Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

[Philippe Dufresne]

In terms of the sandboxes for organizations, we're not currently resourced to offer this, but my international counterparts are, and they are doing it with business, so they will say, “You can come over, and you can test this new technology in a safe space where the regulator can provide input, can provide risk. We're able to provide proactive guidance and to be consulted, and we have services for that, but not to the extent of offering sandboxes. This is something I'd like to be able to do. I think it would be good for Canadians and good for industry.

We've identified that we would need ongoing annual funding, an increase of about $25 million for Bill C-27, to optimally provide those services based on those new authorities.

In terms of the sweep that you made reference to, with our partners we look at various numbers of websites and see.... I don't have the randomized formula that was used by the team, but the goal is to say that we're going to do some spot checks and see.... Are there trends? Are there concerns? Are we seeing some websites that are using what we call deceptive practices or dark patterns, which are communication tools that will lead people into making bad decisions and will sometimes trick them?

[Philippe Dufresne]

We have roughly 215 employees at the OPC, and we have proposed budget funding for my office in the 2024-25 main estimates of $34 million. We have had an increase of $4.5 million in the previous year. Half of that is attributable to collective bargaining increases, so that's not really increasing our budget or our ability to do our work; it's just maintaining it. We've had temporary funding, as part of budget 2023, of $2.4 million for that year to help us address the backlog and privacy breaches.

We need increases in our budgets on a permanent basis. This additional funding is useful and very important, but it will come to an end, and the challenges will not come to an end. We are seeing more privacy breaches. We are seeing them on a larger scale. We are seeing that they are more complex, and technology is making it more challenging.

There is a need for more permanent funding on that. Specifically on the point of more proactive and promotion work, we will also need additional resources in this space, particularly if Bill C-27 is adopted. Bill C-27 would bring new responsibilities to my office from an enforcement standpoint, with order-making powers, but also with, just as importantly, more guidance opportunities to help organizations and small and medium-sized enterprises know what their obligations are, to provide clarity on this industry, which needs as much certainty as possible to do its work and to know what the expectations are.

There are very interesting provisions in Bill C-27 that would allow the preparation of codes of practice and certification programs. These are things that businesses around the world have been asking for to give them more certainty, and I would be playing a role in approving them and providing some more legal certainty.

There are a lot of things that we could be doing. The resources limit that. Of course, public resources have to be used judiciously and cautiously. We're looking at that. We've made some requests. We're going to continue to do that in a fiscally prudent manner.

[Philippe Dufresne]

We're investigating TikTok right now, so this is the one where we will have some findings to make. We made a general statement for all social media, in terms of protecting the rights of children, with my provincial-territorial counterparts. We cautioned against nudging techniques that would encourage children to give more personal information than they need to. We called for the treatment of children's personal information to be different and for them to have a greater right to delete information. I won't make a specific comment about a specific website if we haven't investigated it particularly on that issue, but generally we are calling on all of those platforms to be mindful of those elements.

Again, I think Bill C-27 will bring greater tools in respect of this heightened protection. I've made it one of my priorities, so we're going to continue the education work but also targeted compliance, as needed, to protect children, whichever platform is at issue.

[Philippe Dufresne]

In some of these investigations we're focused on the consent. Are you obtaining meaningful consent by Canadians, and are you doing that in an appropriate way with respect to the age? We have guidance on that in terms of the fact that what is appropriate for an adult isn't going to be appropriate for a child, for a minor.

There are different types of circumstances, and Bill C-27 recognizes that by protecting minors' information and treating it as sensitive, so that's an additional positive step to recognize the best interests of the child.

[Philippe Dufresne]

In Bill C‑27, for example, the emphasis is on making consent easy to understand and simpler. In addition, organizations are required to be more proactive, and there is a greater role for my office in preparing guidelines. It also provides for the authority to issue orders. So, that is why I think this bill is a step in the right direction.

[Philippe Dufresne]

We're working very closely with a number of our international counterparts. I'll name a few.

The G7 data protection authorities work yearly. Last year in Japan, we issued a joint statement on artificial intelligence from a privacy standpoint. I was very proud of that statement. It's a statement that was endorsed in the Department of Industry's and Minister Champagne's statement on voluntary codes for AI. It's that collaboration, the sense that my colleagues and I understand the need to have very strong privacy protection but at the same time very strong economies and a very strong ability for organizations to have data across borders.

I'll point to the U.K.'s ICO. They've done great work on children's privacy. They have a children's code, an age-appropriate code, talking about steps that we can take. I think this is something that Bill C-27 highlights. I was happy to see a recent amendment at the INDU committee recognizing the best interest of the child, which was one of my recommended amendments for this bill.

