Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Industry and Technology

[Brian Masse, NDP, Windsor West, ON]

moved:

That it be an instruction to the Standing Committee on Industry and Technology that, during its consideration of C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, the committee be granted the power to divide the bill into two pieces of legislation:

(a) Bill C-27A, An Act to enact the Consumer Privacy Protection Act and An Act to enact the Personal Information and Data Protection Tribunal Act, containing Part 1, Part 2 and the schedule to section 2; and

(b) ) Bill C-27B, An Act to enact the Artificial Intelligence and Data Act, containing Part 3.

Mr. Speaker, as New Democrats, we are taking this opportunity to try to rescue part of a bill to protect Canadians' privacy as the Conservatives and Liberals have been warring over a number of different things. We have an important piece of legislation that has been drafted poorly but can be recovered. We are going to focus on this Parliament being able to rescue tens of thousands of dollars, having multiple meetings with witnesses and a variety of organizations, including the Canadian Chamber of Commerce and others, that would not seem to be naturally in the NDP camp, but are on this issue.

It is important to note that the petty politics going on by the Liberals and Conservatives on this are at the expense of the privacy of Canadians. Specifically, I am talking about Bill C-27, which goes back to 2020 with regards to Bill C-11. It re-emerged in 2022 in this chamber, in November, when the Liberals tabled an act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

The Liberals drafted a bill that was so encompassing and so problematic because they were willing to compromise personal privacy rights for the consumer industry, big tech and other businesses at the expense of individual Canadians' privacy. However, we called them out on that. We have this motion in front of us today because the member for New Westminster—Burnaby stood in this chamber and helped separate the actual bill to make sure that the privacy component of this, which should have been done separately, can still get done.

As Parliament winds down, not only this session but potentially a future session, we still have time to protect Canadians' privacy. The Liberals and Conservatives have no interest in this whatsoever. They would rather play their own games and sacrifice the privacy of Canadians.

The bill was so poorly drafted that when I first saw it, I went to the minister back in 2022 and asked him to separate the bill, saying that he did not have to compromise Canadians' privacy for consumer interests. The Liberals knew that, because their lobbyists, their friends, their CEOs and the big tech, all those elements were chirping in the minister's ear, basically giving him the political support to go ahead with this. When I said to the minister, “Separate the bill, and let's do the privacy component first”, the Liberals basically said that they could not do it, they did not want to do it. We proved that wrong in this chamber by separating the bill in a previous debate.

Here we are now, as New Democrats, understanding there are dozens of organizations calling for the personal protection of privacy, including the Privacy Commissioner, to get this done and to not waste the work that is now being compromised by the games going on by the official opposition and the Liberals.

Again, this bill was drafted so poorly. When bills go to committee, they usually have maybe a dozen, at the most, amendments. Of those amendments, there are usually a few that are very significant to the bill and others that could be on language. I believe this bill had over 240 amendments to correct the problems with the bill.

We had debates here in the House of Commons and we referred the bill to committee. The minister showed up, after doing a lot of prancing around Canada about how great the legislation was, talking about the importance of artificial intelligence and how Canada has to deal with it, which we do agree with. However, the reality is that he did not care at all, and neither did the Liberals, about the privacy element.

In fact, we saw elements of the bill do the same thing to the Privacy Commissioner. This has been taking place in the Competition Bureau. I am referring to the Shaw-Rogers takeover. We saw the debacle that played out, because New Democrats were the ones that opposed that. We have seen that it has not lowered prices, only laid off workers. It has led to non-disclosure clauses from the people who got fired from Rogers. The Liberals did not care at all and created a tribunal over the top of the Privacy Commissioner.

That is important, because the tribunal, for doing its job, was actually sued by Rogers. Rogers took it to court to do due diligence, but the tribunal, which has people appointed from Liberals and Conservatives, then taxed our own Competition Bureau $10 million to pay for the legal costs for Rogers for just doing its job.

We did not want the same thing, we do not want the Privacy Commissioner being overridden by political appointees of Liberals and Conservatives. The history that I have seen here in this place, over the two decades I have been here, is one of constant appointments of either the blue or the red team to different positions of power, with no oversight and no accountability, leading to decisions against the public.

The bill came back to committee. I do not even know how many witnesses we had, off the top of my head, but we went for a long period of time and heard how badly the legislation was drafted. Some were so desperate to have anything that they would take anything, and they admitted that the bill was basically a piece of garbage. They basically said they would just take anything other than nothing, but most of those times, that was from the interests tied to businesses and consumer rights for industries versus those concerned with Canadians' personal privacy and protection. We heard that constantly, as the committee wound through all the different witnesses.

The minister came to us at the very beginning of all those witnesses and said he had some amendments, but it turned out those amendments were just ideas. They were not in any legislative format that we could deal with. They were not in any legal terms. He did not have the House of Commons or his department draft them. They were basically a set of ideas and propositions that did not even make any sense, in terms of the legislation. I do not think the minister even understood, and probably does not to this day, the amendments.

We got through the entire process. We fought over these amendments and what the minister really meant. Was he willing to compromise on the Privacy Commissioner and trying not to neuter it? Was he willing to do the right things to fix some of the elements of AI that people are concerned about? I kept on asking witness after witness whether they thought we should split this bill, and the resounding answer was “yes,” even from those who want to get the AI stuff done, and that there was no need to put the Privacy Commissioner in there.

