Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

[René Villemure, Bloc, Trois-Rivières, QC]

You're talking about adequacy. As we all know, adequacy is a form of social capital.

Unless we act or perhaps completely redo Bill C‑27, do you think that social capital would be threatened?

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Mr. Balsillie, you discussed the difficult interoperability with Europe in the context of Bill C‑27. Could you be more specific on that subject?

[René Villemure, Bloc, Trois-Rivières, QC]

That's very interesting. Thank you.

Ms. Fortin LeFaivre, do you think that Bill C‑27 should align with Quebec's legislation and that the latter should prevail?

[Jim Balsillie]

Bill C-27 turbocharges surveillance capitalism. I talked to Shoshana last week, and we worked through this. She is coming here in February. This turbocharge is insane.

[Jim Balsillie]

Yes, in Europe, for adequacy—and don't assume this bill will get adequacy in Europe—the two most sensitive types of information are children's information and political party information, which were not included in Bill C-27.

There's a minimum standard in British Columbia, and the political parties under the budget bill are claiming that they trump that under a judicial review right now, which is effectively no oversight whatsoever. It shows that you're playing with our democratic structures, our global adequacy and what is a constitutional realm for the provinces and the federal level here. I don't know for what purpose. I don't see anything wrong with raising an appropriate standard and then putting together the proper tool kit to look after the country we all love.

[René Villemure, Bloc, Trois-Rivières, QC]

As an ethicist, I am very happy to hear you refer to norms and values that must be in harmony in order to create this act, which would be exemplary.

You've previously spoken out about the fact that political parties aren't subject to Bill C‑27. Would you please clarify that view a little further?

[Jim Balsillie]

To contrast it with bill 25 in Quebec and its effect on Quebec, I think the strategic approach of Bill C-27 will disproportionately harm Quebec, worse than any other region in Canada, for several reasons.

Number one, when you commodify social relationships and cultural properties and they can be exfiltrated and exploited, then you diminish the distinct social society in its control within the province.

Second, when you create ambiguities or different thresholds between the federal and the provincial, you'll naturally have lawyers go deeply into exploiting the lower threshold. You're seeing that happen with federal-provincial party data, where they're saying that the feds control federal political data even though law 25 says that's a provincial realm, but the position of the lawyers, in a judicial review happening in British Columbia now, is that it is not true.

Third, businesses will naturally arbitrage to the lowest jurisdiction. Picture a river between Quebec and another province. If there's a high environmental rule on the Quebec side of the river and a lower on the other side, the business will go to the lower part, even though it's all the same river.

The best way to protect Quebec, Quebec society and the Quebec economy is to make sure that every aspect of this bill is equal or superior to the principles that are in law 25, and currently that is not the case.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Mr. Balsillie, what do you think the foreseeable effects of Bill C‑27 will be based on jurisdictions and, in particular, in comparison to Quebec's Bill 25?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Mr. Balsillie, I had the pleasure of sitting with you when Mr. Breton, the European commissioner, was here. I believe it was last year or something like that. I think we were talking somewhat about the issues that we're talking about today.

The Europeans have been the first movers on a lot of aspects of the new economy or industrial revolution 4.0 or 5.0—whichever clichéd term we want to use. You have brought your views here in terms of what you think is wrong and why. I respect that, of course. We all do.

In terms of what Bill C-27 intends to do in relation to the modernization of privacy and how we deal with privacy and AI, are there aspects of the bill where we are going in the right direction? Is it just absolutely going in the completely wrong direction?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Okay.

I would like to follow up. I believe the CMA commented that it enabled small and medium-sized businesses to compete in the global economy through Bill C-27 as it is. Can you elaborate on that? Bill C-27 is a pretty in-depth bill. I almost wish I had gone to law school to understand most of it, but we're trying to get through it. Could you comment on that aspect quickly?

Then I have a follow-up question for Mr. Balsillie, if I have time.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Mr. Chair.

Welcome, everyone.

Bill C-27 is a very important bill for consumers, for individuals and for businesses, both domestically and internationally. One of the things I've been able to glean just from the testimony today is the regulatory alignment that's needed between us and other jurisdictions, and also that we in Canada benefit, sometimes, from what's called a fiscal federation. Sometimes the provinces move first, and sometimes we do, but we need to be on the same page due to the importance of the material here.

This is for the Canadian Bankers Association.

In 2018, I was part of the finance committee when we did the statutory review on money laundering and terrorist financing. “Moving Canada Forward” was a report that we issued in November 2018. You've raised some good things and some potential amendments and so forth with regard to the CPPA in relation to money laundering and terrorist financing. Can you comment on that and add any more colour that you wish to add in that vein?

[Ulrike Bahr-Gedalia, Senior Director, Digital Economy, Technology and Innovation, Canadian Chamber of Commerce]

Good afternoon, everyone.

Yes, indeed, we have received a long list of Bill C-27 recommendations from our members. A detailed brief was submitted to INDU in September and is available on the committee page, just so you're all aware. Please note that our analysis of the bill is ongoing as new material becomes available, such as the eight government amendments. Therefore, we are working with members to produce additional feedback to complement our earlier submission.

I’d like to take the opportunity to underscore a few key recommendations. First, a core position of the Canadian Chamber of Commerce is that there need to be amendments to better define many of the principles and concepts in Bill C-27 and to harmonize the bill with the norms and standards found in existing provincial and international law. Interoperability is paramount.

Among our recommendations on the CPPA, we are suggesting that the following elements align with Quebec’s law 25: that the term “minor” be defined to include an age, that the definition of “anonymize” be in line with industry standards, and that the scope of the private right of action be narrowed. We also want to underscore the importance of legitimate interest exceptions in the current bill.

On AIDA, we were encouraged to see that government amendments would be forthcoming with respect to defining high-impact systems, creating clearer obligations along the AI value chain, and ensuring alignment with the EU AI act and those in other advanced economies. We look forward to seeing the text of these amendments to provide more specific feedback.

However, other matters remain unaddressed thus far, such as better defining the use of the term “harm”. Our members have also raised serious concerns around the criminal liability element of AIDA, noting that Canada is the only jurisdiction in the world with such penalties. There is a belief that this provision might discourage businesses developing or deploying AI from setting up operations in Canada or even force some to leave, based on risk assessment.

Finally, in terms of coming into force, it’s important that our businesses, especially SMEs—because small business is big business in Canada—have adequate time to adapt to new environments and requirements. We therefore recommend a phased implementation of CPPA and AIDA over a period of 36 months.

Thank you very much.

[Steve Boms, Executive Director, Financial Data and Technology Association of North America]

Thank you very much, Chair, and good afternoon.

I am the executive director of the Financial Data and Technology Association of North America, or FDATA. We're the leading trade association advocating for consumer-permissioned access to financial data in both Canada and the United States.

Our members include firms with a variety of different business models, which collectively provide more than six million Canadian consumers and SMEs with access to vital financial services and products. Utilizing these products, services and tools, Canadian consumers can, for example, access more competitive banking services, including more affordable credit. They could utilize more efficient payment options and benefit from technology to better manage their finances and grow their wealth. Canadian SMEs depend on FDATA North America member companies to manage their accounting and credit needs and more easily send and receive payments.

We are strong advocates of Canada's implementation of an open finance regime, which was first outlined as a government priority in budget 2018. The core idea of open finance is this: A Canadian consumer or SME should be able to safely and securely share access to their data held at one provider with another provider that offers a better financial product, service or tool. Whether it's a chequing, savings, business, brokerage, pension, mortgage, or auto loan account, or data held by a payroll or benefits provider, open finance is the straightforward notion that the customer should have the right to use that data for their own benefit.

Once built, open finance in Canada will put consumers and SMEs in full control of their financial data, facilitating a more transparent and competitive Canadian financial services marketplace that provides safe and secure data portability. The data portability right and data privacy framework included in Bill C-27 are fundamental cornerstones of this modernized approach to financial services.

A survey of Canadians commissioned last year by FDATA North America and Fintechs Canada found that half of Canadians feel stress when interacting with Canada's existing financial services sector and more than two-thirds of Canadians believe that more competition in the financial services marketplace would lead to a greater choice in products and lower financial services fees. Ninety per cent of Canadians indicated that they found fintech products easy to use, with more than 80% reporting they paid lower fees to fintechs than to their banks for similar services or products. Canadians deserve access to these alternatives.

Canada lags behind virtually every other G20 country with regard to open finance, data portability and data privacy. The U.K., Australia, New Zealand, Singapore, Brazil, the European Union and other jurisdictions have all enacted some version of government-led open finance, under which consumers and SMEs have legally binding data access rights and privacy protections afforded to them.

In contrast, today Canadian consumers and SMEs have no legal right to access or share access to their financial data. Unlike the overwhelming majority of other countries, in Canada, a consumer's or SME's bank is empowered to determine whether their customer may share elements of their data with a third party to get a better deal, access a new product or tool or avoid paying exorbitant fees. To the extent that a bank may allow its customers to do so, there are generally onerous and, in some cases, restrictive terms dictating the limitations under which their customers are able to do so.

While Canada has taken important steps towards such a regime since budget 2018, significant work remains to reach implementation.

Meanwhile, the rest of the world advances. Earlier this month, the United States formally launched its own open finance regime with a CFPB rule-making. Recognizing that incumbents in the financial services market will not, on their own, deliver a more competitive, customer-centric ecosystem, the director of the CFPB noted in his announcement that the rule will “supercharge competition, improve financial products and services, and discourage junk fees”. Like Bill C-27, the CFPB rule would provide data portability rights to consumers and will require those firms that access—with their express consent—end-users’ data to abide by strict data privacy and security provisions.

To advance its open finance regulations, the U.S. had an advantage that the Department of Finance and the Department of Innovation, Science and Economic Development currently do not: strong statutory authority to do so. Finance Canada has been studying how to deliver open finance in Canada for the better part of five years. FDATA views enactment of Bill C-27 as a critical element of the transition from open finance ideation to implementation. Once consumer and SME data portability has been enshrined in law, ISED and Finance Canada will have the statutory tools required to finally deliver open finance.

Consumers and SMEs in Canada are being left behind as the rest of the G20 build and deploy open finance frameworks that facilitate competition, enable greater access to and inclusion within the financial services marketplace and provide their citizens with appropriate data protections. The data portability and privacy provisions included in Bill C-27 represent integrally important statutory tools for ISED and Finance Canada that will help Canada catch up.

Thank you. I would be pleased to answer any questions.

[Jim Balsillie, Founder, Centre for Digital Rights]

Chairman Lightbound and honourable members, thank you for the opportunity to share my views on Bill C-27, legislation that will have profound consequences on Canada's economic prosperity, freedom, democracy, consumer protection and child well-being.

The Digital Charter Implementation Act prioritizes the interests of large data monopolies and their ecosystem of traffickers. It sets a dangerous precedent by allowing corporations to allocate to individuals, children and vulnerable groups the harmful economic, political and social consequences of the data-driven economy. It normalizes and expands surveillance, treating human rights as an obstacle to corporate profits.

Bill C-27 requires a wholesale redo, and my written submission includes comprehensive proposed amendments.

A high-level perspective of some of the foundational flaws with the bill as tabled include the following: one, use of a notice and consent framework, which creates a pseudo-compliance system that enables personal data harvesting and intrusive profiling while spamming users with misleading consent barriers; two, a legitimate business interest carve-out that allows corporations to put the pursuit of profits above the interests of consumers, where businesses are allowed to privately self-determine what constitutes legitimate surveillance and behavioural modification to trample on fundamental rights but are under no obligation to notify consumers how they are tracking and profiling them; three, a diminishment of protections for children and vulnerable persons and an omission of meaningful measures that curtail insidious surveillance and behavioural manipulation practices that are driving the current youth mental health crisis; and four, an artificial intelligence and data act that doesn't include an independent and expert regulator for automated decision systems and excludes the right to contest decisions made with AI, such as insurance, school admissions and credit scoring. AIDA needs to be scrapped completely.

There are many more flawed parts of this legislation, all detailed in my submission.

The recent letter by Minister Champagne indicating willingness to make some unspecified amendments is a woefully inadequate approach to dealing with the serious flaws in this bill. It joins the long list of bad governance practices, which is how we ended up with this untenable bill in the first place.

There has been much gaslighting from industry lobbyists and self-interested parties whose profits depend on mass surveillance, arguing that meaningful AI privacy regulations limit innovation. Privacy and AI regulations are not impediments to innovation. As innovation economists and digital policy experts have shown, the unique features of the data-driven economy—specifically, data's network effects alongside economies of scope, scale and information asymmetry—mean that the more data a company gathers, the more value it gains from it. Every new dataset makes all pre-existing datasets in the hands of the same few companies more valuable, disproportionately enhancing the power of established data giants and their vested assets. This is why, in less than a decade of the data-driven economy, we have seen the greatest market and wealth concentrations in economic history, a reduced rate of entrepreneurship, innovation and business dynamism and, also, lowered wages.

Properly regulating insidious data collection and trafficking, as other jurisdictions are doing, would not only address concentrated economic power, but also force business to compete on the level of quality and innovation, not surveillance and manipulation, as is currently the case.

I am an entrepreneur, investor, co-founder of the Council of Canadian Innovators, and a vocal advocate for Canadian technological and innovation success in global markets. It's deeply troubling to hear the government talk about advancing Canadian innovation, because earlier this year the government admitted that it has no AI strategy. We are merely funding basic research that principally supports the growth of foreign data monopolies.

This lack of capacity to understand and regulate the digital economy has real consequences, chief among them a steady decline in the standard of living and prosperity for the average Canadian, particularly in Ontario and Quebec, which used to drive our national prosperity. Because Canada is unable to create policies to harness the potential of IP, data and AI, the OECD recently projected that Canada's economy will be the worst-performing advanced economy of 2020-30 and the three decades thereafter.

The choice you have is to adopt Bill C-27, a deeply flawed attempt at privacy regulation, or to create new legislation that builds trust in the digital economy, supports Canadian prosperity and innovation and protects Canadians not only as consumers but as citizens. The choice is a continued erosion of Canadian prosperity, emboldening surveillance and manipulation and deepening the mental health crisis of our youth, or a healthy democracy, long-term prosperity, robust freedoms and the protection of our children.

Thank you.

[Siobhán Vipond, Executive Vice-President, Canadian Labour Congress]

Good afternoon, committee members. It is my honour to be here with you today.

The 55 national and international unions affiliated with the Canadian Labour Congress bring together three million workers in virtually all sectors, industries, occupations and regions of the country. We are grateful for the opportunity to speak to the artificial intelligence and data act, AIDA, enacted by Bill C-27.

Across sectors, industries and occupations, workers in Canada increasingly encounter AI applications in their work and employment. Many report that AI has the potential to improve and enrich their work. In certain instances, AI applications could reduce time and energy spent on routine tasks. This could free workers up to focus on more skill-intensive aspects of their jobs, or on directly serving the public.

However, workers are also concerned about the negative potential consequences for jobs, privacy rights, discrimination and workplace surveillance. Workers are troubled by the potential for displacement and job loss from AI. Workers in creative industries and the performing arts are concerned about control over, and compensation for, their images and work. Workers are concerned about the collection, use and sharing of their personal data. Workers and unions are concerned about the use of AI in hiring, discipline and human resource management functions. Almost every week, we hear from workers who have real-life experience with the impact this is already having on their jobs. AI systems carry serious risks of racial discrimination, gender discrimination, and labour and human rights violations.

The number one demand from Canada's unions is greater transparency, consultation and information sharing around the introduction of AI systems in workplaces and Canadian society. Unfortunately, AIDA falls short in this respect.

Our concerns about AIDA are as follows.

First, unions are troubled by the lack of public debate and broad consultation on regulating AI in Canada. We feel there should have been proper public debate prior to the drafting and introduction of AIDA.

Second, the major deficiency of AIDA is that it exempts government and Crown corporations. The Government of Canada is a leading adopter and promoter of AI. Despite this, AIDA provides no protection for public service workers, whose work and employment are affected by AI systems. Government is responsible for many high-impact AI systems for decision-making—from immigration and benefits claims to policing and military operations. AIDA should be expressly expanded to apply to all federal departments, agencies and Crown corporations, including national security institutions.

Third, the bill only requires measures to prevent harms caused by high-impact systems. It leaves the definition of “high-impact systems” to regulation. As well, it is silent on AI systems that can cause real harms and discrimination despite falling outside the classification of “high-impact”.

Fourth, AIDA contemplates a senior Innovation, Science and Economic Development Canada official acting as the AI and data commissioner. The commissioner should be an independent position. An office tasked with supervision and regulatory oversight should not be housed within the department responsible for promoting the AI industry.

Fifth, while AIDA authorizes the minister to establish an advisory committee, we strongly believe the government must go much further than the current advisory council on artificial intelligence, established in 2019. The advisory council is dominated by industry and academic voices, with no participation from civil society, human rights advocacy organizations, unions and the public. The CLC urges the government to create a permanent representative advisory council that makes recommendations on research needs, regulatory matters, and the administration and enforcement of AIDA.

Finally, the purpose clause of the act should be strengthened. Currently, AIDA is intended in part “to prohibit certain conduct in relation to artificial intelligence systems that may result in serious harm to individuals or harm to their interests.” This should be revised to prohibit conduct that may result in harm to individuals and groups, not just “serious harm”. Currently, AIDA is focused on individual harms, not on societal risks, such as to the environment or Canadian democracy.

In summary, the CLC believes there should be much more institutionalized transparency, information sharing and engagement around AI in the workplace and Canadian society.

Thank you. I welcome any questions the committee may have.

[Lorraine Krugel, Vice-President, Privacy and Data, Canadian Bankers Association]

I would like to thank the committee for the opportunity to speak on Bill C-27, the consumer privacy protection act, or CPPA.

My name is Lorraine Krugel, and I am vice-president of privacy and data for the Canadian Bankers Association. The CBA is the voice of more than 60 banks operating in Canada, employing more than 280,000 Canadians and helping to drive Canada’s economic growth and prosperity.

Banks have long been entrusted with significant amounts of personal information, and privacy and trust are paramount to our banks' customer relationships. As global data flows and technological advances have continued to increase, Canadian banks have been able to responsibly innovate to meet consumer demand for even more convenience, value and simplification. The CPPA reflects a unique, made-in-Canada approach that aims to address the needs of consumers and organizations in our evolving digital world.

We need to get this right. Some of the proposed provisions in the CPPA need to be better tailored for the Canadian context. We are concerned that there is a real risk of significant adverse consequences if the scope of certain provisions is not better defined and necessary exceptions are not included.

In particular, we would like to avoid situations where organizations would be required to provide too much information in order to be transparent. For example, certain transparency provisions could end up replicating the equivalent of consent fatigue or cookie banner fatigue, with no meaningful value to the consumer. Transparency obligations also require appropriate limits so that they cannot be abused or leveraged by criminals to circumvent processes designed to protect against fraud, money laundering or cyber-threats. In addition, we need to take care so that any requirements that are highly complex or operationally onerous would, in fact, address the right underlying risks and policy intent without negatively impacting legitimate operations, product and service delivery or the safeguarding of information.

The CBA is supportive of many of the key foundations of the CPPA. The CPPA is principles-based, scalable and technology-neutral and requires organizations to comply with a collection of interconnected provisions that provide a solid privacy foundation based on accountability, reasonability and proportionality; however, we see the need for targeted amendments in the following key areas: de-identification and anonymization, disposal requests and retention, and automated decision systems.

Relating to consent, we recommend an important technical amendment that will ensure continued alignment with provincial approaches while preserving policy intent and avoiding unintended consequences regarding consent obligations. In addition, we recommend an amendment to the CPPA to legally allow certain organizations to share personal information to combat money laundering and terrorist financing as part of a legislative framework that would be further defined through the Proceeds of Crime (Money Laundering) and Terrorist Financing Act. Done in the right way, such sharing could increase privacy protections for Canadians by reducing unnecessary reporting to the government on low-risk transactions and simultaneously increase the effectiveness of Canada’s anti-money laundering regime through targeted and more effective reporting.

Finally, we believe that a minimum two-year implementation period is necessary to accommodate the scope of change and the development of regulations and guidance associated with the CPPA.

Regarding the artificial intelligence and data act, or AIDA, we are in the process of evaluating the minister’s recent proposals and will be submitting comments and recommendations to the committee when the study focuses on the AI portions of the bill.

We have provided the committee with written comments and recommendations on the CPPA and look forward to your questions.

Thank you.

[The Chair, Liberal, Joël Lightbound]

I call this meeting to order.

Good afternoon, everyone.

Welcome to meeting No. 93 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in a hybrid format, pursuant to the standing orders.

Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C‑27, An Act to Enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts.

I would like to welcome our many witnesses today and also apologize for the brief delay caused by votes in the house.

Today we welcome, from the Canadian Bankers Association, Lorraine Krugel, who is vice president, privacy and data.

From the Canadian Labour Congress, we have Siobhán Vipond, who is executive vice-president, and Chris Roberts, director, social and economic policy. From the Centre for Digital Rights, we have its founder, Jim Balsillie. From the Financial Data and Technology Association of North America, Steve Boms is with us via video conference.

From the Canadian Marketing Association, we have Sara Clodman, vice president, public affairs and thought leadership, and David Elder, head of privacy and data protection group, Stikeman Elliott LL. Lastly, we have, from the Canadian Chamber of Commerce, Catherine Fortin LeFaivre, who is vice president, strategic policy and global partnerships, and Ulrike Bahr-Gedalia, senior director, digital economy, technology and innovation.

So we have a lot of witnesses with us today. Once again, I thank you for being here.

I would also inform my member colleagues that the meeting will adjourn at 6:00 p.m. today. Please bear that in mind.

Without further ado, I give the floor to Ms. Krugel for five minutes.

[Dr. Teresa Scassa]

I completely agree that there are problems with this provision.

The one I flagged in my opening comments is that it refers to de-identified information. This was taken verbatim from Bill C-11 and put into Bill C-27, but in Bill C-11, “de-identified” was given the definition that is commonly given to anonymized information.

Under Bill C-27, we have two different categories: de-identified and anonymized. Anonymized is the more protected. Now you have a provision that allows de-identified information—which is not anonymized, just de-identified—to be shared, so there has actually been a weakening of proposed section 39 in Bill C-27 from Bill C-11, which shouldn't be the case.

In addition to that, there are no guardrails, as you mentioned, for transparency or for other protections where information is shared for socially beneficial purposes. The ETHI committee held hearings about the PHAC use of mobility data, which is an example of this kind of sharing for socially beneficial purposes.

The purposes may be socially beneficial. They may be justifiable and it may be something we want to do, but unless there is a level of transparency and the potential for some oversight, there isn't going to be trust. I think we risk recreating the same sort of situation where people suddenly discover that their information has been shared with a public sector organization for particular purposes that have been deemed by somebody to be socially beneficial and those people don't know. They haven't been given an option to learn more about it, they haven't been able to opt out and the Privacy Commissioner hasn't been notified or given any opportunity to review.

I think we have to be really careful with proposed section 39, partly because I think it's been transplanted without appropriate changes and partly because it doesn't have the guardrails that are required for that provision.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

We've had some meaningful discussions. However, I'm wondering whether this committee will really have the will or capacity to move quickly and help get this bill passed. To be honest, I even wonder if the government really wants to get Bill C‑27 passed at this point, in the context of this legislature.

Having said that, I feel like asking you some questions, Dr. McPhail.

In your publications, you put a great deal of emphasis on developing responsible artificial intelligence and transparent governance of artificial intelligence.

Because the rapid development of technology poses significant data security and privacy challenges, what are your thoughts on establishing a technological sandbox that would isolate emerging technologies in a separate environment, with a view to assessing their compliance with privacy standards before they are made available to the public?

[Vivek Krishnamurthy]

Undoubtedly, the Bill C-27 package of amendments is an improvement over the status quo. I think all of us would acknowledge that. However, I'm not sure we should settle for a C+ bill. I think Canadians deserve A+ privacy protection, and amendments to this bill can get us there.

