalties that could be instituted on organizations if they fail to do so.

[Paul Manly, Green, Nanaimo—Ladysmith, BC]

Madam Speaker, there are much-needed updates to the privacy legislation in this bill. In particular, I like the right to erasure, which would allow consumers to demand that organizations delete information about them.

The Greens believe this privacy legislation should apply to political parties, as it does in the B.C. legislation. I am wondering whether the hon. member would support an amendment to that effect.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I hope to see this legislation brought forth to, I believe, the ethics committee, where it would be sent from the House and we would see a vigorous debate on the bill.

I am very happy that for the first time since 2001, when PIPEDA was introduced, we are seeing the modernization of our privacy act, if I can use those terms. It is great to see because we know data, technology and the importance of data have grown exponentially throughout the years and even more so in our daily lives. We need to ensure laws are updated and revamped to protect Canadians. That is what we are doing with Bill C-11. I will be happy to see it go to committee, and as a member of that committee I will be involved in that vigorous debate.

[William Amos, Liberal, Parliamentary Secretary to the Minister of Innovation]

Madam Speaker, I am pleased to rise today to speak to this Bill on consumer privacy protection.

The bill, which will replace the Personal Information Protection and Electronic Documents Act, makes consumer protection a top priority to ensure that Canadians have confidence in the digital marketplace and trust that their personal data will be managed responsibly by the private sector.

It is so important, in an era of global online commerce, for Canada to be putting in place a privacy standard that offers consumers increased control over their personal information as they participate in the modern digital marketplace. The act also includes several important changes to enable and support innovation in an increasingly digital marketplace.

I am going to speak today about how our government is supporting business and protecting Canadians' privacy as they actively participate in the digital economy. Our government is working to establish an enhanced privacy framework where consumer protection is strengthened and where businesses are supported in their efforts to innovate in a rapidly changing digital landscape.

Bill C-11 marks all sorts of important changes to the privacy framework for Canadians, and it is long overdue. It sets out enhanced measures for Canadians to ensure that their personal information is protected, and it establishes new roles and new mechanisms for industry in a way that promotes innovation in a digital world.

We understand the need to ensure that Canadians’ privacy is protected. We must also ensure that Canadian businesses have access to the support they need to grow and compete in a global marketplace based on digital technologies and data.

These changes are taking place at a time of great upheaval, namely the rapid evolution of digital technologies. They are also taking place at a critical time for businesses, which must adapt and innovate in a digital world.

The current pandemic has made digital solutions essential to everyday life. At a time when physical distancing is so important, consumers want solutions that give them access to the products and services they need. Moreover, companies must continue to do business and develop. Digital solutions have helped many of them stay afloat.

However, we all recognize that new technologies provide businesses with huge amounts of personal information, the kind of data they need to make business decisions and offer clients new services.

We know that innovation and growth are critical, but we have to stand up for Canadians and ensure that this innovation in a digital world happens in a responsible way. Today I am going to outline some of the key elements of Bill C-11 that enable responsible innovation: innovation that is done right in a Canadian way.

One of the goals of our current law, PIPEDA, which Bill C-11 would supersede, has been ensuring that companies are able to handle personal information to meet their own legitimate business ends. The other is to ensure that companies do this in a privacy-protective way. To achieve this dual objective, PIPEDA's framework is principles-based and technology-neutral. The framework ensures that this law continues to apply, even as technology has undergone rapid change.

Bill C-11, the CPPA, retains this approach, continuing the success of a flexible and adaptive privacy law in the Canadian private sector context, but we have to recognize that “the times they are a-changin'.” To better reflect the realities of the digital economy, and the continued emergence of new big-data technologies and artificial intelligence, the CPPA would allow for a number of provisions that support industry going forward.

The bill would create a level playing field for companies of all sizes by reducing administrative burdens, which is critical for the vast number of small and medium-sized enterprises in Canada. It would introduce a new framework for personal information that is de-identified. It would establish new mechanisms, such as codes of practice and certification, with independent oversight by the office of the Privacy Commissioner, and it would address data for research purposes or purposes deemed to be socially beneficial.

I will outline how the bill would do all this.

The bill before us today includes a new exception to the requirement for consent regarding certain business activities. The objective is to allow Canadians to give meaningful consent by limiting it to specific activities that involve real choice. This is essential to prevent the use of blanket consent and lengthy contracts that—let us be honest—no one reads.

This will also reduce the administrative burden on businesses in cases where an individual’s consent may be less relevant. Let's consider the example of a third-party service provider that ships various goods. The customer wants the goods shipped, and the business should be able to meet that need. The bill should not add to the burden of providing that service.

The bill would provide for new regulations to be developed for prescribed business activities and would introduce the concept of legitimate interests in Canada's privacy framework. This is something that industry has asked for, we have consulted about and the government has answered in Bill C-11.

Second, we are better defining and clarifying how companies are to handle de-identified personal information: personal information that has been processed and altered to prevent any identification of a particular individual. The bill would allow organizations to de-identify personal information and use it for new research and development purposes. Businesses must undertake research and development to improve their products and offer customers the new and leading-edge services they are looking for. This provision would give businesses the flexibility they need to use de-identified data for these purposes, which would add value for customers and businesses alike.

The law would also allow organizations to use data for purposes of serving the public good, specifically by allowing companies to disclose de-identified data to public entities. Such disclosures would only be allowed when the personal information could not be traced back to particular individuals and when there was a socially beneficial purpose; that is, a purpose related to health, public infrastructure or even environmental protection. This kind of provision would protect individuals while ensuring we use all the tools at our disposal to address the biggest challenges of our time.

Included in the bill is a clear set of parameters for institutions, such as hospitals, universities and even libraries that would seek to receive personal information for a socially beneficial purpose. These parameters would help clarify the rules of the road in new and important fields.

These provisions would also permit organizations to share more data in a trustworthy fashion. They would allow the private sector to work with different levels of government and public institutions to carry out data-based initiatives in a privacy-protecting fashion. By taking this approach, the bill would accommodate emerging situations where collaboration between public and private sectors could have broad public benefits, while at the same time maintaining the trust and accountability that Canadians demand and deserve.

Third, the bill would provide the framework for codes of practice so businesses, especially those in specific industries or sectors of the economy, could proactively demonstrate compliance with the law. The bill would do this by introducing co-regulatory mechanisms into Canada's privacy landscape that would have businesses and the Privacy Commissioner working together. For example, there could be a code for de-identification.

I recognize my time is running short so I will simply mention that I would open the door to talking about the process the bill would provide for certification and certification bodies. I think this would be a very important provision that businesses across Canada would use regularly and that the Privacy Commissioner would have the opportunity to work on with businesses.

With that, I am thankful for the opportunity to speak to Bill C-11. I look forward to taking the questions of my hon. colleagues.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I thank my colleague for his speech.

Bill C-11 seems to apply only to private businesses, not to the federal government. We all saw many examples of this during the pandemic. I imagine that all members were informed of the cases of victims of fraud or identity theft reported to their riding offices.

It therefore seems to me that this bill could also be applied to the federal government. Before imposing these sorts of measures, which I agree are desperately needed, on private businesses, perhaps the government should have a look in its own backyard.

I would like my colleague to tell me whether his government plans to do that.

[William Amos, Liberal, Pontiac, QC]

Madam Speaker, I thank my colleague for her question.

Bill C-11 certainly focuses more on commercial activities. That is where there is a real interest, and it is the stakeholders in that area that we have been consulting for several months, and even years, to find solutions that will not only protect consumers but also benefit businesses and SME development across Canada.

That said, with regard to the federal government's work on modernization and the protection of individuals, we have already included protections in the Elections Modernization Act during the previous Parliament and so I think we have made progress on both sides. This time, we are focusing on commercial activities.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, I thank my colleague for his speech.

My question is a fundamental one, to my mind. Our data and personal information are invaluable to the web giants. They use this information for marketing and targeted advertising. They use it to direct users to websites or places where they can purchase and consume products. One of the fundamental aspects of that process is that companies can exchange and sell personal data, even if that data is separated from the person's information and packaged in a set of metadata. Companies rely heavily on selling and exchanging personal data.

Will the government commit to putting an end to this practice, which turns consumers into mere numbers, into merchandise to be exchanged by big companies?

[William Amos, Liberal, Pontiac, QC]

Madam Speaker, I thank my esteemed colleague from Rosemont.

We are well aware that Canadian consumers want more protections. They want to consent to the use of their information, and they want that consent to be informed and to be freely and clearly given. That desire for better control over their personal information is central to this bill. It is very important that people have the right to request that their personal information be destroyed. There are also circumstances where the consumer may want to transfer their data to other organizations.

There are several organizations, and I think our government has tried to find a middle ground and balance public and private interests in this very complex area. We will be pleased to discuss potential amendments to this bill in committee.

[Lloyd Longfield, Liberal, Guelph, ON]

Madam Speaker, when Canada's anti-spam legislation was first brought forward, I was president of a chamber of commerce. I was dealing with the issues, in business, of all the requirements and hurdles that had to be dealt with. They were designed around email spam. We are now into the next generation of spam, and information is shared digitally in different ways other than email.

Could the member describe how this legislation builds on previous legislation such as Canada's anti-spam legislation?

[William Amos, Liberal, Pontiac, QC]

Madam Speaker, that is a great question because privacy law needs to evolve. The spam issue came from an email generation. Now we are into the big data and social media generation. It all fundamentally starts with a better consent regime. It goes to transparency. It goes to a more informed consumer of data.

I am looking forward to the improvements to this privacy regime as the bill passes through Parliament.

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Madam Speaker, I would like to inform you that I will be sharing my time with the hon. member for Lethbridge.

Today we are discussing Bill C-11, an act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other acts, which received first reading in the House on November 17.

I am aware of the importance of the issue addressed in the bill. It is 2020. Who would have thought that, in 2020, we would have to come to grips with technology in such a hurry because of a pandemic?

Technology was already evolving at a fast pace, but I can say that we have had to increase our knowledge at great speed. If someone had asked me three months ago if I was comfortable with teleconferencing, I would have said no, but today it is an everyday occurrence. It is important to address this issue.

I would like to remind the House that I represent the fantastic riding of Portneuf—Jacques-Cartier in Quebec. In 2019, the personal data of 2.9 million Desjardins members were leaked. They were victims of identity theft. Their data were resold to people who wanted to use them to do business in the financial sector. Although the leak did not involve banking information, it still exposed the affected customers to identity theft.

On June 20, 2019, Desjardins revealed that the personal information of 40% of its members had been illegally shared outside the organization by an employee, who had since been fired, of course. On July 8, Quebec's Commission d'accès à l'information and the Office of the Privacy Commissioner of Canada announced that they were launching investigations. On July 15, Desjardins broadened its identity theft protection and offered protection to more than 4.2 million individual members and 300,000 corporate members. On November 1, it announced that all 4.2 million individual members had been affected by the data leak. About 173 of the 350,000 corporate members were also affected.

I will reveal that I am a Desjardins customer and that I was part of this group. Even before the pandemic, digital transactions were commonplace. The current context is speeding things up.

Today's bill comes from a good place, because we do need to keep up with the times, but will we be able to apply and enforce it? Are we not putting the cart before the horse? That is the problem with this bill.

Examples in my riding make me wonder. The government is trying to bring in legislation that would impose astronomical fines on non-compliant companies. The government is puffing out its chest, bragging that our country will be giving the biggest, juiciest, harshest and most lucrative fines, but will we be able to collect?

What do we want? We want to protect Canadians and provide them with the necessary tools. Would it not make more sense to invest in a service that gives these tools to our businesses, so they can help Canadians and consumers?

I have mixed feelings about this bill. It obviously comes from a good place, but are we taking the best possible measures to ensure solutions for the coming days, weeks and months? We need something concrete.

My constituents often tell me that I must find it hard to be a parliamentarian, because I am pragmatic. We need concrete solutions. The goal is laudable, but are we taking the right measures? I am not sure.

I hear from many businesses and citizens. They are still calling me to tell me they are having problems with Phoenix. They are federal employees who are having problems with their pay because of Phoenix. Phoenix is a problem that was never fixed. It has been around since the Liberal government's first term in 2015. It is now 2020, and nothing has been resolved.

I agree that we need to enact a law to protect personal information, but there may be other priorities. We are seeing it now with the Canada Revenue Agency. I have constituents calling my office to ask if I can help them, because the CRA is claiming it sent them money that they never received, which is a sign that they are victims of fraud and their identity has been stolen.

Should we be enacting a law to punish large companies when we cannot even solve the problem in our own backyard? I am aware of the importance of this bill, but I wonder whether we are taking the right measures.

I mentioned this earlier, but it is worth repeating: I am the member for Portneuf—Jacques-Cartier, which is in the province of Quebec. Quebec has a program to help people who have a baby: The mother or the father is entitled to parental leave.

Here is another example that boggles the mind. One of my constituents meets all of the EI eligibility criteria, but his claim is being reviewed because there seems to be some problem factoring in the parental leave he took in 2019 and the Canada child benefit claim he submitted during the pandemic interfered with processing his claim.

That only happens in Quebec. The Liberal government seems unaware of the existence of provincial programs, and its Canada-wide employment insurance system prevents it from fixing the problem. In this case, is it because it is a Quebecker? Is it because he is a father? I am asking because I want to stress the importance of finding concrete solutions to systems before we consider a bill that will punish big corporations.

I completely agree that those who are at fault should be held responsible, should accept the consequences and should pay if they break the law. I completely agree with my colleagues on that point. However, I wanted to show how bizarre this situation is, a situation that puzzles me.

Clearly, we need to reflect on this and update the legislation, but is the version being introduced today the best one? I think we need to send this bill to committee for further study and consultation with specialists and experts. We did actually notice that there is only one expert regarding the tribunal.

I do not pretend to be such an expert. I am not computer savvy and, as I said six months or a year ago, I was unaware of my skills and adaptability to technology. Many members here in Parliament have managed to learn quickly, at lightning speed.

That is why we need to think about this bill and, as I said in my speech, not put the cart before the horse. We need to do things right to make sure that the bill really meets Canadians' needs. At the end of the day, the goal is the same: to protect society's interests and ensure that Canadians are respected and protected. We are all working toward this goal.

I will now happily answer my colleagues' questions. On that note, let us be vigilant, because fraud is always lurking around the corner.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, big corporate data breaches are becoming more and more common. Canadians are concerned about how big tech giants, like Facebook and others, are using their data.

Privacy rights are so important in this day and age. We have to be clear on where we stand. We need stronger policies than some of the policies presented in this bill on compensation, enforcement and data collection.

Does the member agree that we should not be making it easier for the Facebooks and the Googles of the world to use Canadians' personal information in ways that have nothing to do with their services, in the guise of helping small business? Is that really the right place to stand?