Again, I go back to the roots of this legislation. The roots of this were to address the undermining of personal privacy of Canadians at the expense of businesses being able to access their data information and not be updated. We have an open hole right now. We have all this work that has been done, but we are going to propose to send it back to committee with this motion to try to deal with it and see if this House can actually get something done for Canadians. We spent a lot of time and money on this. There are some really significant issues here, and we are doing this because we have been in consultation with many groups and organizations that still want to see our privacy protected.

We got to clause-by-clause, and we went through over 200 amendments, as I mentioned. We found that there are some elements there that we could actually work with, at least as the opposition members. To give credit to the Conservatives, the Bloc and ourselves, there were some elements that we could actually agree upon and work with, and the government altered some of its stuff, too, but we were still stuck in a myriad of problems.

The situation became so bad that the Liberals began to filibuster their own bill in committee, because they did not know what to do. The minister then said he would come back with further amendments, and we have not seen them to date. I raised this most recently a couple of weeks ago as we tried to plan out our session, and we still have not had the Liberals bring back any of those amendments. They are on the record promising them. They said that they were going to happen, but we still have not been able to get over this tribunal issue. The tribunal issue is something important that we can get done.

Hence, we are going to split this bill, or see if there is interest in the House to do it, to see if we can rescue part of this legislation. I think it is important to note that, when we look at some of the issues here, the Canadian Civil Liberties Association has raised concerns about this. It has some of the best capabilities of understanding legislation and it understands that we must protect the privacy component. Unlike the United States, we do have a Privacy Commissioner, and that is very important when dealing with artificial intelligence. It cannot actually be different.

The Privacy Commissioner of Canada also expressed misgivings and reservations about the bill's structuring and proposed measures for digital privacy in AI. Governments could benefit from them being addressed separately, as these are distinct areas that require separate attention.

Again, we have that component that can go forward with support from the Privacy Commissioner. It is indifferent to how legislation should be brought through the House of Commons, but at the same time it recognizes this is not the only way to do this. The minister did not have to throw everything he could into a bill to diminish privacy rights to distract Canadians, and that is really what this was about.

We should never even have started on the AI component without finishing the privacy component. This could have been done ages ago, and it should have been done ages ago. The Canadian Internet Policy and Public Interest Clinic is calling for separation of the bill, emphasizing the importance of ensuring that privacy laws and AI regulations receive individual, dedicated scrutiny, especially given their different implications for society and households. These organizations, among others, are also very much interested in moving it forward.

I mentioned the Canadian Chamber of Commerce as well. It sent in support, believing that the legislation has to be separated. I had a chance to meet with the members recently on a number of different issues, including border issues. They are really well aware. I know the previous debate was partially about CBSA officers. I am on the front line; I have 40% of Canada's daily trade go through my riding to the United States. The New Democratic Party has been supporting getting the training centre and improving the mandate of CBSA officers. This includes being able to seize illegal and counterfeit goods and materials, which they cannot do so readily right now, as well as ensuring that the 1932 order in council has been rescinded and, most importantly, giving the push to get 1,100 frontline border officers and sniffer dogs.

Those who were doing the examination are hired back by the Liberals after they were cut by the Conservatives. Under COVID, we had two tranches of not hiring workers. They are short 2,000 to 3,000 workers right now. The Conservatives and Liberals pushed for apps like ArriveCAN to take over the workers on the border. They went to more automation.

We believe the solution is right in front of us, and that is workers on the front line. Bring back the sniffer dogs. Bring back the workers who were fired and put them on the border where they should be. This is also a way to help stop drugs, paraphernalia, car smuggling and all that from coming into Canada.

We can look at a number of different things. I want to go back to and talk about how the Canadian Chamber of Commerce is actually calling for this bill because it understands there is a difference when it comes to artificial intelligence and the privacy elements.

It is important, not only to individuals but also to companies to understand how to protect Canadians' rules. There are many Canadian companies that want to follow rules, protect privacy and do the right thing. Those companies should be rewarded versus some of the larger ones we have seen, like Meta, Facebook and so forth. These companies have used loopholes to expose people in their privacy or use it to their advantage to manipulate them, and are getting rewarded for it and do not have to pay the consequences of not respecting privacy or the provisions under data protection.

In fact, it was the New Democratic Party that put forth the first legislation on a digital bill of rights. We did this several years ago on everything from net neutrality to the right to be forgotten with regard to getting information scrubbed from the Internet, as well as a series of things to protect personal privacy. I know this very well coming from the automotive capital of Canada because we saw what took place with vehicles. They now gain information about drivers and how that is sold, how it is distributed and so forth, versus even actually selling the cars at times. This data can be more valuable than making the vehicle. This is one of the reasons we have had a focus on this for a long period of time, and we believe the privacy element should not be abandoned by the misfortune in the House.

There are a number of different organizations that are also concerned with this. In an article for The Hill Times, Andrew Clement says, “the Artificial Intelligence and Data Act needs a reset.” The author states that AIDA was written “too hastily”, noting that it “skipped...the normal public consultation” process and was introduced alongside the digital charter implementation act, whereas it should have been “separated from the rest of Bill C-27 for substantial reworking.”

The author suggested redrafting AIDA, which should include genuine public consultation; looking to the European Union's Artificial Intelligence Act; and engaging community advocates, researchers, lawyers, and representatives of at-risk populations. The reason I gave that reference is that this was the due diligence and why the minister laid an egg with this bill. It was basically broken upon delivery as well because he did not do the work that was necessary beforehand, consulting all the different organizations. What we had is what Ottawa loves. Ottawa loves this so much. Ottawa has the back room scurrying with all the lobbyists who go to the Conservatives and Liberals. They all get paid for this. They are lawyers or representatives, who are getting the meetings and all those different things. Can we guess who the mass majority of them are? They are Liberals and Conservatives. They get all these appointments. They get all this lobbying going on; then, instead of having public consultations, which we think would have been important, they start to steer their influence if they can.

