Digital Charter Implementation Act, 2020

An Act to enact the Consumer Privacy Protection Act and the Personal Information and Data Protection Tribunal Act and to make consequential and related amendments to other Acts

This bill was last introduced in the 43rd Parliament, 2nd Session, which ended in August 2021.

Sponsor

Navdeep Bains  Liberal

Status

Second reading (House), as of April 19, 2021
(This bill did not become law.)

Summary

This is from the published bill. The Library of Parliament often publishes better independent summaries.

Part 1 enacts the Consumer Privacy Protection Act to protect the personal information of individuals while recognizing the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act. It also makes consequential and related amendments to other Acts.

Part 2 enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act.

Elsewhere

All sorts of information on this bill is available at LEGISinfo, provided by the Library of Parliament. You can also read the full text of the bill.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:05 p.m.
See context

Liberal

Julie Dzerowicz Liberal Davenport, ON

Mr. Speaker, it is an absolute honour for me to rise in the House to speak on behalf of the residents of my riding of Davenport. I am speaking in support of Bill C-11, an act to enact the consumer privacy protection act and the personal information and data protection tribunal act and to make consequential and related amendments to other acts. It is also known as the digital charter implementation act.

From the earliest days of my first run for office, the residents of Davenport have approached me to tell me how concerned they are about the security of their personal information. They are literally running after me in the streets to say that this is an issue of great importance to them. I can assure members that it is not just Davenport residents who are concerned. The Privacy Commissioner published a survey in 2019 that found that 92% of all Canadians were concerned about their privacy, with 37% of Canadians being extremely concerned. This means that nine out of 10 Canadians are worried about their privacy.

I know that the third wave of this pandemic is the most pressing issue for all of us right now, and rightly so, but it has not made our privacy concerns go away. Indeed, this pandemic has had the opposite effect, given that most, if not all, our lives have moved online, from work to worship to shopping to social gatherings. This is a front and centre issue.

Davenport residents are not comfortable entrusting all their data into the black hole of the Internet, managed mainly by big multinational tech giants. These companies have been operating with outdated regulations and limited transparency. As Canadians right now, we have no choice. We are all used to downloading apps or signing up for things online that come with long privacy policies and consents requests. I do not know about everyone else, but most of us do not have time to read all the online terms and conditions that are often in legalise and not easy to understand. That is why I am happy that Bill C-11 would require plain-language consent requests.

We are also too used to being peppered with targeted ads and content based on the websites we visit, with no consent or even knowledge about algorithms that track our actions. It is impossible to keep track of how our personal data and how our online actions are being used or abused, whether it is to misinform others or even more nefarious purposes like identity theft.

That is will I am glad that Bill C-11 is before the House. It marks a huge leap forward in our privacy laws. Canada must do all it can to protect the data of all our residents, and Canadians should know exactly how their data is used with maximum transparency. We should have the right to manage what data is kept online and what is deleted.

Canada must also keep up with the rapid growth of the digital economy, as hundreds of companies and organizations are now handling our personal data. Other countries have already acted on this. The E.U. passed the General Data Protection Regulations in 2018. Its rules require that other countries meet its standards to do business, to exchange data across borders. This means that if we want Canadian businesses to continue to have an edge in European markets, we have to modernize our privacy rules. It is imperative that we move now, as aggressively as possible, and for all these reasons, we must pass the digital charter implementation act.

What would the bill actually do? First, the bill introduces the new consumer privacy protection act that updates the old PIPEDA act, which was first passed in 2001. Second, the bill introduces the personal information and data protection tribunal act to create an oversight and enforcement body for the new privacy rules. Third, it would retain the measures of part 2 of PIPEDA under the new electronic documents act. The measures in the bill are built upon three key goals: consumer control, responsible innovation and strong enforcement and oversight.

Let me just touch very briefly on how the measures in the bill would meet each of these goals.