I think that is the spirit in which all of us who are scholars and activists, and who think about privacy and take a big-picture approach to this, think of it. We understand that private information does need to be collected and processed, but that needs to be done in a way that respects what is a very fundamental human right, one that is becoming more important in our digital age over time, as technology becomes more invasive, and it is important to get that right.

Political oxygen is scarce. Again, you have many priorities, many things to legislate, so if this is our shot, we have to do our very best. I think everyone here today has provided lots of really good ideas, and if this committee would embrace them and enact some amendments, this could be a much better bill.

[Viviane LaPointe, Liberal, Sudbury, ON]

Thank you, Mr. Chair.

My question is for Mr. Krishnamurthy.

You wrote an article in May 2022 called “With Great (Computing) Power Comes Great (Human Rights) Responsibility: Cloud Computing and Human Rights”—great title, I might add. In the article, you stated that the human rights impacts of cloud computing have not been studied to nearly the same extent as newer technologies that are powered by the cloud. Can you expand on this in relation to Bill C-27, recognizing privacy as a human right?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Dr. Geist, I'd like us to discuss the data the government collects.

Is this something we should be concerned about? Do people feel that the public and private sectors are equally subject to the provisions of Bill C‑27? Should we feel reassured? Is our data adequately protected, given what the various levels of government do with it?

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you, Mr. Chair.

Thank you to our witnesses here today.

I'm somewhat concerned about this bad bill before us today.

With Bill C-11, the Government of Canada had an opportunity to enshrine the fundamental right to privacy for children, to define what a minor is, to define perhaps an age of consent and do a whole bunch of stuff to ensure that children were protected. That bill died on the Order Paper.

Then, we had Bill C-27 when this Parliament opened up again. The minister again had an opportunity to enshrine the fundamental right for children to protect their privacy in some of the actions they may take online. Then the government had the opportunity to define what sensitive information is—likely in the context of a child. They had an opportunity to define what a socially beneficial purpose was in the context of a child.

The minister came before us a few weeks ago. He said, “I have this bill. It's going to do so much work to protect children, but we have to amend it.” Then we had to put a motion forward to get a copy of those amendments. We're here today. I am not going to relent on this until we have more clarification and I hear from as many witnesses as possible to ensure that children's rights are protected.

My question is open-ended. I'll start with you, Mr. Geist. What clauses of the bill do you believe need to be amended to ensure that a child's fundamental right to privacy and their online actions are not used in a way that will compromise them as adults, or at a future period of time in their life?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you very much.

With respect to the shortcomings of the Canadian law, in an article entitled “What political parties know about you”, one thing you talk about is the factors affecting how political parties, MPs or independent candidates protect the personal information of Canadians that they may have in their possession. In the current context, Bill C‑27 makes no mention of protection of this kind.

Is the government falling short of protecting voter data and perhaps moving forward in the quest for open and transparent governance?

Do you think Canada should follow Quebec's lead and subject federal parties to the same privacy standards as organizations?

[Prof. Colin Bennett]

Thank you for that question.

I was trying to draw, in that statement, a distinction between harmonizational convergence, which is a harmonization of text ensuring that the statutes essentially say the same thing, and interoperability, which I think means something subtlely different. It means that if businesses have a requirement to do something in one province or one jurisdiction, such as a privacy impact assessment under Quebec's law 25, it will in fact be accepted by a regulator elsewhere. You can see that distinction in Canada among different provincial laws that have been worked out over time pragmatically, but it's also important to see it internationally through the GDPR.

That was the point I was trying to make. I'm not an expert on Quebec law, but I was trying to point out certain areas in Quebec's law where I think businesses would be required to do more under that law than they would under the current text of Bill C-27. Then you have to ask this question: What might be the economic impact of that across Canada if the CPPA is perceived to be lowering the standard within the Quebec legislation? That's the point I was making.

I think the particular provision on international data flows is an interesting example, because in the CPPA at the moment there's really nothing explicit for businesses on what to do when they are processing data offshore, and the vast majority of data protection laws that I know of.... This is also something that's of critical importance to the European Union when it comes to making a judgment about the adequacy, and the continued adequacy, of our laws in Canada. What happens when data on Europeans comes to Canada and then it is processed offshore elsewhere? Those are critical questions. I think there would be some concerns about that by our European friends when they come to make those judgments.

I hope that answers your question.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

I'd like to thank all the witnesses.

Mr. Bennett, in your February 12, 2021, submission to the public consultations on Bill C‑11, you distinguished between the concepts of interoperability and harmonization. I believe this is particularly germane to the subject before us, because these two concepts can be confused. You showed the difference between the two with an example I'd like to quote:

For instance, the processes for doing PIAs should be interoperable between the federal government and the provinces. If an organization does a PIA under the authority of one law, it may need the assurance that the PIA will also be acceptable in another jurisdiction. But that does not necessarily mean the harmonization or convergence of rules.

First, can you provide us with a definition of these two distinct concepts?

Second, can you tell us whether the provisions of Bill C‑27 promote the interoperability of processes among the various levels of government or rather the harmonization of rules?

[Dr. Brenda McPhail]

I think there will always be differences of opinions as to whether definitions are sufficiently stringent or overly weak.

What would address our concerns? There are three categories of concerns that we have around de-identified and anonymized information. The first is that the definition has been weakened between Bill C-11 and the current iteration, Bill C-27. In the past definition, it included indirect identifiers. You can identify me by my name, but you can also identify me if you have a combination of my postal code, my gender and a few other factors about me. To truly de-identify information to an adequate standard where re-identification is unlikely, I believe—and my co-submitters believe—that the definition should include indirect identifiers.

To some degree, that definition has been weakened because Bill C-27 includes the addition of a new category of information: anonymized information. The problem with that new category is that technically people agree that it's extremely difficult to achieve perfect and effective anonymized information, and by taking anonymized information out of the scope of the bill, what we do is remove it from the ability of the Office of the Privacy Commissioner of Canada to inspect the processing that has happened to ensure that it has been done to a reasonable standard.

Like some of the witnesses you heard from—who would disagree with me about whether or not definitions should be stronger or weaker—I think we all agree on the reality that when personal information is processed, whether it is used to create de-identified information or anonymized information, there should be some checks and balances to make sure that the companies doing it are doing it to a reasonable standard that is broadly accepted. The way to achieve that is by including the ability within the bill for the Office of the Privacy Commissioner to inspect that processing and give it a passing grade, should that be necessary.

The last piece of concern we have with anonymization, which makes that scrutiny even more important, is that the bill conflates anonymization with deletion. It was introduced to great fanfare when this bill was put forward that individuals would now have a right to request deletion of their personal information from the companies with which they deal.

That right, I believe, is rendered moderately illusory. Certainly members of the public would not expect that if they ask for their information to be deleted, an organization could say, yes, they'll do that, and then simply anonymize the information and continue to use it for their own purposes. If we are going to allow anonymized information to be equivalent to deletion, again, it's incredibly important that we are 100% certain that the equivalency is real and valid, that truly no individual can be identified from that information and that it's not going to harm them in its use after they've explicitly exercised their right to ask for deletion.

[Dr. Teresa Scassa]

Thank you.

I have concerns about both the CPPA and the AIDA. Many of these have been communicated in my own writings and in the report submitted to this committee by the Centre for Digital Rights. My comments today focus on the consumer privacy protection act. I note, however, that I have very substantial concerns about the AI and data act, and I would be happy to answer questions on that, as well.

Let me begin by stating that I am generally supportive of the recommendations of Commissioner Dufresne for the amendment of Bill C‑27, as set out in his letter of April 26, 2023 to the chair of this committee.

I will address three other points.

The minister has chosen to retain consent as the backbone of the CPPA, with specific exceptions to consent. One of the most significant of these is the “legitimate interest” exception in proposed subsection 18(3). This allows organizations to collect or use personal information without knowledge or consent if it is for an activity in which an organization has a legitimate interest. There are guardrails: The interest must outweigh any adverse effects on the individual; it must be one that a reasonable person would expect; and the information must not be collected or used to influence the behaviour or decisions of the individual. There are also additional documentation and mitigation requirements.

The problem lies in the continuing presence of “implied consent” in proposed subsection 15(5) of the CPPA. PIPEDA allowed for implied consent because there were circumstances where it made sense and there was no legitimate interest exception. However, in the CPPA, the legitimate interest exception does the work of implied consent. Leaving implied consent in the legislation provides a way to get around the guardrails in proposed subsection 18(3). An organization can opt for the implied consent route instead of legitimate interest. It will create confusion for organizations that might struggle to understand which is the appropriate approach. The solution is simple: Get rid of implied consent. I note that implied consent is not a basis for processing under the GDPR. Consent must be expressed, or processing must fall under another permitted ground.

My second point relates to proposed section 39 of the CPPA: an exception to an individual's knowledge and consent where information is disclosed to a potentially very broad range of entities for “socially beneficial purposes”. Such information need only be de-identified—not anonymized—making it more vulnerable to re-identification. I question whether there is social licence for sharing de-identified rather than anonymized data for these purposes. I note that proposed section 39 was carried over verbatim from Bill C-11, when “de-identified” was defined to mean what we now understand as anonymized. Permitting disclosure for socially beneficial purposes is a useful idea, but proposed section 39, especially with the shift in meaning of “de-identified”, lacks necessary safeguards.

First, there is no obvious transparency requirement. If we are to learn anything from the ETHI committee's inquiry into PHAC's use of Canadians' mobility data, transparency is fundamentally important. At the very least, there should be a requirement that written notice of data sharing for socially beneficial purposes be given to the Privacy Commissioner of Canada. Ideally, there should also be a requirement for public notice. Further, proposed section 39 should provide that any sharing be subject to a data-sharing agreement, which should also be provided to the Privacy Commissioner. None of this is too much to ask where Canadians' data are conscripted for public purposes. Failure to ensure transparency and a basic measure of oversight will undermine trust and legitimacy.

My third point relates to the exception to knowledge and consent for publicly available personal information. Bill C-27 reproduces PIPEDA's provision on publicly available personal information, providing in proposed section 51 that “An organization may collect, use or disclose an individual's personal information without their knowledge or consent if the personal information is publicly available and is specified by the regulations.” We have seen the consequences of data scraping from social media platforms in the case of Clearview AI, which used scraped photographs to build a massive facial recognition database. The Privacy Commissioner takes the position that personal information on social media platforms does not fall within the “publicly available personal information” exception.

Not only could this approach be upended in the future by the new personal information and data protection tribunal, but it could also easily be modified by new regulations. Recognizing the importance of proposed section 51, former Commissioner Therrien recommended amending it to add that the publicly available personal information be “such that the individual would have no reasonable expectation of privacy.” An alternative is to incorporate the text of the current regulations specifying publicly available information into the CPPA, revising them to clarify scope and application in our current data environment. I would be happy to provide some sample language.

This issue should not be left to regulations. The amount of publicly available personal information online is staggering, and it is easily susceptible to scraping and misuse. It should be clear and explicit in the law that personal data cannot be harvested from the Internet, except in limited circumstances set out in the statute.

Finally, I add my voice to those of so many others in saying that data protection obligations set out in the CPPA should apply to political parties. It is unacceptable that they do not.

Thank you.

[Dr. Brenda McPhail, Acting Executive Director, Master of Public Policy in Digital Society Program, McMaster University, As an Individual]

Thank you, Mr. Chair and members of the committee, for inviting me here today to speak to the submission authored by Jane Bailey, professor at the faculty of law of the University of Ottawa; Jacquelyn Burkell, professor at the faculty of information and media studies at Western University; and myself, currently the acting executive director of the public policy and digital society program at McMaster University.

It is a privilege to appear before you on this omnibus bill, which needs significant improvement to protect people in the face of emerging data-hungry technologies.

I will focus on part 1 and very briefly on part 3 of the bill in these initial remarks, and I welcome questions on both.

Privacy, of course, is a fundamental underpinning of our democratic society, but it is also a gateway right that enables or reinforces other rights, including equality rights. Our written submission explicitly focuses on the connection between privacy and equality, because strong, effective privacy laws help prevent excessive and discriminatory uses of data.

We identified eight areas where the CPPA falls short. In these remarks, I will focus on four.

First of all, privacy must be recognized as a fundamental human right. Like others on this panel, while we welcome the amendment suggested by Minister Champagne, we would note that proposed section 12 in particular also requires amendment so that the analysis to determine whether information is collected or used for an appropriate purpose is grounded in that right.

Bill C-27 offers a significant improvement over PIPEDA in explicitly bringing de-identified information into the scope of the law, but it has diminished the definition from the predecessor law, Bill C-11, by removing the mention of indirect identifiers. The bill also introduces a new category, anonymized information, which is deemed out of the scope of the act, in contrast to the superior approach taken by Quebec. Given that even effective anonymization of personal data fails to address the concerns about social sorting that sit at the junction of privacy and equality, all data derived from personal information, whether identifiable, de-identified or anonymized, should be subject to proportionate oversight by the OPC, simply to ensure that it's done right.

Third, proposed subsection 12(4) weakens requirements for purpose specification. It allows information collected for one purpose by organizations to be used for something else simply by recording that new purpose any time after the initial collection. How often have you shared information with a business and then gone back a year later to see if it had changed its mind about how it's going to use it? At a minimum, the bill needs constraints that limit new uses to purposes consistent with the original consensual purpose.

Finally, the CPPA adds a series of exceptions to consent. I'll focus here on the worst, the legitimate interest exception in proposed subsection 18(3), which I differ from my colleagues in believing should be struck from the bill. It is a dangerously permissive exception that allows collection without knowledge or consent if the organization that wants the information decides its mere interest outweighs adverse impacts on an individual.

This essentially allows collections for organizational purposes that don't have to provide benefits to the customer. Keeping in mind that the CPPA is the bill that turns the tap for the AIDA on or off, this exception opens the tap and then takes away the handle. Here, I would commend to you the concerns of the Right2YourFace coalition, which flags this exception as one in which organizations may attempt to justify and hide their use of invasive facial recognition technology.

Turning to part 3 of Bill C-27, the AIDA received virtually no public consultation prior to being included in Bill C-27, and that lack of feedback has resulted in a bill that is fundamentally underdeveloped and prioritizes commercial over public interests. The bill, by focusing only on high-impact systems, leaves systems that fail to meet the threshold unregulated. AI can impact equality in nuanced ways not limited to systems that may be obviously high-impact, and we need an act that is flexible enough to also address bias in those systems in a proportionate manner.

A recommender system is mundane these days, yet it can affect whether we view the world with tolerance or prejudice from our filter bubble. Election time comes to mind as a time when that cumulative impact could change our society. Maybe that should be in, and maybe it should be out. We just haven't had the public conversation to work through the range of risks, and it's a disservice to Canadians that we're reduced to talking about amendments to a bad bill in the absence of a shared understanding of the full scope of what it needs to do and what it should not do.

Practically, in our submission, we nonetheless make specific recommendations in our brief to include law enforcement agencies in scope, to create independent oversight and to amend the definitions of harm and bias. We further support the recommendations submitted by the Women's Legal Education & Action Fund.

I would be very happy to address all of these recommendations during the question period.

Thank you.

[Vivek Krishnamurthy, Associate Professor of Law, University of Colorado Law School, As an Individual]

Thank you, Mr. Chair and members of the committee. I am very honoured to be speaking with you today regarding Bill C-27.

I am currently a professor of law at the University of Colorado, but when I was the director of CIPPIC at the University of Ottawa, we published two reports in the spring of 2023 that consider AIDA and the CPPA. I am going to focus my remarks on the CPPA, particularly on provisions that relate to the privacy of minors. I would be happy to share some of my thoughts around AIDA as well.

I would like to begin by saying that I agree with everything that Professor Bennett and Professor Geist said. You could treat these remarks as additive.

While it is very welcome that the CPPA, unlike PIPEDA, specifically defines that the personal information of minors is sensitive information, Professor Bennett already told you about how “sensitive information” is not a defined term in the legislation. It is positive that children would have—if this bill passes into law—some recognition of the importance of protecting their personal information to a higher standard. However, we believe that this legislation can do far better.

For context, it is important to realize that children spend increasing amounts of time online, at younger and younger ages. This is a trend that accelerated during COVID-19 and the transition to digital online learning. I am a parent, and I am sure many of you are parents. Our children are using devices under commercial terms of service all the time, and this poses a very significant risk to the privacy rights of children.

While COVID has receded, it's the new reality that kids are using more and more technology at younger ages. What can we do? There are three things, and then a fourth about jurisdictional competence.

The Privacy Commissioner, in his recommendations regarding the CPPA, suggested that “best interests of the children” language should be incorporated into the law, and he suggested doing that in the preamble. I take no position myself as to where that should be done, but it is clear that this is international best practice. The United Kingdom and California have both incorporated such language into recently enacted statues, and we think that Canada should follow this approach. What would that mean? It means that organizations that handle children's personal data must take the best interests of children into account. That must come ahead of their commercial interests.

Second, we think it is important for the CPPA to require organizations that develop products or services that are likely to be accessed by children to set their privacy settings to the highest level. Defaults play a really important role in our subjective experience of privacy. It is great to have rights, but you can very easily leave those rights on the table if a setting is such that it contracts you out. We think that requiring a company to set those defaults to high levels when children are their likely users or their known users is very important.

Third, I'd like to pick up on what Professor Bennett told you about data protection impact assessments, a made-in-Canada idea. Bill C-27 is extremely weak when it comes to data protection impact assessments. The provisions apply only when the legitimate interest, excepting the consent, is being used. This is a problem for everyone, especially for children.

We believe—and I specifically believe this personally—that the data protection impact assessment requirements of this bill need to be considerably strengthened whenever data-processing activities pose a high risk to the privacy rights of Canadians. I would say that if children's data is sensitive data, that means we basically need to do that impact assessment all the time.

Last, I'd like to talk about constitutional competence here. There may be some concerns that it may be beyond federal competence to protect the privacy rights of children with more expansive provisions. Our analysis suggests otherwise. CPPA, like PIPEDA before it, is being enacted under Parliament's power to regulate trade and commerce.

Now, it is true that in our federal system, provincial governments get to determine the age of majority, but there is plenty of federal legislation that is designed to protect the rights of children. This also leads to how we think of this law, the consumer privacy protection act. It's not just a form of privacy regulation; it's also, when you think about it, a form of consumer protection legislation that is regulating the safety of digital products that invade and interfere with our right to privacy.

In view of the long history of federal regulation directed at protecting children in the marketplace, we think it would be appropriate for the federal government to include stronger privacy protections, and that would not prejudice provincial laws, like Quebec's, that are stronger. Just as PIPEDA yields to provincial legislation when it's substantially equivalent or better, the same could be true of strengthened children's privacy protections in the new CPPA.

Thank you very much.

[Prof. Colin Bennett, Professor, Political Science, Unversity of Victoria, As an Individual]

Thank you very much, Mr. Chair.

I'm from the University of Victoria, although I'm currently in Australia. I wish everybody a good day.

I would like to emphasize five specific areas for reform of the CPPA and to suggest ways in which the bill might be brought into better alignment with Quebec's law 25. I don't think that Bill C-27 should be allowed to undermine Quebec law, and in some respects, it does. I also think these are some of the areas where the bill will be vulnerable when the European Commission comes to evaluate whether Canadian law continues to provide an adequate level of protection.

Some of these recommendations are taken from the report that you have from the Centre for Digital Rights, which I'd like to commend to you.

First, I believe that CPPA's proposed section 15, on consent, is confusing to both consumers and businesses. In particular, I question the continued reliance on “implied consent” in proposed subsection 15(5), which states, “Consent must be expressly obtained unless...it is appropriate to rely on an individual's implied consent”.

The bill enumerates those business activities for which consent is not required, including if “the organization has a legitimate interest that outweighs any potential adverse effect on the individual”. That's a standard that has been imported from the GDPR. However, in the GDPR, “consent” means express consent; it's “freely given, specific, informed and unambiguous”.

In the current version of the CPPA, businesses can have it both ways. They can declare that they have implied consent because of some inaction that a consumer allegedly took in the past because of not reading the legalese in a complex terms-of-service agreement, or they can assert a “legitimate interest” in the personal data by claiming that there is no “potential adverse effect on the individual”. That is a risk assessment performed by the company rather than a judgment made about the human rights of individuals to control their personal information.

In that respect, it's really important that the bill be brought within a human rights framework. There should be no room for implied consent in this legislation. It's a dated idea that creates confusion for both consumers and businesses.

Second, there is no section in the CPPA on international data transfers. I find that very odd. I know of no other modern privacy law that fails to give businesses proper guidance on what they have to do if they want to process personal data offshore. The only requirement is for the organization to require the service provider, “by contract or otherwise,” to ensure “a level of protection of the personal information equivalent to that which the organization is required to provide under this Act.” That's proposed subsection 11(1) of the CPPA.

That due diligence applies whether the business is transferring personal data to another province in Canada or overseas to a country that may or may not have strong privacy protection or, indeed, a record of the protection of human rights. That's particularly troubling because of proposed section 19 of the CPPA, which reads, “An organization may transfer an individual's personal information to a service provider without their knowledge or consent.”

The Canadian government has never gotten into the business of adopting a safe harbour approach or a white list, and I'm not recommending that. However, Quebec, I believe, has legislated an appropriate compromise under section 17 of law 25, which requires businesses to do an assessment, including of the legal framework, when sending personal data outside of Quebec. As many businesses will have to comply with the Quebec legislation, why not mirror that provision in Bill C-27?

Third, the bill ignores important accountability mechanisms that were pioneered in Canada and exported to other jurisdictions, including Europe. Therefore, it's very strange that those same measures do not appear in the CPPA. In particular, privacy impact assessments are an established instrument and a critical component of accountable personal data governance, and they should be required in advance of product or service development, particularly where invasive technologies and business models are being applied, where minors are involved, where sensitive personal information is being collected, or where the processing is likely to result in a high risk to an individual's rights and freedoms. Businesses do the PIAs, and they stand ready to demonstrate their compliance or their accountability to the regulator.

A fourth and related problem is the absence of any definition of sensitive forms of personal data. The word “sensitivity” appears throughout the legislation in several provisions of the bill, but with the exception of the specification about data on minors, it is nowhere defined. In my view, the bill should define what “sensitive information” means, and it should also enumerate a non-exhaustive list of categories, which, in fact, occurs in many forms of legislation.

Finally—I know you've heard about this in the past, and I've researched on this—the absence of proper privacy standards for federal political parties is unjustifiable and untenable. The government is relying on the argument that the FPPs’ privacy practices are regulated under the Elections Act, but those provisions are nowhere near as strong as in Bill C-27. I think businesses resent the fact that parties are exempted. This is not an issue that will go away, given advances in technology and its use in modern digital campaigning. Canada is one of the few countries in the world in which political parties are not covered by applicable privacy law.

Thank you so much.

[The Chair, Liberal, Joël Lightbound]

Good afternoon, everyone. I call this meeting to order.

Welcome to meeting no. 92 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in a hybrid format, pursuant to the standing orders.

Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C-27, An Act to Enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts.

I'd like to welcome our witnesses today and also apologize for the brief delay caused by a vote in the House.

Joining us today are Colin J. Bennett, professor; Dr. Michael Geist, professor of law and Canada research chair in Internet and e‑commerce law; Vivek Krishnamurthy, associate professor of law at University of Colorado Law School; Dr. Brenda McPhail, acting executive director of the public policy in digital society program; and lastly, Teresa Scassa, Canada research chair in information law and policy, Faculty of Law, Common Law Section, University of Ottawa.

I'd like to welcome you all.

We'll begin the discussion without further ado.

Mr. Bennett has the floor for five minutes.

Motions in Amendment

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Speaker, today, we are debating Bill 34, an act to amend the Investment Canada Act, at report stage. We are dealing with a new amendment to this bill from the Conservative side of the House, as well as some housekeeping amendments from the government side.

