Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Digital Charter Implementation Act, 2022

[François-Philippe Champagne, Liberal, Minister of Innovation]

moved that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

Madam Speaker, I thank my colleagues on the other side of the House for their enthusiasm this morning. I am extremely proud to speak today to Bill C-27, a bill to implement Canada's digital charter 2022. This bill will help us better protect our children in the digital age.

I am also proud because our government continues to show leadership in an ever-changing world. In 2019, we launched Canada's Digital Charter, a set of 10 core principles intended to build trust in a digital world.

Today, we are putting those principles into action by proposing ambitious and comprehensive reforms for Canada's privacy framework, including stronger protections for children.

More importantly, Bill C‑27 recognizes that protecting personal information is not enough. Canadians also deserve to know that they can trust the innovative technologies that shape our economy and our society. With this bill, we will be one of the first countries in the world to create a framework for the responsible use of artificial intelligence.

For Canadians to further prosper from the digital economy, we need to ensure they have confidence and trust in the digital platforms, confidence that our advantage in cutting-edge technology does not come at the price of privacy and safety, confidence that their personal information is protected and confidence that we are taking the extra steps to protect our children.

Children interact with the digital world just like adults do, but our government believes that their privacy deserves special protections. Just as Canadians need to have confidence that new technologies are being developed and deployed responsibly, businesses need clear rules so that they can effectively deliver the products and services Canadians want and need. In today's digital economy, trust has never been more important.

As my hon. colleagues know, Canada is a nation that depends on foreign trade. We live in a world where data are constantly going back and forth across geographical boundaries. Economic activity is increasingly reliant on the analysis and exchange of personal information and data. It also relies on the development of technology, such as artificial intelligence, that can be deployed anywhere in the world.

Although these technologies can improve our quality of life and make our societies and economies smarter and greener, we recognize that Canadians deserve to have their private information properly protected. We recognize that a responsible approach to artificial intelligence is crucial to building a more prosperous Canada.

What is in the digital charter implementation act of 2022? Let me turn to some of the specifics.

The bill introduces three new key pieces of legislation. The first is the consumer privacy protection act. It would replace part 1 of the existing Personal Information Protection and Electronic Documents Act, or what we otherwise know in Canada as PIPEDA. The second is the personal information and data protection tribunal act, which would establish the personal information and data protection tribunal as a key part of Canada's privacy enforcement regime. Third, this bill would introduce the artificial intelligence and data act, a new law that would set a foundation for regulating the design, development, deployment and operations of AI systems. It would also criminalize intentional acts that cause serious harm to individuals.

Our previous privacy legislation, PIPEDA, has served us well. For more than 20 years, businesses have relied on its principles to guide their use of personal information, even as technologies have changed dramatically. Canadians have been secure in the knowledge that their information has been protected. However, we know there is significant room for improvement.

The world now is a very different place than it was 20 years ago. Twenty years ago, iPhones did not exist, and neither did Facebook, TikTok and other social media. Those in this room who are old enough will recognize what I am saying this morning. It is therefore urgent that we update our laws to be in sync with the times.

The amount of data that Canadians create and share every day has grown exponentially. Given that reality, our legislation must adapt to the latest technologies and business practices.

Canadians have told us time and time again that we need more powers to enforce the law, as well as tougher penalties for those who commit the most serious offences. That is exactly what the consumer privacy protection act would do.

The legislation would strengthen privacy protection for Canadians by giving the Privacy Commissioner of Canada significantly more powers, better protecting the data of Canadians, especially minors, and creating a clear set of rules to encourage Canadian organizations to innovate while using data responsibly. Together with the personal information and data protection tribunal act, it would introduce a new enforcement regime to hold organizations accountable for how they handle personal information.

Specifically, it would increase control and transparency when Canadians' personal information is handled by companies. It would give Canadians the freedom to delete their data, as well as move their information from one organization to another in a secure manner. It would provide the Privacy Commissioner with broad powers, including the ability to order a company to stop collecting data or using personal information. It would also establish significant financial consequences for non-compliant organizations, among some of the toughest penalties in the G7.

