Bill C-11 (Historical)

Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Digital Charter Implementation Act, 2020

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, just listening to the member's comments on the bill, I suspect the Bloc will be supporting the legislation at least going to committee. It is important for us to recognize the role of the Privacy Commissioner and that it has been incorporated to provide additional support. It will provide more confidence in cybersecurity and show how important data is.

Could the member provide a confirmation of the Bloc's position on seeing the bill go to committee? Does the member have anything else she would like to talk about in regard to the important role the Privacy Commissioner plays in general for Canadians and small businesses?

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, I thank my colleague for his question.

The Bloc Québécois is obviously in favour of a bill to protect the fundamental rights of Quebeckers and Canadians.

That said, it is important that several proposals be presented in committee. While we are at it, we will ensure that nothing is missing. That will surprise no one. Although the commissioner may be very pleased to hear that penalties can be imposed, he is also very aware of what might be missing from this bill.

With respect to personal information, we really have a lot of ground to cover quickly, because Canada is lagging behind in the eyes of the international community. We will have to make quick adjustments to protect our fundamental rights, as 30-plus other countries around the world have done.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, since there are no other questions and comments, I believe that shows that my colleague was very clear. I will try to be clear as well. The bar is high, but I will try to meet it.

Generally speaking, as my colleague said, this bill represents a step forward and addresses several of the Privacy Commissioner of Canada's requests. Quebeckers were profoundly shocked by the Desjardins data breach. It was a very significant event. However, it was not the only one. Similar incidents occurred in 2017 and 2018, and there have probably been dozens more that we are not aware of. In fact, when a bank's data is stolen, the bank is required to inform the police and the Privacy Commissioner of Canada, but it is not required to inform the public or even its customers.

We like this bill because it sets out a series of principles relating to the collection and sharing of personal information by companies: free and informed consent for the collection and use of data; the ability to allow or deny the transfer of data to another company, such as between two financial institutions; the ability to withdraw consent or request that data be deleted; transparency about the use of algorithms that use personal data; and stricter criteria for the use of de-identified data. This bill also gives real powers to Canada's Privacy Commissioner, sets out significant penalties for non-compliance, and creates the personal information and data protection tribunal. All of that is great.

Unfortunately, the problem is that the bill omits one extremely important element, and that is protecting people's identity online to prevent fraud due to identity theft, especially during financial transactions. We know that Europe has brought in a whole suite of regulations to force financial institutions to verify a person's identity before authorizing a transaction. There is nothing like that in Canada, and this bill does not have anything of the kind either.

The federal government is not properly verifying individuals' identity before authorizing electronic transactions. We know that the challenge is to prevent data from being stolen and used to commit fraud. Having personal data stolen is unpleasant enough, so all measures must be taken to ensure that the data are not then used for fraud.

The debate in Ottawa over the massive data breach at Desjardins mainly revolved around social insurance numbers. We know that several people would like to change their social insurance numbers, but under the current system, they cannot do so unless they become a victim of fraud resulting from identity theft.

In addition, the federal government has received a number of requests to redesign the social insurance card to make it harder to counterfeit, similar to what Ottawa did with passports after the September 11, 2001, attacks, at the request of the United States.

These two requests are perfectly reasonable. The Bloc fully agrees and is asking Ottawa to follow up. However, that alone will not stop fraud.

The best way to prevent identity theft is to make sure that the person who is making the transaction is indeed who they claim to be. This goes without saying. There are three ways to verify a person's identity.

First, a person can be identified based on what they know, namely personal information such as their name, address or social insurance number. However, as cases of identity theft are on the rise, it is getting harder and harder to accurately identify someone. In other words, our private information is no longer private when everyone can find out almost everything about us. Fraudsters can simply use this information to create a fake ID, and they are set.

Second, a person can be identified based on what they have, such as their computer's IP address, which the institution can recognize if the transaction is being conducted from the person's home, or their cell phone, to which the institution can send a secret code via text message.

Third, a person can be identified based on who they are. The institution can use technologies that recognize a person's physical characteristics, such as their voice, their facial features, through the use of facial recognition, their digital fingerprints, which are increasingly being used by cell phones, or their handwritten signature.

Europe adopted regulations in 2016 requiring financial institutions to use at least two of these three ways to identify someone before authorizing a transaction. Banks in Canada are under no such obligation. If they believe that the control mechanisms will cost more than the losses they are currently incurring in fraud, they are better off doing nothing. The banks will not pay for controls that would be more costly than the fraud. That is simply profit-driven logic.

Many members have probably had the experience of having a store issue a credit card on the spot, based solely on the personal information we provide. We just have to give our phone number, address, and so on, and that is all it takes. This practice really opens the door to fraud, and it has to stop.