First, how do we give consumers more control? Bill C-11 would modernize consent rules and would require companies to ask for consent in plain language, which is great. The bill would also give Canadians the right to data mobility. That means they could direct one organization to share certain data with another for a specific reason. For example, they could direct their banks to share financial information with another bank.

Next, it would give Canadians the right to withdraw their consent for the use of their data. It would allow people to direct a company to delete whatever personal information it has about them, including on social media platforms, which would give control of personal data back to Canadians. The bill also clarifies that even information that has been de-identified is still personal information. Even if a company removes people's names from its data, this bill would ensure that the data still belongs to those people. It has to be protected, and companies need their consent to use it.

Finally, the bill requires transparency for use of algorithms and AI. It would give every Canadian the right to request an explanation of how and why an automated system made a choice or prediction about the individual. I am hoping that at some point, we are allowed to relay what companies can and cannot do with that information.

The second goal is enabling responsible innovation. We want our country to stay globally competitive, support innovation and unlock the potential of data to create incredible value and improve our lives, but we need to support that innovation in a way that guarantees the right to privacy. The bill would simplify consent rules so that companies are not burdened by seeking consent for every use of information, even when consumers reasonably expect it. This is good for business and also helps Canadians make meaningful choices. Rather that being bombarded by consent requests full of legal jargon, consumers will see plain language requests when it really matters.

Bill C-11 would also allow Canadians the choice to contribute their data for the common good. It would allow businesses to share de-identified data with certain public institutions to power social benefits like public health and infrastructure. Lastly, the bill would allow businesses to submit their codes of practice to the Office of the Privacy Commissioner to ensure they comply with the law. This kind of transparency and streamlined regulation is both good for businesses and good for Canadians.

The third goal is strong enforcement and oversight. With any new regulations, we absolutely need stronger enforcement and oversight. Indeed, I know that is something the Office of the Privacy Commissioner has long requested. What would this bill do? It would give the commissioner that power, including forcing an organization to comply with privacy laws and ordering a company to stop collecting data for personal information. It would also create the personal information and data protection tribunal, and the Privacy Commissioner could also ask the tribunal to impose fines. We would have the stiffest penalties in the G7. For small transactions, the fine would be 3% of global revenue or $10 million, whichever is greater, and for more serious violations, the penalty is up to 5% of global revenue or $25 million, whichever is greater.

I mentioned earlier that Davenport residents have been raising this as a concern to me for five years now. I have received a number of letters, so I want to pay tribute to all those who have written to me through the years to indicate that this continues to be an issue. I know they will be very happy to hear that we are moving forward on this legislation.

This bill is the first of many steps our federal government will take to protect Canadians' privacy and harness our country's potential in the digital age. Our current privacy laws were passed in 2001, and in 20 years the pace of change has left those laws badly out of date. We will need to keep doing more to stay on top of rapid changes, looking at both the threats and the opportunities. Davenport residents and, indeed, all Canadians demand that we continue to do all we can to keep our privacy and data security laws updated in a way that protects them, while still enabling data to be used for innovation and economic growth.

In 2019, we set out a vision for the Internet in the digital charter. That vision is of an Internet that serves the public good and guarantees certain rights, like the right to control and consent, the right to transparency and portability, the use of data for the common good and the need for strong enforcement and accountability.

I am proud that our government has introduced this bill to implement the digital charter and guarantee these rights to Canadians. We have seen big new challenges, and we have stepped up with real solutions. I ask all of my colleagues for the speedy passage of this bill.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:15 p.m.
See context

Conservative

Marilyn Gladu Conservative Sarnia—Lambton, ON

Mr. Speaker, I am very glad that we are trying to update the legislation to reflect our digital reality.

The member commented on the Privacy Commissioner and the additional powers that would be given. We have seen quite a number of privacy data breaches from the federal government, especially from the Canada Revenue Agency. Would the Privacy Commissioner have the ability under this legislation to fine the government or order the government to stop collecting private information because it is not adequately protected?