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Madam Speaker, I would like to thank my colleague from Victoria for her question, which is very relevant.

I would not even break it down by category. As I mentioned at the end of my presentation, Canadians must be protected. We could include the banking sector, e-commerce companies, Facebook and all organizations. I say organizations, because there is also fraud in other organizations. That is why I am taking this opportunity to say that the government should ban Huawei from 5G. I am talking about organizations and all businesses that could benefit from exploiting Canadians.

My colleague is perfectly correct: We need a stronger act to protect Canadians, and it must cover all users and possible scammers.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, it is important to recognize what the legislation is doing. At the end of the day, we can take a look at our digital environment and the degree to which there has been a explosion of activity on the Internet, and we can see that in the last couple of years we have probably seen more data put into the Internet than we saw in the previous 10 years. One can only imagine what it will be like two years from now.

It appears as if all parties want to see the bill sent to committee. Does the member have some specific amendments today that he would like to see made to the legislation, or is he more content to wait until it gets to committee and then have the discussion at that point in time?

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Madam Speaker, I would like to thank my colleague, the Parliamentary Secretary to the Leader of the Government in the House of Commons.

In my speech, I raised certain questions. I think that we must act and that the intent of the legislation is positive. Having said that, I will not pretend to present any facts today. I want to hear from computer experts in the field. I think that we need to send this bill to committee in order to study it and to get it right.

The bottom line of my speech today is that we need to get it right in order to protect Canadians in the technological world. That is how I would put it. As my colleague said, we need to take a comprehensive look at the bill.

I fully agree with him; we need to take a comprehensive look at it in order to protect Canadians.

[Kristina Michaud, Bloc, Avignon—La Mitis—Matane—Matapédia, QC]

Madam Speaker, I thank my colleague for his speech.

A bill on the same subject is currently working its way through the Quebec National Assembly: Bill 64. It provides fairly significant penalties for organizations that fail to meet their privacy obligations.

Does my hon. colleague think that this bill is strong enough in terms of penalties?

[Joël Godin, Conservative, Portneuf—Jacques-Cartier, QC]

Madam Speaker, I thank my hon. colleague from Avignon—La Mitis—Matane—Matapédia.

I would rather not see stiffer penalties and fines as a way to get results. I think that we have to be smart and strategic about it. We need to think carefully and pass legislation that will yield concrete results and protect Canadians.

[Rachael Thomas, Conservative, Lethbridge, AB]

Madam Speaker, citizens are increasingly concerned with the information that is being collected about them, how that information is stored and how that information is used. When they like or dislike something on Facebook, where is that information stored and how is it utilized? When the bank asks them three important questions, to which they provide a security answer, where is that information stored and who has access to it?

As the digital world has advanced and expanded exponentially, regulations and oversight, unfortunately, have been rather lax. Now Canada is in a position where it needs to play catch-up. Like an untamed beast, bad actors have been given access to our information and now we are having to pull back in an effort to protect Canadians.

The digital charter implementation act, which seeks to protect the country's aging privacy regime or bring it up to international standards, is much needed and I commend the government for that. However, there are a number of concerns I wish to address as we bring this to a vote. Of course, my hope is that appropriate amendments are made once this gets to the committee stage.

Technology provides us with incredible opportunities for connectivity, influence and prosperity. However, in the midst of all of these positive components, there is also a dark side. By not seriously enforcing transparency and security measures, we run the risk of perpetuating our nation's technological vulnerabilities and we fail to protect our citizens' privacy.

I want to commend the government for acting on this file and crafting legislation that attempts to right some of these wrongs. It is unfortunate, however, that it took five years to bring this time-sensitive bill forward, but it is definitely a step in the right direction. The Privacy Commissioner has been calling for many of these changes, but the Privacy Commissioner would also urge the House to go further. It is no secret that Canada is lagging behind other countries and we need to get going.

If we want Canada to be a leader in technology and artificial intelligence, it is important that we invest the time and resources to get this right. While some measures in the bill meet international standards, others are lacking. Therefore, it is absolutely vital that we do not just pass legislation that checks off a few boxes and makes a few provisions, and then pat ourselves on the back as if we accomplished something great. What we are dealing with is very complex, sometimes confusing and merits keen attention, as well as bringing all the experts to the table.

Jim Balsillie, the founder of Centre for International Governance Innovation and an expert in the realm of digital privacy, has rightfully flagged this for us. He has flagged the call for algorithmic transparency in the bill as something that is inadequate and ineffective in addressing the real problem. We do not just need transparency. He is saying that we need to go a step further. We also need full access to the information and an understanding of what it means, as well as teeth in the event that something needs to be done about it.

In order to better understand the problem, let me take one moment to talk about algorithms. In simple terms, an algorithm is a set of codified instructions followed by our computing devices, whether that is our smart phone or television, etc. Basically, it instructs the device or the site that we are on to do something that the creator would desire it to do in order to anticipate our digital decisions and to direct us to the places it would like to direct us to go.

We know that algorithms are being used especially on social media platforms to affect our shopping habits, as well as our human behaviour. They are used to evoke strong, primarily negative emotions from the platform user, which produce harmful results both mentally and emotionally. Algorithms determine what is shown on our Facebook timelines or Instagram feeds and the advertisements that come up on the pages we look at. Companies and organizations use patented algorithms to push their agendas, whether that is to boost sales or to elicit support for a specific cause. They study us, they follow us and they direct us.

As we navigate online, our behaviour is constantly monitored. The data is stored, commodified and then it is even monetized, often without our consent. That information is then used to manipulate and control future behaviours through other algorithms. This pattern is particularly harmful to young children, as well as young adults, who are susceptible to these tactics.

Algorithms are now using artificial intelligence, which means that they are in some ways scarier than ever. They can learn how to trigger negative emotions and keep the user online for hours upon hours by targeting them with enticing images, stories or videos, things that would be of interest to them, because, remember, these individuals have been preyed upon and studied for many years.

The legislation before the House would give Canadians a right to transparency, but it fails to provide a mechanism for action. It is like being able to see that someone is harming a child but not actually being able to take any action. Again, transparency is there, but what is the good of transparency if the wrong cannot be righted?

Robert Mazzolin is the chief cybersecurity strategist for the RHEA Group. He explained that legislators must insist that AI systems are made comprehensible to humans. In other words, make them understandable. He went on to say, “Enhanced transparency is a precondition for the acceptance of AI systems, particularly in mission-critical applications impacting life and death”. Algorithmic transparency is not enough. Canadians must be able to access not only the algorithms that are being used but what the code actually means. They must also be able to act when the algorithms are being used in a harmful manner.

Furthermore, when it comes to requesting information about the algorithms that are being used, the bill actually fails to legislate or give direction as to how the contact information for companies can be easily accessed. This might seem simple, but when was the last time members were able to just phone Google or contact it to inquire about something? It is not very easy. When was the last time members were able to get a hold of customer service at Facebook? Again, it is not very easy.

There is an opportunity within this legislation, a bare minimum within regulation, to tell companies where the information needs to be located and how it needs to be accessible to the Canadian public. For example, make it so that it has to be accessible on the home page, that it has to be size 12 font, that it has to be a certain type of font or that it has to be a certain colour of font. Make it so that the phone number, email and mailing address have to be listed. Make sure that we are caring for the consumer if this legislation is truly about Canadians.

If we want to keep children safe on their way to school, we do not just reduce speed limits in the area. We put in a crosswalk, lights, signs and crossing guards. We issue speeding tickets and we might even have police control. The objective here is to protect the kids, not just put up a speed limit sign. It is imperative that we take a very comprehensive approach to protecting Canadians' privacy, their digital safety and their security. It is not just about transparency. It is about so much more.

If the bill were to pass today, it would already be out of date. We are seriously behind in protecting Canadians' data, and foreign countries are certainly aware of that. By only addressing certain aspects of digital privacy and ignoring others, the government is leaving Canadians vulnerable and putting our national security at risk. AI technology is upending the international balance of power and shaping the geopolitical competition between nation-states. It would be naive for us to assume that foreign governments are not looking at Canada's vulnerabilities as an opportunity to upset information systems from within. This is extremely alarming and deserves for our attention.

For example, there is Huawei. Countries like China are seeking to obtain information superiority by acquiring massive amounts of data and using it to their advantage. The Chinese Communist Party has been pushing for greater civil-military fusion, as it calls it, which is evident in numerous sectors but especially in telecoms and data harvesting. The Chinese president has stated that AI, big data, cloud storage, cyberspace and quantum communications were among “the liveliest and most promising areas for civil-military fusion”.

It is perplexing then why this government has not yet taken steps to limit the impact that Huawei can have on our nation. In fact, we are the only country out of the Five Eyes alliance that has not limited Huawei or banned it altogether. This is perplexing and troubling.

The legislation is akin to building a security wall around a city, but only one section of the wall is built high enough to keep enemies out. Meanwhile, the rest of the wall is only built maybe a few feet high. If enemies are looking at the part of the wall that is actually built to the correct height, they are intimated by it and stay out, but the moment they take a peek around the corner and realize that the rest of the wall is only built a few feet high, they are in. That is what the legislation is like. It means well, but it is not nearly as comprehensive as it needs to be.

In closing, I am asking for an opportunity to work across party lines to address the concerns of Canadians to adequately serve their safety needs.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, I know that the member across the way has lots of concerns with this legislation. I certainly do. They are about the creation of a whole bunch of new categories for data exemption from those privacy protections. I am a bit concerned about that.

I am wondering if she could address the concerns that this giveaway to big tech giants, which the Liberals have been accused of being far too close to, are also worrying. What does she see as something that could fix that within the legislation?

[Rachael Thomas, Conservative, Lethbridge, AB]

Madam Speaker, I think one of the things that has come to our attention over the years is just how buddy-buddy the current government is with, let us say, Facebook. We know the rules are bent. We know that provisions are made. We see evidence of leniencies being granted, and at the end of the day the rules should be applied equally across the spectrum of organizations and businesses.

Certainly, there is a greater need for accountability within this piece of legislation. When it comes to exemptions, that must be thought through very carefully.

[Monique Pauzé, Bloc, Repentigny, QC]

Madam Speaker, in her speech, my colleague said that she had some suggestions to improve Bill C-11. This is also the case for the Bloc Québécois.

On our side, we are very concerned about the issue of identity theft. There are ways to verify someone's identity. In Europe, mechanisms have been put in place. Here, however, the banks have no such obligations and, if it costs too much, they do nothing. We would like to see stricter regulations for banks and greater transparency.

Does the hon. member agree with what we are calling for?

[Rachael Thomas, Conservative, Lethbridge, AB]

Madam Speaker, within the context of this bill, in which we are talking about the protection of privacy and the safety of Canadians, we are really talking about consumer rights and provisions.

When we are talking about identity theft and how our information is being used by organizations or businesses, of course the most stringent rules should be put in place. As I said in my speech, transparency must be granted. That is one thing, but the other is that, in addition to transparency, there has to be teeth.

If our information is being misused, then we must have the right to know that. We must also have the right to hold those organizations accountable for their misuse. As well, it is important to note that misuse is not just what they do with our data. It is also how they are managing it, in terms of keeping it secure.

That is exactly the hon. member's point, and it certainly deserves thorough thought.

[Rachel Bendayan, Liberal, Parliamentary Secretary to the Minister of Small Business]

Madam Speaker, I thank my colleague for her question.

One very interesting element of the bill we are debating is the potential for the legislation to cover artificial intelligence and algorithms, which are used by many companies, including Facebook and other such social networks. I am interested in my colleague's views on these algorithms and the applicable provisions.

[Rachael Thomas, Conservative, Lethbridge, AB]

Madam Speaker, the question was with regard to algorithms, which I went into quite extensively in my speech.

Again, I would certainly applaud the government for taking responsibility and putting within the bill the need for transparency around algorithms, but here is the deal: if, as a consumer or as a user, I ask for the algorithms that are being used when I am on a certain website, and those algorithms come back to me as numerous pages of scattered numbers and letters, what does that mean to me? What good is that to me?

Therefore, in this legislation, we actually need to make sure it is not just the transparency of the information being used and the algorithms being used. We also have to make it accessible to Canadians. They have to understand what is actually being done. They need transparency, and to know, when algorithms are being misused, if they will have the opportunity to take action and to seek justice.

This legislation falls short. It does not provide that for Canadians.

The House resumed consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Rachel Bendayan, Liberal, Parliamentary Secretary to the Minister of Small Business]

Madam Speaker, I will be sharing my time with my colleague from Egmont.

It is with great pleasure that I rise in the House today to speak to the consumer privacy protection act and explain why this reform is important for enhancing the protection of our personal information.

When we talk about consumers, we are talking about all of us. All Canadians deserve the peace of mind of knowing that their personal information is protected.

As the Privacy Commissioner of Canada has said, the pandemic has accelerated the digitization of our lives, which inevitably increases risks to our privacy and the security of our data. This has raised serious concerns about our personal freedoms, our societal values, the public good, and the compliance and oversight measures required to manage this public health crisis.

Clearly, this crisis has laid bare the need for a certain use of available data, including personal information. In this context, we have seen many different approaches around the world. Different countries have deployed an array of technologies to support their efforts.

In some cases, their approach has focused on collecting location data for contact tracing or population monitoring or even for tracking an individual's movements. In other cases, telecom service providers have given the government location data from their network. On that, let me make it clear that our approach, Canada's approach, does not use those types of technologies.

This federal government will always defend our privacy and our personal data. Many stakeholders and experts have noted the potential impacts on the right to privacy arising from technologies being used elsewhere around the world. We heard those concerns, and that is why our Canadian approach does not involve these types of technologies.

For example, in the case of the COVID Alert app, our government worked with a variety of partners to support public health efforts to limit the spread of the virus, while also making sure we protected Canadians' privacy. The application was designed with this very objective in mind. As we have said before, the app has no way of knowing one's location, name, address, contacts or other information. In fact, following a review of the app, the Office of the Privacy Commissioner fully supported it.

I hope that this dispels any lingering myths about the app, and as we are very much still in the midst of this pandemic with rising community cases throughout the country, I would like to take this moment to encourage everybody to download the COVID Alert app.

Bill C-11, before us today, would create a strong framework for the protection of personal information in the private sector. The new consumer privacy protection act would impose requirements for obtaining individuals' consent to collect and use their data. Consent must be granted prior to data collection, and consent forms must be written in plain language that absolutely everybody can understand.

While this is extremely important, I know from my own experience, the experience of my friends and speaking to my constituents, and surely this is the case for many Canadians across the country, that not everybody reads the disclosure and consent page before clicking “I agree”. That is why we have proposed in this bill to legislate that organizations can only seek consent for data that are strictly necessary for their purposes. They can collect credit card information if they are selling something; they can collect an address if they will be delivering something.