We believe that the banks must be forced to tackle fraud. That is the solution that we are advocating. We are going to propose possible approaches. As my colleague was saying, we are going to support the bill, but we will be bringing forward amendments. We will have concrete, constructive and coherent proposals when the time comes to study the bill in detail.

We will propose ways to combat identity theft, such as by drawing on the European regulations I was talking about, in order to force the banks to bring in robust processes to verify people’s identity before authorizing a financial transaction. We will also propose to increase fines in order to encourage banks to better protect their customers’ personal information. We will propose that banks be required to submit a detailed report, as part of their annual reporting, on the number of identity thefts and the resulting losses.

We will also propose a requirement to contact any person whose identity has been fraudulently used within the organization, regardless of whether an account was opened or not. As I said earlier, there is no such obligation in place and it must be brought in. There is also an obligation to cover the costs paid by victims to recover their identity. These costs must be covered by the banks, which are rolling in a lot more money than individuals and most of their customers.

There also need to be anonymous tip lines for employees who are aware of unreported identity theft, as well as protection for whistleblowers. There is currently a void when it comes to whistleblower protection, as in virtually all areas. I am getting a little off topic, but the House will have to deal with this issue as well.

Ottawa also has to look in its own backyard. Beyond the banks, the same anti-fraud controls need to be imposed on the federal government itself. Bill C-11 applies only to private businesses. It does not apply to the federal government. Currently, Ottawa’s online identity controls are clearly inadequate. Before authorizing a transaction, the government does not take all the necessary steps to ensure that a claimant is who they say they are.

Since last spring, there have been numerous cases of identity theft. These include Canada emergency response benefit claims made in other people’s names and tax refunds being redirected to other accounts. Some people will not find out that they have been victims of identity theft until they file their income tax returns. It has not yet happened yet, but it will soon. In a few months, many people will discover that they have been victims of fraud. Right now, they have no idea. This is absurd, and it is unacceptable.

Again this fall, thousands of taxpayers lost access to their Service Canada account, which prevented them from applying for employment insurance even though they lost their jobs because their region was going back into the red zone.

It is all well and good to introduce a bill on the management of personal data by private companies. I want to stress that we agree on this bill and that we will vote in favour of it. That part is settled.

However, Ottawa needs to clean up its own backyard as soon as possible and take immediate action to combat identity theft. We are saying yes to regulating private businesses, but we are also saying yes to regulating Ottawa and the banking industry.

[Randy Hoback, Conservative, Prince Albert, SK]

Madam Speaker, my colleague mentioned that the government should be looking to include identity theft in the legislation. I agree with him that it should be included, but this is the government that brought in the Phoenix pay system, and we know how much of a fiasco that was.

What would he propose the government do to prevent something like the Phoenix pay system if it was to bring this type of legislation into its own house?

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, the Phoenix pay system is indeed a fiasco, a complete disaster. I completely agree with my colleague, who I want thank for his kind words about my speech.

This is a big problem, but the bill that is before us deals with identity theft. The Phoenix pay system is another issue, but we completely agree that something needs to be done ASAP, as they say.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the President of the Queen’s Privy Council for Canada and to the Leader of the Government in the House of Commons]

Madam Speaker, it should be noted that it was actually the Conservative government that brought in the Phoenix payroll system. We did flip the switch on it, but it was fairly well established under the previous administration.

Having said that, the member, as well as his colleague, made reference to individuals who collected the CERB but who should not have been collecting the CERB. In hindsight, would the member have any recommendations or suggestions for how the government could have done things differently to avoid that?

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I thank the hon. parliamentary secretary for his question.

I think that I answered that question in my speech. Stricter oversight and monitoring mechanisms like the ones I suggested are the answer to that question.

We could also review the whole matter of the CERB. We warned the government many times from the beginning about the monitoring that should be done and the formula itself. I could talk about those mechanisms again, but I do not really have time. I made suggestions to that effect in my speech.

Looking back, the government should have monitored this more closely in every respect.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Madam Speaker, I would like to thank my colleague for his intervention today. It was very interesting.

Cybersecurity, of course, is a very important issue. As we know, in Canada there are too many victims of cybercrime each year. However, I feel it is not a problem that a privacy law would solve.

I am wondering if the member could speak a bit about why he is bringing forward a criminal law issue that would put more burden on Quebec and some of the other provincial jurisdictions at this time. I would like a few comments on that.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, if I understood my colleague's question about criminal law, the bill in this current form suggests penalties for companies that break the law. That would involve criminal law.

