Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you to Mr. Garon for moving this motion. Certainly I think it's an important issue to study.

I wanted to clarify two quick things.

One is that the intention of this motion is not to delay Bill C-27, but would follow any work we have left on Bill C-27.

The other very small change, which I would like to propose, is just to remove the word “each” in the last paragraph in the English version, which would suggest we have one two-hour meeting on this. Right now, the way I read it, it looks like it's two hours each, which makes it four hours, as far as I interpret it.

If Mr. Garon would be amenable to those small changes and the clarification that this is to come after the work on C-27, I would certainly be supportive. I think we could probably say he would have the support of all the members on this side.

Thank you.

[Dane Lloyd, Conservative, Sturgeon River—Parkland, AB]

My next question is for Carfax Canada.

We know that we're dealing with Bill C-27 in another committee and there are a lot of privacy issues with it, and we of course know that VINs—vehicle identification numbers—are part of that. Do you have any concerns about Bill C-27 and VINs? Is there an impact that this committee should be aware of?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Okay.

With respect to privacy, I have the pleasure and honour of sitting on the industry committee. With Bill C-27, there's an aspect of privacy in that, with PIPEDA and the relevant sections and so forth. Privacy is a huge thing these days, which is an understatement—I'm using very common language, if I can say that—in terms of striking a balance. Like many of our representatives, I worked in the private sector before I had the distinct pleasure of serving the residents I currently serve. When you are provided a device from your employer to utilize, it is their device. You need to use it with judiciousness and diligence. There's a balance there. I've always seen that a balance needs to be struck.

Within that, within the government operations, there have to be guardrails within the departments, and they need to follow the PIAs, the privacy impact assessments. I literally learned this in the last couple of hours. I sit on two other committees, so it's been a busy week. With the PIAs, there is an agreement that when investigations need to happen, they should happen, and the devices and the contents of those devices need to be looked at.

Also, taking a step back, if I'm working for Nathan's organization and I enter into an agreement with the federal government, there is consent that you will use this device but you will use it responsibly. I'm putting that out there, because there needs to be that balance. If processes were not followed properly, you would need to correct those internal processes and the governance, of course.

Do you not agree that consent is important and that balance is important, but the notion that there has to be responsibility on the end-user is important as well?

[The Chair, Liberal, Joël Lightbound]

That's a good segue for me to say thank you to our witnesses.

This concludes our portion on Bill C-27, where we have heard from a lot of witnesses. That's going to instruct us as we go through clause-by-clause in April.

Colleagues, before we suspend, I want to let you know—and also for the people watching at home who might be tempted to submit to us a brief on Bill C-27—that we would like to receive that by March 1.

Colleagues, we need amendments, if possible, by March 14, so we have the time to study the amendments proposed and have discussions. If you can do it earlier, that would also be ideal.

I would also like to thank our analyst, Ms. Savoie, who is attending her last meeting with us today.

Thank you, Ms. Savoie.

Thank you, colleagues.

I want to thank the witnesses again.

The meeting is suspended.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Chair.

Welcome, everyone.

These are the last five minutes I'll be able to comment with regard to Bill C-27. Obviously, a lot of work has gone into this bill. I just want to say congratulations to everyone involved and to thank all the witnesses who have come. It is well needed. Artificial intelligence is impacting and will impact every single person in Canada and across the world, in their lives and their livelihoods, in everything we do, from using Google Maps to the health care sector and any other aspect of our daily lives.

I would say it is good, to use a very simple term, that our government is working with and consulting with and listening to a number of stakeholders, who came forth in the dozens to be heard on Bill C-27. Obviously, not everyone will agree on legislation. That is part of our democracy. That is an individual's right. I get that, having been in Parliament for a number of years. Not everyone agrees, but we must work, we must take action and we must legislate, because that's what we are—legislators.

Since joining this committee several months ago and coming on board and looking at the privacy aspects of the bill, which I think are parts 1 and 2, and then part 3 is AIDA, I know there is a lot of stuff in here. We know that other jurisdictions are moving, with Europe and the U.K. and the United States and us. I do agree on one aspect, that a voluntary code is good, but we need legislation. I think that's a part of capitalism. Voluntary codes for business are voluntary, but you need teeth. That's why you need to legislate.

I want to start off there and turn to the individual who works at the Mayo Clinic, because I believe one of the powerful tools of AI will be in the health care sector. As we move toward more specialized medicine and specialized screening and specialized diagnoses, AI will continue to play a greater role.

Mr. Malik, could you comment on AI's role within the health care sector from your point of view, please?

[Jim Balsillie]

Sure, you could do a comprehensive set of amendments to make it proper, but you will always deal with the democratic integrity issue, and the first nations have said that they're going to litigate on Bill C-27 and AIDA. You're always going to have an integrity issue. You could do sufficient amendments to make it appropriate, from my point of view, but how do you have legitimacy from the stakeholders?

On the earlier comment, overwhelmingly the consultations were with industry after it was presented. It's a very dangerous move, and I don't see the math in it.

[Ryan Turnbull, Liberal, Whitby, ON]

Thanks.

I just wanted to go back to my line of questioning earlier, which was about the right to object to automated processing of personal data. I really feel like Bill C-27 has dealt with this through express consent for using biometric data. I can just withhold my consent if I don't want someone to use that data. If they contravene that requirement, they would be breaking the law, because they wouldn't have sought my express consent.

I don't understand why in your paper you're recommending that we do something that is actually, I feel, included in the bill. Can you maybe speak to that, Ms. Tessono, from your perspective?

