Thank you to all committee members.
Today I am very pleased to speak about CPC-1.
Over the course of all our meetings, I really emphasized the need for a fundamental right to privacy, as many of you did, and the special rights we have the opportunity to put in place, not only to protect our freedoms and ensure fairness in the push for a just society, but to do so specifically for Canadian minors.
Let me break CPC-1 down for you. It essentially embeds the preamble into part 1 of the act and adds a crucial clause. It would read:
Whereas the protection of the fundamental right to privacy of individuals with respect to their personal information is essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms in Canada....
Whereas the processing of personal...data should respect minors’ privacy and their best interests....
Why do these changes matter? The Office of the Privacy Commissioner has noted that, as Bill C-27 is currently drafted, the preamble of Bill C-27 appears only in the introductory text of the bill and not at the beginning of the CPPA or the AIDA. According to the Privacy Commissioner, once enacted, neither act will contain any mention of the preamble, which includes the bill's only mention of the fundamental right to privacy. While, yes, I understand that the preamble of an act is not legally binding, it does provide guidance to the courts with regard to the intention of our work in drafting this bill. When privacy interests and those of businesses are in conflict, the inclusion of the preamble will allow the courts to identify the intent of our work here at committee.
In addition to embedding the preamble in the act, this amendment would also make changes to the preamble's existing text. One, it would strengthen the recognition of a person's fundamental right to privacy in the existing text by making a specific reference to the right to privacy. Two, it would recognize that the processing of the personal information of minors should respect their best interests.
These amendments were recommended by the Office of the Privacy Commissioner as a means to strengthen privacy protection for all Canadians. More specifically, the Office of the Privacy Commissioner, in the submission made on April 26, 2023, made it clear that the preamble of the bill must...and stated, “Privacy is both a fundamental right in itself, and is instrumental to the exercise of other rights.”
Also in this submission, the OPC makes recommendations and proposes amendments in the following five areas to advance this broader theme—privacy as a fundamental right, children's privacy and the rights of the child, appropriate purposes, administrative monetary penalties and disposal. It recommends that the preamble should “recognize that the processing of personal data should respect children’s privacy and the best interests of the child.”
The preamble of the bill would apply to the CPPA and the AIDA, which is why the OPC believes it is important that this amendment is included in the text of the bill. Its submission also stated:
As the preamble would apply to all the Acts comprised in Bill C-27, including the CPPA and AIDA, adding the proposed language to the section that frames the legislation’s intent would help ensure that the best interests of children and minors are prioritized and consistently considered across all the related Acts.
At meeting 87, on September 28, the Privacy Commissioner repeated what was voiced in the OPC submission. He said:
Under the theme of privacy as a fundamental right, I recommend strengthening the preamble and purpose clause to explicitly recognize privacy as a fundamental right, and highlight the need to protect children's privacy and the best interest of the child, so that these important principles inform the interpretation of all aspects of the legislation.
In addition to listening to the recommendations given by the Office of the Privacy Commissioner, it is very important for us to listen to what other stakeholders said on this as well.
In meeting 99, on November 28, Elizabeth Denham, who is the chief strategy officer of the Information Accountability Foundation, came to voice her input. She's worked for decades as a privacy professional and worked for 15 years as an information rights regulator in 15 jurisdictions. She previously had a role as the information commissioner for the United Kingdom in 2016, where she brought into oversight the board that administered the general data protection regulation, an important part of EU privacy and human rights law, which was also raised consistently at our meetings.
While working as the U.K.'s information commissioner, she oversaw the creation of a children's appropriate design code, which has influenced the U.K.'s laws related to privacy. The GDPR's children's code of age-appropriate design assists organizations in creating digital services that cater to children's needs, respect their rights and foster their exploration and growth online. In later meetings, I will speak about this further, as we have an amendment that would create a similar code to protect children in Canada. That being said, I think it's important for us to recognize what the GDPR has done in explicitly emphasizing the language of the best interests of the child.
Furthermore, in meeting 99, Ms. Denham emphasized the importance of including “privacy as a fundamental right” and the best interests of the child in the preamble. Two of the leading experts globally, who both happen to be Canadian, are asking for this. Ms. Denham said:
Looking first at Canada's CPPA from a global perspective, I see a big missing piece, and the legislation's language, in my view, needs adjusting so that it explicitly declares privacy as a fundamental right for Canadians. Its absence really puts us behind nations who lead the way in privacy and data protection.
She also stated:
One of them needs to be a statement in the preamble or in the purpose statement that recognizes that companies need to provide services in the best interests of the child. That language comes out of the UN convention that I mentioned earlier. Canada is a signatory to that.
The best interests of the child—
During meeting 98, on November 23, we heard from Michael Beauvais, a doctoral candidate at the University of Toronto's faculty of law, who said:
...the best interests of the child should be included as a fundamental principle in the act. Doing so would make the child's interests a primary concern in all aspects of the proposed legislation. For example, the best interests of children should matter in specifying the purposes of data collection, use and disclosure, as well as data retention.
During meeting 92, on October 26, Vivek Krishnamurthy, associate professor of law at the University of Colorado law school, said:
Including language that says the best interests of the child need to be taken into consideration throughout the interpretation of the subsequent provisions means that if you're doing a legitimate interest analysis, that's going to impact that analysis by the company or other organization that's collecting and processing children's data.