If I understood the question properly, that is the response I have for my colleague.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Madam Speaker, I can always count on my Bloc colleagues to explore the relationship between the federal government and the provincial governments.

I am wondering if the member has any comments on concerns he might have regarding the bill and provincial jurisdiction.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Madam Speaker, I will try to be brief, although I know that is not my strong suit.

The Government of Quebec is currently in the process of modernizing its legislation on this. There is a stereotype about Quebec and I believe it is founded: Quebec generally does very good work and often, or in most cases, does a much better job than Ottawa.

Of course, we also think that the governments have to agree. We hope that this new legislation will not encroach on provincial jurisdictions. Earlier I asked the hon. Minister of Industry that question and he said that would not be the case.

Time will tell.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I am pleased to participate from my office in this important debate on Canadian privacy. The bill would enact the consumer privacy protection act and the personal Information and data protection tribunal act. It would also make consequential amendments to other acts. We are debating a fairly complicated subject, but one that has been warranted for many years.

The New Democrats have been calling for a modernization of our privacy laws and our consumer protection laws for about a decade. Most recently, our efforts have resulted in a digital bill of rights' discussion across Canada in which we have been at the forefront and have pushed hard to have some of these rights discussed, not only in the public forum but also in the chambers of Parliament.

We have witnessed the world move on. We have seen the Privacy Commissioner identify Canada as backwater when it comes to protecting privacy and the capabilities of the modern world. With COVID-19, we see further online activity among Canadians and further vulnerabilities for not only individuals but for our families, schools, businesses and even Parliament.

The New Democrats have a different position from other political parties. We believe that people's human rights are connected to their digital rights. People's online presence and the digital footprint they leave in the wake of the business they have to do is just as important as their physically enshrined rights as a human being.

When we look at what is taking place, even with COVID, and the ability of people to participate online, we have seen the failings of two decades of Liberals and Conservatives to connect Canadians, all the way from Maxime Bernier's program, launched as a Conservative minister, to most recently where we are struggling and scrambling to get Canadians connected.

One of the other things the New Democrats talk about is the affordability of participating in this democracy and not only with respect to one's participation on a regular social basis. As governments have moved more and more services away from brick and mortar to online, we have seen the exposure of Canadian privacy. We have seen that even within government resources, everything from social insurance numbers to other types of breaches that have taken place. We have seen this in the private sector as well.

Canada has often lagged in the private sector, not only in oversight but also in the punishment of those who take advantage of people in the new digital age. In our digital bill of rights, which we presented more than two years ago, we talked about not only personal data being protected, but also how people were being manipulated through the services provided online. For years and years our philosophy has been net neutrality. I will highlight a few new problems with the bill which could derail that type of philosophy and could stream Canadians to more vulnerabilities.

There are all kinds of examples of how Canadians have been abused. Whether it be Yahoo, Ticketmaster, Marriott or Equifax, the list goes on and on. Most recently, a heightened example of this, which created a lot of attention across the world, was Facebook and the outright manipulation of people's personal data. People were being used as pawns without even knowing what their rights were or being protected from that.

Again, Canada's laws do not allow our Privacy Commissioner to come down hard on some of these giants. Governments in the past have been too close with the web giants and have not allowed Canadians to have the proper recourse when data breaches have taken place.

The personal information and data production tribunal act being proposed by the government would create a number of potential false promises for accountability. It has a low threshold of involvement of those who would be appointed to the tribunal.

First, we have to get past the notion that these types of political appointments will be free and clear of all political and business-type leverages to select the tribunal. Second, we have to assume the tribunal can be fair, quick and just in its cases. Third, baked-in problems with regard to the role of the tribunal create some concerns. The first is that the tribunal could overturn the Privacy Commissioner in many respects and it would go to a judicial process, which could take years and years to settle cases that may no longer be relevant to Canadians.

There is also a low threshold for the inclusion of some of the appointments. There is no requirement for a Superior Court judge and only one judge is allowed in maybe a one-to-three-member panel or a one-to-six-member panel. These things need to be fixed.

Something I want to further explore are more powers for the Privacy Commissioner. The Privacy Commissioner has been very clear in asking for more resources and supports over the last number of years to deal with privacy breaches that have occurred and also to bring in more accountability. It is in our business interests, not only our interests as individuals, families and all of the institutions but in business interests, to have a clear process so the bad actors in this environment that are doing harm to Canadians and other businesses are not rewarded.

One thing I am most proud of accomplishing as a member of Parliament was ending the tax deductibility of corporate fines and penalties. That was about 15 years ago. In the past, if a business was caught doing something illegal, it was able to write off part of the government fine as a business-related expense. I was able to champion a change to that.