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:15 p.m.
See context

Liberal

Julie Dzerowicz Liberal Davenport, ON

Mr. Speaker, I can assure the hon. member that it does not matter whether it is the federal government or any level of government; we are all really concerned about any type of these breaches. The honest answer to her question is that I actually do not know if the Office of the Privacy Commissioner is able to. I will ask about it.

My sense is that it is what we are trying to do, so I would hope it would also incorporate the federal government and the different levels of government. I do not know the answer. I hope it would be the case, but I know it does have the power to order businesses to do that. I will look into it and get back to the hon. member.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:20 p.m.
See context

Bloc

Yves Perron Bloc Berthier—Maskinongé, QC

Mr. Speaker, I thank the member for her speech.

What our Conservative colleague said is true. This bill does not seem to apply to the government.

I have another question. There is another flaw with respect to the identification of individuals. There is nothing in the bill to force banks, for example, to institute a strict policy for the identification of individuals, nor is there any kind of fine system that would compel them to do so.

Is the government open to a series of amendments on this issue?

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:20 p.m.
See context

Liberal

Julie Dzerowicz Liberal Davenport, ON

Mr. Speaker, one of the reasons I am eager to move forward with this legislation is that it is good to have these types of discussions in committee. If there are improvements to be had and ways we could even strengthen what is already an excellent bill, there is always an opportunity to do so at committee.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:20 p.m.
See context

NDP

Gord Johns NDP Courtenay—Alberni, BC

Mr. Speaker, as we know, big corporate data privacy breaches are becoming more common every year, and Canadians are concerned about how the big tech giants like Facebook are collecting and using information. Privacy is now a household issue that really affects everyone.

My concerns are around the private rights of action, which would allow individuals and groups of consumers to seek compensation in court. This has been effectively used in the United States to remedy violations. However, it is unnecessarily so burdensome in Bill C-11 that it effectively makes it unusable. For example, if the Privacy Commissioner does not investigate and rule on a complaint, an individual has no right of action. If the Privacy Commissioner does investigate and rule on a complaint but the tribunal does not uphold it, the individual has no right of action. Additionally, if a two-year timeline is exceeded for whatever reason, individuals lose their right of action, basically making it a right only in theory but not in practice.

Does my colleague agree that the bill needs to be amended to fix this?

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:20 p.m.
See context

Liberal

Julie Dzerowicz Liberal Davenport, ON

Mr. Speaker, believe me, I am very concerned about data and ensuring that Canadians have complete control over the data they are sharing: who uses their personal data and for what purposes. A fundamental objective of this bill is to give control and consent, to ensure transparency, portability and interoperability, and to have strong enforcement and real accountability. If there are some additional measures the hon. member thinks should be considered, I would suggest that it be brought up in committee.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:20 p.m.
See context

Green

Elizabeth May Green Saanich—Gulf Islands, BC

Mr. Speaker, I would put to the hon. member this quote from Jim Balsillie, from an article in the National Post in March: “The algorithms that push this content are addictive by design and exploit negative emotions—or, as Facebook insiders say, 'Our algorithms exploit the human brain’s attraction to divisiveness.'”

This bill would not address that problem. Is the government open to amendments in committee to deal with this aspect of the dark web?

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:20 p.m.
See context

Liberal

Julie Dzerowicz Liberal Davenport, ON

Mr. Speaker, the point the member brought up is something I personally worry about as well. It really bothers me that my actions online are fed into some sort of an algorithm or AI system and translated in specific ways I have no control over. I would like to believe, and do believe, that all these types of amendments would be very open to consideration within committee.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:20 p.m.
See context

Conservative

Bob Zimmer Conservative Prince George—Peace River—Northern Rockies, BC

Mr. Speaker, I am honoured to speak to Bill C-11 and data privacy.