To make sure everybody watching understands what the Investment Canada Act is about, it deals with the acquisition of Canadian companies by foreign entities: companies and governments that come to Canada to try to acquire our businesses. There is a government process, through Investment Canada, that these entities need to go through with the Minister of Innovation, Science and Industry and cabinet. Through the bill before us, cabinet would be removed from the process. I will speak to this in a moment.

Wayne Gretzky, whom I know everybody here admires, said, “You miss 100% of the shots you don't take”, and this bill fits that description. While it would make administrative amendments and speed up the process a little, it missed the opportunity to look at what is happening in the Canadian economy and deal with the increasing acquisitions of assets and businesses of various sizes, from small businesses worth a few million dollars up to minerals rights and large corporations, by states that are hostile to us. As has been said before, it has been 14 years since the act was amended. A lot has changed in the world, in particular around the way that state-owned enterprises have become extraterritorial in taking over companies around the world for their own economic interests. The Conservatives' challenge with the bill is that it thinks small. It did not use this opportunity to take a shot on net and score a goal by recognizing the change in the global economy and what is happening with the outright sales of Canadian businesses and assets to hostile states.

The minister is the minister of broken bills, which is why we are having to make more amendments to this one. On his other bill, Bill C-27, after a year and a half, he has had to make amendments. Perhaps if he had spent more time here in Canada understanding what was going on, he might have produced better legislation. The Liberals missed the chance to think big and understand what is going on in our economy. What is going on in our economy is what I call the Chinese government cold war. We are in a new cold war. It is not one of bombs and the military in that sense; it is the silent takeover of the economic assets of other countries. This is how China is gaining influence all around the world. We all know about the election interference issues, but those things are perhaps a little more obvious than this is to Canadians, this creeping strategic control by the Communist Party of China of Canada's assets and those of other countries. Other countries have put mechanisms in place within their investment acts to recognize this and prevent it. The bill, as it was introduced in the House and debated at second reading, did not contain any of that.

Small businesses in my riding, such as lobster buyers, are $2-million businesses being bought for $10 million by China. The Chinese government owns a number of lobster businesses in my riding. It is how it is getting control of our seafood assets behind the door. It is doing the same in agriculture. It is buying land and farms in western Canada and mineral rights in our land. It is buying more obvious things, which I will speak to. It is buying companies like the only producing lithium mine in Canada. Therefore, Bill 34 missed a lot and would just make small administrative changes.

The Communist Party of China cold war's being ignored in Canada might be out of incompetence, but it also could be the case, as we know, that the Prime Minister believes that China is his most admired country, so maybe it is more strategic. Let us take a look at the Liberal government's record on this issue.

In 2017, the Liberal government allowed a telecom company from B.C. called Norsat to be acquired by a company called Hytera, which is Chinese-based. Hytera does not make any money. Conservatives demanded, at the time, a full national security review. The Liberal minister of the day refused to do one and approved the acquisition. Lo and behold, in 2022, Hytera was charged with 21 counts of espionage in the United States and was banned from doing business there, but only eight months later, the RCMP in Canada, shockingly, bought telecommunications equipment from Hytera to put in its communications system. When I asked the RCMP, at the industry committee, because it was in all the newspapers, whether its members were aware that eight months before, Hytera had done this and been banned in the U.S., the RCMP, shockingly, said no.

I referred earlier to the Tanco mine, our only producing lithium mine, which was bought by the Sinomine Resource Group, a Chinese-owned mining company. Every ounce of that lithium in our critical minerals industry goes to China.

The record on this is very awkward for the government to hear, but it is a growing concern. It did not take those things into consideration in drafting the bill before us, As a responsible opposition to His Majesty, the Conservatives proposed a number of amendments in committee, and thanks to the support of the other two opposition parties amidst the objections of the Liberals, we made some significant amendments. Those amendments include that with any state-owned enterprise from a country that does not have a bilateral trade relationship with Canada, the threshold for review by the Government of Canada would now be zero dollars. Any transaction over zero dollars would be reviewed, compared to the threshold now, which is $512 million. China is buying a lot of assets for under $512 million, and the threshold would now be zero. The same would apply for a new concept we added, which is that all asset sales would need to be included in that test with a state-owned enterprise.

Today, we are also taking this one step further by saying that the minister has made yet another error. That error was trying to consolidate all his power and ignore his cabinet colleagues. The bill would change the Investment Canada Act process that requires that at the beginning, when an acquisition is made, the minister take his recommendation on how far to go with a national security and net benefit review into a study. The bill before us says that he would not have to do that anymore and that he could decide on his own, that at the end of the process, whatever the results are, he would come back and say he will decide whether or not he goes to cabinet with the results.

Removing cabinet from the decision-making process would mean that we would not get the breadth of experience of people around the cabinet table and that we also would not get the breadth of experience from regional perspectives. For example, there have been companies bought in Quebec. If an industry minister is from Ontario and our public safety minister is from out west, they would make the decision on their own without any input from Quebec. I suspect that the Bloc Québécois would be opposed to that issue and would want to see Quebec representation in those decision-making processes, but the bill before us has the potential to eliminate that part of it.

We are proposing common sense Conservative amendments, as we did in committee. Thankfully we upped the ante of the bill and made it more than an administrative bill such that it would deal with the serious international challenges we had, through the four amendments that were accepted. By the way, there are two national tests in there. One is on national security and the other is on the net benefit to Canada. Conservatives in committee added a third: if a company has been convicted of bribery or corruption, the minister would now have to take that into consideration in deciding whether to approve the acquisition. It would add much benefit, but, for some reason, Liberals did not think it was worthy when they voted against it.

We believe that Conservatives have improved the bill dramatically. We are trying to improve it again in the spirit of good public policy for Canada and protecting our economy against hostile interests, which the Liberals seem not to care about. I urge the House, including all members from the Bloc Québécois, the NDP and the government, to recognize that cabinet's decision-making process is essential to getting the full breadth of things, and I urge members to vote for our amendment.

[Philippe Dufresne]

Indeed.

This raises the whole question of online age verification and techniques for determining whether a person is underage or not. This will be important in the context of Bill C‑27, which explicitly grants rights and treats information differently. It's an issue we're looking at, in the privacy field. There's a lot of discussion about it. In fact, the Information Commissioner's Office of the U.K. has issued guidelines on verification tools.

What we're saying, at the Office of the Privacy Commissioner, is that these tools need to be appropriate and not ask for too much personal information. Age verification needs to be managed, but we don't necessarily want to ask for too much personal information to do that. That said, there are ways of doing it and technologies to do it. It's another area where we need to be creative.

Also, it has to be context-appropriate. Some sites may be higher-risk and will require tighter verification. We can think of gambling or pornography sites, for example. Some sites may be less sensitive. Others may be aimed specifically at children. There may be a presumption.

I think this will be part of the implementation of this law. My office will have a role to play in this as it can issue guidelines.

In addition, the bill also provides for the creation of codes of practice and certification programs.

This will encourage organizations to adhere to a series of rules. If they respect them, it will have an effect on the complaints process, which will be beneficial for these organizations. So it will be one more tool. I suspect that the Office of the Privacy Commissioner will be able to work on it, precisely to give these details.

The Office of the Privacy Commissioner also has an advisory mandate. Companies, especially small and medium-sized enterprises, can contact us for answers to specific questions. We're here to help them with questions like these, especially those of a more technical nature.

[Philippe Dufresne]

Yes, a revision of the two laws is necessary. One is under way for the law in the private sector. This is Bill C‑27. This also includes a specific component for artificial intelligence.

A revision is necessary because the law is 20 years old. It's older than social media. We're still applying it, the principles are there, but technology is advancing rapidly. In my opinion, this calls for stronger proactive obligations, for example. We need to force organizations to make basic assessments that they have to disclose to our office; we also need to impose greater transparency, particularly when it comes to artificial intelligence.

The law governing the public sector, on the other hand, is even older. It dates back 40 years. It needs to be modernized and strengthened, because when it was passed, it was really at a time when the impact of data was not what it is today.

[Philippe Dufresne]

It's a problem for kids because of their greater vulnerability. We've made a number of recommendations in terms of making sure that we're not using these behavioural techniques of nudging. We shouldn't be nudging individuals generally, but certainly not children, into making bad decisions and making bad privacy decisions. There needs to be work on that.

There have been reports on social media being addictive and being addictive for children generally. Sometimes the business model is to try to encourage them to stay longer, because that's what generates more revenues. That has to be taken into consideration with children who have been online more and more during the pandemic, and since then with school. I've seen it and parents have seen it.

We need to adjust to this new reality as parents, children and society as a whole, so that there's a greater awareness of what this means and what their rights are.

Bill C-27 proposes a right to disposal. That's informing.... When I say that children have a right to be children, that's what I'm alluding to. Children do things online. If it stays online forever, then they're treated as adults right from when they're teenagers. It stays forever, and it could be used against them for jobs and so on and so forth.

We need to deal with this. Bill C-27 will deal with it to some extent, but we certainly need to build greater awareness of it as we are living more and more in a digital world. It brings innovation and it brings great things, but we need to be well equipped to deal with it and we need to learn about it. I would hope to see mandatory training in schools early on, so that individuals can get the tools early on.

We'll get these reflexes. We're going to ask questions. We're going to ask why they need this information. We're going to learn to see what a good privacy policy is, and if it's not, we're going to learn how to complain about it so that it could become a good privacy policy in the future.

That way, we're creating ambassadors for privacy everywhere.

[Philippe Dufresne]

That's why the European model, which is the General Data Protection Regulation, the model in Quebec, which is Bill 25, and the model proposed in Bill C‑27 provide that it's going to be a maximum amount of $10 million, for example, or 3% of sales. I think that addresses the issue you raised.

If a company has significant sales, $10 million isn't a lot; setting a percentage addresses that.

[Philippe Dufresne]

Again, in terms of meaningful consent, Bill C-27 would make it stronger in terms of explicitly saying that this has to be provided in information that the person can understand. That's what we look at. This is very complex information. How are you giving those notices? Are you giving a notice that only an expert will understand?

Even if you're an expert, you may be reviewing this at the end of the day. You may be tired. You may be bombarded with so many things. Every time you go on a website, you get a cookie page or whatnot. We provide a number of tips in that guidance: Make it user-friendly. Make it not just a one-time thing. Make sure that you sometimes provide follow-ups. Make it as understandable as possible. In the context of children, make it appropriate to the child. Maybe there are opportunities for video or other ways.

The goal is to provide the information so that individuals can understand what's going on and to bring that same innovation.... We often talk about innovation requiring data, and that's true, but let's use innovation to protect data. That would assist in terms of the consent and the explainability.

[Philippe Dufresne]

There are extra issues, in the sense that we will generally consider minors' information or children's information to be “sensitive information”. That brings with it greater obligations in terms of care and in terms of methods of consent.

We've issued guidance under current law about obtaining meaningful consent. We are expecting organizations to make it user-friendly and so on, but specifically with respect to children, there are circumstances in which they won't be able to give that consent. They may need a parent to do that if they're below a certain age. In our current guidance, although certain provinces might take different views, for us, if they're under13 years old, there's almost a presumption that you need that parental consent.

It certainly has to be considered in how you look at information. They will have different needs. They will have greater vulnerabilities. That is something that's recognized in the European legislation. It's proposed to be recognized in Bill C-27, which I certainly hope will happen.

[Philippe Dufresne]

Thank you, Mr. Chair.

I'm pleased to now turn to this part of the discussion. I thank the committee for its interest in the ways that social media platforms such as TikTok harvest, handle and share personal information.

The online world brings with it a host of possibilities for innovation and connection, but it also carries potential for significant harm, especially for young people.

As you know, my office, along with our counterparts in Quebec, British Columbia and Alberta, launched an investigation into TikTok in February. We are examining whether TikTok's practices comply with Canadian privacy legislation, and in particular whether it obtains valid and meaningful consent for the collection, use and disclosure of personal information.

We are also looking at whether a reasonable person would consider the purposes for which it handles personal information, in particular children's information, to be appropriate in the circumstances.

This matter is a high priority for my office, especially given the importance of protecting the fundamental right to privacy of young people, who represent a notable proportion of TikTok users. As a result of the ongoing investigation, there are limits to my ability to speak publicly about the company’s practices at the moment.

For that reason, I will focus my remarks today on the privacy principles that underpin my office’s approach to the digital world from the perspective of the privacy rights of children.

Growing up in the digital age presents significant new challenges for the privacy of young people. As children and youth embrace new technologies and experience much of their lives online, we need strong safeguards to protect their personal information, and how it may be collected, used and disclosed. Increasingly, their information is being used to create personalized content and advertising profiles that are ultimately aimed at influencing their behaviours.

Children have a right to be children, even in the digital world. As UNICEF notes in its policy guidance on artificial intelligence for children, young people are affected by digital technologies to a greater extent than adults. Young people are also less able to understand and appreciate the long-term implications of consenting to their data collection. Privacy laws should recognize the rights of the child and the right to be a child. This means interpreting the privacy provisions in the legislation in a way that is consistent with the best interests of the child.

I'm encouraged by statements from the Minister of Innovation, Science and Industry indicating that there is a desire to strengthen children's privacy rights in Bill C-27, the Digital Charter Implementation Act, 2022. My office has recommended that the preamble of the modernized federal privacy law should recognize that the processing of personal data should respect children's privacy and the best interests of the child. I believe that this would encourage organizations to build privacy for children into their products and services by design and by default. I was pleased to hear the minister signalling his agreement with that recommendation.

The law must have strong safeguards to protect children’s information from unauthorized access, and reflect greater consideration of the appropriateness of collecting, using and disclosing their information.

Earlier this month, my provincial and territorial colleagues and I adopted a resolution calling on organizations in the private and public sectors to put the best interests of young people first by, among other things, providing privacy tools and consent mechanisms that are appropriate for young people and their maturity level; rejecting the kind of deceptive practices that influence young people to make poor privacy decisions or to engage in harmful behaviours; and allowing for the deletion and de‑indexing of information that was collected when users were children.

I am happy to see this was included in Bill C‑27.

In closing, it's critical that government and organizations take action to ensure that young people can benefit from technology and be active online without the risk of being targeted, manipulated or harmed as a result. I expect that the findings from our investigation into TikTok will be informative not just for that company but also for other organizations that collect and handle children’s sensitive personal information.

I also look forward to seeing Bill C-27 progress through the legislative process in a way that will provide children and minors with the privacy protections that they need in this increasingly digital world.

With that, I will be happy to take your questions.

[Philippe Dufresne]

I would say a few things. One is that we've issued a declaration with my federal, provincial and territorial colleagues called “Putting best interests of young people at the forefront of privacy and access to personal information”. It's available on our website. We give a number of recommendations and expectations for organizations about making sure that they're protecting children and the best interests of the child and that they're treating their information appropriately.

In terms of what people should do—and that's something we've said in our data-scraping statement with my international colleagues—ask yourself if you are comfortable sharing this much information. Do you know enough about the settings and the protections that are there? Is this something you want to potentially see forever?

In Bill C-27, there's a new proposed section to dispose of information, especially for minors. That's good, but whenever you're putting a picture of your children online, ask yourself if you want to take the risk. Have you put the privacy settings in a strong enough way? Are you sharing this with the whole world? If you don't understand enough about what the organization is doing and you find its privacy policy to be complex, I always encourage everyone to ask the organization.

Ask for more information. When stores ask for your birthday, ask them why they want to know your birthday when you're buying jewellery or any kind of item. Why do they need that information?

It's getting that reflex of not just saying, “Yes, sure, I'll give it to you.”

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Very good. Thank you.

I want to turn my attention to digital technology and Bill C-27.

One concern that's been raised is people worrying about deepfakes, this generative AI that will make anybody look like they're saying or doing things they didn't.

Did you provide any recommendations to the minister or do you have any thoughts on how to fix that?

[Philippe Dufresne]

Yes, of course.

Under the Privacy Act, the public sector's obligations are less stringent than the private sector's. Departments are required to show that the information is used for purposes related to their respective mandates. For example, they have to show that they have a legal mandate to do X, so they can do it.

Some obligations are more specific, like those at issue in the Canada Post case. When an organization uses information indirectly, the obligation threshold is greater. It has to ask for permission. The first major consideration when a public organization uses information is whether the activity is relevant to its mandate.

We think it's important to impose the obligations of necessity and proportionality, in keeping with international principles and practices in the private sector. The idea is to consider what information the organization is collecting and for what purpose. It's a bit similar to how it works for charter human rights. Is the organization's purpose important enough? Will the measure achieve the purpose? Has the organization done everything possible to minimize the use of the information in achieving its purpose?

We underscored those principles in our report on the pandemic, and we apply them. While we realize they aren't binding, we apply them and use them to inform our recommendations. We've been able to draw some useful lessons. On the whole, the government adheres to the principles. Occasionally, we're of the view that there should have been more information on how the organization assessed the discarded options, but that, on balance, its decision was justifiable.

It's a standard that encourages decision-makers to ask questions about what they're doing and whether they are minimizing the risks. That's more or less what we are asking.

One of my major recommendations for Bill C‑27 is to require organizations to conduct audits and privacy impact assessments, or PIAs. It's about considering what the risks are and which measures can minimize them.

PIAs are good for privacy, and they're good for Canadians.

[Philippe Dufresne]

We explicitly recommended that the term “profiling” be included in the definitions. When organizations use an algorithm, when they infer things from your personal information and, then, use that to build profiles, there are consequences, and they need to be taken into account and regulated. Both Quebec's law and the European regulation refer to the term “profiling”. My office recommended it be explicitly included in Bill C-27.

[Philippe Dufresne]

Yes, Quebec's law 25 definitely has more teeth than existing federal laws, simply because it grants the power to issue orders. Quebec's access to information authority, the Commission d'accès à l'information, or CAI, can issue binding orders and impose heavy fines, similar to the European model under the General Data Protection Regulation. That makes it a more robust piece of legislation on that front. It lays out proactive obligations.

Hopefully, Bill C‑27 will make its way successfully through Parliament and bring federal laws more up to date in that regard. It's not exactly the same as law 25, but it comes close with the power to issue orders, and to impose fines as well as proactive obligations on companies. I think it's a good model, following in the footsteps of Europe and Quebec. I think, federally, we can get there.

To answer your question about working with the CAI, I can report that we do indeed work very closely with Quebec and all the provinces and territories.

I was in Quebec City in September for the annual gathering of federal, provincial and territorial privacy commissioners, which the CAI hosted. We had some very important and useful conversations. We put out two resolutions, including on the protection of young people's privacy. They are joint statements reflecting principles that all the commissioners have agreed upon, despite the legislative differences between the jurisdictions. In this way, the commissioners are trying to make things easier for companies by flagging common elements across the different regimes. My office carries out joint investigations with provinces that have regimes similar to the federal government's, so Quebec, Alberta and British Columbia. We worked together on the investigations into TikTok, ChatGPT and Tim Hortons.

Our collaborative work is not only extensive, but also very useful. We are able to make sure that we are on the same page across the country.

[Philippe Dufresne]

Certainly. There are sometimes discussions about that.

As for the cases you're referring to, sometimes a department tells us it's already doing what we recommend. In the case of the pandemic, we also carried out an assessment of proportionality and necessity, which is not mandatory under the Privacy Act, but which we feel should be. We put forward that analysis.

It's a dialogue. We are always given the reasons for refusal, and dialogue is established.

Some breaches are more serious than others. The really worrying situations are those where there has actually been a major breach or a major consequence, combined with a complete refusal to follow our recommendation. That can undermine trust.

I feel the power to issue orders is important. When an officer of Parliament makes a recommendation to an organization and the latter refuses to implement it, the situation is not satisfactory. I believe there must be sufficient justifications given. If we had the power to issue orders, this wouldn't be a problem. We'd issue them when necessary. With that said, in my opinion, they should only ever be used exceptionally.

The same applies to fines. In Bill C‑27, we would add the possibility of imposing significant financial penalties on organizations. I think this is very important, for the same reason again: to create incentives. The idea is not to use them often, but...

[Philippe Dufresne]

I think it's absolutely essential to modernize this act. We also need to modernize the part of the Privacy Act that deals with the private sector. This law is 20 years old, so it's older than Facebook and social media. It is positive that Bill C‑27 aims to modernize the act with respect to the private sector. I look forward to seeing this bill move forward.

In addition, I hope that a bill to modernize the act for the public sector will soon follow. The Minister of Justice had said, when Bill C‑27 was tabled, that the public sector privacy bill would follow. Consultations were held with first nations and indigenous peoples on certain implications. The Department of Justice published a report on these consultations—I believe it was in September. The work is ongoing. In my opinion, the solution is to move forward with Bill C‑27. The model passed in this legislation can then be adapted to the public sector, as needed. That could be beneficial.

Among our proposals, we suggest that there should be an increasing number of public-private partnerships and that the government should work hand in hand with the industry. At present, we have two laws with different requirements for government and the private sector. This is not optimal, and it creates problems in terms of interoperability. I entirely agree with you that this is becoming important.

In the meantime, the law applies, and our office will continue to implement it to the best of our ability. In fact, this is a message that my counterparts from the G7 countries and I conveyed when we were in Tokyo last summer. At that meeting, we talked about artificial intelligence. To address people's concerns, we said we needed laws on artificial intelligence. There are already some—privacy laws, for instance. They exist and they are enforced.

I've also launched an investigation into ChatGPT, to confirm whether or not it is compliant with the legislation. Tools do exist, but they absolutely must be modernized. We will be there to support Parliament.

[Philippe Dufresne]

I think we have to hold public discussions, be transparent and have obligations to be transparent.

The phenomenon you're describing has accelerated even more with artificial intelligence. We may think we know our personal information will be used by such and such an entity. However, do we really know what anyone can conclude about us based on that information? What inferences can be drawn? Sometimes postal codes or tastes in music, for example, can help someone deduce a person's sexual orientation, income level and so on. People don't know all that.

I recommended that Bill C‑27 provide for a transparency obligation so that, when people reached a decision with the help of artificial intelligence, they could request an explanation in every case. However, the current version of the bill provides that a general account may be provided only in cases that would have a significant impact on the individuals concerned. I recommended that part be deleted because, for the moment, I think it's better to encourage more transparency rather than less.

We have to try to find pleasant ways to explain this. One of my mandates is to try to acquire tools. We provide a lot of information on our website, and we try to explain it all as best we can, but I think we can do better.

We also have to talk about children, because I think the message has to be adapted to suit the audience.

[Philippe Dufresne, Privacy Commissioner of Canada, Offices of the Information and Privacy Commissioners of Canada]

Good afternoon, Mr. Chair.

Good afternoon, members of the committee.

I am pleased to be here today to discuss my 2022‑23 Annual Report to Parliament, which highlights the important work that my office is doing to protect and promote the fundamental right to privacy in a time of unprecedented technological change.

It is encouraging to see this continued focus on the importance of privacy, as it impacts virtually all aspects of our lives.

Many of the public interest issues that you are seized with as parliamentarians—children's rights, online safety and cybersecurity, democratic rights, national security, equality rights, ethical corporate practices and the rule of law—all have privacy implications and, I would argue, all depend on strong privacy protections.

In this digital era, as you will see from some of the work and investigations my office has conducted this year, routine activities of daily life—for example, socializing online, using mobile apps, getting packages delivered or going to the checkout counter—can also raise privacy issues.

Since my appointment as Privacy Commissioner in June 2022, I've identified strategic priorities for my office that helped frame our work over the past year and that will guide the way ahead. These include addressing the privacy impacts of the fast-moving pace of technological advancements—especially in the world of artificial intelligence and generative AI—protecting children's privacy, and maximizing the OPC's impact in fully and effectively promoting and protecting the fundamental right to privacy.

To support these priorities, this past year we have engaged extensively with our domestic and international counterparts to identify and undertake collaborative opportunities.