Canadians care about privacy. Members can look at the B.C. civil liberties union and others across the country, including some good protection in Quebec, which is better than in other parts of Canada. We need to give them credit for that. On top of that, that interest is well respected, not only here but also across the world.

Interestingly enough, on April 24, a joint letter was sent to the minister; it was also sent to the rest of us in turn, as well as to the official opposition. It was a joint call for AIDA to be sent back for meaningful public consultations and redrafting. Nothing has happened since then, aside from more debacle. These groups and organizations are calling for something the NDP has been asking about for a long period of time, in terms of why the government is putting privacy rights at the expense of artificial intelligence rights for businesses and corporations. I asked about that, especially when I had the first meeting with the minister.

These organizations include Amnesty International, the Canadian section; the BC Civil Liberties Association; the Canadian Arab Federation; the Canadian Civil Liberties Association; the Canadian Muslim Public Affairs Council; the Centre for Digital Rights; the Centre for Free Expression; the communications program of Glendon College, York University; Digital Public; Fédération nationale des enseignantes et enseignants du Québec; the Firearms Institute for Rational Education; International Civil Liberties Monitoring Group; Inter Pares; Just Peace Advocates; Macdonald-Laurier Institute; Mines Action Canada; the National Union of Public and General Employees; NSTP Consulting corporation; OpenMedia; the Privacy and Access Council of Canada; Response Marketing Association; Rideau Institute of International Affairs; and Tech Reset Canada.

Then there is a whole series of other individuals who would add another 34 names that I could actually put down here. I will not read them all because there are just too many. However, reading out the names of those different organizations tells us that there is a general consensus that the legislation is a complete and utter disaster the way it is. What we can do now is what New Democrats have called for in a motion, which is to separate them as follows:

(a) Bill C-27A, An Act to enact the Consumer Privacy Protection Act and An Act to enact the Personal Information and Data Protection Tribunal Act, containing Part 1, Part 2 and the schedule to section 2; and

(b) Bill C-27B, An Act to enact the Artificial Intelligence and Data Act, containing Part 3.

That way, we can actually do the job that is necessary.

This is crucial because Canada has fallen farther behind. I know that the Liberals are all excited about creating another digital group and committee, which the minister announced, because we cannot get this through committee if there is no interest. Again, I remind the chamber that, the last we saw of this, the Liberals were in committee filibustering to talk out the clock before we broke session. They would not even come with their own committee recommendations or amendments. They talked the clock out on themselves for the last two meetings that we had because they did not know what to do. We are still waiting, to this day, for those amendments to come forward.

As I wrap up my speech, I want to thank all the interested parties out there. Canada has an opportunity with artificial intelligence; Canada could actually be a leading component for good on this in the world. However, we have to do this with the right protections in place and the right way of doing things. The first thing is to protect our privacy elements with the Privacy Commissioner and update, and the second part is to get it on to the business of order.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you for that.

During your time as deputy in the last Parliament, the government introduced a privacy bill, Bill C-11, and Minister Bains would have been the lead for that.

Do you recall that bill?

Access to Information, Privacy and Ethics

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, I want to thank my hon. colleague for giving a great speech. It seems like nine years ago that we sat on the ethics committee, but I think it was only three years ago. We use the number nine a lot in the House.

Today, I want to speak about why nations fail. To quote Acemoglu and Robinson, “Nations fail today because their extractive economic institutions do not create the incentives needed for people to save, invest, and innovate.” As a whole, that also includes privacy: the right of businesses to operate and the freedom of citizens to operate.

We can go all the way back to something I am very fascinated with. North America and South America were founded around the same time, but how did North America end up becoming so rich and wealthy and South America did not? It comes down to those same pillars. We allowed freedom to operate. We allowed freedom for patents to be developed, especially in the Industrial Revolution. We allowed people the freedom to have their own land, to have privacy on their own land and to own businesses with patents, allowing privacy for those businesses to operate, to get investments and capital and to grow.

What we saw from that was a tremendous amount of wealth, more wealth than the world had ever seen. It formed a capitalist society that allowed wealth to be owned by individuals. People who used to be poor became wealthy, and that allowed a nation like Canada to have socialist capitalism. With this tremendous amount of wealth, there was the ability to have socialist programs like a universal health care system.

When we do not follow the narrow corridor, and it is a very narrow corridor, not only with liberty but also with capitalism and socialism, and we stick with the fundamentals of privacy, investment, free capital and patents, we lose the wealth of the nation. With that, the citizens suffer.

After nine years, we are seeing that reality here in Canada. We have the worst housing crisis this country has ever faced. Rents have doubled. Mortgage payments have doubled. The amount needed for a down payment has doubled. Nine million Canadians are now food insecure. That is one-third of Canadians, and that number in the U.S. is barely 13%.

We see the problem with businesses fleeing this country. We talk a lot about what that means for AI and having great ideas. We also talk about IP, the currency of innovation. When we look at what happens in Canada, the numbers are startling. Canada files 40,000 patents annually compared to the 374,000 the U.S. files, and only 13 out of 100 patents are owned by Canadians. That means we give away over 87% of our patents to foreign nations; we give that data away.

When we look at what that means for the Americans, we see they generate 12 million jobs and $2 trillion from patents and IP. Of course, AI is among that. In Canada, that number is less. The best way to look at it is by using GDP per capita or income per capita. The GDP per capita for Canada is $53,000, compared to $80,000 for the U.S., more than a 36% difference. We have seen less capital and less ability to invest, save and innovate.