Critically, this bill also would further empower consumers. It would give us the unfettered right to ask what information has been collected about us, how it has been used, whether it has been shared, and whether it has been sold. We, as consumers, would have the right to access the information that an organization might have on us and request its immediate deletion.

Another groundbreaking provision involves AI and algorithmic transparency. We are all familiar with these algorithms which make predictions and recommendations with the aim of influencing and impacting our decisions. Whether our experience is seeing advertising on Facebook or Google, which, very strangely, resembles some searches we recently did, or recommendations of videos on YouTube, for example, Canadians are constantly being fed information and suggested purchases based on algorithms that we know very little about.

Without going on too much of a tangent, I watched a few weeks ago a documentary called The Social Dilemma. I imagine many of us in this House who are interested in the topic of privacy protection and the Internet are familiar with the documentary. Let me say it scared the you-know-what out of me.

This bill would make it mandatory for companies to provide answers and an explanation, upon request, about how any predictions or recommendations targeted toward us were obtained. Legislating that right, providing that opportunity for consumers, is itself a deterrent for companies seeking to make use of algorithms for nefarious purposes. This is a critical step forward.

This bill deals with a very complex issue for individuals and consumers and for businesses. It recognizes individuals' right to privacy as well as the need of organizations to collect, use or disclose personal information in the course of reasonable commercial activities.

Our privacy bill is flexible enough to allow companies to apply the general requirements to practices specific to their sector. However, I want to make it very clear that good intentions on the part of private-sector organizations are not enough.

We know that for the new protections included in the legislation to really be implemented, we need binding and effective mechanisms to protect the rights of Canadian consumers. That is why this bill includes serious penalties for those who try to get around it. We are talking about monetary penalties of up to $10 million, or 3% of global revenues, for large corporations that break the law. For more serious offences, fines up can go up to $25 million, or 5% of global revenues.

These measures would be among the toughest in the G7. Our government takes the privacy of Canadians very seriously, and the web giants must do the same. We have seen major innovations and digital solutions that not only serve the public interest, but also protect the privacy of our citizens.

The legislation would allow companies to innovate in a responsible manner and enable Canadians to have more control over their personal information. It is true that the digital environment presents many challenges, but we must not let that stop us. There are tremendous opportunities. Back home in Montreal, I am seeing the potential of AI and responsible data usage. I am thinking about Mila, Element AI, Hopper, AlayaCare and all the start-ups and small businesses that are opening every day in Mile End and Mile Ex. We must continue to encourage the development of this sector while ensuring that the public has confidence in the regulatory and legal framework governing these companies.

As legislators, we must give Canadians our assurance that their data is safe and their privacy is respected. This assurance is necessary not just to foster creativity and innovation, which are essential ingredients for building a strong economy, but also to give us all peace of mind.

[Alexis Brunelle-Duceppe, Bloc, Lac-Saint-Jean, QC]

Madam Speaker, I listened carefully to my hon. colleague's speech and I saw that the government did its homework by looking at what is being done elsewhere in the world and learning from the experience before legislating on this issue.

It is a good idea to see what other countries are doing wrong so as not to make the same mistakes, but it is also a good idea to look at what other countries are doing right. The Europeans implemented a whole set of regulations to force financial institutions to verify people's identity before authorizing transactions. That is missing from this bill, so we are failing to protect our constituents. I will repeat that we work for them. This does not protect them from fraud.

Does my hon. colleague not agree that this is a weakness of the bill?

[Rachel Bendayan, Liberal, Outremont, QC]

Madam Speaker, I think what we have before us is fairly comprehensive.

We do need to look at what is being done right elsewhere, but we have also created a whole framework. We have also created a tribunal where consumers can file complaints and appeal their case. I believe that what we are presenting today is quite substantial, but I am of course very open to looking at what other countries are doing if my colleague wants to present specific amendments in committee.

[Kenny Chiu, Conservative, Steveston—Richmond East, BC]

Madam Speaker, we have had a lot of time to talk about the current situation of privacy in Canada. As the member forPortneuf—Jacques-Cartier mentioned, there are many situations in Canada where privacy has already been a problem. I wonder what the member's thoughts are on this. We are like a sinking ship. We have many holes in the Canadian privacy ship. Meanwhile, the government is talking about a scheme that would make it perfect. Why not just plug the big holes, such as the infiltration by Russia, Iran, or even China through Huawei's 5G network? To me that is not the wisest way to handle our current situation.

[Rachel Bendayan, Liberal, Outremont, QC]

Madam Speaker, I did have the opportunity to rise on the Conservative motion with respect to Huawei. As I made clear at that time, there are no providers in Canada at the moment that are using Huawei's 5G infrastructure.

I would also take issue, perhaps, with the word “scheme”. What is presented here in the bill before the House is a very serious framework for the protection of personal information and data on behalf of all Canadians. It is certainly something that I am looking forward to debating more fully today and in the future. If there are specific amendments, as I said, I think we are open to them, but at its core, we have a very sound structure that we presenting in Bill C-11.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, when Canadians' privacy rights are violated, they should be compensated. We have already heard stories about consumers in the U.S. receiving compensation, when Canadians in the same circumstances received no compensation. I think that is a gap in this bill.

I am curious about going a step farther. I am wondering if the member could comment on the idea of consumers being compensated for the data that they are giving, and having more choice around which data and which personal information is going to these big web tech giants.

[Rachel Bendayan, Liberal, Outremont, QC]

Madam Speaker, I detailed, in my speech earlier, the very significant fines that companies would suffer for any contravention to this law.

I understand that what my colleague is asking for is compensation directly to consumers. As a former commercial litigator, I think there are serious issues with identifying what appropriate damages would ensue from what kinds of data breaches.

What I find so interesting about many of the provisions in this legislation is that it provides deterrence for companies not to engage in this behaviour. It would actually eliminate the behaviour that we want to discourage rather than compensating consumers after the fact.

The House resumed consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Bobby Morrissey, Liberal, Egmont, PE]

Madam Speaker, it is a pleasure for me to stand and resume debate on Bill C-11, now at second reading, on the consumer privacy protection act.

This act, which replaces private sector privacy protections under the Personal Information Protection and Electronic Documents Act, PIPEDA, places consumer protection at the forefront in order to ensure Canadians have confidence in the digital marketplace and can trust that businesses are handling their personal data responsibly.

It is important in an era of global online commerce for Canada to put in place a privacy standard that offers consumers increased control over their personal information as they participate in a modern digital marketplace. The act also includes important changes to enable and support innovation in an increasingly digital marketplace.

Today I will be speaking about how our government is supporting business and protecting Canadians' privacy as they actively participate in the digital economy. Our government is working to establish an enhanced privacy framework where consumer protection is strong and where businesses are supported in their efforts to innovate in a rapidly changing digital landscape.

Bill C-11 makes important changes to the privacy framework for Canadians. It sets out enhanced measures for Canadians to ensure their personal information is protected and it enables new rules and mechanisms for industry in a way that promotes innovation in a digital world.

We understand the need to ensure the privacy of Canadians is protected. There is also a need to ensure that Canadian businesses have the supports they need to grow and prosper in a global marketplace that runs on digital technologies and data. These changes come at a time of great change, not only in terms of rapid advances in digital technologies, but also at a time that is critical for business to adopt and innovate in a digital world.

The need for digital solutions in our daily lives has become essential in the current pandemic environment. In a time when physical distancing has been so important, consumers want solutions that give them access to the products and services they need and firms need to keep doing business and set themselves up to grow.

For many, digital solutions have been the answer. However, we all recognize that new technologies are providing companies with vast amounts of personal information, data that is essential to making business decisions and offering new services to customers.

Innovation and growth are critical, but we must stand up for Canadians and ensure that this innovation happens in a responsible way. Today, I will be outlining the key elements of Bill C-11 that enable responsible innovation done right in the Canadian way.

One of the goals of PIPEDA, our current law, has been to ensure companies are able to handle personal information to meet their legitimate business needs and do this in a privacy-protected way. To achieve this dual objective, PIPEDA's framework is principles-based and technology neutral. This framework ensures that the law continues to apply even as technology has undergone rapid change. The CPPA retains this approach, continuing the success of a flexible and adaptable privacy law in the Canadian private sector context. We all recognize that times are changing rapidly.

To better reflect the realities of the digital economy and to continue the emergence of the new big data technologies and artificial intelligence, the CPPA has a number of provisions that support industry moving forward. The bill would create a level playing field for companies of all sizes. It does this by reducing administrative burdens, critical for the vast number of small and medium-sized enterprises in Canada so essential to our economy.

It introduces a new framework for personal information that is de-identified. It establishes new mechanisms likes codes of practice and certification with independent oversight by the Office of the Privacy Commissioner. It addresses data for research purposes or purposes deemed to be socially beneficial.

I will outline how the bill would do it all. The bill before us today includes a new exception which is consent to cover specified business activities. The goal here is to allow Canadians to provide meaningful consent by focusing on specific activities that involve real choice. This is critical to avoid blanket consent agreements or the long, multi-page contracts that no one reads.

It would also reduce the administrative burden on the business in situations where an individual's consent may be less relevant, such as a company's choice of a third party service provider for shipping goods. The customer wants goods shipped and the company should have the ability to make this happen. The law should not add extra burden to fulfilling the service.

Therefore, the bill provides for new regulations to be developed for prescribed business activities, and that introduces the concept of legitimate interest in Canada's privacy framework. This is something that industry has asked for and the government has answered in Bill C-11.

Second, we are better defining and clarifying how companies are to handle de-identified personal information, that is, personal information that has been processed and altered to prevent any identification of a particular individual. The bill would allow organizations to de-identify personal information and use it for new research and development purposes. Businesses must undertake R and D to improve their products and to offer customers the new and leading-edge services that they are looking for. This provision would give businesses the flexibility to use de-identified data for those purposes, adding value for customers and firms alike.

The law would also allow organizations to use data for purposes of the public good, specifically by allowing companies to disclose de-identified data to public entities. Such disclosures are only allowed where the personal information cannot be traced back to a particular individual and there is a socially beneficial purpose, that is, a purpose related to health, public infrastructure or even environmental protections. This kind of provision would protect individuals while ensuring that we use all the tools at our disposal to address the biggest challenges of our time.

Included in the bill is a clear set of parameters for institutions, such as hospitals, universities and even libraries, that would seek to receive personal information for a socially beneficial purpose. These parameters would help to clarify the rules of the road in a new and important field.

These new provisions would also permit organizations to share more data in a trustworthy manner. This would allow the private sector to work with different levels of government and public institutions to carry out data-based initiatives in a privacy-protecting manner. By taking this approach, the bill accommodates emerging situations where collaboration between public and private sectors can provide broad public benefits, while at the same time retaining the trust and accountability we demand and deserve.

Third, the bill would provide a framework for codes of practice so that businesses, especially those in specific industries or sectors of the economy, can proactively demonstrate their compliance with the law. The bill would do this by introducing coregulatory mechanisms into Canada's privacy landscape that would have businesses and the Privacy Commissioner working together. For example, companies operating a specific type of business could develop a code of practice that demonstrates compliance with a specific part of the law, and the Privacy Commissioner could formally recognize the code. For instance, there could be a code for de-identification.

Lastly, the bill provides for certification and certification bodies. Such bodies could use codes of practice to certify businesses compliance with some or all of the law. This is a useful tool for companies, especially small and medium-sized identities, and would be backed up by oversight by the Privacy Commissioner. This means that the Privacy Commissioner would have the option to decline to investigate a privacy complaint when a company has obtained a certification related to the complaint. This is not only efficient, but also provides an additional layer of certainty for business and consumers alike.

Recognized practices, codes and certifications would make it easier for business to comply with the law and for individuals to understand how they are protected. Bill C-11 would not only help keep the personal information of Canadians safe, but enable tomorrow's innovators by supporting Canadian businesses in every corner of the digital economy.

With the bill, the government has made innovation and economic growth a top priority. It is a major step forward.

[Louise Charbonneau, Bloc, Trois-Rivières, QC]

Madam Speaker, I want to thank my colleague for all his clarifications on Bill C-11.

However, I would like to take him in another direction. Quebec is also currently studying proposed legislation, Bill 64, which would provide increased protection for personal information and is heavily based on European law.

I am wondering if the government considered how these two laws will work together, to avoid the confusion that any overlap would cause for the consumer.

[Bobby Morrissey, Liberal, Egmont, PE]

Madam Speaker, crafting legislation is obviously complex, and governments reach out to various jurisdictions in analyzing similar legislation to adapt best practices that occur elsewhere. Certainly, as the bill moves through the parliamentary process and gets analysis and debate at various stages including committee, I am sure all those best practices will be brought forward and included in any amendments that may make the bill stronger, better and less confusing for consumers, as the hon. member pointed out.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, I heard something from an organization a few years ago. It was talking about providing individuals with the ability to give their consent for the use of their information and allowing for companies to compensate them directly.

Considering this has been out there for quite a while, I wonder why the government did not put it forward in the legislation and what the member would think about that as an amendment.

[Bobby Morrissey, Liberal, Egmont, PE]

Madam Speaker, the complexity of the question lies in the definition or interpretation of consent by the individual who is giving it. That is why legislation in most cases is broad and can be broadly applied, as my hon. colleague pointed out. She used a specific reference, but in this case it is about incorporating an individual's or a business's idea of consent into legislation so that it respects the many definitions of consent across the country.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, could my hon. colleague provide his thoughts as to why it is so important that we bring forward legislation of this nature? I have not had this factually substantiated, but one thing I was told is that the amount of information that has been put on the Internet in the last two years is greater than the amount of information that has been put on the Internet for decades. One can only imagine what it is going to be like two years from now.

Could my colleague provide his thoughts on why it is important that we bring forth this legislation?

[Bobby Morrissey, Liberal, Egmont, PE]

Madam Speaker, as my colleague is a long-time parliamentarian, he would understand that in the last five to 10 years, the world economy has expanded and changed so rapidly, especially on the data side and in the technology base, that we are really running to catch up. If we look at businesses in the past, we see change occurred slowly and businesses, especially small businesses, could adapt to it in a meaningful way.

At the heart of this legislation is the idea of providing certainty in an uncertain world to small and medium-sized businesses, which really are the foundation of Canada's economy. The government should be able to provide certainty to small and medium-sized businesses, as it is a key economic driver in the country.

I am excited about this legislation, as it provides for a certain world in a very dramatically changing data period. That is why the bill is important. It will require amendments, though, as it goes down the road, because we will be playing catch-up for some time.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I am honoured to be sharing my time with the member for Terrebonne.

I am pleased to rise to speak to the fundamental issue of the protection of privacy.