We have also continued to advocate domestically for the modernization of Canada's privacy laws. I was honoured to appear before the Standing Committee on Industry and Technology last week in the context of their study of Bill C‑27, the digital charter implementation act, 2022, where I made 15 key recommendations needed to improve and strengthen the bill. I was pleased to see a number of them endorsed by Minister Champagne in the form of amendments that will be put forward to the committee, and I look forward to the work of Parliament in reviewing this important bill.

I will now turn to some of our compliance work from the last year.

We accepted 1,241 complaints under the Privacy Act, representing an increase of 37% over the previous year, and 454 under the Personal Information Protection and Electronic Documents Act, or PIPEDA, a 6% increase over the year before.

One of the public sector investigations highlighted in this year's report involved Canada Post's Smartmail marketing program. Our investigation revealed that Canada Post builds marketing lists with information gleaned from the envelopes and packages that it delivers to homes across Canada. It makes these lists available to advertisers for a fee. We found this contravened the Privacy Act, as it was done without the knowledge and consent of Canadians. We recommended that Canada Post stop its practice of using and disclosing personal information without first seeking authorization from Canadians. As a possible solution to remedy this matter, we recommended that Canada Post send a mail notice to Canadians to inform them of this practice and indicate an easy way for Canadians to opt out.

Until the tabling of my annual report, which made this decision public, Canada Post did not agree to implement this solution. After the report was made public, Canada Post issued a statement that it would review its policies. I expect Canada Post to comply with the Privacy Act and I look forward to hearing from them on the next steps to resolve this matter.

The report also highlights some of our private-sector investigations from last year, including our investigation of Home Depot's sharing of the personal information of customers who opted for an electronic receipt instead of the printed one at checkout with a social media company.

Home Depot has since stopped that practice and implemented my offices recommendations. This case underscored the importance of businesses obtaining meaningful consent to share customers' personal information.

Another important area of our work is addressing breaches in the public and private sectors.

We remain concerned about possible under-reporting of breach incidents in the public sector. The number of reported breaches fell by 36% to 298 last year, and only one of those reports involved a cyber-attack. This compares to 681 breach reports from the private sector, of which 278 were cyber-related.

We also engage in groundbreaking policy work, provide advice and guidance to organizations in both the public and private sectors on privacy matters of public interest and importance, and continue to provide advice to Parliament.

We know that privacy matters to Canadians more today than ever before and that they are concerned about the impact of technology on their privacy. Our latest survey of Canadians found that 93% have some level of concern about protecting their personal information and that half do not feel that they have enough information to understand the privacy implications of new technologies. This is why the work of my office to deliver concrete results that have meaningful impacts for Canadians and privacy in Canada is so important.

In closing, I would like to thank this committee for its work over the years, including the many reports and recommendations in the field of privacy. I cite them often. We certainly consider and consult them very often, and I know that Canadians do as well.

I look forward to continuing our efforts to ensure that privacy rights are respected and prioritized by government institutions and businesses alike, and to position Canada as a global leader on privacy.

I would now be happy to answer your questions.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Mr. Therrien, in the context of Bill C‑27 and, more specifically, in the context of artificial intelligence, I would like to hear your opinion on industry self-regulation standards. That is, I would say, the new approach that is being put forward, both in Europe and by Mr. Champagne as a temporary or transitional measure. Can we trust industry to regulate itself?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Bill C-27, in my humble view, is a groundbreaking piece of legislation. I'll use that term. I think it is groundbreaking in terms of the update it's providing to the act and to privacy.

Mr. Therrien, you're fully versed on privacy issues relating to Canadians. When I think of this bill and I think of my constituents back in the city of Vaughan in my riding of Vaughan—Woodbridge, I would tell them how their privacy is being protected and not being protected on a very granular basis. I would use layman's terms. What would you tell me to tell them in terms of your view of BillC-27?

[Adam Kardash]

I'll be brief.

My view—and we've thought about this quite carefully—is that there is no public policy rationale for the political parties' processing of personal information not to be subject to a privacy legislative regime. The only question that I think is open is what the appropriate instrument would be and whether that would that go into the CPPA. I think there's some validity to the proposition that it might be a separate instrument. My personal view is that it was something that was missing in Bill C-27. It could have been in there.

Right now, if you compare the privacy protections that are set out in Bill C-27 under the CPPA to the current protections afforded to individuals in respect to the processing of personal information by political parties, you see that they're not even in the same universe. You would just have to post a privacy statement. There's no security breach notification requirement. There are no access rights and no consent rules. It goes on and on. There are no rights of express redress. There's no independent ombudsman who would oversee and take complaints, investigate, etc.

I think this is something that is incredibly important and I'm very thankful to you, Mr. Masse, for bringing that up.

[Daniel Therrien]

I think that the CPPA brings us much closer to where we ought to be in 2023. With the new implementation of artificial intelligence, part 2 of Bill C-27 is an attempt to align Canada's legislation to that new technology.

There's no perfect solution in all of these situations. There are people who think that the artificial intelligence act is so skeletal as to be meaningless, and there's some merit to this. I think it's okay for where we are today.

One virtue of the legislation before you is that it continues with the consent model in many circumstances in which consent can possibly be given, but it also recognizes that there are important limits to the consent model, such as legitimate interests and socially beneficial purposes, but I think the missing piece is that these additional flexibilities that reflect the current use of technology have to be implemented within a rights protection framework.

Although the minister's latest amendments bring us a bit closer, we are still quite a way from where we ought to be, and that is why I recommended that proposed sections 12 and 94 on penalties, particularly on penalties, are important, because what's the value of having a recognition of privacy as a fundamental right if there is no penalty when you breach that principle?

[Daniel Therrien]

In common parlance, when people post personal information on a social media platform and allow certain other people to see it, one might think that this information becomes public. Importantly in this context, one might also think that companies and commercial organizations could use this information as public, rather than personal, information. However, the current law provides that this information remains personal and cannot be used by companies, except in accordance with the law.

I think this is a good aspect of the current law, and the fact that nothing in the current text of Bill C‑27 changes this is a good thing.

[Daniel Therrien]

I was telling Mr. Perkins that clause 15 of Bill C‑27 will probably need to be amended. Section 6.1 of the current act sets out certain requirements for consent to be considered valid, including the notion that the person giving consent must be able to understand the purposes and consequences of disclosing the information. This terminology does not exist in Bill C‑27 and I believe it would be much better to retain the current wording.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you very much.

Mr. Therrien, Bill C‑27 emphasizes the need for informed consent by devoting an entire section to it. However, we have seen the rise of platforms favouring the use of opt-out formulas. These are the famous opt-out rather than opt‑in options. In your opinion, does this bill do enough to protect users of digital platforms from the pitfalls of these opt-out formulas?

[Éloïse Gratton]

The Quebec and federal provisions are certainly similar. Those in Quebec are probably a little more stringent in some respects and include additional requirements, such as profiling in section 8.1 of the Quebec law, as well as the need to perform risk factor assessments before transferring data outside Quebec.

The analysis you mention is therefore certainly acceptable: if we compare the new Quebec requirements with the provisions of Bill C‑27, there is no doubt in my mind that Quebec would pass the test.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

In another connection, Bill C‑27 obviously raises the issue of the precedence of Quebec's recently updated private sector privacy legislation. As you know, Minister Champagne has made public a letter he sent to members of our committee to clarify the federal government's position in this regard. He acknowledges that the provisions of the Quebec legislation are essentially similar to those of the federal bill, and that they can take precedence. Do you agree with this analysis?

[Viviane LaPointe, Liberal, Sudbury, ON]

Could you give us your opinion on the measures that Bill C‑27 provides in terms of data protection?

[Daniel Therrien]

I characterize Bill C-11 as a step backwards. I think Bill C-27 is a step forward. Some recommendations that I had made as commissioner were accepted—not all, and not some that I think are essential that I spoke to.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

—and Bill C-27 was tabled.

Did either of those bills reflect the advice you gave them?

Obviously not, since you asked for a number of errors to be...but did they reflect the desire to have fundamental right included in the bill?

[Adam Kardash, Partner, Canadian Anonymization Network]

Thank you. Good afternoon, everyone.

My name is Adam Kardash. I'm chair of Osler, Hoskin and Harcourt's national privacy law and data management practice, and I've been practising exclusively in the privacy area for more than 20 years.

I'm pleased to be before INDU on behalf of CANON, the Canadian Anonymization Network, which is a not-for-profit organization whose members comprise large data custodians from across the public, private and health sectors.

I'm joined this afternoon by Khaled El Emam, a Canada research chair in medical AI at the University of Ottawa and the leading global expert on anonymization and de-identification technologies and methods.

As you are aware, Bill C-27 introduces definitions of anonymized data and de-identified data within the text of the proposed consumer privacy protection act. The concept of anonymized data is a core feature of the CPPA, as it clarifies the scope of application of the CPPA's privacy legislative scheme.

There are several very important provisions throughout the CPPA related to the terms de-identification and anonymization. It is therefore essential that the CPPA provisions relating to these terms—anonymized and de-identified data—be carefully considered and appropriately articulated within the CPPA's legislative scheme.

In August of 2022, CANON struck a working group to conduct a thorough legal consideration of Bill C-27, and we received comments from stakeholders across all sectors as part of a consultation process, including a workshop attended by over 100 participants.

CANON is proposing surgical revisions that provide critical clarifications to several provisions within the CPPA, including to the provision referenced by my colleague Éloïse Gratton for proposed section 39. We're proposing additional privacy protections to disclosures without consent for socially beneficial purposes. The details of our submissions are contained within the written submission we submitted to INDU.

Our most important recommendation relates to the CPPA's current definition of “anonymize”. The current definition provides that personal information would be anonymized only if it is “irreversibly and permanently” modified in accordance with “generally accepted best practices, to ensure that no individual can be identified from the information, whether directly or indirectly....”

We are proposing an amendment as a surgical addition to this definition, as the current text of the definition of “anonymize” sets an extremely high and practically unworkable threshold for the circumstances in which information would no longer be deemed to be identifiable. Specifically, anonymized data within the CPPA does not incorporate the concept of reasonably foreseeable risk in the circumstances and therefore is not consistent with the standard for anonymization within legislative schemes across the country, including Quebec's Law 25, Ontario's Personal Health Information Protection Act, and multiple other statutes cited in our submission. We have everyone. There are at least 12 that we've cited in the statutes for your consideration when you're reviewing our brief.

To be clear, and this is critically important, there is a very high legal standard for anonymization right now in Law 25, under PHIPA and under all these other statutory frameworks. It's very high, but unlike the CPPA, the anonymization standard in these other legislative schemes is practically workable. The reason is that it expressly contemplates contextual risk.

As a result of these concerns, CANON has proposed an amendment to the CPPA's definition of “anonymize” that simply incorporates the concept of reasonably foreseeable risk in the circumstances into the definition. Our proposed surgical amendment would align the CPPA's concept of anonymized data and, critically, ensure the interoperability of the CPPA with the standard for anonymization within other legislative schemes across Canadian jurisdictions. Our proposal is fully consistent with well-established Canadian jurisprudence on the scope of the concept of personal information, the citations for which we provide in our submission.

I'm going to turn my comments over now to Khaled El Emam to conclude our introductory remarks.

[Daniel Therrien, Lawyer and Former Privacy Commissioner of Canada, As an Individual]

Thank you, Mr. Chair.

Thank you, committee members, for inviting me to participate in your study.

I am here as an individual, but my experience as the federal privacy commissioner from 2014 to 2022 will certainly be reflected in my remarks.

To begin, let me say I agree with my successor, Philippe Dufresne, that the bill before you is a step in the right direction, but that it is necessary to go further in order to properly protect Canadians. I also agree with the Office of the Privacy Commissioner's 15 recommendations for amending Bill C‑27, with some nuances on audits, remedies and appeals. The government has taken up, at least in part, a good number of the recommendations I had made regarding Bill C‑11, the predecessor to Bill C‑27. Among those that were not accepted is the application of privacy law to political parties.

I am very pleased that a consensus appears to have emerged among political parties to recognize in the law that privacy is a fundamental right. I applaud parliamentarians for that decision. The question now becomes how to best translate into law the principle with which you now all agree.

Minister Champagne suggests amending the preamble and the purpose clause of the CPPA. These are steps in the right direction, but they are not sufficient. You should also amend two operative clauses: proposed section 12 of the act on “appropriate purposes”, and proposed section 94, which provides for administrative monetary penalties for certain violations of the law. Without these amendments, the law would still give greater weight to commercial interests than to privacy, which is a fundamental right. This does not appear to be your intent.

Based on my reading of parliamentary debates, it also seems to me there's consensus around the idea that privacy and economic growth through innovation are not in a zero-sum game. The question is generally not on deciding which should prevail—privacy protection or innovation—as both can and should be pursued at the same time. It is only in rare cases that it will not be possible. In those cases, privacy as a fundamental right should take precedence.

Proposed section 12 of the CPPA does not, in my view, faithfully translate this consensus. Rather, it upholds the traditional approach, which is that privacy and economic goals are conflicting interests that must be balanced without considering that privacy is a fundamental right. This may have made sense under the current act's purpose clause, but it will no longer make sense if the CPPA's purpose clause recognizes privacy as a fundamental right, as is currently proposed.

Proposed section 12 is central to the exercise that commercial organizations, the Privacy Commissioner and ultimately the courts will have to go through in order to determine the factual context of each case and the weight given to privacy and commercial interests.

Section 12 as drafted gives more weight to economic interests. It does that in several ways.

The first is through the terminology it uses. It refers to “business needs” and does not refer to privacy as a right, fundamental or otherwise.

When the proposed section does refer to privacy, in paragraphs (2)(d) and (e), it is as an element to consider in achieving business goals, mitigating losses where possible, that is where achieving business goals can be achieved at comparable cost and with comparable benefits.

Nowhere is it mentioned that privacy protection is an objective at least equally as important as economic goals. On the contrary, the focus is on economic goals, and privacy loss as something to be mitigated, where possible, in the pursuit of those goals.

I have provided you with my proposals for amending section 12, and they would be consistent with the amendments proposed at section 5.

With respect to sanctions, all violations of section 12, including the appropriate purposes clause at subsection (1), should potentially lead to administrative monetary penalties. Without sanctions, recognizing privacy as a fundamental right would be a pious wish, without real consequences.

I would go further and recommend that all violations of the CPPA should be subject to these penalties. This would align Canada with most other jurisdictions.

I have a few words on the Artificial Intelligence and Data Act. That part of Bill C-27 is brief, even skeletal, and leaves a lot of room for regulations. While I understand why some are concerned with this, I think this approach is defensible, given the fact that AI technology is relatively nascent and is certainly evolving very quickly; however, the lack of precision in AIDA, in my opinion, requires that certain fundamental principles and values be recognized in the act itself. First and foremost, the act should recognize the importance of protecting fundamental rights, including the right to privacy, in the development and implementation of AI systems.

Finally, some of you expressed concerns in an earlier meeting with the difficulty of detecting violations of the law and the potential value of proactive audits to facilitate detection. As commissioner, I had recommended proactive audits, and I still believe they are a necessary part of an effective enforcement regime. This is particularly true in the case of AI.

Thank you. I would be pleased to take your questions later.

[Éloïse Gratton, Partner and National Leader, Privacy and Data Protection, BLG, As an Individual]

Thank you for inviting me.

I'm pleased to be here today to share my thoughts on Bill C‑27.

I am a partner at Borden Ladner Gervais and the leader of the firm's national privacy and data protection practice. Having worked in the field for more than two decades, I provide advice to large national companies in a number of industries across the private sector. Many of these companies have international operations as well, so I have followed the developments in the European Union's General Data Protection Regulation, or GDPR, in recent years. The GDPR is, of course, the EU's equivalent to our privacy legislation.

I believe this privacy reform process should draw on the lessons learned by Quebec and the European Union in reforming their privacy legislation.

I am here today as an individual. I'm going to switch to English now, but I would be happy to answer members' questions in English or French.

Today I stand before you to discuss a matter of paramount importance, the reform of the federal privacy law.

We find ourselves at a critical juncture. We have the unique opportunity to strike a balance that ensures the protection of our privacy rights while fostering an environment of innovation. In a rapidly evolving digital age, where information flows faster than ever before, our privacy is at an increased risk. This makes it imperative that we reform our privacy laws to reflect the realities of today.

However, data protection laws should not stifle the innovative spirit that has propelled us into the 21st century. Canada needs to remain competitive. Innovation drives economic growth, creates jobs and improves our quality of life. It is the engine of progress. Striking the right balance between privacy and innovation is a complex task, but I don't think it's an impossible one.

I'll focus my presentation on the consumer privacy protection act and areas of improvement for four specific issues that potentially impact innovation.

First, I absolutely welcome the introduction of a consent exception regarding specified business activities and for certain activities in which the organization has “legitimate interest” under subclause 18(3). This being said, the legitimate interest exception is actually narrower than the same exception under the EU's GDPR, the General Data Protection Regulation.

David raised this issue, so I'm going to talk a bit more about it.

Bill C-27 provides no exception, nor any significant flexibility, as to the application of the consent rule to the collection of personal information collected from publicly available sources on the Internet. It prevents all organizations from leveraging data available on the web, including legitimate ones working on new products and services that may benefit society and that need a large volume of information.

In short, I submit to you that this legitimate interest exception should be more closely aligned with the GDPR legitimate interest legal basis to accommodate innovative types of business models while protecting the privacy interests of Canadians.

Clause 39 creates a new consent exception for disclosures of de-identified personal information to specific public sector entities, including government, health care and post-secondary educational institutions. Limiting this consent exception only to disclosures to public sector entities instead of public and private sector entities severely restricts its utility. Clause 39 should authorize and facilitate responsible data sharing between a broader range of actors to have access to talent and resources that they can leverage to pursue socially beneficial purposes.

The third point is that the CPPA introduces new definitions for the terms “anonymize” and “de-identify” and provides greater flexibility regarding the processing of these categories of information. However, the proposed standard for anonymization under subclause 2(1) is more stringent than other recently updated privacy legislation, including the GDPR and the recently amended Quebec private sector act.

My point is that the CPPA should include a reasonableness standard instead of holding organizations accountable to an absolute standard that may be impossible to meet in practice. As you certainly know, access to to anonymized datasets, with legal certainty, is crucial to research and development performed by Canadian organizations. I have a feeling that Adam Kardash and Khaled El Emam will be talking about this a bit more.

My last point is that clause 21 introduces a new consent exception for the use of de-identified information for internal research, analysis and development purposes.

Restricting such use to internal uses may limit collaboration and the fostering of research partnerships, preventing stakeholders from sharing datasets to create data pools that are broad enough for the production of useful and actionable insights. This section should authorize the use and sharing of de-identified information among different organizations.

I've submitted a short brief in French and English in which I provide additional detail on these four proposed changes. I think innovation and privacy can coexist, and the responsible use of personal information can be the cornerstone of building new and exciting technologies while respecting our fundamental rights.

Thank you, and I welcome questions.

[David Fraser, Partner, McInnes Cooper, As an Individual]

Thank you very much, and thank you for your kind invitation to appear before this committee to assist in its important study of Bill C-27.

I'm a partner in private practice at a law firm where I've been practising privacy law for 22 years. Most of my practice involves advising international businesses on complying with Canadian privacy laws. More often than not, they're trying to make their existing privacy programs, which they've developed in places like Europe and California, work in Canada. I also advise Canadian businesses, large and small, on compliance with these laws. I regularly advise organizations in connection with investigations and encounters with the Office of the Privacy Commissioner of Canada and his provincial counterparts.

I'm here in my own personal capacity, but obviously my work and opinions are informed by my experience working with my clients.

Now, I may come across as somewhat contrarian in saying this, but I actually think that PIPEDA works pretty well as it is. It was designed to be technologically neutral, based on existing principles that are largely embedded in Bill C-27. One thing I've often said is that Bill C-27 takes PIPEDA and turns it up to 11.

I don't think the legislation's necessarily broken. I think the commissioner, over the past 22 years, has not necessarily exhausted all of his enforcement powers and authorities over that time.

I'd like to start by saying that I don't really like the name of the new statute. Canadians aren't simply consumers. This legislation applies to consumers. It also applies to certain employees in the federally regulated sector. It's a bit negative and dismissive. If we're wedded to the acronym CPPA, we could call it the “Canadian Privacy Protection Act”, but I don't think that actually affects its substance.

Now, I like PIPEDA, but over the last little while, it's been pretty clear that there's an emerging consensus in looking toward order-making powers and penalties and thinking they're desirable. In the course of this, I would ask the committee to consider that that requires a commensurate and appropriate increase and shift to greater procedural fairness than is currently in the bill.

Based on my experience, I'm of the view that the Privacy Commissioner potentially has a conflict in being a privacy advocate, a privacy educator, the privacy police, the privacy judge and the privacy executioner. Any determination of whether a violation of the CPPA has taken place and what penalties should be imposed should be carried out by an independent arm's-length tribunal, such as the Federal Court or the new tribunal. The commissioner can recommend a penalty and can take on the role of prosecutor, but ultimately the determination of whether or not a violation has taken place and whether or not a penalty should be imposed should be vested in an arm's-length body.

I think the recent Facebook case in the Federal Court is a bit of a cautionary tale. I'd be happy to talk more about that.

Children's privacy is obviously a very important theme in this particular piece of legislation. I agree with and appreciate the views of the government and the commissioner with respect to protecting the privacy of children.

One thing I'm a bit concerned about is that the current bill would be difficult to operationalize for businesses that operate across Canada. Whether or not somebody is a minor currently depends upon provincial law. That varies from province to province, and implementing consistent programs across the country would be difficult. I would advocate putting in the legislation that a minor is 18 years or below.

I would also suggest that there be a presumption that children under the age of 13 are not able to make their own privacy decisions and that their parents should be their substitute decision-makers by default.

For organizations that offer a general service to the public—like a car dealership, for example—there should be a presumption that all of their customers are adults, unless they know otherwise. If you have a website that's focused toward children, you know there are children in the audience and you have to calibrate your practices appropriately. Anything different might lead to mandatory age verification, which can be very difficult and raises its own issues.

Having been involved in investigations and in litigation involving privacy claims, I would suggest that the “private right of action” be amended to be limited to the Federal Court of Canada, if you're wedded to a private right of action to begin with. The problem with the existing legislation is that anybody can go to the Federal Court of Canada or a provincial court. We know that there are going to be hundreds of people affected over the next decade or so, with respect to particular incidents. You're going to end up with duplicative proceedings simultaneously across the country. We already know that judicial resources are significantly taxed.

I think legitimate purposes—which are largely based on the European model—need to be more closely aligned. I'm happy to provide more details on what is happening in Europe.

With respect to the artificial intelligence and data act, it should be its own bill and subject to its own study. I would note that excluding the government from it is dangerous. The government has guns. The government decides about benefits, immigration and things like that. I think it's subject to a constitutional challenge. It's not necessarily harmonized with what's going on with our international trading partners, and there should be reciprocal recognition.

If a company is complying with European data regulation and we have deemed it to be substantially similar, that should work. Otherwise, we're going to have difficulty with Canadian businesses operating internationally and international businesses coming here.

Finally, I think research and development should be removed from the bill, because it presents no real risk of harm to an individual until it's presented into the public.

I have a longer list. I could go on for much more than five minutes, but I think that's my time. I look forward to the discussion.

[The Chair, Liberal, Joël Lightbound]

I call the meeting to order.

Good afternoon. Welcome to meeting number 91 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in a hybrid format, as per the rules. Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming its study of Bill C‑27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts.

I would like to welcome our witnesses today. We have, appearing as individuals, David Fraser, partner at McInnes Cooper; Éloïse Gratton, partner and national leader, privacy and data protection, at BLG, who is joining us by video conference; and Daniel Therrien, lawyer and former Privacy Commissioner of Canada. Ms. Gratton was my professor at Université de Montréal for a short time, so it's nice to see her again. Finally, from the Canadian Anonymization Network, we have Adam Kardash, partner, and Khaled El Emam, professor, both joining us by video conference.