We can couple that with the problems with the business investment and productivity we have seen in Canada and the lack of privacy. Of course, the government has tried, but as with a lot of things, it has tried and failed. It presented Bill C-11 before the last Parliament and could not get it through. In this Parliament, it submitted Bill C-27, and at the last minute, it threw AI legislation in it called the AIDA. What happened at committee? I know the Conservatives get blamed for this, but at committee, the Conservatives, the Bloc and the NDP all came together to say this bill was terrible in the way it was presented. Even the Liberals were filibustering it in committee at one point.

We need these bills to work. The Conservatives have been steadfast that privacy is a fundamental human right, and not only privacy for individuals in Canada but privacy for our children. We know the results of not having the right legislation come forward and not having privacy protection in Canada. We saw it at the ethics committee two years ago when we faced the daunting speculation of privacy in facial recognition technology.

This technology was misused. A company called Clearview AI scraped images off the Internet, and we know how many images are on the Internet. It scraped everyone's face off the Internet and sold those images, which should not be owned by anyone.

Privacy is a fundamental right. However, the thing we have come to also understand about AI, which was discussed at committee but was not in the legislation, is that it should never be able to use someone's face or likeness without their permission. Those are the biggest problems we are having. The biggest thumbprint we have, the most unique thing about us, is our face. Our colleague from the NDP brought this up, but the main point that came up at committee about facial recognition technology was this: When this technology was used by the RCMP and our police forces in Canada in terms of marginalized and minority groups in Canada, Black women and Black men, the technology misread their face and misidentified them 30% of the time. That is terrible.

Technology is supposed to make things better, and we could not believe what we were hearing. Police representatives were at this committee multiple times and testified that it misidentified these groups 30% of the time. That is a failure; it is ridiculous. This is something that should not be used. We went through all the reports on ethics and brought the final report to Parliament two years ago, in October 2022, with the recommendation to outlaw this technology until it gets better.

Here we are today, two years later, and this technology has not been outlawed. It has been in place for two years since the ethics committee found that there were these breaches. It is terrible that these breaches have been happening for so long. Today, as we stand in Parliament, facial recognition technology, which we call digital racism, is still allowed to be used in this country.

Again, it follows the bigger problems we have with the government, and not only with the recommendations that come from committee. The government always talks about filibustering. These are recommendations in a report that could have been done without Parliament's consent, because it was enacted by Parliament and came to the House to begin with. Here we are two years later, and that has not happened.

Let us talk about all the other things that have not happened either. With respect to privacy, Bill C-27 is still in committee based on, again, the fact that the Liberals are filibustering their own bill. It is just terrible and needs to be redone. I think we all agree on the first part of PIPEDA and how that is going to be done. The Liberals do not, but we agree that the tribunal should be eliminated and that more power should go to the Privacy Commissioner. Again, those privacy breaches and the rights should be governed by the Privacy Commissioner as a whole.

We looked at the proposed AIDA as a whole. AIDA was riddled with delays and inefficient guidance. It failed to provide the necessary oversight, allowing technologies such as facial recognition to remain largely unregulated. It was supposed to be prioritized legislation, yet it was wrong. The industry minister brought the legislation to the committee, and three months later, he brought 60 different amendments to his own bill. We had never even heard of that before, and it certainly was not a good bill.

I want to talk briefly about what is happening because we do not get privacy investment right in Canada. This is going to have long-term impacts. The capital gains tax hike is expected to reduce Canada's capital stock by $127 billion, resulting in 414,000 fewer jobs and a $90-billion drop in GDP. We cannot afford to lose control of our most valuable ideas or allow unchecked technologies to undermine our freedoms. Nations fail today because their extractive economic institutions do not create the incentives needed for people to save, to invest and to innovate.

The consequences are already visible. Nine million Canadians are food insecure. Two million Canadians are visiting food banks, and this rate is 36% higher than that in the United States. It is time to reverse course. Let us regain control over our privacy. Let us make sure we give those fundamentals back to save, innovate and invest back into Canadian businesses. Let us bring home capitalism once again, where people can make a good wage, have a good job and bring home savings for them and their families.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Let me pose my questions, if I could. Thank you.

I understand all of that, and there are different systems, but privacy commissioners all talk to each other. They're not some sort of independent, isolated person. In fact, they talk to each other around the world.

I'm sure you've read this, but in the current Privacy Commissioner's submission on Bill C-11 in 2021, he wrote:

The central issue in this design is as follows. In order to enhance consumer confidence, we believe that the decision-making system for adjudicating complaints should be as fast and efficient as possible. In order for individuals to have confidence, they would expect there to be real and timely consequences when the law is violated. Of course, the system must also be fair to businesses. Over a 40-year period, the OPC's performance in this regard has been excellent, and we welcome making our procedures more transparent and consulting on ways to enhance them. We are also prepared, should Parliament grant us the power to impose monetary penalties, to have to take into account any relevant factors, beyond those set out in—

He mentioned a particular section in the previous bill.

He continued:

In our opinion, the design of the decision-making system proposed in the CPPA goes in the wrong direction. By adding an administrative appeals Tribunal and reserving the power to impose monetary penalties at that level, the CPPA encourages organizations to use the appeal process rather than seek common ground with the OPC when it is about to render an unfavorable decision. While the drafters of the legislation wanted to have informal resolution of cases, they removed an important persuasive tool from the OPC. Moreover, this design is outside the norm when compared with other jurisdictions.

We've had a lengthy discussion on that already.