We heard from many stakeholders on the importance of privacy reform and got specific feedback for the effort we put forward as a government in the last Parliament, including from the Privacy Commissioner. We listened, and our bill is better for it, balancing strong privacy protections with responsible innovation. This bill reflects and builds on the strengths of prior work, but also ensures that we are responding to new realities, as Canadians would expect from the House.

For example, the Privacy Commissioner asked for greater discretion and power to ensure that his office would have the ability to prioritize the most important issues. We agreed. At the same time, we recognized that the needs of smaller organizations for timely guidance and advice are real. For this reason, the CPPA would enable the Privacy Commissioner to prioritize organizations with the greatest needs when it comes to providing them with advice, while also supporting our small and medium-sized businesses so they can comply with this important legislation.

We heard from organizations that said they needed flexibility about data use in order to be innovative and competitive, arguing that the new exceptions to consent proposed in a previous bill were either too narrow or too broad and were potentially susceptible to abuse. For this reason, the proposed new privacy law includes a new limiting exception to consent for activities in which an organization has a legitimate interest. This new limited exception would include a strong backstop to ensure that organizations act responsibly.

Let me be clear. This would be a strongly enforced mechanism to allow for innovation within particular parameters. It is an approach similar to what is found in privacy laws in both the EU and Singapore, which are considered best in class.

We also heard from many stakeholders, including esteemed colleagues here in the House, who urged us to go further when it came to the protection of children. They were right, and this is the section that I am most proud of in the bill. It is why the new privacy protection act would hold organizations to a higher standard when it comes to protecting the personal information of minors.

Specifically, it would define their information as sensitive, requiring a different level of assessment and protection by the companies that use such information. This would help determine whether a company's reason for using personal information is appropriate, what type of consent they must seek, the strengths of safeguards that must be used to protect the information and how long it can be kept. Finally, the bill would also give parents and minors more power over this information, including the ability to have it deleted.

This bill has so much more, and I urge every member in the House to seize this moment.

[The Assistant Deputy Speaker, Carol Hughes]

I think there was an error in the time on the screen. The hon. minister has 20 minutes for his speech, so I will not cut him off.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Madam Speaker, obviously, if my colleagues will indulge me, I will continue, because there is so much to be said.

I hear that they are clapping, which makes me proud that my colleagues have decided on a Friday to be here to support, attend and listen. I will try to go faster, as I know the House would like to hear from them.

After the Digital Charter Implementation Act, 2020 was passed, we heard many people say that we should recognize the growing role of algorithms, even beyond their use of personal information. Privacy protection is important to Canadians, and many want the government to go much further.

More specifically, stakeholders have drawn our attention to the growing use of artificial intelligence systems and their transformative role for society and the economy. Needless to say, as a global leader in artificial intelligence, Canada has an opportunity to play a key role on these important issues.

Thanks to the pan-Canadian artificial intelligence strategy, Canada now has many leading researchers and businesses in this field across the country who also have an influence around the world. Their work is essential not only to job growth and creation here at home, but also to the supply of products and services that consumers demand and need.

We want to continue to encourage their work. Artificial intelligence can contribute to stimulating the economy and enhancing productivity in many industries. We know, for example, the immense potential of artificial intelligence for diagnosing disease or even finding numerous treatments for several diseases.

We know that it also has the potential to cause harm, including prejudice. That is why we want to act quickly to establish our expectations about how these risks should be mitigated.

To that end the measures included in the Consumer Privacy Protection Act is a most important step.

Another important component is knowing that—

[The Assistant Deputy Speaker, Carol Hughes]

I am sorry to interrupt.

The hon. member will have eight minutes when we resume debate after oral question period.

The House resumed consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[François-Philippe Champagne, Liberal, Minister of Innovation]

Madam Speaker, it is a pleasure to be here with my colleagues this morning.

Let me start where I left it before we paused for question period on a Friday.

Another important component is knowing that companies are committed to the responsible development and deployment of artificial intelligence systems. This is why we have developed the artificial intelligence and data act. Ensuring strong legal protection so that organizations remain accountable for the use of AI systems will help us to build trust.