Since March 2020, Quebec business owners have been hard hit by the negative economic impacts of the COVID-19 crisis, namely the lockdown, the closures, the health measures, the labour shortage and the drop in consumption.

SMEs in Quebec have received assistance in the form of tax credits from the Government of Quebec and the Government of Canada to help mitigate these negative economic impacts. Now more than ever, SMEs are struggling under a burden of debt and many of them may never recover. At this difficult time for Quebec's social and economic life, I am worried about Quebec's SMEs, and particularly the small business owners who do not have the time or money to get bogged down in a data protection program that, in some cases, will have to take into account a number of Quebec and Canada laws.

By amending the Privacy Act, the Government of Canada is creating a number of problems for Quebec's SMEs because of legislation adopted by two governments, the Government of Quebec and the Government of Canada. Depending on whether their economic activities extend beyond Quebec's borders, it is very likely that Quebec's SMEs will not know which law governs their data protection plan.

The new federal law proposed in Bill C-11 will have real teeth, which means that Quebec's SMEs are likely to suffer, unfortunately. I am scared to think how this bill will affect Quebec's SMEs.

The pandemic is forcing many retailers to shift to online sales, the kind of electronic commerce referred to in the bill. In his speech to the House this morning, the Minister of Industry acknowledged that the protection of personal information is essentially a provincial responsibility and a matter of civil law. He said his bill respects provincial jurisdiction, but a closer look at the text reveals that to be not quite the case.

It is true that Bill C-11 applies to all federally regulated businesses. However, businesses that are not federally regulated, which describes the vast majority of companies and virtually all SMEs, are not really excluded from the scope of the bill.

The minister can exclude them if the province has substantially similar legislation, as is the case in Quebec, but he cannot exclude them entirely. In fact, he can exclude them only “in respect of the collection, use or disclosure of personal information that occurs within that province”.

Imagine the mess: a Quebec SME will have to comply with the Quebec law if the information does not leave Quebec, but it will have to comply with the federal law if the information does leave Quebec. Information collected from one customer will be subject to two different laws.

Which law do Visa card payments fall under? Does it depends on which territory the Visa server is located in? This seems unenforceable to me. If a business is covered by the Quebec legislation on data protection, that should apply to all its activities, not just half of them, as it would under the bill as currently worded.

Furthermore, Quebec laws are also adapting to the reality. We must recognize that the federal government's bill represents a step forward, because the current legislation has no teeth. Under Bill C-11, a privacy commissioner could establish the specific practices to be adopted in accordance with the principles set out in the legislation. A privacy commissioner would have order-making powers to force organizations to comply with those principles.

Under Bill C-11, a citizen could file a complaint with a tribunal. The privacy tribunal will also be able to impose significant penalties of up to 3% of a multinational's global revenue for non-compliance. In short, the major difference between the law and the bill we are debating, is that the bill's mechanisms are more favourable to citizens when faced with an organization that misuses digital data.

This bill fails to address the important issue of online identity protection to prevent fraud through identity theft, especially when Canadians engage in financial transactions. Bill C-11 does nothing to ensure that financial institutions in Canada verify someone's identity before authorizing a transaction, which exposes Canadians to fraud. Even the federal government has failed to properly verify a person's identity before authorizing an electronic transaction.

I would like to share an unfortunate incident that happened to one of my constituents. This summer, a young man was a victim of identity theft and wound up having to defend his reputation to the Canada Revenue Agency and another financial institution. It was my own office manager who, while talking to a federal official on the phone, realized that fraud had taken place. My office manager took charge of the case and helped my young constituent navigate the unpleasant process that lasted weeks. There was a police investigation and all kinds of documentation. There were numerous discussions with a financial institution and government officials. He had to go to great lengths just to prove that a fraudster had stolen his identity and to defend his reputation to a financial institution and the Canada Revenue Agency.

It was weeks before this young man was able to access the Canada emergency student benefit he very much needed. That is not exactly the kind of introduction a young adult should have to dealing with banks and governments. This whole situation happened because the government did not take the time to verify the identity of the CERB applicant.

The government needs to set an example and take immediate action to combat identity theft. This is a serious problem. Bill C-11 contains some privacy mechanisms, but there is no mechanism to verify the identity of users or consumers to protect their personal information.

I remind members that private information falls under the umbrella of property and civil rights, which is a provincial jurisdiction, as set out in the Constitution. Quebec is in the process of modernizing its act. Unfortunately, it is difficult to assess right now how the federal act and the Quebec act will interface.

However, the Bloc Québécois foresees some problems, and we do not want these problems to affect small businesses in Quebec, which, I remind members, are struggling as a result of the economic issues associated with the COVID-19 crisis.

SMEs carry a heavy debt load at times. Any additional weight on the shoulders of Quebec entrepreneurs is becoming harder and harder to bear. Considering the potential administrative nightmare that could result from how the federal legislation intersects with the Quebec legislation, I would ask that Quebec SMEs be exempt from Bill C-11.

Simon Marchand, chief fraud prevention officer at Nuance Communications, is a certified fraud examiner, a certified administrator and an expert in biometrics and security. He appeared before the Standing Committee on Industry, Science and Technology on May 20. We were discussing fraud-related topics. He mentioned that in the context of COVID-19, telework was a risk factor. This is especially true when it comes to customer service.

All customer service agents who normally work in call centres now work from home, in an unsupervised environment. These agents have limited resources, but now have the opportunity to access sensitive consumer information, whether it is data on their assets or information that could be used by anyone to impersonate someone else.

A second factor is the socio-economic reality, which will no doubt put pressure on many households. When it comes to internal fraud, we know that pressure and opportunity are the two basic factors that drive an employee to go against their employer’s interests and commit fraud.

Some areas have seen a 600% increase in the number of phishing scams involving COVID-19; attachments, links to websites and other methods are being used to lure victims. Fraudsters will be able to get their hands on vast amounts of consumer information, which they will not use in the next few weeks. Rather, they will wait six to 18 months before opening up accounts, taking out financial products and acquiring products from telecommunications carriers. That is what this bill is all about. It provides a modicum of protection, which is a good thing.

In terms of accountability, Simon Marchand said:

I think, though, the focus should be on accountability and the responsibility companies have in relation to the information they use to deliver services.... it calls into question the bank’s responsibility, which is protecting that information.

The first benefit of accountability will be to give the government a clear picture of the situation. It will know exactly how many victims there are, and it will be able to direct measures accordingly to strengthen security, particularly in banks and telecommunications companies.

This will put a burden on businesses, which will have to file reports, but this burden is not unreasonable, since the data they have is already known. All they will have to do is provide them to lawmakers or to a government-supervised body that can present these data more broadly and anonymously so that members of Parliament can access that information and know exactly what is going on in Canada.

This is an important step, because if there is a leak, companies must tell individuals what information was exposed and the risk of harm from the leak. That is what the bill does, and it is absolutely fundamental, because that is a risk that we run.

In conclusion, the lack of accountability for federally regulated businesses is a problem with the current legislation. There is currently no overall picture of how many people are actually victimized by having their identity used once it has been stolen. I am therefore pleased that the federal government is taking greater responsibility and beginning to act by introducing this legislation.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, when we talk about the legislation, even some of its limitations, and how it could be complemented by working with other jurisdictions, it is important that we recognize the role provinces can play through provincial legislation, which could complement it or even be a leading force. We previously have seen this with other administrations.

For me, the overriding concern has to be the privacy and protection of Canadians and consumers. That is the most important aspect going forward when we deal with legislation of this nature. Could the member provide his thoughts on how important it is to protect the information of individuals that gets onto the Internet via one way or another?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I thank my colleague from Winnipeg North for his excellent question.

I agree with him. The best way to thwart identity theft is to ensure that the person who wants to conduct a transaction is who they say they are. People can be identified based on what they know, what they have and who they are, through personal information. A person's name and address are part of what they know. The IP address of their computer or a cellphone number where an institution can send a text message are part of what they have, and finally, facial recognition, their handwriting or their digital fingerprints are part of who they are. These are ways to fight fraud.

In the European Union, two of these three ways must be used to identify a person. Why does Canada not do the same? These control mechanisms will not cost more than fraud will if nothing is done.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, we know identity theft is a crime. We saw what happened with LifeLabs; over 15 million people's data was stolen. An employee at Desjardins stole the personal data of four million people and affected 173,000 businesses.

We are not discussing the Criminal Code today, but maybe the member could talk about what changes he would propose in dealing with those issues to ensure there are steep penalties so that does not happen again.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I thank my colleague for his question, and I want to take this opportunity to talk about crisis management.

In my opinion, Desjardins' response is the gold standard. It acknowledged the thefts and sent a personal letter to its clients or, specifically, to the clients that had been affected. As a result, they were able to act very quickly.

There have been other situations. Equifax chose to cover up what happened to protect its reputation. The Bank of Montreal and CIBC did the same until the hackers themselves put a message online. There are dozens of similar examples.

Desjardins knows its clients. In all likelihood, it is other financial institutions, and not banks, that fall under federal jurisdiction. Once we identify the problem we can find a solution. The first solution is transparency.

[Kenny Chiu, Conservative, Steveston—Richmond East, BC]

Madam Speaker, I have a question that relates to applicability, which was mentioned by my colleague.

In my previous job as a software development professional, I learned that the European general data protection regulation was applicable to anyone who provided goods and services. Our company, even though we registered it in Canada, does business there as well. Therefore, I imagine many of the businesses in Quebec would also do business in Europe, and the GDPR would be applicable.

Could he comment on that?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I agree with my colleague, and I would even add that this should apply to the federal government.

The government does not verify identities online, and any verifications that do exist are cursory ones. I should say that the government is not doing what it needs to do to ensure that an applicant is actually who they claim they are. As we have seen with the CERB, this can really open the system up to risks like identity theft, which have serious consequences for Quebeckers and Canadians.

[Michel Boudrias, Bloc, Terrebonne, QC]

Madam Speaker, it is a great pleasure to speak to Bill C-11 today.

This is an extremely important subject that concerns the security and protection of all citizens' personal information. As my colleague already clearly stated, over the past 10 years and during the current pandemic, there have been a multitude of phishing scams via telephone, the Internet and online shopping platforms, which are increasingly popular.

I believe that Bill C-11 is timely and will correct major problems that we have been seeing for some time in different areas. For example, there have been cases of bank fraud, notably at Desjardins, and the federal government has also been affected. I know that the bill does not apply to the federal government, but this issue remains a very serious concern.

Take, for example, a situation that has occurred in my riding of Terrebonne. For the past month or so, we have been seeing a whole host of complaints related to the Canada Revenue Agency, from people whose identities were stolen by fraudsters who claimed CERB cheques in their name. This shows that there is a gap at the government level, which is very interesting.

I understand that we need to look at what requirements should be established for banks and e-commerce, but I think that there may be some aspects of the bill that we could rework. We are only at debate at second reading for this bill, which means that the bill could be amended and improved to give it more teeth, make it more robust and ensure that it is more responsive to the various threats that could arise in the future. Since we are essentially talking about technology here, the new law should be able to adapt its mechanisms to the changes in technology that will occur in the coming years.

However, there are a number of troubling issues that the bill does not address. For instance, metadata is not included in the bill. I am not an IT expert, but metadata is something that we see regularly. For example, if we spend a few minutes on the Internet searching for a camp chair, it is not unusual to then see ads for various types of camping equipment.

That is worrisome because metadata can be used to target specific individuals. When a group of individuals is targeted, there is a risk of more targeted threats or cyber-attacks. That is why I think it would be a good idea to improve the bill by addressing the issue of metadata.

The federal government, and the Canada Revenue Agency in particular, has quite a lot of work to do on matters of identity theft. The CRA's mandate is to manage revenues on behalf of the Canadian government.

However, what happens in the case of computer fraud as a result of identity theft? In that case, it becomes more a matter of public safety and national security. In many cases, fraud and identity theft, particularly in the banking sector, are committed from abroad using fairly sophisticated electronic means.

Once again, I am not familiar with the mechanisms used to investigate these predominantly computer-based threats or to protect us from them.

I am also referring to the recent debate we had—and I do think this is related—on 5G networks in Canada, in terms of the technological means that will be deployed over the next few years to protect the IT infrastructure itself from all threats and foreign influences.

In some cases, the threat might involve political or public influence. In other cases, it could literally be individual hackers from around the world who use technology, including 5G networks, to circumvent security mechanisms and break into various systems to steal identities and the personal data of the various citizens that we are meant to protect.

It seems to me that the general intent behind Bill C-11 is a worthwhile one, crucial even, as I said in my opening remarks. However, we also need to tackle the technical side. I get the sense that some issues were not considered from all angles so as to ensure that the bill reinforces the back door as much as it does the front door.

Once again, protecting online identity is the most tenuous aspect, and we are trying to rectify that here. I am concerned about a number of aspects of the authentication mechanisms, because that is really what this is about. Currently, many banks, institutions and businesses use a variety of platforms to secure and protect the identity of online customers and consumers.

As a few minutes on the Internet will show, private online commerce companies use many different authentication platforms and mechanisms. It might be a good idea to consider using the bill to standardize those online transaction authentication mechanisms, but the government seems unwilling to do that in the current version of Bill C-11.

The government wants to have companies and financial institutions take on more of the control, responsibility and obligations of protecting personal information. The government should, however, set out some very specific measures in the bill to ensure that all companies can shoulder this responsibility. Not every company has the financial means to set up robust data protection mechanisms. I therefore think that the government needs to set some statutory requirements.

As my colleague from Abitibi—Témiscamingue pointed out earlier, a lot of small merchants and businesses do not have the financial means to improve or modernize their technology infrastructure. This issue may also need to be addressed in the comprehensive approach we are advocating today.

There is the whole issue of jurisdictions. Quebec's jurisdiction over civil law and consumer protection plays an extremely important role. We know that the laws are confined to the jurisdictions for which they were written. This is not just a Quebec and Canadian problem, but also an international one. By the way, I think it will be necessary for the government to define very clearly these famous control mechanisms and make solid political and governmental choices in connection with the new information technologies that will crop up here at home.

That is essentially where this will play out. We cannot give a foreign government control over telecommunications and computer infrastructure. It is extremely important. We are wading into another field, but to be able to protect our constituents we have to ensure that our infrastructure is not threatened by other countries or by foreign nationals, such as the hackers I mentioned earlier.

Then we have to find some form of standardization to help ensure that clients or consumers are protected during online transactions. Let's not forget the entire issue of metadata, which are a formidable tool for any bad actor wanting to target and attack groups that are more privileged or more vulnerable.

In conclusion, the federal government must ensure that Canadians can be guaranteed, in all circumstances, that a consistent international standard will be rigorously applied, and that it will be possible to efficiently identify any and all fraudsters. Identifying fraudsters has always been a problem, and the Canada Revenue Agency could speak at length about this in committee.