He continued:

Given these considerations, our primary and strong recommendation is to remove the provisions relating to Personal Information and Data Protection Tribunal....

That's from the previous bill, Bill C-11, which has been put forward again.

When the Privacy Commissioner appeared before this committee on October 19, 2023, he said:

Third, there remains the proposed addition of a new tribunal, which would become a fourth layer of review in the complaints process. As indicated in our submission to the committee, this would make the process longer and more expensive than the common models used internationally and in the provinces.

This is why we've recommended two options to resolve this problem. The first would be to have decisions of the proposed tribunal reviewed directly by the Federal Court of Appeal, and the second would be to provide my office with the authority to issue fines and to have our decisions reviewable by the Federal Court without the need to create a new tribunal....

He's an expert, but that was also shared by the former privacy commissioner when he appeared before this committee. He also pointed out that every provincial privacy commissioner opposes the tribunal. In fact, specifically, the Information and Privacy Commissioner of Alberta stated before this committee, at meeting number 104, that:

We are concerned about whether the inclusion of the tribunal as an appeal body to the Privacy Commissioner's orders would impact our ability [as provincial privacy commissioners] to conduct joint investigations.

There's a lot of opposition to this. That's what we've heard. I'm at a loss to see.... Almost anybody who's an expert in this has said this will lengthen the process and make it more difficult—everybody except the government.

[Samir Chhabra]

As was pointed out, CPC-9 is a very broad set of proposed amendments that would, as we understand it, have the effect of making three important changes. First, it would limit the imposition of cost awards against the OPC. Second, it appears to remove the private right of action that would allow folks who have been impacted by a transgression of law to be compensated for their loss. Third, it would remove the tribunal from part 1 of the act.

We see the tribunal as a critical element that's necessary to ensure that the system is credible and fair. Removing it would be inconsistent with the current commissioner's recommendations. We have since 2018 conducted a significant number of consultations and engagements broadly engaging Canadians. I believe in 2018 there were more than 30 round tables across the country. More than 550 Canadians participated in those engagements. The more recent figure of 300 meetings that the honourable member referenced, I believe, refers to part 3 of the bill, on AIDA, which obviously we will come back to later.

A number of stakeholders pointed out that it would be perhaps unprecedented and certainly out of alignment with international examples, and even some domestic models and examples, to have one individual carry out an ombuds function, an investigatory function and an adjudicative function all in one. There have been, to our count, 50 cases since 2003 that have gone from the Privacy Commissioner on to court. By our count, 70% of those court decisions disagreed with the OPC's position on the issue. Expecting the Privacy Commissioner to carry out these very distinct functions in addition to the significant new powers that have been added....

The CPPA will provide the Privacy Commissioner with a number of new enforcement powers. They include the ability to issue binding orders following investigations, which can order compliance with the CPPA. They can order organizations to cease activities that violate the CPPA. They can force compliance in a compliance agreement and also make public any measure taken to comply with the CPPA.

In addition, the CPPA enables the commissioner to recommend administrative monetary penalties. That's the point at which a recommendation would be made to the tribunal around the penalties. The orders and all those are powers being vested directly with the commissioner and not with the tribunal. It's important to recognize as well that the tribunal has an important appeal function to play and has expertise in the space by virtue of the fact that three of the six members of the tribunal must be recognized as privacy experts.

I also think it's important to point out that we don't see any risk of hampering joint investigations that would be undertaken between the federal Privacy Commissioner and any provincial counterparts. A number of international counterparts do have tribunal-type approaches, including Australia, New Zealand and Ireland, just off the top of my head. The U.K. also has a tribunal approach, organized slightly differently. The CAI in Quebec also has a tribunal approach to doing this function. We don't see any issues around joint investigations at all. In fact, the CPPA specifically encourages and allows for the OPC to engage with other regulators to share information and to leverage that information to the best effect to protect Canadians. It's also consistent with other areas of federal regulation in which tribunals are used—agriculture, transport, competition and international trade.

The efficiency of the CPPA tribunal has also been raised in this recent dialogue. It's important to recognize that we see efficiency gains actually being made by providing a tribunal that, first of all, pays deference to the commissioner's decisions, whereas a court would take a de novo proceeding. By having proceedings that are more informal and easier to understand and engage with for ordinary Canadians, rather than needing to have a lawyer go through the proceedings with the Federal Court, it would be less costly and easier to access as well, for those reasons, and for ordinary Canadians to engage with.

There are a number of very important reasons that we feel the tribunal is the right approach. The department did receive many, many inputs to that effect from a range of stakeholders, dating back to 2018, before the previous Bill C-11 was introduced.

I hope that helps to answer the question.

[Mark Schaan]

Mr. Perkins, I would note that Bill C-11 was contemplated by a previous Privacy Commissioner.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair.

Thank you, officials.

Before I ask a couple questions on this, which I don't believe I've talked to yet, I note that this is the third meeting we've had on CPC-7, most of which has been driven by the government's desire to amend and change it. I note this only because the government suggested that clause-by-clause would take four meetings and the government is the one pushing to make it longer.

Mr. Schaan, I'm a little concerned by your testimony earlier about the Privacy Commissioner. Bill C-11, which was the predecessor to this bill, attempted to make Privacy Act changes in the last Parliament, and I would like to read from the Privacy Commissioner's submission on it to committee, if I could:

While the OPC and the courts have provided some interpretations of sensitive information, it would be preferable to have a legislative definition that sets out a general principle and is context-specific, followed by an explicitly non-exhaustive list of examples (such as those included in article 9 of the GDPR). This would provide greater certainty for organizations and consumers as to the interpretation of the term. For instance, such a definition might read:

Sensitive information means personal information for which an individual has a heightened expectation of privacy, or for which collection, use or disclosure creates a heightened risk of harm to the individual. This may include, but is not limited to—

Does that sound familiar? It's in MP Garon's subamendment.