During meeting 94, on November 2, interim director of the privacy, technology and surveillance program at the Canadian Civil Liberties Association, Daniel Konikoff, alluded to the fact that the current legislation does not give people a fundamental right to privacy. He said:
First, Bill C-27 does not give fundamental rights their due and frequently puts them in second place, behind commercial interests. It has been said before but CCLA believes that it's worth emphasizing that Bill C-27 must be amended to recognize privacy as a human right, both in the CPPA and in AIDA, since privacy is something that should be respected at all points throughout data's life cycle.
The stakeholders and witnesses have been diligent in making the case for why we must include this critical amendment. As legislators who serve a democracy, it is crucial for us to draft legislation that listens to the voices of professionals in this field, and they have been very clear on this point.
I now want to further emphasize why it is important that this bill specify a fundamental right to privacy and a child's best interests in the preamble.
First, privacy has long been considered a fundamental right in Canada. Our Charter of Rights and Freedoms, the Privacy Act and territorial and provincial privacy legislation work together to protect Canadians' personal information held by governments or private institutions.
Recent trends and events have raised new concerns about whether personal information is adequately protected by governments and companies when this information travels outside of Canada's borders. With the increasing flow of computerized data across international borders, particularly to the United States, privacy concerns and the rights of Canadians to safeguard their personal information make it more important than ever to include the language of a fundamental right in the preamble of the bill.
In 1948, Canada signed the Universal Declaration of Human Rights, which is an integral part of protecting individual autonomy, dignity and the fundamental rights of people. We need to ensure that the text of this bill emphasizes this right, as article 12 of the Universal Declaration of Human Rights states:
No one shall be subjected to arbitrary interference with his privacy, family, home or correspondence, nor to attacks upon his honour and reputation. Everyone has the right to the protection of the law against such interference or attacks.
Privacy is a fundamental right because it is intricately tied to our dignity and the enjoyment of other fundamental freedoms. Let me elaborate on this.
Privacy is not merely about keeping secrets. It's about control over our personal information. Our identities, beliefs and choices are deeply connected to the data we share. We heard that time and time again throughout all of our meetings.
Respecting privacy rights ensures that individuals maintain their dignity and autonomy. Think about some of the conversations we had during the meetings about what this would do to protect young people, who might make a really bad decision when they're young and online. We need to make sure that this law gets it right so that children have a right to have those bad decisions forgotten online and something is not following them throughout their entire careers and personal life. Essentially, it allows us to define who we are without undue interference, either intentionally or unintentionally.
In cases of conflict between private interests—such as convenience, business and security, as outlined in the bill—and public interest, privacy should always prevail. This balance acknowledges that, while innovation and security are essential, they must not come at the expense of individual privacy rights.
Privacy isn't an obstacle to progress. It is the catalyst that all of us have spoken so clearly on through this whole process. When people trust that their data is protected, they are more likely to engage in positive digital activities or even to use new technologies in a way that might help our economy, for example. Canada's innovation and competitiveness therefore rely on this amendment to provide a robust framework that encourages responsible data use.
Privacy will accelerate trust. When citizens feel their privacy is respected, they trust their institutions more. As digital citizens, we want to participate fully in society and the economy without compromising our fundamental privacy rights.
In summary, privacy is a fundamental right and is crucial for our digital age, which is why the preamble of the bill must highlight this right. It would ensure that we can benefit from technological advances while safeguarding our personal information and giving tools to the courts to make future decisions.
Secondly, I want to emphasize the importance of including the second half of the amendment, which states that “the processing of personal...data should respect minors' privacy and their best interests”. This line is vital at the beginning of the bill, as it sets a precedent and standard that should be followed throughout. This is especially important, as the bill proposes multiple clauses that are subject to a lot of regulation by the Department of Industry. By specifically indicating the precious needs of minors' data and in taking a nuanced approach that puts children first, we are putting protections that will hold future regulators and commissioners accountable to this fundamental concern, which we have all outlined during our meetings.
More specifically, the concept of the best interests of the child is, in fact, an international standard. It was first established in 1989, serving as a primary United Nations human rights treaty that focused on safeguarding children's rights. Article 3 states:
In all actions concerning children, whether undertaken by public or private social welfare institutions, courts of law, administrative authorities or legislative bodies, the best interests of the child shall be a primary consideration.
This declaration underscores the universal recognition of the importance of prioritizing children's well-being and interests in all decision-making processes, particularly that, one, “the best interests of the child will be a primary consideration in all actions affecting children”; two, “there will be no discrimination on the grounds of race, colour, sex, language, religion, political or other opinions, national, ethnic or social origin, property, disability, birth or other status”; three, states or parties that have signed it “recognize that every child has the inherent right to life and will ensure to the maximum extent possible the survival and development of the child”; and four, “children will be assured the right to express their views freely in all matters affecting them, their views being given due weight in accordance with the child's age and level of maturity”.
Incorporating the best interests of the child into this legislative framework is not merely a legal obligation but a moral imperative for all of us. It reflects our commitment to nurturing environments where children can, where possible, thrive free from exploitation and harm, particularly in the digital realm, which we discussed at length. The digital landscape presents so many unique challenges and risks to our kids. We can get this done. With this robust safeguard, we can protect our kids. Embedding provisions that explicitly protect minors' privacy and prioritize their best interests within the legislative framework is essential.
Thank you so much.