I think we're seeing lots of work in this space and lots of awareness too. Perhaps another example I'll give is the creation of what we call the privacy sandbox. A commissioner's office will invite industry to come and test a new process and highlight risks in privacy before this technology is deployed, so that the risk can be mitigated. You protect privacy, and you avoid a complaint on the front end.

[Philippe Dufresne, Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada]

Thank you, Mr. Chair.

Members of the committee, I'm pleased to be here today to discuss the Office of the Privacy Commissioner of Canada's main estimates for fiscal year 2024-25 and to describe the work of my office to protect and promote the fundamental right to privacy of Canadians. I'm accompanied by Richard Roulx, deputy commissioner, corporate management sector.

In January I launched a strategic plan that lays out three key priorities that will guide the work of the OPC through 2027. The first is protecting and promoting privacy with maximum impact, by using business intelligence to identify trends that need attention, producing focused guidance and outreach, leveraging strategic partnerships and preparing for the implementation of potentially new privacy legislation.

The second is addressing and advocating for privacy in this time of technological change, with a focus on artificial intelligence and generative AI, the proliferation of which brings both potential benefits and increased risks to privacy.

The third is championing children's privacy rights to ensure that their unique privacy needs are met and that they can exercise their rights.

I believe that these three priorities are where the Office of the Privacy Commissioner can have the greatest impact for Canadians, and that these are also where the greatest risks lie if the issues are not addressed.

Protecting privacy is one of the paramount challenges of our time. My office is poised to meet this challenge through strong advocacy, collaboration, partnerships, education, promotion, enforcement and capacity building, which includes doing more to identify and address privacy trends in a timely way.

Investigations under the Privacy Act, which covers the personal information-handling practices of federal government departments and agencies, and the Personal Information Protection and Electronic Documents Act, Canada’s federal private sector privacy law, are a key aspect of the Office of the Privacy Commissioner’s work on issues that significantly impact the lives of Canadians.

In February I made public the results of my investigation into Aylo, the operator of the website Pornhub and other pornographic websites. I found that the company had contravened Canada's federal private sector privacy law by enabling intimate images to be shared on its websites without the direct knowledge and consent of everyone who is depicted.

In releasing my report on this investigation, I reiterated that the non-consensual sharing of intimate images is a serious privacy violation that can cause severe harms to victims, and that organizations have an obligation under privacy law to prevent and remedy this.

This case is also relevant to the discussions that will be taking place on Bill C-63, and I will welcome the opportunity to share my views on the online harms act with parliamentarians.

I also look forward to sharing in the coming months the findings of two high-profile investigations that are closely tied to two of my strategic priorities—protecting children’s privacy and addressing the privacy impacts of emerging technology, including AI.

When I appeared before you last year on Main Estimates, I spoke about the launch of investigations into TikTok, as well as OpenAI, the company behind the AI-driven text generation ‘chat bot’ ChatGPT. Both investigations are being conducted jointly with my counterparts in Quebec, British Columbia and Alberta.

In the case of the TikTok investigation, the four offices are examining whether the practices of the company ByteDance comply with Canadian federal and provincial privacy legislation and, in particular, whether valid and meaningful consent is being obtained for the collection, use, and disclosure of personal information.

Given the importance of protecting children's privacy, the joint investigation has a particular focus on TikTok's privacy practices as they relate to younger users.

The investigation into OpenAI and its ChatGPT chat bot is examining whether the company is compliant with requirements under Canadian privacy law in relation to consent, openness, access, accuracy and accountability. It is also considering whether the collection, use and disclosure are done for an appropriate purpose.

Both investigations remain a high priority and we are working to complete them in a timely manner.

Protecting and promoting privacy with maximum impact remains integral to fulfilling my current mandate and preparing for potential changes to federal privacy law.

In the 2023 budget we received temporary funding to address pressures related to privacy breaches and a complaints backlog, as well as to prepare for the implementation of Bill C-27. While these temporary funds provide necessary and immediate support, it is essential that my office be properly resourced on a permanent basis to deal with the increasing complexity of today's privacy landscape and the associated demands on my office's resources.

To address this, we will continue to present fiscally responsible funding requests and will also aim to maximize agility and cost-effectiveness by assessing and streamlining program and service delivery.

With that, I would be happy to answer your questions. Thank you.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

I shift, then, over to Statistics Canada. It's requesting $736 million, an additional almost $204 million compared to last year's estimates. The plan for the department focuses on the agency's continued modernization—and we heard about that in the digitization of service delivery—but how will Statistics Canada leverage large language models and generative artificial intelligence to deliver timely and reliable data? The reason I want to expand on that is that we're undertaking the study with Bill C-27, and I'd like to have an understanding as to how that might impact the government's plans, specifically through Statistics Canada.