—information revealing racial or ethnic origin, gender identity, sexual orientation, political opinions, or religious or philosophical beliefs; genetic information; biometric information for the purpose of uniquely identifying an individual; financial information; information concerning health; or information revealing an individual’s geolocation.

That was for the last bill, so it comes as a surprise to me, Mr. Schaan, that you said the Privacy Commissioner has not asked for that. It's right in his brief.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair.

This one's not a test, I don't think.

Throughout the bill, the term “lawful authority” appears. Now, we're in the early stages of the bill, and we found that our concern was that nowhere in the definition section of the bill does it actually define what “lawful authority” means. Without even providing that term, I think it provides a bit of ambiguity in there.

For instance, proposed section 44 of Bill C-27 allows an organization to share “an individual's personal information” with a government institution upon request “for the purpose of enforcing federal or provincial law”. The language of proposed section 44 is taken from PIPEDA, as I understand it, and it is problematic, given that it outlines few privacy safeguards that have been afforded to individuals in the past with Supreme Court decisions like the 2014 R. v. Spencer case. I'm sure everyone on the committee is familiar with that—I know that some of the witnesses are—but I'll just go over a summary of it.

R. v. Spencer, in 2014, according to Wikipedia, “is a landmark decision of the Supreme Court of Canada on informational privacy. The Court unanimously held that internet users were entitled to a reasonable expectation of privacy in subscriber information held by Internet service providers. And as such, police attempts to access such data could be subject to section 8 of the Charter of Rights and Freedoms. At issue was whether the police could request subscriber information associated with an IP address from an Internet service provider without prior judicial authorisation, who could then voluntarily provide it. The Supreme Court ruled that the request for internet subscriber information infringed on the Charter's guarantee against unreasonable search and seizure.”

Law enforcement, with some exceptions, in my view—in our view—generally should be required to produce a court order when asking for somebody's personal information: a bank account, personal messages, health information and that kind of thing.

The ambiguity with respect to the meaning of “lawful authority” that existed in PIPEDA with regard to disclosures to law enforcement remains in the CPPA and will likely result in continued disclosures of personal information without consent by organizations to police and to other law enforcement agencies in the absence of a court order.

Given this issue, the Privacy Commissioner recommended that the definition of “lawful authority” for purposes of sections like proposed section 44 in this bill be amended to clarify that individuals should still enjoy a reasonable expectation of privacy.

In the Privacy Commissioner's submission on Bill C-11 in May 2021, the Privacy Commissioner said:

Beyond transparency, clarity is also required with respect to the impact of the 2014 R v. Spencer decision with respect to when the state can obtain personal information via warrantless access. When Bill S-4 was before Parliament, the OPC recommended that:

a legal framework, based on the Spencer decision, is needed to provide clarity and guidance to help organizations comply with PIPEDA and ensure that state authorities respect the Supreme Court of Canada's decision. Such a framework would provide Canadians with greater transparency about private sector disclosures of their personal information to state agencies.

The Privacy Commissioner went on to state:

The ambiguity with respect to the meaning of “lawful authority” that existed in PIPEDA remains in the CPPA, as evidenced by companies' continued disclosures of personal information without consent to police and other law enforcement agencies absent a court order.

As such, we reiterate and update for Bill C-11—

At the time, that's what he was dealing with.

—a recommendation previously made in our 2015 submission to Parliament on Bill S-4, that a clarifying provision be introduced that defines lawful authority for the purposes of section 44. This provision would make clear that discretionary disclosures to law enforcement following a request should be permissible only where there are exigent circumstances, pursuant to a reasonable law other than section 44 of the CPPA, or in prescribed circumstances where personal information would not attract a reasonable expectation of privacy.

Recommendation 19: That a definition clarifying the meaning of “lawful authority” for the purposes of section 44 be introduced.

It wasn't. In his submission for this bill, on April 26, 2023, the Privacy Commissioner again proposed recommendation 19: “That a definition clarifying the meaning of 'lawful authority' for the purposes of section 44 be introduced” in this bill.

This amendment follows on the recommendations of the Privacy Commissioner on numerous occasions to “make clear that discretionary disclosures to law enforcement...should be permissible only where there are exigent circumstances, pursuant to a reasonable law other than section 44 of the CPPA, or in prescribed circumstances where personal information would not attract a reasonable expectation of privacy.”

That's by way of introduction. I haven't read the actual amendment, which is fairly short, but I know the witnesses have read it.

Do you agree with the Privacy Commissioner that this needs to be added to this bill, that we need to add a definition in the definitions section for “lawful authority”, which is a term used frequently throughout this legislation?

[Diane Poitras]

I certainly share my colleagues' concerns about the interoperability of the act in a context where the obligations would not be exactly the same. The fact that similar protection applies across the country is important for Canadian citizens, but also for businesses. They can operate in Quebec, but a number of them can do so across the country.

The fact that the process can be very costly is a concern we've heard very often in Quebec. At the time, under Bill C‑11, there was concern about the harmonization of the rules. Without harmonization, companies feared that they would have to comply with two sets of rules, and operating would become very expensive.

I don't know if that answers your question.