Businesses that were doing illegal activity and influencing competition were using it as a loss leader. They would essentially get millions of dollars in fines and penalties, everything from drug companies to those getting environmental fines and penalties, and they would apply for that money back at tax time. It was a way for them to undercut the competition that was doing the right thing. That is what I am concerned about with the tribunal. It would have the capability to influence market stability to some degree with regard to penalties and fines for the bad actors.

If it does not work right, if it is not seen as credible and if it does not flow the way it should, it can be an encouragement for some of those committing the breaches to be sloppy with personal information, disrespectful and also manipulative in taking information from Canadians, steering them to different purchases and activities, exposing them and then beating some of the competition. For some young entrepreneurs who have to go up against some of these established giants, it is very difficult for them to get a toehold.

A number of factors are in place, even in our general market economy, for young people and entrepreneurs to get busy and to compete. One most recently was in the retail sector. Businesses are being charged extra to get floor space in the real world. Amazon and other players have also used manipulative practices to steer consumers to particular products and services from preferred customers. That defeats our philosophy of net neutrality. It could also direct people and their families to making purchases or viewing activity with the time they have into different market conditions as opposed to exploring in a free and open Internet society.

Another thing is that Canadian federal political parties are exempt from oversight. We do not understand why the Liberals would allow this to take place. It should be clear and proper that their data and personal information be open and accountable in political parties as well. We will be looking at amendments to this activity because we strongly believe they should be accountable.

To bring faith and accountability to our democracy requires transparency. We have seen the sensationalism that has taken place in political advertising in the last number of campaigns and the favouritism that has been seen online. We have also seen the giant data assembly that has taken place which can manipulate voting and steer people to different discussion points.

The personal privacy information collected by political parties should also be clear. This way there will be more faith in the information that political parties get. More important, our democracy will be strengthened by privacy protection, not weakened or exempted with regard to the model being presented by the government right now.

We also want to be more technical and continue to have commercial activity defined under PIPEDA. This is more related to the business section aspect for fair and open transparency.

We want to deal with a particular issue in regard to algorithmic transparency. Algorithms can help direct purchasing and activity and can also manipulate someone. It will just get stronger because artificial intelligence is being introduced more and more into society in regard to all our products and services. This includes search engine searches, the types of purchases made with different corporations and a number of different activities that take place. It is important there be accountability and oversight for that.

A number of different things have been going on with regard to Canadians and their privacy. There is no doubt there will be more challenges with this bill. We want to go back to a number of different structures that take place with respect to this. Again, the New Democrats championed a digital bill of rights for many years. I want to highlight a few important things.

If we cannot have a fair, open and just society with regard to our digital footprint, we believe our democracy is threatened, our economy is threatened and, more important, investments into this country will be threatened. We will not have the same oversight that Europe or the United States have. That is very important to ensure that investment in Canada will take place

It is important to note that if we are working toward things like access to telecommunication services all across Canada and we are investing in this, we need to think about the billions of dollars already spent on this, along with the additional money to be spent. We want this to be done right and proper, especially with COVID-19.

Over the years, as we have gone to more online services and invested in this, we have had opportunities. When we think about how we use this space for ourselves, whether it be commercial activity, entertainment or business, we sell off the spectrum. The spectrum is the infrastructure we can use. It is above us. It is the radio and capacity to move, most recently, the 5G network. We will see a spectrum auction.

In the past 20 years, $22 billion of revenue has come into the public coffers with spectrum auctions. We have seen a patchwork of activity take place all across the country.

I previously mentioned Maxime Bernier, with the Conservatives, and most recently the Liberals. Several plans have emerged that are more a hodgepodge of applications. It is one program after another that is sought out. They are also providing massive subsidizations for those markets, which costs billions of dollars. Even the CRTC has a fund.

I can list a series of them, but the point is that if we are going through all this trouble and investment to create a society space for our digital world and economy and we are heavily investing in this, then we need to do it right, especially with a geography like Canada, which is so large. This can be a challenge, but given our population size and the fact that we have dense populations along the border and other places, we can turn this into an advantage for business investment as well.

The New Democrats believe this is part of our human right with respect to how people are treated online. This includes accountability from companies with regard to cyber-bullying, privacy protection, speeds and affordability. They are combined. If we do not have this type of approach as a philosophical one, we leave ourselves open to having more winners than losers. It would be no different than having lost education opportunities for people and a requirement for the government to come in and do the right thing, which is to make things more affordable.

I mentioned the concentration of our population. It is important we tie this into the bill as we finally expand to rural and remote locations, and the security and accountability for that information.