Thank you all for being here today.

We are fortunate to have this panel for our study of Bill C‑27, so without further ado, I will turn the floor over to Mr. Fraser for five minutes.

Amendments to the Standing Orders

[Brian Masse, NDP, Windsor West, ON]

Mr. Speaker, as this is the first time I rise in the chamber with you at the helm, I want to say congratulations for all the work you have done in Parliament as a parliamentary secretary and also for your tenure as Speaker in this chamber.

I am glad to speak on this motion, Motion No. 79, from the member for Elmwood—Transcona. I have affectionately referred to this bill as “ending Ottawa's entitlement to my entitlements” motion, because that is really what this is about. This is about the traditional gatekeepers in this facility who have kept the doors closed against many Canadians, at the same time protecting their self-interests. I will get into that a little bit later.

When prorogation was used by the Prime Minister, it could have been characterized as the “running to your mommy or daddy to protect you from the people around you” bill. They go running to the monarchy to beg for forgiveness. It was the Queen before and now it is the King. It is because “I can't handle it anymore. Please save me”. It is ridiculous. In a modern democracy we should not have to turn to our mommies and daddies as adults in this place. That is really what it is about. That is what has taken place with prorogation. It has been used to protect someone's own interests.

I think one of the biggest things that we want to see with this motion is greater accountability to the public so they understand the rules. At the end of the day, prorogation is about, “Well, I just simply don't have to do it anymore so the rules don't apply to me. I'll see you later.” I am sure a lot of Canadians can relate to that. They wish they could prorogue their laundry, their dishes or their awkward conversations with people who they do not want to be around, but they cannot. They have to deal with them.

It is sad because that is really what we are dealing with. I have seen this happen in the worst of circumstances with then prime minister Harper who did not want to deal with the House of Commons at that time and I have seen it with the current Prime Minister when he did not want to deal with the WE scandal, for example. It is a very serious issue, as it is a way of keeping privileges and entitlements. I was thinking about gatekeeping this morning and about protecting entitlements. There is the protection of the entitlements one gets as a prime minister with all the perks. For my Conservative friends, there are the perks of keeping Stornoway and all the privileges there. By the way, Stornoway does have a gate, because it protects the gardener, the butler, the person who is making the meals, and the $70,000-a-year budget. It has a history of being part of the entitlements that we need to get rid of.

I think that it is really important that people know that prorogation is unique and special at the workplace. People do not get to call a time out in a democracy, which is really what this is: I cannot get my act together. I cannot get my caucus together. I cannot do whatever and I get to call a time out. The problem with that is there are serious issues. One prorogation was over the documents of women and men and issues over Afghanistan. We have that legacy to this day. The devastation to individuals and what took place subsequently would have been shining spotlights on those things. The consequences are still felt now, because we have many Afghanistan men and women who served under our country's banner who are still in harm's way. Some still cannot even come to this country because we do not have our act together on that.

The legacy of prorogation goes beyond the moment of the day because all the stuff in the House of Commons ceases. Everything grinds to a halt, which costs money. To the parties who often champion their role of being the custodians of the public purse, the last unnecessary election sent another $630 million down the drain. A time when Harper did it resulted in a freeze of all of the House of Commons' operations, along with all of its work, worth hundreds of thousands of dollars in that year alone between the studies that would have been done, the people who were flown in for hearings, getting witnesses to come forward and producing reports. All the work that was done in the chamber and all the hours that go into moving bills were basically liquidated at that point in time.

Dozens and dozens of important bills were killed by the Conservatives and the Liberals; some bills had to go on to the next Parliament. That is where the real damage is done. The rest of the world does not get a time out or time off. People do not go running to mommy or daddy to try to figure things out. The world still goes on. The grinding of Parliament starts and the grinding of Senate follows. What that means is that we have to start over.

I cannot say how many of those bills dealt with social justice, women's rights, housing, the environment and the auto industry. They dealt with a number of things that we are trying to compete with in the world. If the Prime Minister, right now, chose to prorogue this Parliament, we would lose the GST rebate, a modest housing initiative and work on the Competition Bureau. They would all be gone.

In the committee I sit on, there are 96 witnesses and about 140 who want to work on Bill C-27, Canada's first bill on artificial intelligence. As the entire world is moving beyond us right now, that would be the real consequence. If an election is called because we have to bend a knee to the monarchy again in the system that we have because the Governor General can decide, we would be into another costly election. none of these bills could be brought back unless there was unanimous consent. On top of that, there would be months and months, if not more, perhaps almost a full year, to get back into order the work that would be gone.

That is critical if we are trying to compete with the rest of the world and world events are taking place, as they are now. My heart goes out to those who are suffering due to what is taking place. So many people are suffering. It is not just the wars, it is famine. Canadians are dealing with an opioid crisis. There is a whole series of issues on housing affordability and people cannot afford groceries. The Prime Minister of the day could basically say he is calling a time out, everyone can deal with it on their own and he will keep all of his privileges intact.

What is funny is when that happens, the Prime Minister's salary, the perks of the residence and everything else are not prorogued. They continue. What does not continue is the hard work that is necessary to improve lives. That is why the member for Elmwood—Transcona is onto something here. It is critical that he get some type of recognition because this issue has not gone away.

The member's father, the former member for Elmwood—Transcona, Bill Blaikie, would be proud of him today. I stood in this chamber with Bill Blaikie many times and listened to his statesman approach, which is missing in many respects, and his maturity in trying to work toward trying to better this place and establish some rules, which is the legacy that current member for Elmwood—Transcona is carrying on. That is what Bill often did in this place: He brought sense and logic to it.

At the end of the day, this motion is about creating a balance of rules. It does not end all the rules but improves upon them in taking a credible step forward. That is critical, because we just cannot have what we have today. Imagine if Parliament shut down tomorrow. What is at stake is our lost voices.

I want it to be clear that this is a reasonable, modest, sensible and practical approach to changing the rules. Conservatives and Liberals should think about this. I know they do not often end some of the privileges in this chamber because they think they can constantly switch back and forth. There will be a new day when they are not there and they will be wishing for this legislation, because all their constituents will need it, instead of the ego of the member who occupies the Prime Minister's seat.

With that, I move:

That the motion be amended by replacing the words, “(iii) in Standing Order 45(6)(a)”, by adding, after the words “An exception to this rule is”, the following: “the division on a confidence motion pursuant to Standing Order 53.2(9) and”, with the words, “(iii) in Standing Order 45(4)(b)”, by adding after paragraph (v), the following: “(vi) a confidence motion pursuant to Standing Order 53.2(9).”

These are housekeeping amendments to improve this bill and make it even stronger.

[Ryan Turnbull, Liberal, Whitby, ON]

I'm not trying to give you ammunition to ask for even more funds, but I suspect that there's a lot of online activity and a lot of data being collected, and I suspect that it would be very challenging to try to monitor and detect any breaches of the obligations that would be in Bill C-27. With respect, I think you have your work cut out for you in the future. I don't envy you that, but I appreciate the work that will be undertaken.

Maybe I'll leave it there for the moment on that.

I have another question or two. On the flip side of this—and I think my colleague Mr. Van Bynen asked some questions about this—what are the risks in going too far? By “going too far”, I mean are there risks within this legislation and this debate we're having, such that we could go a step or two too far and impede all of the positive benefits Canadians are getting out of the use of these online tools?

The data that's collected has enhanced our lives in a lot of different ways. There's a sense in which there's that balancing act between innovation and privacy, which you've already talked about. I guess I want to know specifically whether you see any risks in going too far. We really have been talking from the other side, about not going far enough on privacy rights. If we go too far, we might also stifle innovation. Would you agree with that, and are there any risks to that?

[Ryan Turnbull, Liberal, Whitby, ON]

Just as a thought experiment—because I'm sort of testing this in my mind—I'm sure there are cases of bad actors who are not forthright in fulfilling their obligations in certain instances. I guess what I'm asking is whether you have sufficient powers and tools to be able to really detect those nefarious activities where they may not, and intentionally may not, be living up to the obligations, even once Bill C-27 has passed?

[Ryan Turnbull, Liberal, Whitby, ON]

Thanks, Commissioner.

There's some really great conversation today. I really appreciate all the questions and the positive engagement here. I think this is really good for this work and this legislation.

I want to get back to a line of questioning that I started on and didn't quite finish.

I sort of take it that Bill C-27 and the minister's letter, which provides details, introduce new obligations for organizations and companies. It's also giving your office and you new powers, which I think are both positive.

One of the questions that keep coming up for me when considering what work you'll have ahead, once we hopefully get this bill through and strengthened in many ways, is whether there is enough around detecting non-compliance. It seems to me that it must be hard to detect who is not complying with these additional obligations that are being introduced in Bill C-27.

Can you speak to how you'll undertake that? I know you mentioned it with the last question about additional resources needed. I'm certain that's part of it, but could you speak to how you'll detect non-compliance when it does occur?

[Philippe Dufresne]

That would be the model, in fact, that exists in Quebec and that exists internationally. In fact, the GDPR—which, as you know, is the regulation that applies to the European Union—states that the DPAs, which would be the privacy commissioners, have the ability to issue fines. In the recital, in the description of this, they're talking about the DPAs issuing the fines, and they're generally reviewed by the courts. They list Estonia and Denmark as being exceptions, where they have to ask courts to issue fines because of the specifics of their legal structure.

The CAI, my counterpart in Quebec, has the ability to issue fines. They are reviewable by the normal court system. If there were no tribunal, this could work in the same way. BillC-27, as drafted, already creates a more formal process for my decisions. It provides that the investigations happen at the front end. You try to resolve matters. If you don't resolve the matter, then it goes to what is called an inquiry, and I will have obligations under the law to adapt codes of practice and consultation with industry. Procedural fairness has to be an element of that, and at the end of the day, those decisions, if you choose as a Parliament to give the authority to my office to issue fines directly, would be reviewable by the Federal Court through the normal judicial review process. That's certainly an option.

On the other option, if the decision is to create a new tribunal, my recommendation is that if we're adding a layer of review, we should remove one, so it should go straight to the Court of Appeal, otherwise there will be a cost.

[Philippe Dufresne]

The recommendation on audits was one that was made for proactivity. It was this notion that with great power comes great responsibility, so if you have authorities in cases where there may be an exception to consent for the use of information, there should be an ability to do what I think my predecessor referred to as “looking under the hood”, so having verifications. That's what the audit process allows.

There were concerns with the criteria for initiating an audit. I'm looking for the section in Bill C-27. My colleagues can point it out to me. At the time, under the existing legislation, it talked about having reasonable grounds to believe that the act had been violated, and there is recognition that that was too strict. The current proposal in Bill C-27 now talks about having been violated or being likely to be violated, as I recall, and I'll be able to correct that.... Proposed section 97 says:

The Commissioner may, on reasonable notice and at any reasonable time, audit the personal information management practices of an organization if the Commissioner has reasonable grounds to believe that the organization has contravened, is contravening or is likely to contravene Part 1.

So it has been improved in the proposal on Bill C-27. The test is not as reactive as it was before, because of this notion of “is likely to contravene”.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Allow me to interrupt.

Among the eight recommendations that have clearly not been taken up by the minister so far, which are fundamental and should find their way into Bill C‑27?

[Philippe Dufresne]

Yes, absolutely. The use of sandboxes is good practice. Our British counterparts are very far along on that front. In the case of AI technologies, the industry gets to test out the data and methods in a secure environment.

It's clear that our office would have to be resourced to set up a sandbox. The bill doesn't go as far as establishing a sandbox, but it does require my office to provide the industry with advice as needed. That will be especially important for small and medium-sized businesses. Again, though, it will require capacity. The bill also calls on the commissioner's office to approve codes of practice and certification programs.

Those are all proactive and preventative measures. My recommendations on PIAs and privacy management programs are also prevention-oriented. That's the approach. Organizations have to do these things in the beginning and invest the necessary resources.

The OECD surveyed business leaders and legal experts to find out what challenges they were facing, challenges related not so much to AI, but, rather, to international trade. They said it was sometimes hard to know where to allocate resources because certain investments didn't yield any legal benefit or it was unclear.

Even if well-intentioned business leaders want to set up a sandbox, convincing shareholders to fund it is a challenge. Imposing a legal requirement on companies is helpful, because it sends the message that not only is it the right thing to do, but it's also required of them under the law. The same applies to PIAs.

By the way, I'm quite fond of the certification program provisions in Bill C-27. Europe has that mechanism, and what it basically does is encourage companies to develop the programs and seek the commissioner's approval. Doing this and following the process will help them when complaints arise, because it shows that they acted in good faith and were proactive. It could even lessen fines.

All of those measures encourage companies to move in the right direction. Incentives are extremely important. To encourage innovation and ensure that Canada is well positioned, we have to act on two fronts: impose fines in problematic cases, and reward and recognize good behaviour. They go hand in hand.

My office's mission is to promote and protect privacy rights, and I really appreciate that. It's about more than telling people they did something wrong after the fact. It's also about working alongside them to make sure things are done right from the start.

[Philippe Dufresne]

Bill C-27 needs to prevent that to the same extent that the current law prevents that. As you know, this was a matter that my office investigated. We made findings that Tim Hortons had breached privacy law by collecting more information than it needed and by not being transparent about what was being done with that information.

We see these situations, and we've made some recommendations and some findings. Bill C-27 will help more than the current law, because it will provide for more explicit obligations in terms of explaining consent—making consent something that is explained in a meaningful way for individuals to understand. There is also the possibility that my office can issue orders, and there is the possibility of fines.

I believe that, in the Tim Hortons situation, the organization followed the recommendations. In the Home Depot decision that I issued last year, finding a breach of privacy, the organization agreed with the recommendation. However, that's not always going to be the case, so there need to be these enforcement tools—hopefully not to use them but to reach those results faster and in a proactive way.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you. I appreciate that.

The other thing that often comes up for me is thinking about how companies often collect information. We've heard stories about Tim Hortons collecting the location information of users of its app. I think it's concerning for many Canadians—to be tracked and not know how that information is going to be used. How could Bill C-27 prevent that from happening in the future?

[Philippe Dufresne]

On the current privacy legislation, we've provided guidance in terms of how to obtain meaningful consent. In that, we talk about some things that should be looked at in the context of children.

My federal, provincial and territorial colleagues and I have recently issued a statement, a resolution, on protecting young persons' privacy. It gives examples of things that should be done and should not be done with the data of children, nudges them not to make a bad decision, and recognizes that they are more vulnerable.

We can interpret the law, to some extent, to protect children, but we need to do more, and this bill has started to do so. There is now a recognition in the initial version of the bill, and I give credit to Minister Champagne on that. This was in the original Bill C-27 as tabled—the recognition that the information of minors would be deemed to be sensitive information. That has impacts in a number of areas, in terms of disposal rights, and so on.

We took that, and in our recommendations, we recommended going even further than that to highlight the best interest of the child in the preamble of the bill, so that if there is doubt, in terms of interpretation, you can look at that. The minister has signalled his agreement with that and has suggested going further to include the special situation of children in proposed section 12 on interpreting appropriate purposes. That is a further improvement that I would certainly support. We see comments like that in the European context with recital 38 to the GDPR, highlighting that children deserve special protection. UNICEF has said that.

We know that our kids are digital citizens. They're spending time online for all aspects of their lives, including school. We certainly saw it more during the pandemic. It's important that the legislation protects them appropriately and protects them as children. We need to protect the best interests of the child. We need children to be able to be children in that world, to be protected, and not to suffer consequences later on, when they're adults, for things they have done online. There are improvements there, and I certainly support them.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Commissioner, answer yes or no: Are you comfortable that Bill C-27—in not defining “legitimate interest” for businesses, as it currently stands—allows the government to make lists of activities and regulations that would balance businesses over the privacy of individuals?

[Philippe Dufresne]

This is an issue that the international community is grappling with. In Bill C-27 you have provisions about making sure that other countries are providing similar levels of protections through contracts. Other regimes have more detailed rules about this, for instance, looking at the GDPR, which has the adequacy regime.

There are a number of models for that, and what's important is making sure that the privacy of Canadians is protected with the data that leaves Canada.

[Philippe Dufresne]

With AIDA Canada has the opportunity to be the first. There is legislation is Europe that is moving forward, and that is something that we've pointed out in our submission on Bill C-27. This is a positive step, and Parliament needs to get it right. What I'm highlighting in the context of AI, in particular, is that the AIDA bill would bring in significant proactive risk mitigation measures to deal with harms and biases. This is good, and these are important measures, but they leave out the proactive steps for privacy, which is in the top three risks. This is why I'm insisting on having a privacy impact assessment as a mandatory obligation in the privacy bill, to close this gap.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Chair.

Welcome, Commissioner.

Commissioner, on October 3, two or three weeks ago I guess it was, you provided keynote remarks to the Big Data & Analytics Montréal Summit 2023. I've had a chance to go through your remarks. In one of the sections, entitled “Law reform and the regulation of AI in Canada”, you reference changes to the CPPA and also to the AIDA. You also comment about being “encouraged by the introduction” of the bill and—I'll use my own words—the tone and direction of the bill. One of the comments you make is about the protection of fundamental privacy rights.

In terms of reading your speech on Bill C-27, the direction of the bill, you are encouraged.

[Philippe Dufresne]

My office made a number of recommendations on the predecessor bill to Bill C-27. One of them included recognizing privacy as a fundamental human right. Some concerns were raised with some of the definitions of things like appropriate purposes or the ways information was conveyed. There was an extensive list of recommendations tabled by my predecessor. That is on the public record. A number of those were considered and led to Bill C-27.

There are outstanding ones. In my submissions, I have highlighted 15 key recommendations. In the annex, we made reference to previous recommendations that have been made.

[Philippe Dufresne]

On this question, Mr. Perkins, the bill was introduced before I was formally in place as Privacy Commissioner. The bill was actually introduced the day the House of Commons approved my proposed appointment as Privacy Commissioner. I was not consulted or involved, certainly, before that with respect to Bill C-27, because I wasn't the commissioner.

I have since been making recommendations—

[Philippe Dufresne, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Ladies and gentlemen members of the committee, I am pleased to be back to assist the committee in its study of Bill C‑27, Digital Charter Implementation Act, 2022, which would enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act.

When I previously appeared before the committee three weeks ago, I delivered opening remarks about the bill and presented my 15 key recommendations to improve and strengthen the bill. Today, I want to briefly highlight and respond to the letter the Minister of Innovation, Science and Industry sent to the committee on October 3, 2023, and to answer any questions that you may still have.

I welcome the minister's stated position on the amendments being developed with respect to the proposed CPPA, in which he seems prepared to agree with four of my office's 15 key recommendations, namely by explicitly recognizing privacy as a fundamental right; by strengthening the protection of children's privacy; by providing more flexibility for my office to use compliance agreements, including through the use of financial penalties; and by allowing greater co-operation between regulators.

I also note and commend his statement of openness to further amendments following the study by this committee.

I would like to take this opportunity to highlight other ways in which the bill should be strengthened and improved in order to better protect the fundamental privacy rights of Canadians, which are addressed in our remaining recommendations to the committee.

I will briefly highlight five of our recommendations that stand out in particular in light of the minister's letter, and I would be happy to speak to all of our recommendations in the discussion that will follow.

First, privacy impact assessments, PIAs, should be legally required for high-risk activities, including AI and generative AI. This is critically important in the case of AI systems that could be making decisions that have major impacts on Canadians, including whether they get a job offer, qualify for a loan, pay a higher insurance premium or are suspected of suspicious or unlawful behaviour.

While AIDA would require those responsible for AI systems to assess and mitigate the risks of harm of high-impact AI systems, the definition of harm in the bill does not include privacy. This means that there would be proactive risk assessments for non-privacy harms but not for privacy harms. This is a significant gap, given that in a recent OECD report on generative AI, threats to privacy were among the top three generative AI risks recognized by G7 members.

In my view, responsible AI must start with strong privacy protections, and this includes privacy impact assessments.

Second, Bill C‑27 does not allow for fines for violations of the appropriate purposes provisions, which require organizations to only collect, use and disclose personal information in a manner and for purposes that a reasonable person would consider appropriate in the circumstances. This approach would leave the federal private sector privacy law as a standout when compared with the European Union and the Quebec regime, which allow the imposition of fines for such important privacy violations.

If the goal is, as the minister has indicated, to have a privacy law that includes tangible and effective tools to encourage compliance and to respond to major violations of the law in appropriate circumstances—an objective I agree with—I think this shortcoming surely needs to be addressed for such a critical provision.

Third, there remains the proposed addition of a new tribunal, which would become a fourth layer of review in the complaints process. As indicated in our submission to the committee, this would make the process longer and more expensive than the common models used internationally and in the provinces.

This is why we've recommended two options to resolve this problem. The first would be to have decisions of the proposed tribunal reviewed directly by the Federal Court of Appeal, and the second would be to provide my office with the authority to issue fines and to have our decisions reviewable by the Federal Court without the need to create a new tribunal, which is the model that we most commonly see in other comparable jurisdictions.

Fourth, the bill as drafted continues to allow the government to make exceptions to the law by way of regulations, without the need to demonstrate that those exceptions are necessary. This needs to be corrected as it provides too much uncertainty for industry and for Canadians, and it could significantly reduce privacy protections without parliamentary oversight.

Fifth, and finally, the bill would limit the requirement for organizations to explain, upon request, the predictions, recommendations or decisions that are being made about Canadians using AI, to situations that have a significant impact on an individual. At this crucial time in the development of AI, and given the privacy risks that have been recognized by the G7 and around the world, I would recommend more transparency in this area rather than less.

With that, I would be happy to answer any questions that you may have.

[The Chair, Liberal, Joël Lightbound]

I call this meeting to order.

Good afternoon, everyone.

Welcome to meeting number 90 of the House of Commons Standing Committee on Industry and Technology. Today’s meeting is taking place in a hybrid format, pursuant to the Standing Orders.

Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C‑27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

I’d like to welcome our witnesses today, from the Office of the Privacy Commissioner of Canada. First, we are hearing from Philippe Dufresne, Privacy Commissioner of Canada.

Thank you for joining us again today.

Next, we have Lara Ives, executive director, Policy, Research and Parliamentary Affairs Directorate, as well as Michael Maguire, director, Personal Information Protection and Electronic Documents Act, Compliance Directorate.

I thank all three of you for coming back. I'm confident that everything will go well today—I'm looking at my colleagues—and that we'll have a chance to have a normal meeting and benefit from your insights on Bill C‑27.

Without further ado, Mr. Dufresne, I'll give you the floor for five minutes.

[Steve de Eyre]

I'd be happy to.

As I think I mentioned in my opening statement, I'm a father. We live in Oakville North—Burlington. This is something that's really important to me as my kids are coming of age and starting to explore online.

I think we've outlined a few times the settings that we have in place. One thing we may not have mentioned is that, if you're under 16, your videos will not be eligible for recommendation into the “for you” feed, so those will not come up for other users as they come out. We also work extensively with the non-profits that I've mentioned. They're doing some great work. Canada has some of the best non-profits in the world on these issues.

We've hosted sessions with Digital Moment, for example. They're based out of Montreal. We had a youth session at our office in Toronto, where they brought in a number of youth from the area to talk about algorithms, understand how algorithms work and what algorithm bias is. This is an industry issue. It's not unique to TikTok, but we know we are a popular platform and that we have responsibility and a role to play here.

Going to Madame Fortier's question about consent, we know this is something for young people that's in Bill C-27, which is something we're looking forward to being engaged on, especially as it's in committee now. We think there's definitely a role for government and a need to update Canada's privacy laws.

[Runa Angus]

Yes. Bill C‑27 also establishes a private right of action.

Obviously, regulatory recourse is available, going through the commissioner and so forth, but there are ways to initiate legal action against private organizations.