[The Deputy Speaker, Conservative, Bruce Stanton]

The hon. member for Terrebonne will have five minutes for questions and comments when the House resumes debate on this motion.

It being 5:30 p.m., the House will now proceed to the consideration of Private Members' Business as listed on today's Order Paper.

The House resumed from November 24 consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[François-Philippe Champagne, Liberal, Minister of Innovation]

Madam Speaker, I am proud to continue second reading of Bill C-11, the digital charter implementation act, 2020. I am proud because our government set out to deliver an ambitious and comprehensive reform of Canada's framework for protecting the privacy of Canadians while fostering innovation amongst Canadian businesses.

That is exactly what we have done. There are strong imperatives for advancing this important package of reforms to our framework for privacy protection. Canadians deserve and expect strong protections, just as businesses deserve and expect clear rules of the road so that they can confidently deliver the products and services consumers want in an increasingly digital society.

Prior to my time in government, I spent 20 years in the business world. I know how critical trust and confidence can be in business: trust between manufacturers and their suppliers, between exporters and importers, and between businesses and consumers.

In today's digital economy, protecting personal information is key to earning and maintaining that trust.

In that spirit, Bill C-11 includes robust privacy protections for Canadians, and rightly so.

Harsh penalties could be imposed for violations. This new law will also provide a solid framework for businesses seeking to prosper in the digital economy. These businesses will be well placed to earn and keep their customers' trust, without compromising their ability to innovate and meet the demands of an increasingly well-informed customer base.

Bill C-11 seeks to strike the right balance between these imperatives and the need to boost Canadians' confidence in the digital economy.

There are important reasons to move forward with this legislation, and I hope all of my colleagues in the House will be supportive.

As we have noted in the previous debate and members are well aware, the consumer privacy protection act proposed in Bill C-11 would serve to bring Canada in line with other international jurisdictions. In particular, the CPPA would support interoperability of Canada's privacy regime with that of the European Union, a very important partner for Canada. I will speak more about the importance of that in a moment.

This bill would also support a strong and coherent national framework for privacy so that Canadians and businesses would know what to expect from coast to coast to coast. We are not alone in seeing the urgency of modernizing and strengthening privacy laws in the current environment. The provinces do, too. While Quebec continues to advance proposed new provincial legislation, Ontario and British Columbia are also considering new legislation or substantive amendments to their existing provincial laws.

Moving forward with our legislation now allows us to continue to provide leadership in this area and ensure a harmonized approach to privacy protection across our nation. This is really crucial for business and to encourage investment in Canada. It is also crucial to ensuring that all Canadians can have an equivalent level of privacy protection, wherever they decide to conduct business.

The past year has clearly demonstrated how fundamental digital and data-driven technologies have become in our economy and our society at large. Never before, as a society, have we been more reliant on secure, efficient and accessible technologies as a means of conducting a range of everyday activities.

As I noted previously, the foundation for such a robust digital and data-driven economy is trust.

Canadians have been clear in saying they want strong legal protections for their personal information, backed up by meaningful enforcement and oversight. They have indicated to us these principles are essential to their participation in the digital economy. Businesses also recognize this, and are seeking clear and consistent rules in this area.

Our previous legislation has served us well for almost 20 years, but the digital economy, as we all know, is constantly evolving and we must evolve with it. A modern privacy framework will set the right foundation not only for a post-pandemic recovery, but for many years to come.

I noted how important privacy protection is to the various levels of government, including the provinces and our international partners. The federal private sector privacy law is based on one key objective: bringing in national guidelines for organizations that do most of their business on the Internet, a global network that knows no borders.

We want to build a strong, innovative national economy. In order to get there, privacy rules have to be harmonized at the national level. Businesses and consumers are counting on the leadership of the federal government to set national standards in this area.

In the past few years, a parliamentary committee has examined the private sector privacy law, and I thank the committee for its work. During its study, many business representatives and experts underscored the importance of maintaining adequate protection under the European Union General Data Protection Regulation. We must ensure the free flow of data from the European Union to Canada. The same goes for data from the United Kingdom, whose data protection system is comparable to that of the European Union.

The European Commission clearly indicated that Canada had to make changes to its privacy protection regime to retain its preferred status. As a former minister of international trade and minister of foreign affairs, I can say that this is of crucial importance to Canada.

I am convinced that the proposed reforms to the personal information protection legislation for the private sector will help us attain this objective without giving up our singularly Canadian perspective.

My department's mandate for economic growth and development has required that we consider many factors when determining how to modernize and strengthen a privacy law that applies to the marketplace. One of the goals of Bill C-11 is for businesses to understand their obligations so they can build strong privacy protections from the outset in their business. Our current law and the new law that is proposed apply across sectors, businesses and activities. This means the bill must meet a diverse range of needs and be equally easy to follow for any line of work, particularly for small and medium-sized businesses. To achieve this we must first provide businesses with certainty and clarity regarding their obligations. That is why we are proposing to change the way the law is drafted.

PIPEDA, the framework that has been routinely referred to by the acronym, was based on a series of principles. The new law has translated these principles into clear legal requirements. We have also clarified the application of the act in a number of key areas.

Second, we must help businesses better understand how these obligations concretely apply to their activities and operations. The consumer privacy protection act would provide businesses with the opportunity to consult the Office of the Privacy Commissioner of Canada without fear of repercussions. Businesses would be able to fully understand the requirements and to comply before problems arose. The bill includes a framework for the recognition of codes of conduct and certification programs. These provisions will specify how the law applies in particular sectors or areas.

These measures are especially important for our small business owners. They need to be able to focus on what matters most: quality products, good customer service and growing their businesses, while having confidence that they are following the rules. We also need to make sure that we do not add unnecessary administrative burdens, particularly on those who may not have the time or resources to invest in complex legal analysis and advice.

Our approach ensures that fundamental protections are established and enforced in a way that is fair and accessible to all businesses, no matter their size. We must provide sufficient incentives for compliance to ensure a level playing field across the marketplace. In recent years, the Privacy Commissioner has called for a stronger enforcement regime under the private sector privacy law. Bill C-11 responds to this.

The Privacy Commissioner of Canada is at the heart of the Canadian privacy regime. The commissioner and his office help businesses understand the act and intervene to protect Canadians in the event of a breach. It stands to reason that the new legislation enhances the role and powers of the commissioner.

The commissioner already plays an education role, which will continue and be strengthened under the new regime. The commissioner will retain his key research and guidance role, as well as being assigned the new task of reviewing organizational privacy practices. The commissioner will also review and approve codes of practice and certification programs. This will give organizations and individuals confidence that personal information is being managed in strict compliance with the law.

Clear guidelines help to protect personal information and prevent breaches. This clarity is essential to the proper functioning of the privacy framework. The bill sets out harsh financial penalties for companies that break the law. The fines and administrative financial penalties are a clear demonstration of the government's commitment to ensuring the protection of Canadians' personal information.

That being said, such sanctions should only be imposed following fair and accessible proceedings. That is precisely why Bill C-11 also creates a tribunal to decide on these matters. This means that companies will not have to appear before the Federal Court of Canada. The tribunal will allow all parties to pursue remedies at a lower cost and in a more accessible manner. Over time, the tribunal will also develop a body of privacy jurisprudence.

Let me summarize the approach that the government has taken in modernizing our private sector privacy law. Bill C-11 acknowledges the strengths of our existing law, referred to as PIPEDA, in particular its non-prescriptive, flexible and balanced approach to privacy protection. It reinforces individuals' control over their personal information where it matters most, and it enables innovation.

Moreover, it introduces serious financial consequences for the most egregious behaviour. It ensures procedural fairness and recognizes the role of the federal government in regulating the economy, while respecting the important role that provincial governments also play in private sector privacy regulation. This is the continuation of a made-in-Canada approach that recognizes both the right to privacy and the needs of organizations to use personal information for appropriate purposes.

I am confident Canadians will agree that the law offers them the protection they are seeking, together with all the benefits that a growing digital economy can bring. I am happy to take questions from my colleagues.

[Earl Dreeshen, Conservative, Red Deer—Mountain View, AB]

Mr. Speaker, I want to indicate that Jim Balsillie noted with regard to this bill that “the privacy bill fails to curtail [the] surveillance economy or protect Canadians” and that “The government's proposed legislation would not curb the mass surveillance or behaviour manipulation the tech industry currently engages in with impunity.” In fact, he specifically says that Bill C-11 demonstrates that the Liberal government is not fully aware of the power of the data economy and the impact it has on the lives of Canadians.

This is considered a fundamental flaw in the bill. What can we do in order to address this issue?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, my colleague raised important issues. I know Jim Balsillie. He is a very important voice in our country when it comes to the digital economy.

I would invite the members to study these issues at committee. We want to send the bill to committee so that different voices can be heard in order to strike the right balance.

As I said, we need to ensure that we have a 21st century framework to protect Canadians' information, while at the same time helping to bring innovation to our country. My goal and our goal as parliamentarians should be to have the best framework in the G7 and beyond, so that at one end we can assure Canadians that we as Parliament have taken their concerns very seriously, but at the same time put in a framework that will provide for innovation.

I would hope, as the member suggested, that we can hear many voices during the important work of the committee and work with—

[The Acting Speaker, Conservative, Arnold Viersen]

Questions and comments, the hon. member for Vancouver East.

[Jenny Kwan, NDP, Vancouver East, BC]

Mr. Speaker, the Privacy Commissioner indicated that there are concerns about Bill C-11's new commercial activity definition and consent rules. The concern is that it would open up the door to new commercial uses of personal information without consent. There seems to be an approach that people are suggesting, and it is to restore the language that was in place previously. Would the minister support such an amendment?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, my colleague raised an important issue. The provision in the bill on the issue of consent needs to be strong. It needs to be informed consent. That is what Canadians expect from us and that is what we certainly want to ensure in the bill.

If the member and other members of the House, through the work of the committee, want to propose or reduce certain portions, they can rest assured that we will obviously listen to the Privacy Commissioner. He has a very important role in our system. We want to make sure that the consent is informed. As a lawyer myself, I can assure the member we want to look at that very carefully to make sure that when Canadians provide their consent, it is a true and informed consent. We want to make sure it is in plain language and that people understand what they are consenting to.

[Yves Perron, Bloc, Berthier—Maskinongé, QC]

Madam Speaker, I thank the minister for his speech.

The Bloc Québécois thinks that strengthening privacy protections is a good thing. However, we are concerned about the massive number of fraud cases related to CERB. That is a government issue, but Bill C-11 does not apply to the government.

Does the minister not think this bill should also apply to the federal government? If not, what does the federal government plan to do to improve identity checks when people apply for programs?

Many members of the House have had to help distressed constituents who were the victims of fraud.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Madam Speaker, I thank my hon. colleague from Berthier—Maskinongé, or my neighbour, I should say, for his important question.

I thank the Bloc Québécois for being willing to work with us to move Bill C-11 forward. As he said, I think that all Canadians want a more tailored and certainly more modern system that will protect their personal information.

As for information and data shared with the Government of Canada, we constantly strive to use the most sophisticated measures to protect Canadians' personal information. It is a matter of trust—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I am sorry to interrupt the hon. minister, but other members have questions.

The hon. Parliamentary Secretary to the Minister of National Revenue.

[Francesco Sorbara, Liberal, Parliamentary Secretary to the Minister of National Revenue]

Madam Speaker, Bill C-11 references innovation and the strengthening of privacy for Canadians. As he references in his comments, it is 20 years in business. How important is that in the modern-day world?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Madam Speaker, privacy is essential. Trust in the digital economy is essential. Together as parliamentarians we need to find the right balance for Canadians to be safe and at the same time have innovation.

I am so pleased that colleagues have worked together to bring in Bill C-11 so we can offer, as a legacy to future generations, a framework that they will be proud of, that will protect their information, that will spur innovation and that will protect their data, as they expect this Parliament to do in an age where the digital economy and the data economy are becoming more and more present in our lives.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, this is my first opportunity to address the minister since he has changed portfolio, and I cannot start without thanking him once again for the enormous personal effort at rescuing various constituents who were on cruise ships some months ago.

My question is, of course, on Bill C-11. I have read the commentary, as I am sure he has, of Daniel Therrien, our Privacy Commissioner, who is disappointed in Bill C-11's failure to ensure that privacy is recognized as a right. A rights-based approach would deal with a lot of the criticisms that will come up.

I know the government is taking the view that this is a constitutional matter and there are limitations, but the Supreme Court has made important comments on privacy. Is the minister open to changing this? I do not know if—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I would ask the member to ask her question very quickly, because we are running out of time.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, will the minister be open to amendments to ensure that privacy is recognized as a right?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Madam Speaker, first, let me say how much I appreciate working with the member for Saanich—Gulf Islands. She is a true parliamentarian. Having been able to repatriate people was a true honour.

To her point, the new legislation recognizes the individual right to privacy. We have listened to the Privacy Commissioner, but the framework we are presenting is striking the right balance. However, I am always willing to listen to the member for Saanich—Gulf Islands, because she always provides extremely good feedback to this government in order to serve Canadians in the best possible way.

[James Cumming, Conservative, Edmonton Centre, AB]

Madam Speaker, what kind of assurance has the government received that the legislation, as drafted, will be GDPR-compliant, because business needs that certainty.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Madam Speaker, this is fundamental. The analysis we made and the comments we received when we drafted the bill have provided the right feedback to be compliant. I understand that stability and predictability is important. A number of Canadian companies depend on data to be exchanged with the European Union, one of our largest trading partners. We are confident that this will meet the standard, but I would happy to listen to the member at committee if he wants to add to that.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is a pleasure to join the debate this afternoon on Bill C-11. The bill raises important issues about the privacy of Canadians. It is legislation that seeks to reform aspects of our privacy framework in Canada concerning the use of Canadians' data. I look forward to the debate and the study that is going to take place at committee because I know this bill raises many important issues. It is a very technical area: Canadians will want to delve into the details, find out what the impacts of the provisions are and whether the bill would do the things the government says it would do.

I have some initial comments about the issue of privacy and some of the main threats facing the privacy of Canadians, but I also have a couple of comments on the provisions of the bill. It would provide the Privacy Commissioner with important new order-making powers, it would bring in fines and give individuals the right to demand that their data is destroyed. It would bring in some new powers and provisions for the privacy protection of Canadians, as well as for the Privacy Commissioner. These are some important things to look at, and some study of the details is required.

Certainly, the Conservative caucus is very committed to protecting Canadians' privacy and ensuring that the details all check out with what the government has claimed. I am looking forward to the depth of conversation that I know is going to happen and needs to happen on a piece of legislation in an important policy area such as this.