Mr. Kennedy, I'll let you direct that too.

[Jean-Denis Garon, Bloc, Mirabel, QC]

I actually wasn't trying to get you with that question. I was merely trying to raise the concern. It's an important sector, and it can sometimes seem as though decisions are made just like that. I wanted to hear your take on the situation, so thank you for that.

Now I have a quick question for the deputy minister responsible for Bill C-27. Under the bill, a new tribunal is being established, which the government says is necessary because the Privacy Commissioner's new responsibilities will result in more legal proceedings and things will get complicated. However, I can count on one hand the number of times the Privacy Commissioner's decisions have been challenged before the Federal Court, Federal Court of Appeal or Supreme Court. That casts doubt on the need for the tribunal. With the commissioner being given more tools to do his job, it seems as though the creation of this new tribunal might seek to undermine the commissioner's role.

I want you to understand why I'm raising the issue. As parliamentarians, we talk both behind the scenes and here, publicly, and we have questions. We know that the minister carried out consultations, so we want to find out which companies in the sector he consulted. Obviously, the committee hasn't met with those stakeholders, since we're having to work on this in a bit of a rush.

Can we, the members of the committee, know exactly which companies in the sector the minister consulted before bringing forward Bill C‑27 and his countless amendments? Clearly, the original version of the bill wasn't up to par, unfortunately, even from the department's standpoint.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you.

Moving on, you gave a speech to a small group in a law firm in Toronto—I think it was a small group—about Bill C-27. We requested a copy of the speech, which you kindly provided. It was a speech at a business leaders' breakfast in Toronto, and it was behind closed doors. In that speech, you said, when we talk about high-impact AI systems, we are focused on a few key areas. You go on to list the systems, which include “systems...that can really be used to shape and often narrow perspectives if not appropriately monitored”. What narrow perspectives are you going to use Bill C-27 to moderate content on?

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair, and thank you, everyone. I guess Mr. Schaan missed us, so he's back, even though we're not on Bill C-27.

I'd like to start, Deputy, if I could, again with the net zero accelerator. For the $8 billion that has been committed to this, the environment commissioner, who is part of the Auditor General's office, said that the department doesn't track the per dollar value or the benefit of whether or not it's actually reducing carbon. What's your response to that?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Chair, when the committee finishes Bill C-27, we'll have ample time to look at all these questions. To your point, Mr. Masse, yes, I'm open to looking at that, to be honest. It's one of these things.

I may just say—and I know it's not Bill C-27—the last time we looked at privacy in this country was before we had Google, Facebook, Instagram and Twitter, so that's why I'm always coming back to the urgency of Bill C-27. I think folks watching at home would be surprised that, today, the law to protect our kids predates most of the social media that exists.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Thank you, again. You seem to focus on the big things.

Yes, definitely. I always say that the science of today is the economy of tomorrow. That's why, in 2016, we made record investments in science, and now you've seen $3.5 billion in the last budget. I'll mention one: $2.4 billion on AI.

Canada is already a world leader. We were the first country in the world to have an AI national strategy. We were the first country in the world, with the United States, to have a voluntary code of conduct. We want to keep that leading position.

Yoshua Bengio is a Canadian who has been recognized by Time magazine as one of the 100 people in the world who have great influence, and he is helping us. I would say to people on the committee that they should listen to his voice on Bill C-27, because he's world renowned. To maintain that capacity of leading, these investments in AI, the $2.4 billion we've announced to have more computing power, and the agreement we recently signed with Nvidia should give confidence to Canadians that we're going to continue to lead.

[The Chair, Liberal, Joël Lightbound]

Thank you, Minister. At the rate things are going, we need time to finish our study on Bill C-27 before you bring us a new bill.

We now go to Mr. Masse.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Let's stop there for a moment. I think you realize that sometimes committees serve to deliver a message. I think it's important to discuss the issue with the Minister of Housing, Infrastructure and Communities. I'm confident that the intentions here are good. In my neck of the woods, there's quite a bit of talk about Lion, and a lot of people are worried about this. That was my way of appealing to you, to get you thinking.

I have a bit of time left.

I imagine your binder there includes a page on copyright reform, since it's in your mandate letter. For years, Quebec's publishing community has been calling for the Copyright Act to be reformed, as promised. Despite being in your mandate letter, those reforms have yet to happen.

Educational institutions are not properly compensating authors. Artificial intelligence, or AI, is a whole other issue. I don't want you to list off everything you've done in the area, because I know it will burn up my time and you're good at that. Bill C-27 raises concerns about copyright. In particular, works that are used by AI systems have to be protected.

When will the committee see a bill containing copyright reforms? If we knew the legislation was forthcoming, perhaps it would motivate us to speed up our study of Bill C-27.