[Mark Schaan]

We had engagement with the Privacy Commissioner in the lead-up to the tabling of Bill C-27.

[Mark Schaan]

I have met with the Office of the Privacy Commissioner with respect to Bill C-27.

[Mark Schaan]

The privacy link between Bill C‑27 and the EU's regulation is important in a few ways. The bill lays out some important definitions and elements to support interoperability between the two pieces of legislation.

As far as alignment with the EU is concerned, we are engaged in an ongoing process with our EU counterparts. It began three years ago, and we are confident it will result in the right connections between the two pieces of legislation.

[Mark Schaan]

Thank you to the member for that great question.

The government announced consultations on the link between AI and copyright in order to bring needed clarity to the role of copyright in the age of AI and all sorts of new technologies. The aim is to ensure that creators in creative industries are fairly compensated. That's important because the most effective way to address those concerns is through the Copyright Act. That's why the government has launched another consultation on the issue.

Bill C‑27 would enact the artificial intelligence and data act, a law of general application addressing all uses of AI systems that have significant societal or economic impacts. That may include certain aspects of the creative sector, but the law was designed to take into account all the ways in which AI could harm society overall.

For that reason, consultations on the copyright framework are also taking place. You're right that copyright rules determine how creators are compensated.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

When Minister Champagne was here, I asked him about Quebec's data protection law. In his letter, he mentions that a few provinces have privacy legislation that is substantially similar to PIPEDA, meaning that, in many circumstances, the provincial law applies instead of the federal law. The paragraph basically says that that will continue.

In the specific case of Quebec, it is anticipated that the designation of its provincial privacy regime as “substantially similar” will continue and that its law would apply instead of the consumer privacy protection act, or CPPA. I think that addresses the first issue related to law 25, which could indeed apply.

Currently, is a transition period anticipated? That's new information that came out the day after the minister appeared before the committee. Until Bill C‑27 is passed, will Quebec companies have some sort of transition period?

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Masse. I appreciate that consensus-building effort.

It's removing (a), (b), (d) and (e), and it orders the minister's department and the Department of Justice to produce draft texts of amendments to Bill C-27 as discussed by the minister on September 26, pertaining to part 1 of the bill, provided that these documents shall be deposited with the clerk of the committee in both official language no later than October 20, which is this Friday.

That is the amendment proposed by Mr. Masse.

Is that correct, Mr. Masse?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

I think a number of messages have been conveyed throughout today's meeting. Obviously, we don't support the idea of gag orders. For the sake of credibility, it is paramount that the committee have this debate. This may be one of the most important debates of the next two decades. Bill C‑27's passage will have consequences that go beyond politics. That is why I would like us to begin examining its content as soon as possible.

However, I think the concerns raised by my Conservative and NDP colleagues are entirely legitimate. I urge the government members to provide the documents requested. I don't think we need a formal motion to obtain clarification. That would only delay what comes out of this work. Clarification and predictability, by the way, are keywords the minister uses to send the industry a message. That is the message we, as parliamentarians, need to hear. The industry needs to hear it, as do all the witnesses who come before the committee. I think the committee should receive the text of the amendments.

That said, I think the letter the minister sent is a worthwhile mea culpa. It recognizes aspects of his testimony that provide clarity, specifically in relation to the application of Quebec's law 25, which could take precedence over the Canadian data protection law. I encourage the committee to proceed with its work, and begin the study by hearing from witnesses.

[The Chair, Liberal, Joël Lightbound]

Just to be clear, before we vote, we're debating the amendment by Mr. Masse to remove section (a) of the motion entirely and modify section (e) to order the minister to produce the three amendments he referenced in his presentation before the committee on September 26 pertaining to Part 1 of Bill C-27.

Are there any comments on the amendment proposed by Mr. Masse? I see none.

Madam Clerk, I will ask for a vote on the amendment proposed by Mr. Masse.

We have a tie. I'll vote against it.

(Amendment negatived: nays 6; yeas 5 [See Minutes of Proceedings])

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

MP Masse, if I'm hearing you right, section (e) starts out with “orders the Office of the Law Clerk and Parliamentary Counsel to produce copies of the texts”, and then instead of “of any amendments to Bill C-27”, it would read, “of the three privacy amendments”.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

I'll be supporting the motion, but I have a couple of amendments.

Briefly, this is a train wreck for no reason. We had Bill C-27 tabled in the House of Commons. The reason it's tabled in the House of Commons and goes through first reading is so that we can have discussion and it can be publicly examined, not only by ordinary citizens but also by the groups that want to have input. That's why we have a process of debate. It took a long time to get out of the House, and it came here.

I won a prima facie case in the past because my ability as an MP was impeded by the actions of another government. It resulted in changes, to this day. This is how I view it: You had the minister come forward. He talked about amendments. There were going to be goals and objectives from those, which had to be clarified. After this was clarified, I had a point of privilege, and then it was admitted there weren't amendments. Government members went back to saying, “Tell me more about these amendments.” We're back to where we shouldn't have to be. I've heard nothing but shock from people who are interested in this bill. What is the government's agenda on this?

I think it is a fairly reasonable approach—and that is my appeal—to look at getting the three privacy ones in front of us. In fact, it should be separate legislation. However, the government created flawed legislation by putting three acts together when it probably shouldn't have done that. That was a critical error to begin with. This was raised, and it's probably one of the reasons why, structurally, we have issues right now. There's no reason we can't do some of these things separately. In fact, it would have been wiser and we would have actually gotten things through.

To me, the minister can't just come here and say, “Okay, we have eight specific amendments” and then not provide them—not for us, but for the other people coming here. We have groups and organizations paying lawyers to draft legalese and make submissions to us. They need to know what's in front of us. We don't have that anymore. That's terribly unfortunate. Having the background letter from the minister is fine, but I also want to go over a best practice.

I knew it was going to be bad when it began, because the minister.... A lot of times, ministers come to committees with prepared documents and table them for members to go through while they give their presentation. That's a fairly common practice. A minister will come with a preamble and even the material they will present. Not only did we not get that.... I asked for that. I made a joke about how we'd have to put that testimony into ChatGPT to create the amendments for the minister, because that's all we have to go by.

I want to see whether we can move forward with some consensus here.

I would like to amend the motion to have the three privacy amendments...and I would also like to make an amendment to drop section (f). The reason for dropping section (f) is that—I'll be quite frank—I don't need the minister to come here anymore. I just need his amendments so others can see them. I don't need to have another group of clown cars showing up and distracting us from the work we have to do. That's what this is about. For my part, I would like the three privacy amendments to be tabled, and I don't need the minister to come here anymore. I want to get on with the work here. I can't have people continuing to speculate about what they have to present in front of us. It continues to be like a dog chasing its own tail. That's what we're doing right now.

I'd like to amend section (e) for the three privacy amendments; it can just say “privacy amendments”. Then I'd like to drop section (f), because I don't need the minister to come here.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair.

Thank you to what almost seems like our weekly regular witnesses and officials. I appreciate that.

In the minister's opening testimony here in September on Bill C-27, he said, “we will propose an amendment to recognize a fundamental right to privacy for Canadians.”

In the letter that was sent to the committee in response to our production of documents resolution from about a week and a half ago, the details of number one on page 1 of the appendix of the letter are that they will amend clause 5 “to qualify the right to privacy as a fundamental right.” There's stuff in there about the preamble, but ultimately the preamble doesn't matter because it has no legal basis once the statute is passed.

Clause 5 of Bill C-27 reads, “The purpose of this Act is to establish...rules to govern the protection of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information”.

Can you tell me which words in that clause will change?

[The Chair, Liberal, Joël Lightbound]

I call the meeting to order.

Welcome to meeting number 89 of the House of Commons Standing Committee on Industry and Technology. Today's meeting is taking place in a hybrid format pursuant to the Standing Orders.

Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C‑27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts.

I’d like to welcome our witnesses today. From the Department of Industry, we have Mark Schaan, senior assistant deputy minister, strategy and innovation policy sector; Samir Chhabra, director general, marketplace framework policy branch; Runa Angus, senior director, strategy and innovation policy sector; and Surdas Mohit, director, strategy and innovation policy sector.

Thank you for appearing before the committee yet again in connection with our study of Bill C‑27. I expect we will probably ask you back, but since you were here with the minister for his recent appearance, there aren't any opening remarks. Without further ado, we will go straight to questions.

You may go ahead, Mr. Perkins. You have six minutes.

Copyright Act

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I rise today to speak to a bill that is vital to residents of Abitibi—Témiscamingue and Quebec, and that is Bill C‑244, which was introduced by the hon. member for Richmond Centre.

Bill C‑244 amends the Copyright Act in order to allow a person to circumvent a technological protection measure, or TPM, if the circumvention is solely for the purpose of diagnosing, maintaining or repairing a product.

This bill was examined at almost the same time as Bill C‑294 on interoperability. What is interesting is that the Standing Committee on Industry and Technology was able to look at the issue from different angles and improve the bill's content to allow for the right to repair, to fight waste and to better protect the jobs of repair people, mechanics and technicians in the regions.

Over the past few years, it has become a lot more complicated to repair objects. Our vehicles are turning into motorized computers, and access to programming codes is needed to diagnose problems with them. Unfortunately, more and more manufacturers are refusing to share those codes or are charging independent mechanics exorbitant fees to get them, supposedly for security reasons. This situation is jeopardizing these small businesses and threatening their survival.

How are we to manage when our brand new smart phones get a cracked screen or some other defect? What do we do when our high-end, front-loading washing machine suddenly stops working? What about our three-year-old farm machinery in need of repair?

Let us consider Apple's policy on repairing its products, for example. All Apple products must be repaired at Apple stores, if the parts are available.

By patenting the majority of these parts, Apple holds on to its monopoly, while the electronic locks created by its operating software, protected under the Copyright Act, make counterfeiting liable to prosecution. For a resident of Abitibi—Témiscamingue, the situation is even more troublesome considering that the region has no Apple store. To get the service they are entitled to as consumers, these residents have to ship their product by mail or travel more than 600 kilometres to a large urban centre. Incidentally, the situation is practically the same for passports. That needs to change.

Manufacturers are increasingly choosing the answer for us: toss it out and buy a new one. Tight grips on replacement parts, restrictive design, the use of digital locks and other legal protections have all contributed to the difficulty in repairing and maintaining the increasingly high-tech things that surround us.

Bill C-244 presents a solution to the calls from many individuals who support the right to repair in Quebec. Their message is consistent: The government must make legislative changes that will give us both the right and the ability to repair the objects we own without violating intellectual property laws and other laws.

Although the purpose of the Copyright Act is to protect creators and intellectual property, the way companies have been using it to impede repairs over the last few decades is harmful to society as a whole. It impedes the second-hand market and harms small businesses specializing in repairs.

By supporting this bill, the Bloc Québécois is also supporting Quebec's small businesses that are committed to becoming repair centres, mechanics, computer specialists and artisans who have acquired the skills to repair our everyday products. This industry plays a key role in our energy transition and supports jobs throughout Quebec. Even though repair people are becoming increasingly rare in our communities, this bill lends direct support to their work. It will provide a living for many Quebeckers.

It is not just consumer electronics that are under the microscope. The bill also targets industrial equipment, agricultural equipment, medical devices, electric cars and many other machines that are becoming notoriously difficult for independent technicians to repair and maintain. This increases businesses' operational costs, curtails market competition and discourages follow-on innovation.

The costs of our increasing inability to repair things go beyond pocketbook issues. It is imperative that we consider the environmental impact as well. My colleague from Repentigny will be happy to hear me mention this. The manufacture of new devices generates considerable electronic waste and consumes precious resources. It is therefore crucial to give consumers the right to repair their products. I would like to draw my colleagues' attention to a new law in Quebec that is along the same lines as this one. It reminds manufacturers that they have a role to play in this equation.

Quebec has passed a new law on planned obsolescence. We applaud the leadership of the Quebec National Assembly, which recently passed this legislation to ensure that these products operate properly and to prevent the sale of seriously defective vehicles, what we call lemons.

Let me get back to the shameful waste of raw materials. Extraction of raw materials, use of rare earth metals, lead soldering, shipping and packaging are just a few examples of the ecological toll imposed by the short lifespan of many modern devices and equipment. Electronics waste is now globally among the fastest-growing types of waste, increasing at a rate of 3% to 4% each year. As the global microchip shortage reveals, ostensibly every industry is now the electronics industry. The failure of one electronic part often renders things inoperative, making them all the more likely to end up in a landfill prematurely.

I strongly recommended to my colleagues on the Standing Committee on Industry and Technology that we study the metals, plastics and electronics recycling ecosystems from a circular economy perspective, because the critical minerals in these electronics are important. We must stop them from ending up in landfills. This study will resume once our consideration of Bill C-27 is complete.

We need to address this shameful waste of resources to reduce our tonne of garbage. Quebeckers have had enough. I urge all parliamentarians to support this bill. By voting in favour of this bill, we are demonstrating our commitment to our local businesses, we are contributing to the fight against waste and we are meeting a fundamental need to repair for all our constituents. By supporting this bill, we are sending a strong, united message about our determination to promote a more sustainable and accessible future for all. This is an opportunity for us, as legislators, to make a positive difference in the lives of our constituents and to work in favour of an economy that is more environmentally friendly.

Let us make sure that the right to repair becomes a reality for everyone.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Thank you, Chair. Yes, I would.

Just by way of background, this is revisiting the discussion we had when the member who brought the bill forward was here. We spent the last parliamentary session trying to modernize a lot of the legislation to make sure we captured the digital changes that have happened.

We updated Bill C-11, Bill C-18 and Bill C-27 to all reflect the digital age. We want to make sure that “digital creations” are included. Then, when we had the language discussion, we agreed that English and French were important but, as has been pointed out, there are indigenous languages that people do creative activities in and there may also be ethnic-specific ones. In order to reflect that diversity and the digital creations, this amendment is to add the following:

filmmaking and digital creations that reflect the diversity of Canada, including with respect to the languages in use and its ethnocultural composition.

That's brought to you by the legislative people who know the legalese terms.

Thank you.

Criminal Code

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Mr. Speaker, Western University's brief has a pretty good outline of what some of the definitions of these are, and I would go back to it, as it has been thought about. I think there are two dozen references of other literature in there that I would draw my colleague's attention to.

I would ask colleagues on the justice committee to intersect with some of the work that is being done on the industry committee regarding Bill C-27, the artificial intelligence and data act, to ensure that our laws are harmonized as we move forward and make sure that is done in a way so women, others, people in public life and children are not victimized.

[The Chair, Liberal, Joël Lightbound]

I call the meeting back to order.

We were on Mr. Perkins' subamendment to Mr. Turnbull's proposal.

However, I would like to start by thanking Mr. Dufresne, Ms. Ives and Mr. Maguire for being here. I apologize for the turn of events. These things happen in parliamentary life. I'm sure we'll have an opportunity to invite you back. Anyway, our study of Bill C‑27 has a long way to go, as you can see. Thank you very much. You're free to go, if you wish.

We can now resume debate on Mr. Perkins' subamendment.

To remind members, it was to modify what has been circulated by Mr. Turnbull and add a deadline that conforms with the original motion that Mr. Vis proposed.

Go ahead, Mr. Perkins.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

If members want to proceed to clause-by-clause consideration of the bill, we will of course pass a motion to that effect. We're ready to do the clause-by-clause study, but we know full well that we won't have heard the necessary testimony.

The usual practice for all House of Commons committees is to receive evidence and use that to inform amendments. The chair has confirmed that no date has yet been set to proceed with clause-by-clause consideration and submit our Bill C‑27 amendments or clauses. When the committee decides to proceed with clause-by-clause consideration, the amendments will be moved. I'm sure the Conservatives will have comments to make and amendments to propose. They've said as much. Mr. Masse, for one, said he was ready to put amendments forward, too. I'm sure the Bloc Québécois will also have amendments to propose to Bill C‑27. It's standard practice for a committee to set a date for submitting amendments.

I don't see what's going on here, other than not wanting to hear from Mr. Dufresne. What's happening here is not contempt of Parliament. It's perfectly normal for a minister to say he's open to amendments and prepared to accept them. Regardless of which parties put them forward, we'll debate them once the committee has decided on a date.

That's all I wanted to say. I'm not a regular member of this committee, but I sit on other committees and I know how things work.

[The Chair, Liberal, Joël Lightbound]

Just to make sure we're all on the same page, we're now debating the subamendment that Mr. Perkins has submitted. I would, however, volunteer a small comment. Based on the text of the motion, it asks for the production of certain documents “within five business days”. We have the PBO on Tuesday, so for the next five business days we're not studying Bill C-27. To me, then, it seems moot to add this subamendment.

If you want to maintain it, we can, but—

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Our parliamentary system is obviously based on trust and respect between parliamentarians, particularly in the context of a minority government. However, I can't consider last Tuesday's exercise to be a model of trust and respect, particularly with regard to these aspects, especially in a context where we're being told about the urgency of passing Bill C‑27 and bringing ourselves in line with European law, specifically with regard to data protection.

This is a bill that was tabled in June 2022, I remind you, that the government only addressed three or four times in the House over one year, last year. We can't claim it's because the legislative agenda was particularly heavy last year.

So I find it worrying that the government is pressuring us and, on top of that, pulling these amendments out of its hat as though they were a done deal upon which we were to rely. If only that were all. We learned through the media—and not through parliamentary collegiality, since the minister was not transparent with his fellow MPs—that there would be a voluntary code of conduct pending legislation. In my opinion, a voluntary code of conduct, given what we are to debate, is the opposite of the highest industry standards. By not announcing this news to his colleagues before it reached the media, the minister has not been transparent.

Of course, in front of industry, it might be a fine show and elicit applause, but the minister is accountable to parliamentarians. I cannot understand why he didn't tell us the day before, on Tuesday. It's another element that adds to the context in which we feel that the bill we will be debating is now obsolete, for obvious reasons. ChatGPT didn't previously exist. Technology has evolved. They talk about fundamental principles, saying that the law they want to replace is over 25 years old, and that Facebook and the iPhone didn't exist back then. Where is Facebook, or Meta, now? These are the people who have taken control of our democracy, who prevent our local media from functioning and who laugh at Canada's Parliament and parliamentarians. They boast about legislation that lasted so long, when it has actually caused major setbacks.

So it seems rather irresponsible to allow things to continue in this manner. We began this study on the wrong footing, and I think there needs to be more transparency and collegiality. Not only will we be asking people for about fifteen meetings to react and draw on their expertise to tell us about the repercussions, but companies also need predictability, and we don't know what we'll be debating.

I therefore urge that we obtain these documents as quickly as possible, and even make them public, because we need to be able to do our job. Right now, however, we're not equipped to do so.

Thank you.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair. I appreciate it. I just want to make sure, because when you're attending virtually, sometimes you don't get seen. I know you're diligent on that.

I support this motion. It's been pretty interesting, what's taken place over the last number of hours. The minister has been actively lobbying me to move this bill as quickly as possible, and I do support that, but I also support a proper process. Mr. Dufresne and his team are very valuable pieces of what needs to be done even outside of Bill C-27, which is updating the Privacy Act in several different ways, and it's the same with the Competition Bureau.

I find it hard to accept that the minister sat across the table from us.... He talked about amendments. Government members even referred to them as amendments. I actually did a point of order, if you remember, Mr. Chair, with regard to whether they were ideas or amendments. We know that right now they're just ideas that were presented in front of the committee, despite having over a year. I'm glad that we had the context of them, and some of the stuff that was floated about is important, but I don't know how it's reasonable to expect people to come in front of us in this speculative process that we have, when the minister says he is actually going to fix his bill, which he already acknowledged is flawed and has errors. We discussed that in the House of Commons and now we have come here. This committee also passed a request to the witnesses coming forward on whether they could bring amendments to us as well so that we could properly vet them and also share them with other presenters so that people could look at those things.

How do you start something so important and so critical with only a speculative process? I know that right now I would have a motion to bring back the Privacy Commissioner's team after we know exactly what is there.

There's also the process of respect that Mr. Perkins mentioned. The minister sat right there, and then the next day went out to the public and provided new information that he didn't provide to us as members of Parliament. He went to basically a public event and disclosed new information that he wasn't willing to provide to his own committee the day before. It's pretty hard to accept that and also to be responsible for one of the most important pieces of legislation.

I would point out that some of the groups coming forth will be from the not-for-profit sector or the private sector. They actually have to use time, resources and in some cases money to draft their amendments into a legal form and context to present them to us. They also sit there, in front of the world, with their reputations on the line over what they present to us, and it's a mockery to them when they don't even know exactly what they're presenting to.

I can't believe that we're proceeding in such a way and that the government doesn't have the amendments to table in front of us so that we can also make sure that they'll be in a context that will be accepted within the bill. I spoke at the last meeting about how the government had amendments to my legislation. The government brought them forth, theminister himself, and then the Liberals not only did that but also ruled them out of order themselves.

We don't know exactly where this is going, but I'd like to have the proper context of how we're going to analyze the bill. I think it's bad, when we have our guests in front of us, that we have to go on the fly about what the minister may or may not have and whether he's serious on all the points that were raised. Are they actually going to be ones that will be collectively put together? I don't know. What's the point of our spending resources, time and energy and then treating our guests so poorly? They have to come here and wing it in terms of what theminister and the government have as legislation.

To wrap up, we know two things. One, there's a high degree of interest in this bill. It's very technical. Part of it is new. The second thing we know is that when we invite people to come in front of us, we know that the bill right now is critically flawed. It's had one debate in the House already, and it's our job to fix it. The minister has indicated that it needs fixing, but we don't know what parts they're supportive of or not supportive of. That's unfortunate. Again, I've been open to trying to move this legislation along as quickly as possible, but I'm not going to be part of a broken process from the very beginning.

That's just unfortunate, because I think we all want to move on this.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you, Mr. Chair.

I'd like to thank the witnesses for being here today.

Mr. Dufresne, I want to thank you for your excellent work, including the 15 key recommendations that you put forward with respect to Bill C-27. For what I am about to do today, I apologize. I know your time is very valuable, but I am about to move a motion with respect to the testimony that was given by the minister at the last meeting. I am doing so because the minister indicated that he would be making amendments to the bill, but he wouldn't provide the committee with those specific amendments.

As such, I am going to move a motion right now, Mr. Chair. I move “That pursuant to Standing Order 108(1), the committee order the Minister of Innovation, Science and Industry and his department to produce the amendments, briefing notes and memos referencing the amendments discussed by the minister in his opening remarks to the committee on September 26, 2023, provided that these documents be provided to the clerk of the committee within five business days.” I believe that was just sent to the clerk to be sent around.

I am tabling that because I believe the minister came forward in good faith with those changes, largely based on the recommendations from our witness here today, and I believe it is in the interest of Canada and all members of this committee to have that information before we proceed accordingly.

Thank you, Mr. Chair.

[Philippe Dufresne, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Good afternoon, Mr. Chair, members of the committee, I am pleased to be here today to assist the committee in its study of Bill C‑27, the Digital Charter Implementation Act, which would enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act.

I am accompanied by Michael Maguire, Director of PIPEDA Investigations, and Lara Ives, Executive Director, Policy, Research & Parliamentary Affairs.

I would like to begin by saying that I welcome the introduction of this bill. I view its introduction as an encouraging sign, as the act must be modernized to face challenges and to seize the opportunities presented by major technological advances, including artificial intelligence.

My office has long advocated for a modernization of both the Personal Information Protection and Electronic Documents Act and the Privacy Act, which applies to the public sector. Canadians expect modern privacy laws that will protect their fundamental right to privacy while supporting the public interest and innovation.

The bill addresses a number of concerns that were previously raised by my office and by others. For example, it requires that information used to obtain consent be in understandable language, it provides my office with order-making powers and it includes an expanded list of contraventions to which administrative monetary penalties may apply in cases of violations.