Indeed, the proposed artificial intelligence and data act seeks to build on the already positive work of industry and academics to further promote and support responsible AI development. Specifically, much of the act will focus on regulating the development and deployment of high impact AI technologies.

More importantly, this law is designed in a way that it can grow and evolve over time. It will set expectations and create clear, bright lines right now around the most egregious and harmful conduct, while allowing space for our regulations to evolve to a collaboration with civil society and industry, and I think that is what my friends on the other side of the floor will want.

This part of the act would require that organizations consider the impacts of the system they use and put in place measures to identify, assess and mitigate harms to the health, safety and well-being of Canadians, which is something I hope everyone in this House will support. It would also require organizations to actively mitigate discrimination and bias as they design and develop artificial intelligence systems.

Furthermore, specific requirements would be laid out in regulations regarding how companies must assess and mitigate risk and monitor the effectiveness of those measures. To support compliance and enforcement, the Minister of Innovation, Science and Industry would be empowered to request information, order third party audits or additional mitigation measures, and share information with other federal regulators.

Finally, this new proposed act would set out clear criminal prohibitions and penalties regarding the use of data obtained unlawfully for AI development, where there is reckless deployment of AI, or where there is intent to cause serious harm. The act is a solid foundation, not only for today but also for our future.

The economists among us know full well that Canada is an integral part of the global economy.

That is why we developed legislation that promotes interoperability, but also our leadership in this very important domain. It will give us the necessary tools to work on a coherent national approach with our provincial and territorial counterparts, since that is a critically important issue that was raised.

In recent years, many businesses and privacy experts have highlighted the importance of maintaining Canada's adequacy status with the European Union's General Data Protection Regulation, also known as GDPR. Without GDPR, we are at risk of falling behind globally.

That is why I am asking members that we act today. That is why I am asking my friends and colleagues in this House to send the bill to committee. It is incumbent on the 338 people who sit in this House to bring our privacy laws into the 21st century. What we are suggesting with this bill is to give more power and more control to people over their data online. It is about protecting our children and making sure they are better protected in the digital age. It is also about making sure there is responsible use of AI.

Let us seize the moment, let us be ambitious and let us bring our data privacy law into the 21st century. Let us have all members contribute to that in committee. The country, our nation and our children would be well served. It could be the best gift we give them for Christmas, that this House act to protect them.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Speaker, I thank the minister for his speech. There was not a lot in the speech that I could disagree with or that we could disagree with. Our challenge is that we do not think the speech actually delivers what is said in this bill. We know perfection can be the enemy of the good, but I think, in this case, that “good” is not good enough.

Privacy is a basic human right. We have seen in past iterations of this bill that the Liberal government cannot put that in the bill, which I think is a bit of nonsense. Parliament has the right to deal with economic issues under the Constitution. The personal privacy element is the basis of freedom, the freedom of movement and the freedom of speech. Privacy is critical to that. Privacy is a fundamental human right. It should be recognized in this bill, but it is not.

Why do the Liberals not believe that privacy is a fundamental human right?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, I would like to thank my hon. colleague for his question and also for his work. I expect him to be working with us, and there is a simple answer to his question. He will see, when it goes to committee, that the bill recognizes the right to privacy of individuals and their personal information.

In a sense, the bill achieves the same goal. I think we are on the same page, and that is why we put it in the preamble. I know my colleague, who is an experienced member of this House, is someone who wants to make sure we move into the 21st century. He is right. Let us not have perfection be the enemy of the good. We want to bring our laws into the 21st century.

I would like to take this opportunity to say that today is the birthday of the member for South Shore—St. Margarets, and the best gift he could give to children across Canada is to make sure we vote for this bill and send it to committee. I know he is a man with a big heart; give a gift to our children in Canada. Let us protect them against harm in the digital world.

[Rachel Blaney, NDP, North Island—Powell River, BC]

Mr. Speaker, this is a very broad and complex bill. It is important that we recognize that. It can lead to some serious concerns that we may want to talk about later.

Part of this bill creates the new personal information and data protection tribunal, which can overrule the new enforcement actions and fines imposed by the Privacy Commissioner. I am concerned about the vagueness of the membership of the tribunal, with many appointed by the government.