Many in Parliament know of the previous work that has been done by the access to information, privacy and ethics committee. We dealt with this in 2018 around Facebook and Cambridge Analytica. We came together in London for the first meeting of the International Grand Committee, which represented nine nations and close to half a billion people. We have all seen how data manipulation can be misused by big tech, and our efforts in the International Grand Committee were really to set the stage for what we can do together to push back on some of big tech's practices and hopefully reform those practices. As chair of that committee, I was especially pleased with the efforts of all the parties in the room. In their speeches, the member for Beaches—East York, the member for Timmins—James Bay, my own colleague from Thornhill and many others took this on, as we care about all Canadians' data and privacy.

It is laudable that Bill C-11 attempts to combat some of the concerns that we have and crack down on some of those practices that have been concerning for many years. It deals with things like algorithm accountability, which has been mentioned by some colleagues today, personal access to data, de-identification of information, and certification programs for big tech so that there is a certain set of standards to be followed. Some of these moves have already been taken up by some in big tech who are doing this on their own to some extent. Stiffer penalties are recognized in Bill C-11, as well as private right of action.

However, there are many other things I am concerned about that are simply not in the bill, or there are huge exemptions that a freight train could run through, which would neutralize the bill in many respects.

First, privacy as a human right is the number one thing that I do not see in the bill. Many have said, from our efforts, that privacy as a human right needs to be foundational to any legislation. Conservatives recently passed a policy that deals with this exact principle:

The CPC believes digital data privacy is a fundamental right that urgently requires strengthened legislation, protections, and enforcement. Canadians must have the right to access and control collection, use, monitoring, retention, and disclosure of their personal data. International violations should receive enforcement assistance from the Canadian Government.

Clearly, this is a concern of many. We have heard from countless witnesses and experts. Jim Balsillie, who has been mentioned already this morning, warned us of what can happen if we do not take this seriously.

I will talk about the exemptions in the bill that concern me, and my copy of the bill is very well highlighted for some of the errors that are in it.

There is “Exceptions to Requirement for Consent.” A meaningful consent is another principle that we really need to address in the bill, and it has been mentioned already. If children have an app they like to play games on, all that has to be done to basically hand over their data is just a little check box in order to play the game, and we call that “meaningful consent”. Bill C-11 says that it attempts to fix that, but I will go over the exemptions.

“Exceptions to Requirement for Consent” states:

An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for a business activity described in subsection (2)

This is the list of activities in subsection (2) that are exempt from meaningful consent:

(a) an activity that is necessary to provide or deliver a product or service that the individual has requested from the organization;

(b) an activity that is carried out in the exercise of due diligence to prevent or reduce the organization’s commercial risk;

(c) an activity that is necessary for the organization’s information, system or network security;

(d) an activity that is necessary for the safety of a product or service that the organization provides or delivers;

(e) an activity in the course of which obtaining the individual’s consent would be impracticable because the organization does not have a direct relationship with the individual; and

This is the big one:

(f) any other prescribed activity.

I appreciate the Liberal members stating that this bill is an effort to get us to a better place around data privacy in Canada, but exemptions like that in the legislation need to be addressed. That is why our party talked about getting Bill C-11 to the industry committee to have a fulsome discussion of its good parts and of what needs to be fixed and strengthened. Sadly, the current government has decided to send it to the ethics committee instead of where it should go. Some of the audience today might understand why. Because of the government's many ethical lapses and failures, it would like to use up all of the time it possibly can with other legislation, such as Bill C-11. Only ethics violations should really be discussed at the ethics committee. It is unfortunate that this is going to be pushed to the ethics committee. My hope for legitimate changes to the legislation may be muted by a rush to get through it, and it may not be given due diligence, as many Canadians are expecting it should.