The introduction of the AIDA, the artificial intelligence and data act, could make Canada one of the first countries to regulate AI, which is important, given the technology's potential risks. Although the AIDA does not specifically address privacy risks, the CPPA, the consumer privacy protection act, would apply to the processing of personal information within AI systems.

Bill C-27 is a step in the right direction, but it can and must go further to protect the fundamental privacy rights of Canadians while supporting the public interest and innovation. I've tabled with the committee our written submission, setting out 15 key recommendations with the changes needed to improve and strengthen Bill C-27.

These are based on the three themes of my vision for privacy, which are, one, that privacy is a fundamental right; two, that privacy supports the public interest and innovation; and three, that privacy is an accelerator of Canadians' trust in their institutions and in their participation as digital citizens.

I will now highlight a few of our recommendations, but would invite committee members to also consult the full submission as well as our 15 recommendations.

Under the theme of privacy as a fundamental right, I recommend strengthening the preamble and purpose clause to explicitly recognize privacy as a fundamental right, and highlight the need to protect children's privacy and the best interest of the child, so that these important principles inform the interpretation of all aspects of the legislation. I understood from the minister's testimony earlier this week that the government agrees with this recommendation, and I'm delighted to hear it.

We also recommend that an organization's purposes for collecting, using or disclosing personal information be specific and explicit, and that penalties be available in cases where the personal information of Canadians is collected, used or disclosed for inappropriate purposes. Given the importance of the rules concerning appropriate purposes, effective remedies should be available to ensure compliance.

Under the theme of privacy in support of the public interest, we recommend that organizations be required to implement privacy by design and that privacy impact assessments be prepared in high-risk cases. This would be an important and necessary protection that would apply to high-impact AI systems. We also recommend that the definition of “de-identified information” be modified to include the risk of re-identification and that the government’s authority to issue certain regulations be more narrowly defined. On this last point, I would note that the bill currently gives the government the unduly broad ability to completely remove activities from the scope of the act and to allow new exceptions to the consent requirement for business activities without having to show that those activities are necessary.

We also recommend that Canadians be given the right to request an explanation when an AI system makes a prediction, recommendation, decision or profiling about them.

Under the theme of privacy as an accelerator of Canadians’ trust, and in order to ensure that most cases can be resolved quickly and without the need for lengthy legal processes, we recommend that my office have more flexibility in negotiating and enforcing compliance agreements and in co-operating and communicating with other regulators. Here again, the minister's testimony earlier this week suggests agreement with these points. It will be important to see the details of those proposals. This is important in many areas, but it will be crucial when dealing with AI and generative AI.

We also recommend that challenges to decisions of the proposed new data protection tribunal be brought directly to the Federal Court of Appeal in order to ensure timely and cost-effective resolutions for all parties. We note that as an alternative solution to achieve these goals, reviews of my office’s decisions could be done by the Federal Court instead of the tribunal.

In the last budget, the government proposed temporary funding for my office of $6 million over two years to undertake more in-depth investigations of privacy breaches and improve response rates to privacy complaints, as well as $15 million over five years—this would be temporary funding—to operationalize new processes required to implement the proposed Consumer Privacy Protection Act. Should Parliament adopt Bill C‑27, it will be essential that my office be properly resourced to fully and effectively take on important new responsibilities, especially those focusing on prevention. Otherwise, these costs will be borne by Canadians and by businesses themselves.

While our recommendations focus on the CPPA, some of them would also be relevant to AIDA. For instance, I note that AIDA provides significant authority to the government to define key aspects of the law by way of regulation. This would include, for example, determining what does and does not constitute justification to an otherwise discriminatory AI decision for the purposes of the definition of biased output. The government could also establish criteria through regulation for the purposes of defining a high-impact system or determining measures with respect to the way that data is anonymized and how that data can then be used and managed.

Given that all of these could potentially have privacy implications, it will be important to ensure that there is a formal mechanism for my office to be consulted in the drafting of these regulations. Our recommendation to allow for greater coordination and collaboration between my office and other regulators would also be essential in dealing with the privacy impacts of AI.

In conclusion, privacy law reform is overdue and must be achieved. Our recommendations aim to ensure that Canadians have privacy laws that recognize their fundamental right to privacy while allowing them to participate fully in the digital economy, support innovation and position Canada as a leader in this important and evolving area.

I note that many stakeholders are also putting forward submissions and I thank the committee in advance for the critical work that it will do in its review of this important bill and in ensuring the protection and promotion of the privacy of Canadians.

Thank you for your time. I would now be happy to answer any questions that you might have.

[The Chair, Liberal, Joël Lightbound]

I call this meeting to order.

Good afternoon, everyone.

Welcome to meeting No. 87 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C‑27, An Act to Enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts.

I'd like to welcome our witnesses today, who honour us with their presence and who are here to answer our questions.

Joining us from the Office of the Privacy Commissioner of Canada is Mr. Philippe Dufresne, Privacy Commissioner of Canada, whom I now welcome. We are also welcoming Ms. Lara Ives, Executive Director, Policy, Research and Parliamentary Affairs Directorate, as well as Michael Maguire, Director, Personal Information Protection and Electronic Documents Act, Compliance Directorate.

We are pleased to have you with us. Thank you for taking the time to appear before the committee. On behalf of our committee, I apologize for the slight delay today.

Without further ado, Mr. Dufresne, you have the floor for your opening remarks.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

This is a friendly motion. Hearing from witnesses today is extremely important in the context of Bill C-27. I would like to move, and hopefully get unanimous consent, that we invite the officials back as soon as possible—at your discretion, Chair—to provide us the time we need to begin examining this bill.

[The Chair, Liberal, Joël Lightbound]

That is indeed the motion you tabled a week ago. There was agreement to work on it with the parliamentary secretary, Mr. Turnbull, among other people. I think that has been done.

Is it the will of the committee to adopt this motion, knowing that we might not begin that study for some time, given the work involved in considering Bill C‑27?

Is there unanimous consent to adopt the motion presented by Mr. Lemire?

(Motion agreed to)

Thank you, colleagues.

We now have only 10 more minutes with officials. It will depend on the committee's will.

You might be reinvited, though I'm sure that comes as no surprise to you, Mr. Schaan.

We'll use the time we have left. I would suggest we split the time to three minutes, three minutes, one and a half and one and a half.

Go ahead, Mr. Vis.

[Mark Schaan]

Very quickly, the tribunal has two functions. One is, upon the recommendation of the Privacy Commissioner, to issue an administrative monetary penalty in relation to the violation of the consumer privacy protection act. The second is to ensure that there's an appeal mechanism for any decisions of the Privacy Commissioner, and it's on the basis of law that the determination would be made, such that there would be a review or an appeal of the decision. That's also reviewable.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

No one was expecting that Bill C‑27 would be passed in its entirety.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Thank you, Mr. Minister.

The part of Bill C‑27 that pertains to artificial intelligence relies a great deal on self-regulation. The bill has been designed so that companies can create codes of conduct to regulate themselves more independently. The government will therefore have to approve codes of conduct that may not be very strong, which is a concern. What accountability will there be? Will there be audits? If so, how will those audits be monitored? I am referring to governance, protecting innovation, transparency, which is essential, and copyright protection.

That leads me to a fundamental question: If there were an abuse or someone had to be reprimanded for violating a person's privacy, who would be held accountable? That isn't clear. Would it be the developer, the seller or even the user? The private sector needs us to get clarification from you on that because it is creating confusion and preventing us from moving forward.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I'll say that Brendan has tried to bigfoot me on that.

Brendan, it's good to see you, sir.

Dear colleagues, I have the honour to present Bill C‑27 to your committee today. I want to stress the importance and urgency of this bill. Let us recall that our laws were last updated more than 20 years ago. The last time we did the necessary work for Canadians was more than 20 years ago, before Facebook, Twitter and iPhones even existed. So you can imagine how important it is to act quickly and decisively.

In my view, we cannot miss out on the opportunity to modernize privacy laws for Canadians, who are waiting for concrete action. I think the bill meets their expectations.

Moreover, technology is evolving quickly, as you know. Since we last met, Canadians have witnessed the advent of various new technologies, such as ChatGPT. We are all grappling with the tremendous power of artificial intelligence, which offers great possibilities, as well as risks, to be honest.

Bill C-27 is Canada's much-needed response to these pressing challenges. It will build a stronger framework for privacy protection, and it will introduce a new framework for the regulation of artificial intelligence, putting into practice the principles of Canada's digital charter.

Bill C‑27 will introduce key reforms to better align our privacy bill with international best practices, including the European Union's general data protection regulation. A large part of that is expanding the powers of the office of the Privacy Commissioner of Canada so it can make orders, require businesses to provide information and recommend some of the strongest sanctions in G7 countries.

It is also urgent to provide guardrails around artificial intelligence technology. AI is advancing at a rapid pace and is quickly being adopted across Canada's economy.

I'm happy to say that tomorrow there's a huge summit that I'll be attending in Montreal. It's the All In summit with Yoshua Bengio. Thousands of people are coming from around the world to listen to Canada and to see what we can do together.

Bill C-27 proposes robust guardrails for the responsible development, deployment and use of AI systems. Part 3 of the bill, the AI and data act, is designed to protect Canadians from the risks associated with AI, to encourage trustworthy innovation and to solidify Canada's place as a global leader in responsible AI.

Canada is one of the first jurisdictions in the world to propose a legal framework for AI. Passing AIDA will make Canada's AI synonymous with safe AI around the world. I can tell you that our Japanese, European Union and American colleagues have all been in touch. They see Canada as taking a leadership role in these regards.

First of all, let me tell you what the future artificial intelligence and data act will not do: it will not duplicate what existing legislation already effectively covers. Nor will it regulate the many creative and useful applications of artificial intelligence that do nor require government intervention, such as checking grammar or deciding what music or movie we might enjoy.

Certain artificial intelligence systems, such as those that determine whether a person gets a loan or a job they want, can nonetheless have real consequences for Canadians families and consumers. In my view, what we are proposing will allow for responsible innovation, along with a certain number of rules to protect Canadians.

There are also new AI technologies, like ChatGPT. I don't need to tell you—you've all seen it in recent months and even yesterday—that they're new innovations and we don't really know everything they're capable of. You don't need to take it from me, but I would advise you to read the letter that was signed by Yoshua Bengio, and hundreds of people from around the world, warning us that we need to take action.

We know that they can do a lot of useful work for us, but they can also be used to spread fake images or videos on a scale that we have never seen before. Our laws are not currently set up to deal with these kinds of risks, but AIDA will fill this gap.

I know all parties care about these issues, and I know this committee can play a vital role in protecting Canadians. Let's ensure that the technology is fair for all Canadians and that we have trust again.

In short, our bill has solid foundations. I should note, however, that I have also listened to suggestions to improve it, as we must always do.

My office and department have had more than 300 meetings with academics, businesses and members of civil society regarding his bill. We have also heard important contributions from the committee and our fellow parliamentarians. I also spoke directly with the Privacy Commissioner and listened to his recommendations. Not only did we consult and listen to him, we also followed through with amendments based on his requests. I think my colleagues will be pleased to see the amendments we are proposing.

Throughout the last 18 months, we have also taken action to advance the foundation for privacy in Canada, including by increasing the funding of the Privacy Commissioner by nearly $20 million. We have also prepared a companion document for the AI and data act to shed more light on the responsible AI framework.

Now, I want to put on the table specifically what our government will propose to improve the bill. These are the amendments that we are proposing to the bill, and I would encourage my colleagues to pay attention, particularly to that part of what I will be saying.

First, we will propose an amendment to recognize a fundamental right to privacy for Canadians. I think this is a big win for Canada. This is a major step forward, and I give credit to my colleagues, to this committee—you said that to me before—and to stakeholders across the country for enabling us to move forward on this.

The bill already recognizes important new privacy rights, including the requirement for clear language from companies to improve consent, and the right to data mobility and the right to request that data be deleted.

Specifically, we want to assure you that Canadians can be confident that their right to privacy will be respected. So I encourage all my colleagues to vote for the amendment. Let us all guarantee Canadians' fundamental right to privacy.

I think this is a major step forward, and I think Canada will be seen as a world leader in doing it.

Next, you have heard me talk about children. I think we need to take care of our children, especially online. I think there is broad consensus on this across the country.

I have two young stepdaughters and this is important to me, as it is to all parents in Canada. That is why our government will put forward amendments to recognize and strengthen the protection of children's right to privacy. In my opinion, we still have to do more to protect them online, and that is certainly what we intend to do.

Lastly, I want to highlight that, while the bill significantly strengthens the Privacy Commissioner's ability to issue orders for compliance as well as to recommend some of the highest penalties in the world, I understand that it's important to enable him to pursue justice more quickly. That's why we will propose amendments to give the commissioner more flexibility to reach compliance agreements with companies that are non-compliant with privacy law, allowing for quick resolution of matters without implicating the tribunal or the courts. That's also something I've heard from colleagues around this table.

Next, we will work together on the first artificial intelligence bill put forward in Canada. When I introduced the bill in June 2022, we deliberately designed a flexible bill, knowing that artificial intelligence is evolving very quickly. It must absolutely provide the basis for flexible regulations in the future that will enable businesses to continue to innovate and, obviously, to protect Canadians.

Our government intends to put forward key amendments to provide more structure, detail and clarity in the part pertaining to artificial intelligence, while still retaining flexibility. This is what has made it possible for the Personal Information Protection and Electronic Documents Act, which is still in force in Canada, to evolve over the decades. Flexibility is key. This is the Canadian model that has provided for success thus far. The good news is that our bill has been designed to be flexible so that new artificial intelligence categories can be added through amendments.

First, colleagues, let me say that I've heard you. Let me remind you that our bill focuses on only high-impact AI systems. We will propose an amendment to define classes of systems that would typically be considered high impact—for example, AI systems that make important decisions about loans or employment.

Second, we will introduce specific and distinct obligations for general-purpose AI systems like ChatGPT. I think it's very timely that we do that. These are systems that, for example, are available for public use, can interpret a wide variety of commands, and generate text, picture and audio.

Third, I've heard that a clearer differentiation of the AI value chain—that is, a person who develops AI systems versus one who manages and deploys AI systems in their business—is necessary to ensure that companies have a clear set of obligations.

Fourth, we will strengthen and clarify the role of the proposed AI and data commissioner, including by enabling them to share information and co-operate with other regulators—for example, the Privacy Commissioner or the competition commissioner.

The fifth one we'll be proposing in terms of amendments that I wish to highlight is to align with the EU AI Act as well as other advanced economies of the OECD by making targeted amendments to key definitions and clarifying requirements. This change will specifically ensure that Canadian AI companies are interoperable with other jurisdictions and that our companies have access to international markets. It is fundamental to the world we live in to be able to be interoperable.

In conclusion, Mr. Chair, I hope these significant proposed amendments are as compelling for you as they are for me. We really put our best foot forward to get the support of the committee to provide a piece of legislation that Canadians can be proud of.

I am optimistic about Canada's potential in the global digital economy. I am keen to work with you to enact responsible privacy and artificial intelligence legislation, because I think Canada can serve as an example to the world. People around the world are watching Canada to see the kind of framework we will adopt to help our businesses innovate responsibly, while protecting the interests of Canadians.

Thank you.

[The Chair, Liberal, Joël Lightbound]

This meeting is called to order.

Welcome to meeting No. 86 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in hybrid format, pursuant to the Standing Orders.

Pursuant to the order of reference of Monday, April 24, 2023, the committee is commencing consideration of Bill C‑27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

I'd like to welcome our witnesses today. With us are the Hon. François‑Philippe Champagne, Minister of Innovation, Science and Industry, accompanied by a regular at this committee, Mark Schaan, Senior Assistant Deputy Minister, Strategy and Innovation Policy Sector, and Samir Chhabra, Director General, Marketplace Framework Policy Branch.

I think I speak for all committee members in saying that we have been eagerly awaiting this study and are very keen to begin it.

Without further delay, I invite you to proceed with your opening remarks, Mr. Minister.

[The Chair, Liberal, Joël Lightbound]

That's fine. Then we can discuss it at the subcommittee. In any case, I think we'll be busy studying Bill C‑27 for the next two months.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

This is a suggestion for the committee. I think we're all assuming that we start Bill C-27 on Tuesday. We obviously haven't gone through or been able to get witnesses yet—I don't believe—for Thursday, so perhaps Thursday might be an opportunity for the PBO or the Privacy Commissioner.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

I'm wondering when the Parliamentary Budget Officer could come and testify. If the study of Bill C‑27 leads us to have several meetings—the list of witnesses is quite long—would it be responsible to invite the Parliamentary Budget Officer much later in the fall or even in the winter? Would that be the responsible thing to do under the circumstances? Since it's just one meeting, we can probably find an opportunity to meet with him sooner.

[The Chair, Liberal, Joël Lightbound]

Before we move to a vote, this is basically to inform the committee of what we want to study as a committee and what we decide we want to pursue, knowing full well that Bill C-27 takes precedence. That's what we're going to be dealing with for the next few weeks.

Do we need to vote on the first motion? I sense that there's consensus on the motion proposed by Mr. Perkins.

Mr. Lemire, you look skeptical.

[The Chair, Liberal, Joël Lightbound]

Just to provide a bit of context on the idea for Thursday's meeting, I'm hopeful that we'll get Bill C-34 done, and we can free our friends who've been with us over many meetings. Thursday would be a steering committee meeting so that we can hash out the plan, in particular with regard to Bill C-27 and how we intend to approach it, and also, perhaps, if we have time, to vote on some of the motions that have been presented and how we intend to deal with them.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

I was wondering whether we're going to have a subcommittee meeting to look at what legislation is going to come forth and so forth. Some of these motions are excellent. Actually, they're all really good motions, and in different ways. I have amendments to them, but at any rate, I'm just wondering whether we're going to have our own planning meeting, because it will be interesting to find out out where Bill C-27 stands as we're working through this.

Obviously, the one by Mr. Perkins with regard to the PBO officer is just one meeting, so that's easy to deal with and dispense with, but the other suggestions are more comprehensive and would require planning.

I'll just throw that out there. Maybe you can share with us how you would like to deal with this or if we are going to go one-off at them at the end of the meeting if there's time, or maybe on Thursday, if we can get through Bill C-34 today or next week.

Canada Business Corporations Act

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, I am happy to talk about the beaches of Bay of Quinte. Sandbanks is the largest freshwater sandbar in all the world. We welcome well over a million visitors a year, and everyone is welcome. Some of us wish we were there today.

The bill deserves the attention that we are trying to give it, as rushed as it is. We need to spend time on a lot of different bills right now. We are dealing with Bill C-34 and are waiting for Bill C-27. The reality is that there is a lot of important legislation that we need to get through, and we need to spend the ample amount of time that these bills deserve to have spent on them. As I have mentioned, we certainly would have liked to see a few more amendments studied. We wanted to see the future of money laundering studied and not just to catch up to today.

There is a lot of great work to happen ahead, and as soon as we are done with the beaches and it gets a little colder, we will see everyone back here in Parliament so we can keep working on behalf of Canadians.

Instruction to the Standing Committee on Industry and Technology

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, it is amazing. I had just finished saying “Bill C-27”, and the member then stood up. Bill C-27 is what the motion is actually all about. The Conservative Party has actually moved a motion to try to get the government to divide Bill C-27 into more bills so Conservatives would have more opportunity to cause more filibustering in order to deprive Canadians of good, sound legislation. That is what the Conservative Party is doing.

What is Bill C-27? It would be an actual modernization. Believe it or not, and I say this for the Conservative colleagues across the way, technology has changed over the last 20 years. A lot of things have happened. Do members know the last time we actually had a modernization of this legislation? We are talking about over two decades ago, when iPhones and Facebook did not exist. One would think that the Conservatives would have, and be able to comprehend, the need to change the legislation. However, there has been no signal whatsoever coming from the opposition benches to recognize the value of modernizing this legislation.

The Conservatives should be concerned about it. Do they know the amount of data that is collected in both government agencies and private companies? People must understand that, through technological change, we have seen the development of huge data banks. Canadians are concerned about privacy. They want to make sure that the information being collected is, in fact, protected. A flash disk can have literally millions of entries, and that can be very damaging to the population. Twenty years ago, we did not have flash disks. We might have had the five-inch round disks; I can remember having those about 20 years ago. I will use Tim Hortons as an example, and I could easily use the example of McDonald's too. We can look at those restaurants' apps. People should open up and find out how many apps are out there. When we download these apps, whether they are for a restaurant or any other sort of service like a retail store, and we start using them, we are providing information. People should take a look at the airline industry, hotels and the many different industries out there that are actually collecting the private information of Canadians.

In the Government of Canada, we recognize that we have a responsibility to look at what is impacting Canadians today, and to bring forward not only budgetary measures, as we have done to protect the backs of Canadians, but also legislative measures. That is what Bill C-27 would do in this particular area; it would ensure that the privacy of Canadians would ultimately be respected and that these huge data banks that are being created would not be abused or exploited at the expense of Canadians.

We have consulted extensively. Through private, government and non-profit organizations, the department has done its job in terms of bringing forward legislation that would, in fact, modernize the industry. Most important from my perspective is that it would protect the interests and the privacy of Canadians.

I want to emphasize, at the end of the day, the amount of change that we have witnessed in 20 years, as I said somewhat lightly a few minutes ago. We should understand that when I was first elected to the Manitoba legislature, the Internet was something which people dialed into. The first thing we heard was the “ching-ching-ching-ching” and then the dial tone coming. Then we had to double-click and we were into the Internet, and, boy, was it slow compared to what happens today.

There were data banks at that time, and there was information being collected. That is why I would suggest that legislation of this nature is indeed warranted and needed. That is why we have standing committees. Earlier today, in the Conservatives' filibuster, they made a mockery of a standing committee and its efforts by moving an amendment even though the report was unanimously supported. They made a mockery of that.

I will suggest to the members who participate in standing committees of Parliament that they can play a very important role in giving strength to legislation and to improving legislation. We have a minister who is following the debate, listening to what members have to say, and looking for ways we can improve and strengthen the legislation in the name of protecting Canadians, the data banks and our privacy rights.

We want to see stability in the industry. Not only do consumers benefit from that stability, but businesses do as well. If we put more stability into place, also factoring in things like AI, it puts Canada in a better position to be able to continue to grow and expand our economy. This is an important aspect of that.

We have a Prime Minister and a government that have consistently said we want an economy that works for all Canadians from coast to coast to coast, urban or rural. The impact of the Internet on rural communities has been significant in terms of economics, not to mention in many other ways. I will focus on the issue of economics.

Retail stores can now be found within our computer, and the actual locations are often in rural communities. It can be a driving force for growth in rural communities. That is why it is important we get it right, that we have the confidence of consumers and Canadians in the information that is being gathered. We have to make sure that information is protected, whether it is names, financial information, health-related information and so much more.

The legislation is good. It is sound. We would like to be able to encourage the Conservatives to see its value. By supporting the legislation, they are supporting Canadians. This legislation is a reflection of what Canadians want to see put into law.

On that point, I know there is legislation the Conservatives say they support. Let us see if we can stop the filibustering here in the chamber so we can pass additional legislation so Canadians will be even better served by the House of Commons.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I always welcome the opportunity to point out the hypocrisy of the Conservatives. Sometimes they just make it too easy.

When I first walked in this morning, honest to God, I really thought we were going to be passing historic legislation. I really thought we were going to be talking about Bill C-22. After all, if anyone went on the Internet and looked at what is happening in Ottawa, what would be debated in the House of Commons, the first thing in government business was Bill C-22.

I am sorry, Bill C-22 is another national program, that is the disability program. We do so much good stuff, there so much out there. We are supposed to be talking about Bill C-35, and it did not take a Conservative to point that out. They kind of get lost in the numbers.

At the end of the day, we were supposed to be talking about Bill C-35 today. It is a national child care plan, from coast to coast to coast, and we are enshrining it into law. We had 20 minutes to go, and then it would go into law.