I want to flag some concerns I have in terms of the process of this legislation, as well as the broader framework of privacy in this country.

This bill was initially tabled in the fall and it has had very limited debate between then and now. It underlines the confusion we have about the government's legislative priorities. It looks very much like the government is trying to set itself up to complain about its legislation not passing by scheduling a bill for an hour here and an hour there, rather than having the kind of focus we would typically expect from a government that is trying to pass legislation. Generally, if a government identifies a bill as an area of priority, it will schedule that bill for enough time to be able to complete debate and then it will proceed to committee. However, today alone we have had an hour of debate on a pandemic election bill, and this afternoon we have gone on to a completely different topic rather than the government picking one issue to move the debate forward.

On a process point, the other thing that is interesting to me about this bill is the committee the government is planning to refer this bill to. The industry, science and technology committee has an important role in looking at the regulation of business, promoting business development in this country and so forth, and the minister who just spoke and is leading this discussion is the Minister of Innovation, Science and Industry, but will this bill be referred to the industry committee? No. Once this passes second reading, the bill will be referred to the ethics committee. The ethics committee has a mandate that includes privacy, but I note in particular that there is a lot going on right now at the ethics committee. It is doing important work trying to get to the bottom of the WE Charity scandal.

If I was cynical about the government's motivations, I would think it was interesting that it had decided to bring forward legislation and then refer it to the ethics committee, given the tradition we have in this place of legislation receiving priority at committee. However, we have critical issues of government ethics and scandal that we need to get to the bottom of. It looks like a manoeuvre to try to push the WE scandal off the agenda. It is very striking to see that the government has been so desperate to avoid discussion of its own ethical lapses, around the WE Charity scandal in particular, that it has done all kinds of things to damage its own legislative agenda simply to cover itself on the ethical front.

In fact, the government prorogued Parliament, going back to last summer. There was important information that was coming out as part of the committee studies that were going on in relation to the WE Charity scandal, and the government prorogued Parliament.

Then this issue comes back in the fall, and we are trying to restart the study of it. The government threatens to declare something a confidence issue in order to avoid having a separate committee that could study it. If we had a separate committee, this would not be an issue, right? If we had a separate committee that was looking at these various issues of government corruption, then we would not have an issue with seeing this legislation studied at the ethics and privacy committee.

However, with this renewed discussion and with new information coming out right now as well, we see the government bringing back Bill C-11. It makes me wonder if the House leader thought, “We want to kill this discussion of the WE Charity situation at the ethics committee, but we can't prorogue Parliament again, right?” I mean, I suppose they could, but it sort of gets more and more obvious what they are doing, so they thought, “Let's bring back this bill that we haven't done anything on in months and try to get it sent to the ethics committee.”

These are just more of the kinds of games, I think, that we see from the government. If it was serious about our being able to get to the bottom of these ethics issues as well as moving forward with this legislation, it would be a simple matter of either allowing the creation of that special committee to look at the WE Charity issue or having this bill go to the industry committee. Again, it just raises the question: What is the government trying to hide here?

The government's ethics failings are well known, and it seems the next step in its plan to avoid discussion of its terrible ethical record will be to call an election, a particularly extreme step to kill all of its legislation and shut down important discussions in Parliament on a wide variety of issues, including government ethics.

If we have an early election, of course we are not going to get anywhere on this bill, so hopefully the government will resist the urge to put politics and its own political interests first and instead focus on the kind of policy work that we are doing and are prepared to do in this place to move important issues forward.

In this speech, I want to also zero in on an important issue of privacy, that being the threat to Canadians from foreign actors who are trying to access our data and who are, in many cases, trying to interfere in Canadian institutions, trying to intimidate Canadians and potentially trying to steal intellectual property. In the interest of Canadians, we need to take the threat to privacy that comes from foreign actors very seriously. It is my view that the defining national security threat of our time is interference and intimidation in Canada by foreign state-backed entities.

I have had the opportunity to work with many Canadians who have themselves been direct victims of this kind of intervention, threatening their security and privacy. We had a press conference here on Parliament Hill when I launched Motion No. 55, which is a private member's motion that I am putting forward with respect to foreign state-backed interference and intimidation. We had four people participating in that press conference who were from different backgrounds, from different parts of the world originally, who are now Canadian. They shared their own stories of foreign state-backed intimidation, and all of them expressed frustration at the nature of the response. They felt they were being referred back and forth among different institutions and that we did not really have the capacity to support them effectively and identify who is really responsible for addressing these issues. Is it CSIS? Is it Global Affairs? Is it the RCMP? Is it the local police? Who do they go to? Who responds to it, and then what is the response from the government?

The response from the government has been quite weak. In the case of this minister who is now responsible for this legislation, we had many of these discussions in his previous role as the foreign affairs minister. I would ask him about what he was doing in response to the likely and in some cases very evident involvement of foreign diplomats in the interference with and intimidation of Canadians, and he would kind of look at the camera and tell the diplomats not to interfere in Canadian affairs.

It is great to say that, but we need to have a policy framework and a strategy in place to protect the privacy of Canadians when it is threatened by malicious foreign actors, which are often state-backed or directed actors.

It is with this in mind that Conservatives put forward an opposition day motion, which passed, calling on the government to put in place a comprehensive plan to protect Canadians from this kind of interference and intimidation. The government just failed to respond effectively to that.

My private member's motion, Motion No. 55, reiterates the call of that opposition day motion, but it also particularly focuses on the issue of support to Canadians who are victims. My motion is saying that we need to do more to support Canadians who are victims of foreign state-backed interference and that the federal government's approach to privacy in this area needs to involve cross-jurisdictional co-operation.

It also says the federal government should seek to work collaboratively with provincial, territorial and municipal governments on responding to foreign interference, recognizing we do see manifestations of this foreign interference happening at other levels of governments, such as efforts to capture elites, control institutions, misdirect funds to their interest, and so forth. We see those attempts at intimidation happening at other levels of government, and the response needs to involve effective engagement of those other levels of government as well.

This is another area where the government could be doing more, and needs to do more, to respond to this primary issue of our vulnerability in terms of national security.

In the midst of us saying the government needs a plan and a strategy on this, the simple thing it could do would be to take on this principle of first doing no harm. If it really recognized the threats regarding security in this area, the first thing it would do would be to just say no to Huawei, because we know there are threats to Canadians' security and privacy associated with Huawei being involved in our 5G network.

There is really no disputing the close relationship between Huawei and the Chinese state. We know all private organizations based in China have a high degree of vulnerability to influence and control by the Chinese Communist Party, such as the requirement to defer to party committees, the requirement that information be shared with the Chinese military, and the requirement to respond to requests by the Chinese military.

We know the vulnerabilities that exist across the board, but it is especially the case when we look at a company like Huawei. Clearly, there is a long-standing and very close relationship between the state and this company. Nobody else in the world has trouble figuring this out. Four out of five Five Eyes countries have understood the importance of saying no here.

Our own interests are at stake here, as well as the opportunities for ongoing effective co-operation with our partners, who see these risks. We do not want to be perceived in Canada as being a point of vulnerability. If we want to be able to maintain the levels of co-operation that are so important for our interests, we have to work effectively with our allies and give them reason to have confidence in us.

Yes, the government needs to have a comprehensive plan to address foreign interference and protect Canadians' privacy, but why not just start by doing no harm and saying no to Huawei. As well, the government has just been absent in answering these very basic questions when it comes to the involvement of Huawei in our 5G network.

Going back, we had a previous public safety minister, Ralph Goodale, who said that they would make a decision before the election. We are not talking about the election the government is planning now, we are talking about the last election in 2019. The government said there would be a decision on Huawei before that election. We probably will not see a decision on Huawei at this rate before the next election, or maybe even the one after it, if Liberals stay in government. If Conservatives form government, there would be a decision very quickly when it comes to Huawei, but the government has put it off.

The Liberals have continually said that the decision is coming. Part of our opposition day motion dealt with Canadian intimidation and privacy issues around foreign-state-backed actors. Our opposition day motion included the requirement that the government make a decision with respect to Huawei, but the deadline came and went. The Liberal government, by the way, has a track record of ignoring the motions that are passed by a majority of Parliament.

I think the Liberals' effort to create this narrative about Parliament is not working. The reality is that Parliament is generally working, but sometimes it does things they do not like. Sometimes the opposition works together to pass motions the government does not want to see pass. Sometimes the opposition puts an issue on the agenda and pushes it so much that many government members support it, as we saw with the Uighur genocide, even though the government abstains.

To me, that is a sign of a Parliament that is lively, that is working and that is doing its job because it is holding powerful people to account. That is a big part of what Parliament is supposed to do. The government wants to spin this narrative of Parliament precisely because it is working: it just does things sometimes that the government does not like. Some of that is borne out of the leadership of our party. Some of it is borne out of the very good co-operation that has been on display among the opposition parties.

The point is, we had a motion pass that called on the government to make a decision on Huawei and it still has not. This is a huge issue for Canadian security, for Canadian privacy and for the protection of our national interests at this critical time in global affairs. We are seeing heightened competition, and Canada needs to be clear and principled in terms of standing up for, and standing with, other countries that believe in freedom, democracy, human rights and the rule of law. Part of protecting the rule of law, of human rights, is emphasizing the importance of protecting the privacy of Canadians and excluding actors from our systems who we know will not respect that privacy: actors who say they have a legal obligation to provide data to a foreign military when asked.

Regarding Huawei, there is this issue of looking at the kinds of human rights violations that they and other Chinese-state-affiliated companies are involved in. We see, with the Uighur genocide, the technological enabling of human rights violations by companies such as Dahua and Hikvision: companies that the Canadian pension fund at one time invested in.

We are talking about the involvement of Huawei and other companies that are complicit in detailed monitoring, tracking and controlling. We see these horrific violations of privacy taking place inside China right now: horrific violations of privacy that are being enabled by the very companies that the government has not yet refused access to Canada. That should be a huge concern in any privacy debate we are having.

When the same companies are part of things like the social credit system, whereby individuals are tracked in terms of whether the government thinks they are behaving well, and their ability to travel and participate in events is determined automatically by algorithms based on intense monitoring and evaluation, a very Orwellian system is being brought in.

Then we have some of the actors who are involved in developing these kinds of technologies and deploying them. Those same actors are looking to do business here in Canada. That should concern us. The government needs to make some clear choices. It needs to decide where it stands on these issues and needs to start standing with us, in the opposition, who are taking a principled stand in defence of human rights, in defence of privacy and in defence of our national security. We are recognizing and responding to the very real threats that we see from various actors.

One of the other issues that I hope to see taken up at committee is people's privacy in terms of their intimate images, and some of the horrific abuses of people's human rights that we have seen perpetrated through the Pornhub platform. We have heard testimony at committee that people's intimate images, even involving minors, were posted repeatedly without their consent. That is another privacy issue that Parliament must act on urgently, without delay.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Madam Speaker, in 2019, during the summer, I was very surprised to receive a text message on my government cellphone from a volunteer from the Conservative Party of Canada, asking me if I wanted to vote Conservative and to reply back via text.

Some members from the New Democratic Party and the Green Party would like Bill C-11 to apply to political parties. What does the member have to say about that?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is interesting that we would have been texting the member, asking if she wanted to support the Conservative Party. Hope springs eternal. We can hope that all Canadians will eventually see the value of what we are putting forward. I am hopeful even the member for Kingston and the Islands will see the light at some point and recognize the opportunity he has to support the Conservative Party going forward.

It is an interesting issue for political parties. Maybe it could be further studied at the committee level.

[Andréanne Larouche, Bloc, Shefford, QC]

Madam Speaker, I thank my colleague for his speech on this important bill, which has to do with the protection of privacy.

However, as my colleague mentioned in his speech, there are still a lot of grey areas.

In a recent question, my colleague from Berthier—Maskinongé brought up the cases of CERB fraud. Fraud was also discovered at the Canada Revenue Agency last fall. Some people therefore had problems completing their EI claims when many regions of Quebec were in the red zone and people were losing their jobs.

We also need to think about the issue of the separation of powers. The Government of Quebec is already working on Bill 64.

Depending on the location of the business, will responsibility for the protection of privacy fall to Quebec or Ottawa? Would the same business be subject to Quebec law for certain information and to the federal law for other information?

There are a lot of grey areas, and all of these elements still need to be clarified. How can we do that?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is an important question, a technical one but certainly an important one. It does speak to the need for effective collaboration across jurisdictions.

We have seen, in the life of the Liberal government, a number of cases where the data that the government has on Canadians has been breached. We need to be attentive to those kinds of problems as well as to the issues the member raised, identifying the need for greater cross-jurisdictional support and collaboration. Again, this is an important issue that we need to delve into further.

[Rachel Blaney, NDP, North Island—Powell River, BC]

Madam Speaker, one of the things I want to talk about today is the importance of privacy.

I know the Conservatives were rightly worried about the federal COVID notification app and what that could mean for privacy. Along with the New Democrats, they asked some really tough questions of the government that got us an app that respects privacy while remaining effective.

Could the member address how there is no need to trade off privacy rights while addressing other priorities.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, that is an excellent point from my colleague. What we have done is push the Liberal government to actually take these issues seriously and to recognize that we can put in place the appropriate mechanisms to protect privacy and achieve other objectives.

In the context of the pandemic we are in, the reality is that tracing is a very important tool in responding to the virus. We know countries that have put in place effective tracing systems have generally been much more effective in their response overall. It is an opportunity, a strategy that is very important.

At the same time, I have heard a lot of concerns from people every time I talk about it, and I am firm in the view of the value of tracing. Some people push back and say that they do not trust the system. That is why we need to communicate to people that there can be confidence in the system and actually put in place the mechanisms to ensure they can have confidence in the system, so we can provide the support required in the COVID-19 response.

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Madam Speaker, the member does tremendous work on human rights, whether it be for Canadians here or people across the world. I am going to quote from the Privacy Commissioner in response to Bill C-11's tabling. He said:

Bill C-11 opens the door to new commercial uses of personal information without consent, but does not specify that such uses are conditional on privacy rights being respected.... [T]he Bill essentially repeats the purpose clause of the current legislation, which gives equal weight to privacy and the commercial interests of organizations. In fact, the new purpose clause places even greater emphasis on the importance of the use of personal information for economic activity.

The previous speaker from Powell River talked about the public uses of information and getting the balance right. What does the member think about the need to have a balanced framework for human rights within Canada, particularly around economic ones?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, my colleague's intervention was excellent. It was a pleasure to work with my colleague previously on the Canada-China committee where we were dealing with some of these issues around foreign actors that I talked about in my speech.

To his specific question, it should concern all Canadians that the government is including in this legislation mechanisms that expand the possible use of data without the privacy protections that we would expect. It is sort of the nature of the bill that they are piling these things into it, while not always fronting those more concerning aspects of those changes in their communications. That just speaks to the importance of the parliamentary scrutiny that is required to get to the bottom of the details and to understand their impacts.