Canadian Radio-television and Telecommunications Commission Act

[Helena Jaczek, Liberal, Markham—Stouffville, ON]

Madam Speaker, on September 19, Bill C-354, an act to amend the Canadian Radio-television and Telecommunications Commission Act regarding the cultural specificity of Quebec and the Francophonie was tabled and read for the first time. From the outset, I would like to thank the member for La Pointe-de-l'Île for giving me the opportunity to reiterate our government's commitment to supporting the French language.

Bill C-354 aims to amend the Canadian Radio-television and Telecommunications Commission Act, and this is closely tied to the government's ongoing work to ensure a broadcasting system in Canada that reflects the evolution of our digital world and in which all Canadians, including Quebeckers and members of the Canadian Francophonie, see themselves represented. In fact, closely linked is an understatement. The government's efforts have already been going very much in the same direction as the objective of this bill.

On February 2, 2022, our government introduced Bill C-11, aimed at reforming the Broadcasting Act so that Canadian laws reflect the evolution of our digital world. The latter aimed to clarify that online broadcasting services fall under the act, to ensure that the CRTC has the appropriate tools, to encourage greater diversity and inclusion in the broadcasting sector and to better reflect Canadian society.

The legislative process surrounding Bill C-11 took a very long time. Indeed, one year to the day passed between the initial tabling of the bill in the House and its adoption at third reading by the Senate. Both the Standing Committee on Canadian Heritage and the Standing Senate Committee on Transport and Communications spent many hours dissecting, analyzing, hearing from witnesses and refining Bill C-11. During the same legislative process, several modifications were made to Bill C-11 to strengthen the commitment to the French language and official language minority communities.

The Broadcasting Act, as recently amended, put in place new guarantees to ensure continued support for the production and broadcast of original French-language productions, the majority of which are produced in the province of Quebec. What is more, the CRTC is required to interpret the Broadcasting Act in a manner that respects the Government of Canada's commitment to promoting the vitality of Canada's French-speaking and English-speaking minorities and supporting their development. Added to this is the fact that the act provides that regulations must take into account regional concerns and needs. It should also be noted that the government is already actively consulting the provinces and territories, particularly when it comes to broadcasting.

At each stage of the process surrounding the implementation of the Online Streaming Act, the provinces and territories were consulted. In particular, the government consulted its provincial and territorial counterparts as part of the consultations related to the decree of instructions proposed to the CRTC concerning the implementation of the law.

The final decree also contains various instructions to support the official languages of Canada and official language minority communities. The decree recognizes, among other things, the minority nature of the French language in Canada and North America and the fact that the broadcasting system should promote the development of Canada's official language minority communities and promote full recognition and use of French and English in Canadian society. A section was even added to the final version of the decree to support the creation and availability of programming in French.

In addition, for its part, the CRTC has published a road map describing the main stages of the implementation of the act and is already actively consulting the public. It should be noted that as an administrative tribunal, the CRTC already holds in-depth consultations before making decisions under the rules of practice and procedure that it adopted in order to respect the principles of procedural fairness and of natural justice incumbent upon it. Provinces and territories have the opportunity to participate in CRTC consultations. To this end, the provinces and territories, including Quebec, can already present observations to the CRTC on issues of provincial interest during hearings and consultations.

It is important to specify that the Government of Quebec has the right and already uses its right to intervene in the CRTC's consultative processes. The Broadcasting Act provides for three forms of consultation, depending on the decisions it is considering. They are, in no particular order, one, with official language minority communities on any decision likely to have a detrimental effect on them; two, with CBC/Radio-Canada on its conditions of services; and three, with any interested party for decisions regarding conditions of services. The latter is an open consultation, where provinces and territories and, in fact, any interested intervenor can put forward their opinions and concerns.

In other words, the addition of the consultation obligation provided for by Bill C-354 could raise concerns that are being addressed in the course of the work of the CRTC and under the requirements of the Broadcasting Act. An obligation for the CRTC to consult elected provincial governments could also have an impact on public confidence and the independence of the CRTC. It is important that we are all mindful of not just the independence of the CRTC but the importance of that independence.

As outlined, “The CRTC is an administrative tribunal that regulates and supervises broadcasting and telecommunications in the public interest. [It is] dedicated to ensuring that Canadians have access to a world-class communication system that promotes innovation and enriches [the] lives [of Canadians].”

Further to this, under the section of the CRTC's own website entitled “We listen and collaborate”, it states that, in order to “fulfill [its] mandate, [it] must understand the needs and interests of Canadians who make use of broadcasting and telecommunications services.”

In conclusion, the government supports and will continue to support the French language. The Online Streaming Act and the act to amend the Official Languages Act are concrete examples of our commitment to the French language. Once more, the government regularly consults the provinces and territories, including Quebec.

The minister has consulted her counterparts on numerous occasions when it comes to regulating the broadcasting sector. The government will welcome any questions from members regarding Bill C-354 as the debate on this legislation continues.

[Michelle Gordon, Lawyer and Founder, GEM Privacy Consulting, As an Individual]

Thank you for the invitation to appear before this committee for its important review of Bill C-27.

I'm a privacy lawyer and consultant based in Toronto. Having worked in the privacy field for over 15 years while raising three sons, I have a passion for children's privacy, and I will focus my remarks on this area today.

My interest in privacy law was sparked when I was a law student down the street at the University of Ottawa, where I did research with Professor Michael Geist and the late Professor Ian Kerr at the time when PIPEDA was a new bill being debated similarly to today's. When Professor Geist appeared here a few weeks ago, he reflected on his first appearance before committee to discuss PIPEDA, noting that it was important to get it right, rather than to get it fast. When Professor Kerr appeared in 2017 to discuss PIPEDA reform, he stated that, at the time, “the dominant metaphor was George Orwell's 1984, 'Big Brother is Watching You'”, noting that technological developments in the years since PIPEDA go well beyond watching.