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

We talked earlier, in a previous discussion, about how Bill C-27 in part appears to be at least based on the European Union's model. How would you compare those two pieces of legislation? More importantly, can you highlight some of the elements of the European proposal that are not included in the AIDA and should be?

Then I'll pass it over to my colleague.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

In the November 28 letter from the minister and his proposed amendments, in one of his bullets he talked about creating clearer obligations across the AI value chain, establishing data governance measures and establishing measures to assess and mitigate the risk of having biased output. You already mentioned the definition. My assessment is that, as we are having this broader discussion on governance in respect to AI, the government and the officials at Industry Canada don't really know what they're doing right now, so they're providing themselves, in this bill, massive and broad regulatory powers.

I'm personally having a debate about whether in fact we need this law: whether we should be voting in favour of this aspect of Bill C-27 on artificial intelligence or whether the government could simply do this through their regulatory capacity right now. I don't know.

Do you have any comments on that? Is it even necessary to grant industry so many regulatory powers and so much oversight in legislation? Would it make any difference if we just did that through GIC regulation?

[Jim Balsillie]

Well, put it within.... There's nothing saying that you can't run it within the Office of the Privacy Commissioner and extend its mandate and resources. It has parliamentary direct reporting that is well established and well respected.

By the way, all of these issues of adequacy and so on that we're looking for build upon the Privacy Commissioner's work, so this idea of adequacy in Europe is a living document that's actually contextualized on case decisions, principally from our courts and our Privacy Commissioner. The idea that these are separate structures and that you want parallel, fragmented...never did make sense to me. I don't know what.... Just give the powers to the Privacy Commissioner. Get rid of that silly tribunal. Fix the provisions of Bill C-27 so that they're actually like the GDPR. Have proper consultations on AIDA. If you do that, you're on your way.

I have an expression that I use: Life's hard enough, so don't make the easy things hard.

[Jim Balsillie]

Yes, thank you for that.

What I was trying to say is that this commissioner needs to be independent of ISED and have more powers than the competition commissioner or the Privacy Commissioner, who have been asking for more power. They do not set the standard; they themselves want a higher standard. As I've also said, who came up with this idea of a tribunal? Who pulled that out, and what the heck is that for? It just weakens the courts and creates a middle process.

Also, I think it's worth having a discussion about whether AI should be integrated with the Privacy Commissioner. That question has never been asked. Data and AI hang out together. They're not separate. Privacy is always at play there, and we have an existing regulator who wants to have that authority and whom we have the ability to build with.

If I was designing this, I would start the consultation again on AIDA. I would not include the tribunal. I would ask if this commissioner should be within the Office of the Privacy Commissioner, with enhanced powers and resources. We already have a running system, and we just need to fix the text of Bill C-27, including the consultation with the first nations.

We have a winning path here that isn't expensive and delayed, yet it was all just thrown out there without really thinking.

[Jim Balsillie]

Yes. I've always taken a crosscutting effects and rights approach to it, not a technological one, so I agree with those who frame it that way. Beware of those who think the answer to technology issues is more technology.

I think the place that is going to be hurt the most by far by AIDA and Bill C-27 is Quebec. They have by far the most to lose, because they've set a higher bar—an appropriate bar—with law 25, yet clearly this law is lower. Which one is in charge? Also, if you notice, it's ambiguous, and you know the federal is going to win, but corporations are going to arbitrage away from Quebec. It's like pollution laws are easier on one side of the river than the other, so you just move across the river. I think you'll lose. If you don't do strong laws, we all lose, but Quebec will lose the most.

Absolutely, social, cultural, economic, security, this is the mediation realm of the contemporary. It's extremely important, and I think the provinces should be given tremendous accord on this, and that should be clarified in this bill. However, your primary protection is raising the standard of this bill so that, as a minimum, it meets law 25.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you for that.

I'm going to jump to a slightly different topic.

Recommendation number 5 is about addressing the human rights implications of algorithmic systems. Mr. Balsillie mentioned as well the right to object to the automated processing of personal data.

Doesn't Bill C-27 currently already address this through both the requirement for record keeping and the easy identification of an AI-generated output, which has to be watermarked or identifiable? Also, biometric information is technically protected, so you would have to have express informed consent in order to use that.

Isn't that already addressed in this bill in some very real respects? Maybe you think we should go further.

I will ask Mr. Malik first, and then Ms. Tessono.

[Ryan Turnbull, Liberal, Whitby, ON]

Okay.

Thank you to all the witnesses for being here today. I really appreciate your contributions.

Mr. Balsillie, welcome back to committee. I know it's your second time here for this study. I appreciate your contributions.

I just want to say something off the top here, which is that we've had 86 witnesses, 20 meetings at INDU and 59 written briefs; the department and ministry have conducted over 300 meetings and consultations on Bill C-27, and the regulations that will be forthcoming will involve two years' worth of extensive consultations before they are released. I think there has been consultation. I understand that some witnesses today feel as though there needs to be more, and I value their perspective, but I just want to correct the record. When people say no consultation has been done, I think the evidence or the facts substantiate a different claim.

I just wanted to start with that.

[The Chair, Liberal, Joël Lightbound]

I tend to agree, Mr. Turnbull, and I will ask Mr. Perkins to focus on the matter at hand before this committee, which is Bill C-27. However, I'll note that Mr. Balsillie is free to communicate with the committee, as he wishes, the information he feels is relevant to our studies, by and large.

Go ahead, Mr. Perkins.