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, the member suggested that he hopes I see the light of the Conservatives, but I can assure him that when 54% of the Conservative Party is against recognizing climate change, it is pretty much a non-starter, although I do admire his interest.

This member keeps saying that the governing party wants an election, but we are not even talking about it on this side of the House. I am pretty sure that member has brought up the word election in this House more than anybody who has been speaking for the Liberal Party over the last couple of weeks. As a matter of fact, if the Conservatives are not interested in an election, there were eight confidence votes last night alone and this member voted against—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

The hon. member for North Island—Powell River.

[Rachel Blaney, NDP, North Island—Powell River, BC]

I have a point of order, Madam Chair.

I was so enjoying that question, but we have completely lost the sound.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

If he can hear me, could the hon. member summarize that question?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

In summary, Madam Speaker, I believe in climate change and the Conservatives do not, so I could never become a Conservative, and I apologize.

The member keeps talking about an election. We had eight confidence votes last night alone. I asked for a recorded vote on every single one. This member and all of the Conservatives voted against the budget bill, in essence voting down confidence. Therefore, he is actually the one who appears to be interested in an election.

The member talked about a special committee on WE. The Conservatives have a majority, if they go to their friends in the Bloc, to set up that committee. Why did the member not go to his friends in the Bloc and the NDP to set up that committee?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, if the member wanted to join the Conservative Party, his views on climate change would not be the barrier; it would be his casual disregard for the truth that would get him into more trouble if he wanted to join us on this side of the House. I do welcome his joining us on this side of the House, but more in the sort of switch-places type of scenario.

The member spoke about how Conservatives voted last night on the government's spending. Conservatives do not agree with key aspects of the direction of the government, so it is our responsibility in representing our constituents to raise our concerns, to speak about them, and to vote accordingly.

I will note, though, that those confidence votes passed; that a majority of this House supported those measures. Therefore, it would be particularly rich for the government after getting the confidence of the House, which it did not need my support to do, to then pull the plug later.

We think it is important to warn Canadians about the government's plans with respect to an election. The more the member tries to deny it, the more interesting it will be to play back some of those conversations if the Prime Minister does actually do what many people expect him to do in the next few months.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

The hon. member for Victoria has time for a very brief question.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, I want to thank the member for his points on how the Liberals have been scheduling an hour of debate here and an hour of debate on another bill there, without giving them enough time to move forward.

I am thinking in particular of Bill C-12, the Canadian net-zero emissions accountability act. It has been months and the government has yet to really schedule enough time to finish second reading. The Liberals either need to admit that climate accountability is not a priority for them or schedule the time. I hope they do not use their own game playing to delay important legislation as an excuse for an election.

On the privacy bill, does the member agree—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I did ask for a brief question. There are only 20 seconds left.

I would ask the hon. member for Sherwood Park—Fort Saskatchewan to respond.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is an important point that for those who are following the way legislation is normally scheduled, the government's approach is very different. We agree with some of the bills and some we do not, but the normal thing for government to do would be to prioritize legislation it wants to see passed and schedule enough debate for it to move forward. Liberals are not doing that, and they are very clearly setting the stage for something else. They have no interest in passing their own legislation. It is very evident.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Madam Speaker, I am pleased to participate in the second reading of Bill C-11, the digital charter implementation act, 2020. I will be splitting my time today with the member for Davenport.

When Canada's privacy law was introduced in 2000, Parliament intended that it would achieve two objectives, which were privacy protection for individuals and the growth of electronic commerce. Over 20 years later, our government is introducing this legislation to provide an updated strategy for protecting privacy in our new digital world.

I have heard loud and clear from the constituents in my riding of Mississauga—Erin Mills, and they want to see strong privacy laws. These privacy laws not only protect consumers and help build trust in the digital marketplace, but with the consumer privacy protection act, a principled and agile privacy enforcement regime would create a vital safeguard as companies engage in the digital economy.

Today, I would like to provide further insight into a key aspect of the bill that will not only provide guidance for businesses for protecting individuals' personal information, but will also support responsible innovation. I am speaking today about provisions in the new consumer privacy protection act to formally recognize codes of practice and certification systems as a means of demonstrating compliance with the law.

A key strength of our current private sector privacy law, commonly known as PIPEDA, will be maintained in the new consumer privacy and protection act. That strength is a principled approach to rule setting. Our private sector privacy law applies to all organizations in all industry sectors of all sizes and levels of sophistication. This level of general application is crucial in order to establish a baseline of privacy protection that applies across the marketplace.

While comprehensive, this law must also be flexible, non-prescripted and technology-neutral so that it can be applied in all circumstances. These characteristics have long been recognized as a key strength of the existing law and there is widespread support for maintaining this approach. However, it is sometimes a challenge for organizations, especially smaller businesses without dedicated legal resources, to understand how to implement these high level obligations within their specific context.

For example, consider a situation where an organization is using a cutting edge technology which has not yet been the subject of a finding by the Privacy Commissioner or where an organization must handle complicated data flows with complex accountability, such as in connected and automated vehicles. These challenges are becoming more commonplace in a data-driven economy.

To help address these problems and to provide assurance to businesses and consumers alike, the consumer privacy protection act would allow any entity to apply to the office of the Privacy Commissioner for approval of a code of practice that provides a specific set of rules for how organizations can operate in compliance with the law. This approval would be particularly useful for organizations using a new technology or operating with a new business model.

This type of regulatory certainty is very much needed in today's rapidly developing economy. It gives organizations and their business partners a level of comfort that they are operating on the side of the law. It also supports a level playing field in areas where there is no jurisprudence or specific guidance for organizations. It also makes it more transparent to Canadians how their personal information is being used in these circumstances. To take it—

[The Assistant Deputy Speaker, NDP, Carol Hughes]

Unfortunately, or fortunately depending on which way we look at it, it is 1:30. The hon. member will have five and a half minutes the next time this matter is before the House.

It being 1:30 p.m., the House will now proceed to the consideration of Private Members' Business as listed on today's Order Paper.

The House resumed from March 26 consideration of the motion that Bill C-11, An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Julie Dzerowicz, Liberal, Davenport, ON]

Mr. Speaker, it is an absolute honour for me to rise in the House to speak on behalf of the residents of my riding of Davenport. I am speaking in support of Bill C-11, an act to enact the consumer privacy protection act and the personal information and data protection tribunal act and to make consequential and related amendments to other acts. It is also known as the digital charter implementation act.

From the earliest days of my first run for office, the residents of Davenport have approached me to tell me how concerned they are about the security of their personal information. They are literally running after me in the streets to say that this is an issue of great importance to them. I can assure members that it is not just Davenport residents who are concerned. The Privacy Commissioner published a survey in 2019 that found that 92% of all Canadians were concerned about their privacy, with 37% of Canadians being extremely concerned. This means that nine out of 10 Canadians are worried about their privacy.

I know that the third wave of this pandemic is the most pressing issue for all of us right now, and rightly so, but it has not made our privacy concerns go away. Indeed, this pandemic has had the opposite effect, given that most, if not all, our lives have moved online, from work to worship to shopping to social gatherings. This is a front and centre issue.

Davenport residents are not comfortable entrusting all their data into the black hole of the Internet, managed mainly by big multinational tech giants. These companies have been operating with outdated regulations and limited transparency. As Canadians right now, we have no choice. We are all used to downloading apps or signing up for things online that come with long privacy policies and consents requests. I do not know about everyone else, but most of us do not have time to read all the online terms and conditions that are often in legalise and not easy to understand. That is why I am happy that Bill C-11 would require plain-language consent requests.

We are also too used to being peppered with targeted ads and content based on the websites we visit, with no consent or even knowledge about algorithms that track our actions. It is impossible to keep track of how our personal data and how our online actions are being used or abused, whether it is to misinform others or even more nefarious purposes like identity theft.

That is will I am glad that Bill C-11 is before the House. It marks a huge leap forward in our privacy laws. Canada must do all it can to protect the data of all our residents, and Canadians should know exactly how their data is used with maximum transparency. We should have the right to manage what data is kept online and what is deleted.

Canada must also keep up with the rapid growth of the digital economy, as hundreds of companies and organizations are now handling our personal data. Other countries have already acted on this. The E.U. passed the General Data Protection Regulations in 2018. Its rules require that other countries meet its standards to do business, to exchange data across borders. This means that if we want Canadian businesses to continue to have an edge in European markets, we have to modernize our privacy rules. It is imperative that we move now, as aggressively as possible, and for all these reasons, we must pass the digital charter implementation act.

What would the bill actually do? First, the bill introduces the new consumer privacy protection act that updates the old PIPEDA act, which was first passed in 2001. Second, the bill introduces the personal information and data protection tribunal act to create an oversight and enforcement body for the new privacy rules. Third, it would retain the measures of part 2 of PIPEDA under the new electronic documents act. The measures in the bill are built upon three key goals: consumer control, responsible innovation and strong enforcement and oversight.

Let me just touch very briefly on how the measures in the bill would meet each of these goals.

First, how do we give consumers more control? Bill C-11 would modernize consent rules and would require companies to ask for consent in plain language, which is great. The bill would also give Canadians the right to data mobility. That means they could direct one organization to share certain data with another for a specific reason. For example, they could direct their banks to share financial information with another bank.

Next, it would give Canadians the right to withdraw their consent for the use of their data. It would allow people to direct a company to delete whatever personal information it has about them, including on social media platforms, which would give control of personal data back to Canadians. The bill also clarifies that even information that has been de-identified is still personal information. Even if a company removes people's names from its data, this bill would ensure that the data still belongs to those people. It has to be protected, and companies need their consent to use it.

Finally, the bill requires transparency for use of algorithms and AI. It would give every Canadian the right to request an explanation of how and why an automated system made a choice or prediction about the individual. I am hoping that at some point, we are allowed to relay what companies can and cannot do with that information.

The second goal is enabling responsible innovation. We want our country to stay globally competitive, support innovation and unlock the potential of data to create incredible value and improve our lives, but we need to support that innovation in a way that guarantees the right to privacy. The bill would simplify consent rules so that companies are not burdened by seeking consent for every use of information, even when consumers reasonably expect it. This is good for business and also helps Canadians make meaningful choices. Rather that being bombarded by consent requests full of legal jargon, consumers will see plain language requests when it really matters.

Bill C-11 would also allow Canadians the choice to contribute their data for the common good. It would allow businesses to share de-identified data with certain public institutions to power social benefits like public health and infrastructure. Lastly, the bill would allow businesses to submit their codes of practice to the Office of the Privacy Commissioner to ensure they comply with the law. This kind of transparency and streamlined regulation is both good for businesses and good for Canadians.

The third goal is strong enforcement and oversight. With any new regulations, we absolutely need stronger enforcement and oversight. Indeed, I know that is something the Office of the Privacy Commissioner has long requested. What would this bill do? It would give the commissioner that power, including forcing an organization to comply with privacy laws and ordering a company to stop collecting data for personal information. It would also create the personal information and data protection tribunal, and the Privacy Commissioner could also ask the tribunal to impose fines. We would have the stiffest penalties in the G7. For small transactions, the fine would be 3% of global revenue or $10 million, whichever is greater, and for more serious violations, the penalty is up to 5% of global revenue or $25 million, whichever is greater.

I mentioned earlier that Davenport residents have been raising this as a concern to me for five years now. I have received a number of letters, so I want to pay tribute to all those who have written to me through the years to indicate that this continues to be an issue. I know they will be very happy to hear that we are moving forward on this legislation.

This bill is the first of many steps our federal government will take to protect Canadians' privacy and harness our country's potential in the digital age. Our current privacy laws were passed in 2001, and in 20 years the pace of change has left those laws badly out of date. We will need to keep doing more to stay on top of rapid changes, looking at both the threats and the opportunities. Davenport residents and, indeed, all Canadians demand that we continue to do all we can to keep our privacy and data security laws updated in a way that protects them, while still enabling data to be used for innovation and economic growth.

In 2019, we set out a vision for the Internet in the digital charter. That vision is of an Internet that serves the public good and guarantees certain rights, like the right to control and consent, the right to transparency and portability, the use of data for the common good and the need for strong enforcement and accountability.

I am proud that our government has introduced this bill to implement the digital charter and guarantee these rights to Canadians. We have seen big new challenges, and we have stepped up with real solutions. I ask all of my colleagues for the speedy passage of this bill.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Mr. Speaker, I am very glad that we are trying to update the legislation to reflect our digital reality.

The member commented on the Privacy Commissioner and the additional powers that would be given. We have seen quite a number of privacy data breaches from the federal government, especially from the Canada Revenue Agency. Would the Privacy Commissioner have the ability under this legislation to fine the government or order the government to stop collecting private information because it is not adequately protected?

[Julie Dzerowicz, Liberal, Davenport, ON]

Mr. Speaker, I can assure the hon. member that it does not matter whether it is the federal government or any level of government; we are all really concerned about any type of these breaches. The honest answer to her question is that I actually do not know if the Office of the Privacy Commissioner is able to. I will ask about it.

My sense is that it is what we are trying to do, so I would hope it would also incorporate the federal government and the different levels of government. I do not know the answer. I hope it would be the case, but I know it does have the power to order businesses to do that. I will look into it and get back to the hon. member.

[Yves Perron, Bloc, Berthier—Maskinongé, QC]

Mr. Speaker, I thank the member for her speech.

What our Conservative colleague said is true. This bill does not seem to apply to the government.

I have another question. There is another flaw with respect to the identification of individuals. There is nothing in the bill to force banks, for example, to institute a strict policy for the identification of individuals, nor is there any kind of fine system that would compel them to do so.

Is the government open to a series of amendments on this issue?

[Julie Dzerowicz, Liberal, Davenport, ON]

Mr. Speaker, one of the reasons I am eager to move forward with this legislation is that it is good to have these types of discussions in committee. If there are improvements to be had and ways we could even strengthen what is already an excellent bill, there is always an opportunity to do so at committee.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Mr. Speaker, as we know, big corporate data privacy breaches are becoming more common every year, and Canadians are concerned about how the big tech giants like Facebook are collecting and using information. Privacy is now a household issue that really affects everyone.

My concerns are around the private rights of action, which would allow individuals and groups of consumers to seek compensation in court. This has been effectively used in the United States to remedy violations. However, it is unnecessarily so burdensome in Bill C-11 that it effectively makes it unusable. For example, if the Privacy Commissioner does not investigate and rule on a complaint, an individual has no right of action. If the Privacy Commissioner does investigate and rule on a complaint but the tribunal does not uphold it, the individual has no right of action. Additionally, if a two-year timeline is exceeded for whatever reason, individuals lose their right of action, basically making it a right only in theory but not in practice.