Both professors Geist and Kerr were right, especially in the context of children's privacy. Given that children are inundated with emerging technologies well beyond Orwell's 1984—from AI tools to ed tech, virtual reality and our current reality of watching war and its accompanying hatred unfold on social media—it is more important than ever to get it right when it comes to children's privacy.

When Bill C-11 was introduced in late 2020, it didn't address children at all. As I argued in a Policy Options article in 2021, this was a missed opportunity, given that the amount of online activity for children was at an all-time high during the pandemic.

I commend the legislators for addressing children's privacy in Bill C-27 by stating that “information of minors is considered to be sensitive” and by including language that could provide minors with a more direct route to delete their personal information, otherwise known as the right to be forgotten. I also understand that Minister Champagne proposes further amendments to include stronger protections for minors.

However, as the first witness stated, I think there is more the law can do to get it right for children's privacy. I will focus on two points: first, creating clear definitions, and second, looking to leading jurisdictions for guidance.

First, the law should define the terms “minor” and “sensitive”. Without these definitions, businesses, which already have the upper hand in this law, are left to decide what is sensitive and appropriate for minors. The CPPA should follow the lead of other leading privacy laws. The California Consumer Privacy Act, the U.S. COPPA, the EU's GDPR and Quebec's law 25 all establish a minimum age for consent ranging from 13 to 16.

Further, the law should explicitly define the term “sensitive”. The current wording recognizes that minors' data is sensitive, which means that other provisions in the statute have to interpret the treatment of sensitive information through a contextual analysis, whether it be for safeguarding, consent or retention. Similar to Quebec's law 25, the law should define “sensitive” and provide non-exhaustive examples of sensitive data so that businesses, regulators and courts will have more guidance in applying the legislative framework.

Second, I recommend that you consider revising the law—as an amendment or regulation—in order to align the CPPA with leading jurisdictions, namely the age-appropriate design code legislation in the U.K. and California. Both of these demonstrate a more prescriptive approach to regulating the personal information of children.

The California kids code requires businesses to prioritize the privacy of children by default and in the design of their products. For example, default settings on apps and platforms for users under 18 must be set to the highest privacy level. This is something that could be considered in the CPPA as well.

Further, the California code establishes a level of fiduciary care for platforms such that, if a conflict of interest arises between what is best for the platform and what is best for a user under 18, the children's best interest must come first. This is consistent with the recommendation of former commissioner Therrien and others in these hearings about including language around the “best interest of the child” in the legislation.

The CPPA should contemplate requirements for how businesses use children's data, considering the child's best interest. For example, use of children's data could be limited to those actions necessary to provide an age-appropriate service.

As I argued in my Policy Options article in January 2023, we need a collaborative approach that includes lawmakers and policy-makers from all levels of government, coordination with global privacy laws, engagement with parents and coordination with educators. For this approach to work, the law needs to strike the balance between privacy and innovation. We want laws that are flexible enough to last so that technology can evolve, new business ideas can succeed, and children can be innovators while growing up in a world that recognizes their special needs and rights.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

I'm going to turn to the other witnesses now.

Did any of you participate in the consultations on Bill C-11 or the bill the committee is currently studying, Bill C-27? Please nod your head if you did.

I see that no one was consulted. All right.

In light of what we've seen since we began our study a few weeks ago, no one seems to have been consulted, but the Minister of Innovation, Science and Industry says that 300 individuals and organizations were consulted after the bill was introduced. I'd like to find those individuals and organizations. I don't know where they are.

In a moment, I'll be giving notice of a motion, but I'd like to ask you a question, first, Ms. Piovesan.

Mr. Balsillie appeared before the committee, and I'm sure you read his remarks. He likened the bill to a bucket that has holes. What witnesses have told us so far seems to suggest that the bucket basically has no bottom. That's what it seems like.

You talked about the fact that the committee has heard opposing views from witnesses. Take the tribunal, for instance. Some suggested getting rid of it because we didn't need it, while others argued the opposite, that having a tribunal in the sector was important.

Given how far apart on the spectrum people's views are, do you think the bill should have been split from the beginning? We've heard from the start that the bill is almost monstrous, that it's too big, that the privacy piece and the AI piece should have been dealt with separately.

What do you think?

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you, Mr. Chair.

Thank you to the witnesses as well.

Today's discussion is fascinating. I am very interested in what you have to say.

Ms. Piovesan, if I understood correctly, you helped draft Bill C-11, the predecessor to the bill before us today, Bill C-27.

[David Young]

It's essentially the same point. I was just leading on from that point I just made. It goes back to Bill C-11, which really tried to suck and blow at the same time. It defined a term of “de-identified information”, which if you read it, inherently said it's outside the statute, because it's not personal information—it cannot reasonably identify an individual. However, the statute went on to actually have several provisions, really some of which are still here, that said these apply; these are rules for de-identified information. That was crazy.

I'm sorry, but I lost track. Ask your question again.

[John Lawford]

I don't buy that, because businesses are functioning very well right now. I don't know of any innovation that's being stifled by the present law. Perhaps the Business Council said something different the other day.

If you take proposed section 18 out.... Now consider that proposed section 18 wasn't in Bill C-11. Apparently the department didn't need all these exceptions in the first version. Now, it's in. I'm just saying to take it out because businesses can function at the present time. I think to remove the general right of subjective consent from all Canadians is a pretty big lift. I want to see a lot of innovation being stifled before that gets taken away.