Would this not be either a political tool or perceived as a political tool for the government to turn over rulings it does not like?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, I would like to thank my hon. colleague for her thoughtfulness in this regard, because she understands, like I do, how important it is for society to move and to have modern privacy laws that would protect Canadians. This legislation is about giving more power and control to people over their data.

With respect to the tribunal, in terms of procedural fairness, we have heard a lot. The point I would make to my hon. colleague is that we listened to a lot of people on that. The fact that we would have a specialized tribunal is something that is quite common in our country, where we often have a commissioner who has regulatory power and power to demand action from companies that do not comply with the act. In terms of procedural fairness, we always have this check and balance with a tribunal.

I can assure the member that the thinking behind the bill is to have people who are specialized in the area in order to make sure we have the best possible rulings on that, so that we can make sure the enforcement of the act is enshrined in the law, and also that we have judicial review in a way that would be done by people who are well versed in the field. As she well knows, obviously these decisions could be appealed to the Federal Court of Appeal, so there are a lot of safeguards, and it is really meant to make sure we have the best possible people, who understand privacy law and the digital world and can make rulings that would serve Canadians.

[Sylvie Bérubé, Bloc, Abitibi—Baie-James—Nunavik—Eeyou, QC]

Mr. Speaker, I thank my colleague for his speech.

We know that, in many ways, Bill C‑27 seeks to protect individuals' anonymity. With digital services omnipresent in our lives, we know that transactions and information exchanges are happening faster and faster. Bill C‑27 was designed to give back the personal dignity that organizations have violated for far too long.

Can the minister tell me if Bill C‑27 will go to committee so we can hear from experts who can identify the flaws in this bill?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, it is a pleasure to see you in the big chair.

The answer to my hon. colleague's question is absolutely.

There are parents listening to us at home today. The greatest gift we could give children is to refer Bill C-27 to a committee so that the questions my colleague raised can be properly studied. What she said in her introduction is correct. There are three simple things behind Bill C‑27. First, we want to give individuals more control and power over their online information. Next, as a parent, I feel it is fundamental that there be better protection for our children in the digital age. Finally, it will regulate artificial intelligence so that it is used responsibly and serves the public.

I believe it is time to bring our 20-year-old legislation into the 21st century. That is a good thing, and it is what Canadians want. It may reassure my colleague to know that during the study of Bill C‑11, we listened to many experts and collected comments to ensure not only that we have a good law, but that we are among the best in the world and that we set an example on the international stage.

I am pleased to hear that, like me, my colleague thinks that the best gift we can give our young people before Christmas is to send Bill C‑27 to committee to get it passed as quickly as possible.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Mr. Speaker, I thank the minister for introducing this bill. I think it is very important to Canadians to protect their privacy.

I have heard a lot about these issues in my work with the committee on access to information, privacy and ethics, and one thing we have heard in some of these committee meetings is that the privacy rules in Europe are stronger. I am wondering if the minister could explain to us how this legislation would bring Canada on par with Europe in terms of privacy.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, I will answer quickly.

First, I want to thank my colleague for all of the work she has done on this file. I also want to thank my parliamentary secretary, who does an outstanding job in committee. I strongly believe in the role of committees.

My colleague is absolutely right. This legislation is the equivalent of the EU's General Data Protection Regulation, or GDPR, which is very well known here.

What the member is saying is fundamental. What we want to do with this law is to make sure that we maintain adequacy with the GDPR, which is the law that they have in Europe to protect privacy. I think that is very important. It is important for Canadians, but it is also important for businesses. I think my colleagues on the other side of the aisle will really understand that passing this is fundamental for small and medium-sized businesses across our nation who need to share information with colleagues in Europe to be able to do so. This is the best way we can do that.

I hope we can send the bill to committee, so that work can start and we can give a big a gift to Canadians as we approach Christmas.

[Mike Morrice, Green, Kitchener Centre, ON]

Mr. Speaker, as it stands today, federal political parties do not have to follow the same privacy laws that apply to others across the country.

I wonder if the minister could speak to why this is not addressed in Bill C-27 and if he would be open to addressing this in the future.