Does my colleague agree that the bill needs to be amended to fix this?

[Julie Dzerowicz, Liberal, Davenport, ON]

Mr. Speaker, believe me, I am very concerned about data and ensuring that Canadians have complete control over the data they are sharing: who uses their personal data and for what purposes. A fundamental objective of this bill is to give control and consent, to ensure transparency, portability and interoperability, and to have strong enforcement and real accountability. If there are some additional measures the hon. member thinks should be considered, I would suggest that it be brought up in committee.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I would put to the hon. member this quote from Jim Balsillie, from an article in the National Post in March: “The algorithms that push this content are addictive by design and exploit negative emotions—or, as Facebook insiders say, 'Our algorithms exploit the human brain’s attraction to divisiveness.'”

This bill would not address that problem. Is the government open to amendments in committee to deal with this aspect of the dark web?

[Julie Dzerowicz, Liberal, Davenport, ON]

Mr. Speaker, the point the member brought up is something I personally worry about as well. It really bothers me that my actions online are fed into some sort of an algorithm or AI system and translated in specific ways I have no control over. I would like to believe, and do believe, that all these types of amendments would be very open to consideration within committee.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Mr. Speaker, I am honoured to speak to Bill C-11 and data privacy.

Many in Parliament know of the previous work that has been done by the access to information, privacy and ethics committee. We dealt with this in 2018 around Facebook and Cambridge Analytica. We came together in London for the first meeting of the International Grand Committee, which represented nine nations and close to half a billion people. We have all seen how data manipulation can be misused by big tech, and our efforts in the International Grand Committee were really to set the stage for what we can do together to push back on some of big tech's practices and hopefully reform those practices. As chair of that committee, I was especially pleased with the efforts of all the parties in the room. In their speeches, the member for Beaches—East York, the member for Timmins—James Bay, my own colleague from Thornhill and many others took this on, as we care about all Canadians' data and privacy.

It is laudable that Bill C-11 attempts to combat some of the concerns that we have and crack down on some of those practices that have been concerning for many years. It deals with things like algorithm accountability, which has been mentioned by some colleagues today, personal access to data, de-identification of information, and certification programs for big tech so that there is a certain set of standards to be followed. Some of these moves have already been taken up by some in big tech who are doing this on their own to some extent. Stiffer penalties are recognized in Bill C-11, as well as private right of action.

However, there are many other things I am concerned about that are simply not in the bill, or there are huge exemptions that a freight train could run through, which would neutralize the bill in many respects.

First, privacy as a human right is the number one thing that I do not see in the bill. Many have said, from our efforts, that privacy as a human right needs to be foundational to any legislation. Conservatives recently passed a policy that deals with this exact principle:

The CPC believes digital data privacy is a fundamental right that urgently requires strengthened legislation, protections, and enforcement. Canadians must have the right to access and control collection, use, monitoring, retention, and disclosure of their personal data. International violations should receive enforcement assistance from the Canadian Government.

Clearly, this is a concern of many. We have heard from countless witnesses and experts. Jim Balsillie, who has been mentioned already this morning, warned us of what can happen if we do not take this seriously.

I will talk about the exemptions in the bill that concern me, and my copy of the bill is very well highlighted for some of the errors that are in it.

There is “Exceptions to Requirement for Consent.” A meaningful consent is another principle that we really need to address in the bill, and it has been mentioned already. If children have an app they like to play games on, all that has to be done to basically hand over their data is just a little check box in order to play the game, and we call that “meaningful consent”. Bill C-11 says that it attempts to fix that, but I will go over the exemptions.

“Exceptions to Requirement for Consent” states:

An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for a business activity described in subsection (2)

This is the list of activities in subsection (2) that are exempt from meaningful consent:

(a) an activity that is necessary to provide or deliver a product or service that the individual has requested from the organization;

(b) an activity that is carried out in the exercise of due diligence to prevent or reduce the organization’s commercial risk;

(c) an activity that is necessary for the organization’s information, system or network security;

(d) an activity that is necessary for the safety of a product or service that the organization provides or delivers;

(e) an activity in the course of which obtaining the individual’s consent would be impracticable because the organization does not have a direct relationship with the individual; and

This is the big one:

(f) any other prescribed activity.

I appreciate the Liberal members stating that this bill is an effort to get us to a better place around data privacy in Canada, but exemptions like that in the legislation need to be addressed. That is why our party talked about getting Bill C-11 to the industry committee to have a fulsome discussion of its good parts and of what needs to be fixed and strengthened. Sadly, the current government has decided to send it to the ethics committee instead of where it should go. Some of the audience today might understand why. Because of the government's many ethical lapses and failures, it would like to use up all of the time it possibly can with other legislation, such as Bill C-11. Only ethics violations should really be discussed at the ethics committee. It is unfortunate that this is going to be pushed to the ethics committee. My hope for legitimate changes to the legislation may be muted by a rush to get through it, and it may not be given due diligence, as many Canadians are expecting it should.

I want to thank the Canadians who have come to me over the years to talk about their concerns around the way our data is collected. Many years ago I coined the phrase that our online data is essentially our digital DNA. It is who we are online, and we need to do all we can to protect the information and data of Canadians. In this new era of social media being in the public square, we need to do our due diligence as legislators to make sure that it is protected as much as possible. Unfortunately, although the effort is laudable, this legislation simply falls short. That is why, from our perspective, we want to see it go to committee and hopefully changes can be made there.

There is an old saying: “Don't let the perfect be the enemy of the good.” I do not think we can call this legislation good quite yet.

I wanted to thank some of the guests we had before us. There has been some discussion that not enough has been heard regarding privacy and digital issues online, but we had countless experts from Canada and heard from experts around the world. We heard from Shoshana Zuboff and many witnesses at our International Grand Committee who really set the blueprint for what can be done with digital and data privacy. We have a way to make it better.

Our Privacy Commissioner made many suggestions. We see some of those in this legislation regarding increased fines and stiffer penalties for big tech if they misuse people's data or have lapses with that. However, the legislation still falls short. My hope is that it gets to committee so the committee can get a really good eye on it and have the chance to propose some fixes to those exemptions and other holes in the legislation.

I look forward to any questions.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, the hon. member for Prince George—Peace River—Northern Rockies and I may be known around this place to rarely agree with each other, but I want to salute him for his leadership on this work. We are 100% aligned in that we need to do much more to, in his words, deal with the appropriation without consent of our digital DNA. I agree with him: It is unfortunate this is going to the ethics committee instead of industry, but it is one of those files that has feet in both committees.

What does he think would be the most important amendment to make to this legislation, or should we scrap it and start over as some critics are suggesting?

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Mr. Speaker, I would like to thank the member for her comments and kind words.

The most important thing would be to recognize privacy as a fundamental right or a property right. It needs to be recognized with that significance. The rest comes from that being at the top of the pyramid, because if that fundamental ideal is not there many other reasons can be made not to legislate appropriately. However, if that is the foundation we have a great place to go with the recognition of how serious data is. It really is our digital DNA. We need to protect it as such, and apply rules to big tech and other companies so they use it appropriately.

[Jenny Kwan, NDP, Vancouver East, BC]

Mr. Speaker, regarding Bill C-11, the Privacy Commissioner has stated that he is concerned with the government's new definitions of commercial activity and consent rules. The current bill actually has much less protection of privacy than the previous definition.

I wonder whether the member could comment on that. Does he share those concerns? Should the government be making amendments in this regard?

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Mr. Speaker, I do share those concerns. In my work as the former ethics chair, I have gotten to know our Privacy Commissioner professionally, and I really heard the case for having stringent protocols around data. Again, this bill is supposed to deal with those concerns, and I listed the exceptions, even for the requirement to consent. Members can use the analogies they want, but a truck could drive through it. When there are huge exceptions for uses of data this bill should tighten them up, not open them more widely and broadly. I think this is what needs to be addressed in committee, and my hope is that it will be at ethics.

[Ted Falk, Conservative, Provencher, MB]

Mr. Speaker, I want to thank the hon. member for Prince George—Peace River—Northern Rockies for bringing to the attention of the House some of the errancy of Bill C-11. In particular he noted that this bill should be heading to the industry committee, and it has found its way back here because the Liberals are trying to prevent the ethics committee from doing its work on other very important issues, such as scandals. I acknowledge that.

The member also talked about some exceptions in the bill that would make it less effective than it should be, and I am wondering this: Are there any exceptions in particular that he finds particularly grievous?

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Mr. Speaker, there are many provisions that might be legitimate, given that, between a bank and a person who deals with that bank, there are agreed-upon arrangements. However, there is an exception in place, where it says the organization may collect or use an individual's personal information without their knowledge or consent, if the collection or use is made for business activity described in subsection 2, and that description is for “any other prescribed activity.”

That essentially means the door is wide open for however that corporation wants to use that person's data. “Any other prescribed activity” means that if it decides it wants to use the data for x, y or z, that is up to the corporation. It does not appear to be up to the individual. Things like this need to be tightened up in the extreme. We also need to allow consumers, who want to have their data used, to give corporations their data for a good reason. It must have high fences, so that a corporation cannot use it for anything else and cannot sell it. The biggest concern I have, with all our understanding of data, is of people being manipulated by their data, and our kids being manipulated by their data. People's ever-increasing time spent on smart devices is concerning to everybody in Canada, and we need to make sure that corporations are only using data they are allowed to, in ways they are allowed to.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Mr. Speaker, it is a pleasure for me to be here today and to contribute to this debate on Bill C-11. I have been here for four years. It is hard to believe, as I just had my anniversary on April 3, that I have been serving the good people of Calgary Midnapore for four years, which I am so fortunate to do. At this point in my political career, if I do not believe that the messengers themselves are sincere, I have a hard time believing the message. It is really hard for me to think about and understand a policy if I do not have a lot of good faith in the individual or entity from which it is coming.

There stems one of the two struggles that I have with this bill: I do not genuinely believe in the sincerity of the current government to protect Canadians. I have seen this from many perspectives, both past and present. My second concern is a sort of generalization, but it still remains that I see the government doing things in a half-hearted effort. This is along the same lines as my first point about insincerity.

When I refer to my past experience with this, I am drawing upon my time as the shadow minister for democratic institutions. Bill C-11 is relevant to that because, during my time as shadow minister, the Digital Charter was announced. If not legislation, this was certainly an important policy announcement that was supposed to carry a lot of weight. At the time, we were debating Bill C-76, which would have major implications for future elections. The digital conversation, along with foreign interference and foreign influence, had a lot to contribute to the discussion around Bill C-76.

When the Minister of Innovation, Science and Industry made his announcement at that time, along with the minister of democratic institutions, it felt very flat. It felt as though it was one of those commercials for children on a Saturday morning or, since the current government likes to insult Conservative institutions so much, perhaps a video from PragerU. It really did not come across with a lot of sincerity or a lot of teeth. It just seemed to do what the government likes to do, which is a lot of virtue signalling.

This bill also reminds me of the tribunal composition. It always concerns me a little when the government creates a body that has any type of implication in the direction of Canadians' lives or industry. I am thinking of the Leaders' Debates Commission, which I believe significantly impacted the debates framework in the last election. I recall the question from the member of Parliament for Provencher to the previous speaker. If we look back now, the debates commission included one of the Kielburger brothers. It is very interesting that we find this here today.

One thing I am concerned about within the framework of the Bill C-11 legislation is that the current government members always find a way to take care of their friends. We have seen this with SNC-Lavalin, which we are still dealing with the implications of here today as we go through the pandemic; with Mr. Baylis, the former member of Parliament; and, as has been alluded to before, the WE Charity scandal, which the previous speaker indicated. Unfortunately, this legislation is being sent to ethics rather than industry in an effort to delay that. Even in the context of Bill C-11 and what this is supposed to do, I worry about government members taking care of their friends.

I mentioned that the second part of my concern was that the current government does everything half-heartedly. I believe that includes this legislation, without question.

We look at the possibility of information being shared with other parties. The bill would allow an organization to transfer an individual's personal information to a service provider without their knowledge or consent. Regarding the right to have the collecting party delete collected information on request, it somewhat deals with that, but when I have tried to unsubscribe, in some situations it has definitely been unsuccessful.

We also see in the bill the right to opt out of the sale of personal information where an organization may transfer an individual's personal information to a service provider, again, without their consent or knowledge. This is a theme that I am seeing in terms of the government addressing things half-heartedly and Bill C-11 definitely falls within this.

Also, we have seen this half-hearted response with the pandemic from the very beginning in terms of the government's eliminating the warning system prior to the pandemic's arrival; the return of personal protective equipment, which showed such a lack of foresight for the necessity of its use not months later; and the slow closing of borders that we saw at the very beginning, and in my position as shadow minister for transport I have seen incredible, draconian measures that were inserted at a result of poor response earlier on. It is the same with any situation when the longer we allow something to fester, the greater the response it requires later on. Unfortunately, Canadians are paying the price of the inaction. There is also the rapid testing and of course vaccines, which is a complete failure of the government and of the Prime Minister .

I want to say to any Canadian who is listening to this speech, if they are upset because their business is closed, their children are at home and not at school, they have not seen their family in 18 months, there is a third wave, it is the fault of the Prime Minister for so poorly preparing for the later stages of this pandemic. This is another half-hearted response that I have referred to.

We have also seen this unfortunately within the defence committee. The government was willing to turn its back on women all across the country in not believing the stories and yet it is willing to investigate the unfortunate situation of the member for Pontiac, who is an incredible individual might I say. My husband and I had the good fortune of travelling to Israel with him and I will stand in solidarity with him.

In kindergarten, I was painting a picture and when I was done, I had taken off my smock and was standing there in my slip when my good friend, Kim Crocker, who I later had the pleasure of serving with in student council with in high school said to me, “You're standing there in your slip” as all the fine women of Calgary Midnapore did wear at that time. My point is the Liberals have turned their backs on women at the defence committee as well.

If there is something good to be said about this piece of legislation, in my capacity as shadow minister for transport, many right-to-repair organizations and the small repair shops across rural and suburban Canada have said that Canadians have the right to own their data.

Colleagues within the Conservative Party will argue that this is a property right and a human right. As we advance in the digital age, I believe more and more that this is a human right, that our history of data will one day be almost synonymous with our DNA.

I will leave it there. I do not believe in the government's sincerity of protecting Canadians. I believe that so much that the Liberals do is a half-hearted effort. For both of these reasons, I stand here today in regard to Bill C-11 with a lot of questions about the legislation, but the belief that I am not certain whether this legislation goes far enough.

[The Deputy Speaker, Conservative, Bruce Stanton]

Before we get to questions and comments, I see the hon. member for Cloverdale—Langley City is indicating a point of order.

The hon. member.