We have talked a lot about preserving different cultures and providing business opportunities for areas that have been weakened because of their geography or lack of connectivity to large populations, but if we do not put a rules-based system in place that allows them to compete fairly, then they will fall to the wayside. Specifically, we could have a number of opportunities for smaller businesses to evolve, some scale-ups to take place, communities that could actually have some empowerment in getting to new markets and keeping the community stronger and together, but if it is not done in a way to have online privacy protection and so that businesses can compete in a fair way, then it is going to be lost.

One of the concerns we have in general, not only with regards to ourselves as a country but also the rest of the world with some of the web giants, is the consolidation of services and how online services are used. In Canada, our competition has not been the strongest at some points, but there is an opportunity as we do this, which is why this legislation is so important.

With the spectrum auction coming up, New Democrats have argued that charging as much money as we can to the telcos coming in and then seeing how things go results in what we have right now: less competition and higher prices, and prices that, quite frankly, limit people's participation in the digital world. This is a concern that we have, and so we have suggested to turn the spectrum auction around, like many other countries have done, and use it as a way to connect at lower costs by putting out expectations, such as an RFP-type model. When the bidding comes in, we may get a little less money coming in the front door, but the expectations are going to be higher and the requirements to connect rural or remote communities will be there. The telcos will use it or lose it. That is one of the things we believe could be a real benefit to move along the different programs.

Basically, what we have now is a series of programs out there where communities almost have to go on bended knee to get access, to get support to actually lower the price points to make things more competitive and attractive. Our model would have a reverse role. The business community would already have the expectation that the spectrum is less, but the time frame to connect Canadians is high, with the expectation that they use it or lose it, for those things to happen relatively quickly. In fact, industry has indicated that the NDP plan could take place and connect Canada within four years: 98% in three years and the last little part in the last year, because it is more difficult in some locations.

This is important and critical, because this potential law would lay out the framework on how that activity takes place. It is one of the reasons we believe this tribunal is one of the more interesting curiosities, and there are other things to talk about regarding that. However, if we spend all of this money, time and public policy and then do not get it right, we would have a weak and irresponsible approach to oversight in making sure that Canada does not have problems with regards to this. It is already going to create a skew in the public policy laws that we have. I fear that the bill, in its current form, if it does not sharpen up on those points, would create a skewed market for some years to come.

Parliament most likely will not deal with this again any time soon. It has taken far too long to get to this point. We have to get this through a minority Parliament, we have to get it through the Senate and we have to get it signed off by the Prime Minister at the end of the day. That is going to take some time and commitment, which we have with the New Democrats. We want to improve the bill, we want to make sure that it is stronger, but if we do not get these points right, we are going to undermine things. This is why, when we think about how important this is with our current public policy and our resources, everybody out there has been concerned about COVID-19 and the effects upon the broadband and the experience for education, involvement and commitment.

To conclude, the difference for New Democrats is that we believe that our human rights and digital rights are enshrined just as our physical rights. As we move to this type of engagement, as we see hybrids take place within workplaces, schools and other types of activity, this bill is a step forward, but it needs to be strengthened, and we can be counted on to do that. It is our intent to make Parliament work, but, more importantly, to make sure that we have laws that are going to work to protect Canadians.

[Gary Anandasangaree, Liberal, Parliamentary Secretary to the Minister of Crown-Indigenous Relations]

Mr. Speaker, I want to pick up on the enforcement mechanism in the bill, which would be the establishment of a new tribunal that would be accessible and able to impose significant fines on those who violate the act. I want to take issue with appointments. As a government, since we took over we put in a very robust appointment process that is merit-based and represents the breadth of this country.

I want my friend to comment on what specific issues he has with such an accessible tribunal, which I believe is warranted in this situation.

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, I believe the vast majority of appointments, even when controversial ones have popped up, have been good people doing good things for Canadians. However, that type of appointment process lends itself to some degree of political meddling, corruption and also influence from the outside.

I have been in Ottawa for almost 19 years now, and I have seen a number of different stories played out over the years that give me concern. It is a legitimate concern in this bill, and it also can change with the governments that handle the appointment process. It is something of concern worth talking about.

With regard to who is on those committees and tribunals, it is about the length of time and the types of people on it. Only one of three to six tribunal members would need to have privacy law experience, and that is one specific example of my concern. These are very technical things to deal with.

[Damien Kurek, Conservative, Battle River—Crowfoot, AB]

Mr. Speaker, one of the concerns I have, being from a large rural constituency, is the interplay of this bill and the effect it may have on rural Canada, specifically small and medium-sized enterprises within rural and remote parts of Canada. I am wondering if the member would have comments on that.