I want to thank the Canadians who have come to me over the years to talk about their concerns around the way our data is collected. Many years ago I coined the phrase that our online data is essentially our digital DNA. It is who we are online, and we need to do all we can to protect the information and data of Canadians. In this new era of social media being in the public square, we need to do our due diligence as legislators to make sure that it is protected as much as possible. Unfortunately, although the effort is laudable, this legislation simply falls short. That is why, from our perspective, we want to see it go to committee and hopefully changes can be made there.

There is an old saying: “Don't let the perfect be the enemy of the good.” I do not think we can call this legislation good quite yet.

I wanted to thank some of the guests we had before us. There has been some discussion that not enough has been heard regarding privacy and digital issues online, but we had countless experts from Canada and heard from experts around the world. We heard from Shoshana Zuboff and many witnesses at our International Grand Committee who really set the blueprint for what can be done with digital and data privacy. We have a way to make it better.

Our Privacy Commissioner made many suggestions. We see some of those in this legislation regarding increased fines and stiffer penalties for big tech if they misuse people's data or have lapses with that. However, the legislation still falls short. My hope is that it gets to committee so the committee can get a really good eye on it and have the chance to propose some fixes to those exemptions and other holes in the legislation.

I look forward to any questions.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:30 p.m.
See context

Green

Elizabeth May Green Saanich—Gulf Islands, BC

Mr. Speaker, the hon. member for Prince George—Peace River—Northern Rockies and I may be known around this place to rarely agree with each other, but I want to salute him for his leadership on this work. We are 100% aligned in that we need to do much more to, in his words, deal with the appropriation without consent of our digital DNA. I agree with him: It is unfortunate this is going to the ethics committee instead of industry, but it is one of those files that has feet in both committees.

What does he think would be the most important amendment to make to this legislation, or should we scrap it and start over as some critics are suggesting?

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:30 p.m.
See context

Conservative

Bob Zimmer Conservative Prince George—Peace River—Northern Rockies, BC

Mr. Speaker, I would like to thank the member for her comments and kind words.

The most important thing would be to recognize privacy as a fundamental right or a property right. It needs to be recognized with that significance. The rest comes from that being at the top of the pyramid, because if that fundamental ideal is not there many other reasons can be made not to legislate appropriately. However, if that is the foundation we have a great place to go with the recognition of how serious data is. It really is our digital DNA. We need to protect it as such, and apply rules to big tech and other companies so they use it appropriately.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:35 p.m.
See context

NDP

Jenny Kwan NDP Vancouver East, BC

Mr. Speaker, regarding Bill C-11, the Privacy Commissioner has stated that he is concerned with the government's new definitions of commercial activity and consent rules. The current bill actually has much less protection of privacy than the previous definition.

I wonder whether the member could comment on that. Does he share those concerns? Should the government be making amendments in this regard?

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:35 p.m.
See context

Conservative

Bob Zimmer Conservative Prince George—Peace River—Northern Rockies, BC

Mr. Speaker, I do share those concerns. In my work as the former ethics chair, I have gotten to know our Privacy Commissioner professionally, and I really heard the case for having stringent protocols around data. Again, this bill is supposed to deal with those concerns, and I listed the exceptions, even for the requirement to consent. Members can use the analogies they want, but a truck could drive through it. When there are huge exceptions for uses of data this bill should tighten them up, not open them more widely and broadly. I think this is what needs to be addressed in committee, and my hope is that it will be at ethics.

Digital Charter Implementation Act, 2020Government Orders

April 19th, 2021 / 12:35 p.m.
See context

Conservative

Ted Falk Conservative Provencher, MB

Mr. Speaker, I want to thank the hon. member for Prince George—Peace River—Northern Rockies for bringing to the attention of the House some of the errancy of Bill C-11. In particular he noted that this bill should be heading to the industry committee, and it has found its way back here because the Liberals are trying to prevent the ethics committee from doing its work on other very important issues, such as scandals. I acknowledge that.

The member also talked about some exceptions in the bill that would make it less effective than it should be, and I am wondering this: Are there any exceptions in particular that he finds particularly grievous?