However, no, the Conservatives had a different agenda. They have a partisan agenda. They have an agenda that says “cause frustration, do not allow legislation to pass.” The previous speaker stood up and said that we needed to have more legislation, referring to Bill C-27. He wants to multiply Bill C-27 into three bills. He wants us to introduce three more pieces of legislation so that the Conservatives have more to filibuster.

The member is criticizing the government, saying that it has been months since we last called this legislation. A lot of issues are happening on the floor of the House of Commons, even with the frustrations caused by the Conservatives, and they cause a lot of frustration. I will give them that much. They know how to play a destructive force. Never before have I seen an opposition, and I was in opposition for 20 years, so focused on playing a destructive force with respect to legislation.

Earlier today, I reminded the opposition that it was a minority government, and I acknowledge that. We accept the fact that we were elected as a minority government, and we thank Canadians for recognizing us and allowing us to continue in government. We take that very seriously. I kind of wish the Conservative Party would recognize that as well.

Do they not realize there is a sense of “responsibility” for opposition members as well. Providing endless filibusters and trying to prevent every piece of legislation from passing is the goal of the Conservative. Just last week, and I referenced it this morning, the Conservative leader made a strong statement, and it made the news. It was on Newswatch in fact, not to mention other news agencies. The Leader of the Conservative Party said that he was going to speak and speak and speak, and he might have said “speak” a few more times, to filibuster our budget implementation bill. Let us think about all the things in that the budget implementation bill, and there is not enough time to elaborate on that. That was his intention. He was going to speak until we changed it, and four hours later it passed.

We have these mechanisms to ensure that at least, even with the destructive force of the Conservative Party, we can still get things done for Canadians.

Let us fast forward things here. The Conservatives did not want to debate the child care bill this morning. Instead, they wanted to talk about an issue that now brings us to Bill C-27—

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Mr. Speaker, I thank the hon. member for his arguments to divide the bill. I particularly dislike Bill C-27 for the artificial intelligence act that is included in it. It essentially would exempt the government from any kind of serious harms and any designated provincial government, while saying to business and innovation that it would hang this threat of a criminal offence over their heads, but not telling them what this means. It is going to push our industry and innovation down to the United States, where there is no legislation.

Does he believe this bill needs to have a full vetting, because generative artificial intelligence can be something that we can innovate in Canada? It is powerful. I would not say dangerous, but this kind of bill would push that activity to areas that are not regulated.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Speaker, I am pleased to rise today to speak to Motion No. 426, which deals with Bill C-27. For those watching who do not know Bill C-27, it is the government's piece of legislation to update our privacy laws and introduce a new act on artificial intelligence.

As to the purpose of this motion, even though the bill went through second reading and is now awaiting study at the industry committee, we are asking that the bill be split in three, because it really is three separate bills. The first bill, as my colleague from Bay of Quinte just mentioned, is the part of the legislation that deals with updating the Privacy Act, including all of the privacy terms for protecting an individual's privacy and protecting the rights of others to use someone's privacy, that is, how they can or cannot use it. The second piece of the legislation would create a new agency called the privacy tribunal. It is really a separate piece of legislation. In fact, it is classified as a separate piece of legislation, an act within this act. Then the third piece is the artificial intelligence and data act.

It really is three pieces of legislation in one bill, and that is why we have moved this motion asking that the bill be split in three. It is a massive 120-page piece of legislative change impacting every person and every business in this country. It deserves to be studied as three separate pieces, and members of the House of Commons deserve to vote separately on those three separate pieces of information.

I will start with the first piece, which is the privacy piece. We talked at second reading about the difference between our views on the purpose of this bill, this act, and the government's views. The government made the claim that this bill was making greater steps toward protecting the personal information of the individual, yet that is not what the bill does.

Clause 5 is the purpose section, the most important section of any bill that sets out what the legal structure or purpose of legislation is. It says that it tries to balance the protection of personal privacy with the rights of businesses to use people's data. It puts business interests on a par with individual privacy interests. As my colleague from Bay of Quinte just said and as I said in my second reading speech, that is a fundamental flaw of this bill. The Privacy Commissioner has already spoken out about it.

There has been discussion about whether privacy is a fundamental human right. There is language on this in the preamble, but the preamble of the bill has virtually no legal impact. It says that privacy is among the fundamental rights people have, but it is not in the purpose section. We have been seeking and will be seeking a broad discussion at committee on that issue and the legal implication of it. The purpose section of the bill, clause 5, should say that the protection of personal privacy is a fundamental right. It is not balanced between business needs and individual needs but is a fundamental right.

That is important not only for the reasons that I just outlined, but because further down, clause 18 of the privacy part of the bill creates a concept called “legitimate interest” for a business. Clause 17, just prior to that, lays out that there has to be the express consent of an individual for a business to use privacy data, but clause 18 goes on to say that there is a legitimate interest for the business to not care about an individual's express consent. In fact, it lets a company say that if something is in its legitimate interest as a company, even if it causes individuals harm, it is okay for it to use their data for something that they did not give permission for. It says that right in the legislation.

This is a fundamental flaw of a bill that pretends to be protecting people's fundamental privacy rights. It in fact protects big corporate data and the right of big corporations to use our data however they wish. It does give additional power, which is needed, to the Privacy Commissioner in that, but the second part of the bill then takes it back with the creation of the privacy tribunal.

Maybe the best explanations of the privacy tribunal is to compare it to and understand the way the Competition Act works. There are two aspects to how we decide competition issues and appeals. One is the Competition Bureau that looks at merges and acquisitions, and it says whether they are anti-competitive or not and will rule on that merger. Then there is a Competition Tribunal, like the privacy tribunal as proposed in the bill, which is the legal framework where the law gets done and the battle gets fought between the company that thinks it should do the merger and the Competition Bureau that thinks it should not.

A classic example recently was the Rogers-Shaw takeover. Quite a bit of time was spent both through the Competition Bureau process and the Competition Tribunal process, which ruled whether that sale could happen and then whether an aspect of that sale, being the sale of Freedom Mobile to Vidéotron, could be done.

The government wants to create that kind of process in the privacy law now. It is a separate act that creates this bureaucracy and this appeal mechanism, where six individuals will decide, as a privacy tribunal, whether a company has breached a person's privacy rights. However, out of the six individuals, only three of them need to any familiarity with privacy law. The others do not need any familiarity with privacy law, no familiarity with business, no familiarity with human rights, nothing. They do not need any other qualifications other than, perhaps in this case, they are a Liberal and are appointed to this board.

I have discussed this with a number of law firms since the bill was tabled a year ago. These law firms have very different views about whether this speeds up or slows down the process of dealing with individual privacy law issues. We need to have a separate study within the committee on that aspect. In fact, I have been talking to the chair of the committee about that structure, trying to get the hearings to be set up in a way that looks at these three pieces separately.

The third piece, which my colleague for Bay of Quinte spoke eloquently about, is on artificial intelligence.

Remember, the first two parts of the bill are essentially a modest rewrite of a bill from the last Parliament, Bill C-11, when the government tried to amend these acts and then complained that the bill did not pass, because it called an early election. The Liberals could not figure out why it did not pass. However, the Liberals reintroduced the bill, but then they bolted on this other thing, which has absolutely nothing to do with the first two parts.

The third part is called the “artificial intelligence act”, but it has nothing to do with the privacy of individuals and it has nothing to do with the appeal of a person's privacy. It is all about how to regulate this new industry, and it gets it wrong. The government is basically saying that its does not know what artificial intelligence is, which is not surprising for the Liberals, but it is going to regulate it. It is going to define it in regulation, and the minister is going to be in charge of defining it. The minister is going to be in charge of setting the rules on whether the law has been breached. The minister is also going to be in charge of fining someone who has breached the law of this thing the government cannot define. It is a total usurping of Parliament. The Liberals are saying that they do not know what it is, but we should trust them, that they will never have to come back to Parliament to deal with this again.

We are asking the House to split the bill into three, because it really is three separate pieces of legislation. The government would have more success in its legislative agenda if it actually brought in these pieces properly, individually, rather than a mini-omnibus bill of different types of issues. Then they could be properly studied, properly amended, properly consulted on and properly dealt with by Parliament. The government is choosing not to do that, which is why it is having such poor legislative success in all of its efforts to date.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, it is an interesting tactic. The Conservatives still do not want to talk about child care. I guess they have an objection to that. I think we could pass this historic legislation in about 25 minutes, but they are having an allergic reaction to yet another national program. It is somewhat unfortunate.

The member wants to talk about AI and splitting a bill that is already in committee. I think the Speaker at one point made a ruling on it, but the Conservatives want to continue to kill time. I understand and appreciate that. This is how they feel they are being a good opposition party, though I might challenge that a bit.

Does the member not recognize the legislation also talks about the protection of data? Data is so critically important. I am wondering to what degree the Conservative Party really recognizes that with technological changes, we need to modernize legislation.

Bill C-27 deals with things like AI and other very important aspects of modernization through technology and data banks. We need to deal with that. When does the member believe the Conservatives will agree to see that sort of legislation pass? Is he and the Conservative regime thinking it should be happening sometime this year possibly, or will they want to continue to filibuster this into the months and years ahead? When would they like to see this type of legislation pass?

[Ryan Williams, Conservative, Bay of Quinte, ON]

moved:

That it be an instruction to the Standing Committee on Industry and Technology that, during its consideration of Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, the committee be granted the power to divide the bill into three pieces of legislation:

(a) Bill C-27A, An Act to enact the Consumer Privacy Protection Act, containing Part 1 and the schedule to section 2;

(b) Bill C-27B, An Act to enact the Personal Information and Data Protection Tribunal Act, containing Part 2; and

(c) Bill C-27C, An Act to enact the Artificial Intelligence and Data Act, containing Part 3.

Mr. Speaker, I am happy to be here today to speak on this motion. I will be splitting my time today with the member for South Shore—St. Margarets.

Bill C-27 is a very important bill. We have talked about privacy legislation now for about eight or nine months. Our whole premise was that privacy always should be a fundamental right of Canadians. We talked about the limitations of this bill when the government announced it. That was missing from the bill. The bill was in three parts. The first part spoke to replacing the “PIP” in “PIPEDA”; the second part was announcing and debating the use of a tribunal; and the third part was about AI. This motion asks to split this bill into three parts so the committee can look at and vote on each part individually.

If we talk about why that is needed at this point, it is very simple. The third part about AI part is the most flawed. When we look at the bill in its entirety and we have gone through debate, we certainly hope to have this bill go to the industry committee. The government delayed sending this to committee, but I am hoping it will be in committee in the early fall, and we want to debate, for the most part, the AI section.

I stand today to shed light on a topic that has captured the imagination of many, and yet poses significant risk to our society: the dangers of artificial intelligence, or AI. While AI has the potential to revolutionize our world, we must also be aware of the dangers it presents and take proactive steps to mitigate them. For decades, AI and the imaginary and real threats it brings has been a subject of fascination in popular culture.

I remember, as a child, watching a movie called WarGames. A teenager wanted to change his grades, he went into a computer to try to do that and the computer offered to play a game of nuclear annihilation. It ended up that the U.S.S.R., through this computer, was about to attack the U.S. NORAD thought it was happening, was ready to strike back and somehow the computer could not figure out what was right or wrong and the only way the student was able to figure it out was to play a game of tic-tac-toe that he found he could never win. At the end, after playing the nuclear game he could never win, he said he would play a nice game of chess because that is easier, someone wins, someone loses and it is safe. This was AI in 1984.

My favourite movie with AI was The Matrix. In The Matrix, humans were batteries in the world, who were taken over and owned by machines until Neo saved them and gave them freedom. Another movie that I remember as a kid was Terminator 2, and we know how that one ended. It was pretty good. We are not sure if it has even ended yet. I think there is another one coming. Arnold Schwarzenegger is still alive.

We find ourselves in a season of alarmism over artificial intelligence, with warnings from experts of the need to prioritize the mitigation of AI risks. One of the greatest concerns around AI is the potential loss of jobs as automation and intelligent machines rise. Has anyone ever heard of the Texas McDonald's that is run entirely without people? It is coming. They have figured out how to use robots and machines to eliminate staff positions.

Even though it is not AI, all of us go to the grocery store now and can check out on our own. When we shop, we see lots of different ways, whether it is Amazon or others, that companies are using AI for robotics. We have heard of dark industrial storage where robots operate in the dark, moving products from exit to entrance, and people are not needed. It is a big problem for job losses.

Another major risk of AI lies in the erosion of privacy and personal data security. As AI becomes more integrated in our lives, it gathers vast amounts of data about individuals, which can be used to manipulate behaviour, target individuals and our children with personalized advertisements, and infringe upon our civil liberties. The first part of Bill C-27 has to do with the third part, but is not the same.

We must establish strong regulations and ethical guidelines to protect our privacy rights and prevent the misuse of personal data. Transparency and accountability should be at the forefront of AI development, ensuring that individuals have control over their own information. Moreover, the rapid advancement of AI brings with it the potential for unintended consequences.

AI systems, while designed to learn and improve, can also develop biases. We saw in the ethics committee, with facial recognition technology, when we had experts come into the committee that, alarmingly, Black females were misidentified 34% of the time by computers. It was called “digital racism”. White males were misidentified only 1% of the time.

Again, this is technology that we have allowed, in some instances, to be used by the RCMP and to be used by the forces. All experts asked for a moratorium on that technology, much the same as we are seeing with AI, because without proper oversight and diverse representation in the development of AI logarithms and algorithms, we risk entrenching society biases within these systems. It is imperative that we prioritize diversity and inclusion in AI development to ensure fairness and to avoid exacerbating existing inequalities.

The security implications of AI cannot be overlooked either. As AI becomes more sophisticated, it could be weaponized or manipulated by malicious actors. Cyber-attacks exploiting AI vulnerabilities could lead to significant disruptions in critical systems, such as health care, transportation and defence. They say the greatest risk of war right now is not by sticks and stones, but by computers and joysticks and that AI could infiltrate our systems.

One thing I was reading about the other week is the risk of a solar storm that could knock out all the technology, but AI and cybersecurity could do the same. Can members imagine what our world would be like if we did not have Internet for a day, weeks or a month? We certainly saw that with the Rogers outage last summer, but we can imagine if it was malicious in intent.

Last, we must address the ethical dilemmas posed by AI. As AI systems become more autonomous, they raise complex questions about accountability and decision-making. We have heard about Tesla having automobiles that have gone off course, and the computer is making the life-or-death decision about where that car is going.

The other day I heard a report about vehicles in L.A. that are autonomous and running by Tesla or by taxi, and that fire trucks and ambulances could not get by the vehicles, because the vehicles were programmed to stop and put their four-way lights on, so these fire trucks could not get past them due to AI decisions. They had to smash the windshields in order to get the vehicles out of the way, and they lost precious minutes getting to the scene of a fire.

While AI holds immense potential to improve our lives, we must remain vigilant to the danger it presents. We cannot afford to turn a blind eye to the risks of job displacement, privacy breaches, bias, security threats or ethical concerns. It is our responsibility to shape the future of AI in a way that benefits all of humanity while mitigating its potential harms. We need to work together to foster a world where AI is harnessed for the greater good, ensuring that progress is made with compassion, fairness and responsible stewardship.

Let us shift for a moment to the positive aspects of AI, and AI actually does exist for good. We have AI working right now with health care diagnostics. Algorithms are being developed to analyze medical images, such as X-rays and MRls, to assist doctors in diagnosing diseases like cancer, enabling earlier detection and improved treatment outcomes.

We have disease prevention and prediction. AI models can analyze large datasets of patient information and genetic data to identify patterns and predict the likelihood of individuals getting certain diseases.

There is environmental conservation. Al-powered systems are being used to monitor and analyze environmental data. I have heard of farmers who are using computer systems to monitor the nitrogen in soil, so they can monitor how much water and how much fertilizer they need to put in the soil, which is saving our environment.

There is disaster response and management. AI is used to analyze social media posts and other data sources during natural disasters to provide real-time information, identify critical needs, and coordinate rescue and relief efforts.

For education and personalized learning, AI is changing the way people are learning right now. The greatest thing we have is ChatGPT, and ChatGPT has revolutionized research. Of course we are looking at the possibility of jobs being lost. It has even helped me with my speech today.

We have a lot of great things that are happening, and in the bill we certainly are going to be looking at how we change and monitor that. The bill should be split into three sections. We need to make sure we look at privacy as a fundamental human right for Bill C-27 as number one; the tribunal is number two; but AI is number three. We need to have as many witnesses as possible to make sure we get it right, and we need to work with our G7 partners to make sure we all look at AI and its benefits, its shortcomings and its benefits to society in Canada and the future.

Canada Business Corporations Act

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, I am thankful for the opportunity to engage in this debate.

The reason I find this so important is that I am from the beautiful province of British Columbia and from the city of Abbotsford, which is nestled between majestic Mount Baker, at 10,500 feet high, and, on the other side, the mighty Fraser River. We live in a wonderful community in a wonderful region of the country. However, one of the challenges we have had over the years is that Canada, and more specifically British Columbia, has become the locus, the very heart, of money laundering in our country.

Just so Canadians understand what money laundering is, I will note that it is not benign activity engaged in by Canadians who want to avoid taxes or something like that. Money laundering is about taking the proceeds of crime, channelling them into what appears to be a legitimate business or a legitimate asset and trying to make those proceeds seem legitimate. It is a great way for criminals to hide the proceeds of crime. The last thing I believe Canadians want to do is aid and abet criminals to commit their crimes in our country, yet that is what has been happening for many years.

This legislation is not the be-all and end-all. Bill C-42 is simply a part of the solution. What it would do is establish a beneficial registry, an ownership registry, that would allow Canadians to see who actually owns the companies into which money might be directed from the proceeds of crime. This is not going to solve the whole problem of money laundering. Our police have their hands full in trying to track these criminals down, trying to identify the proceeds of crime and trying to get convictions.

Here is another problem. Money laundering has contributed significantly to the inflationary impacts on prices of land, real estate and homes that Canadians want to buy. These criminals know that if they can get money channelled into a house, it will be less likely for the police to identify that asset as being a proceed of crime. They also channel these proceeds of crime into legitimate businesses, like small and medium-sized enterprises. They channel this money into hard assets. They may be boats or expensive cars. At the end of the day, this costs Canadians big time.

There is another reason this is important to British Columbians. It was in British Columbia that the Cullen commission was established to investigate this very challenging problem to our criminal justice laws and to the broader issue of how much money laundering costs the average Canadian.

The Cullen commission made a long list of recommendations, most of which implicated the provincial government. It called upon the provincial government to act. However, there was one recommendation that stood out, which was that the federal government establish a pan-Canadian beneficial ownership registry for corporations. I believe Justice Cullen really intended for this to cover all companies in Canada. The problem is that the criminal justice law is federal law, so we as a Parliament have jurisdiction over it. Here is the problem: The large majority of Canadian companies are incorporated not at the federal level but at the provincial level, implicating every one of our 10 provinces and our territories.

How do we cobble together a pan-Canadian foreign ownership registry program with all of these different players at the table? The bill would, at least in the immediate term, establish a corporate beneficial ownership registry for federally incorporated companies, which is a good start. However, I believe the Cullen commission's intent was for the Liberal government to engage the provinces and territories to expand this to include the provincial regimes in federal legislation so that we can go after the money launderers in every corner of our country.

There is a reason this has come to our attention as lawmakers. Back in 2016, the Panama papers exposed how vulnerable Canada was to money laundering. Those papers made it clear that Canada was a laggard on the international stage when it came to addressing money laundering and interdicting the criminals who were taking proceeds of crime, filtering that money through legitimate enterprises and assets and then getting away with their crimes.

In 2017, it was the Liberal government's finance minister, Bill Morneau, who said we needed a beneficial registry to help combat money laundering in our market to determine the true source of funds and ownership in the acquisition of firms. He was right at that time, and that was 2017.

What happened in the intervening years? Nothing. From 2016 to 2023, we had eight years of inaction on the part of the Liberal government. This is pretty shocking, since the government, through its finance minister, at the very least had become aware that this was a very important issue for Canadians and nothing was done.

I will say that I am pleased that at least this has now come before us as Bill C-42, and it looks like we will see a beneficial ownership registry passed and implemented in our country. However, as the bill goes through committee review and comes back to the House, we are going to be asking a lot of questions. For example, how will this registry protect Canadians' privacy rights? We want to interdict criminals as they try to undertake their criminal enterprises, but we also want to make sure that the privacy of Canadians is protected.

I do not have great confidence that the government will actually protect our privacy, and here is why. We recently debated Bill C-27 in the House, which is all about privacy rights. We have been asking the government to actually include privacy as a fundamental right in Canada that Canadians can depend on. Sadly, Bill C-27 did not include that, so we have a right to be concerned.

We also want to ask who will have access to the information in the beneficial registry. Is it the police? Is it the ordinary citizen? It is business people? None of that is clarified in this legislation. We need to know that. Will the bill give law enforcement the necessary tools to combat money laundering and terrorist financing?

To conclude, I believe there is all-party agreement, so I am asking for unanimous consent to request a recorded vote on Bill C-42.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you.

Mr. Fay, you talk about data a lot. It's very important. We've been dealing with Bill C-27 as well and some other bills. It's good timing that they're all being talked about at the same time.

Let's include intangible assets and IP with data. What recommendations can you make for Bill C-34 that would review and protect those assets in Canada?

[Richard Cannings, NDP, South Okanagan—West Kootenay, BC]

Thank you.

I'm going to turn to Ms. Greenwood to follow up on Ms. Rempel Garner's line of questioning on big data companies, AI, etc.

First, I would make the comment that some of those hard questions being asked of the big digital companies were around getting them to pay for content and to pay their taxes, just like we ask Canadian companies to do, so it was more on that fairness aspect.

That aside, on this idea that we have to move faster than the speed of government here, we have Bill C-27, which probably won't get to committee before the fall, so that's going to be moving slowly. We have a subject like AI, which is developing very quickly and a lot faster than people imagine, probably, yet it will transform our world.

How do we do that faster than the speed of government and do it with the care that it deserves?

[Philippe Dufresne]

Our current funding is $30 million, so it would be half of that. We have specific requests for potential Bill C-27 responsibilities in terms of additional guidance and additional investigation responsibilities.

[Philippe Dufresne]

I think we're very focused on protecting children and how we use their personal information. Children are exposed more and more, obviously, to the digital world in everything they do, whether it's in school or socializing with their friends. We need to look at it. Our laws need to be updated to reflect this reality.

One of my recommendations on Bill C-27 in the report has to do with the protection of children and ensuring we're treating children's personal information in the best interest of the child, looking at what they are exposed to and the information they share and making sure they're aware and have a good understanding of what's going on and the long-term implications of it.

In many respects, sometimes they're exposed to things and face implications that they're not equipped to understand. We're treating them like adults, to some extent. We have to make sure they have the appropriate protection in terms of their information and their participation in the digital world.

[The Chair, Conservative, John Brassard]

Yes, I checked with the clerk, and we didn't receive it. There may be portions of Bill C-27 this committee will have to deal with, so could I suggest that you share that letter with this committee as well? Is that possible?

[The Chair, Conservative, John Brassard]

Thank you, Mr. Villemure.

Mr. Dufresne, I have to clarify something. When Mr. Villemure was asking questions about Bill C-27, you said that you sent the letter to the ethics committee. Is it possible you sent it to the industry committee?

[Philippe Dufresne]

We received additional financial support in the last budget in connection with Bill C-27 so that we can do the work to prepare for the coming into force of this bill, if Parliament decides to pass it. That is a good thing, as I mentioned.

If this bill is passed as it now stands, we expect my office to have additional responsibilities, for example, the authority to make orders and to recommend financial penalties. What is more, there will be more stringent requirements for the complaints process and we will be responsible for reviewing the organizations' codes of practice. Those are all positive things that will expand our role. That being said, we have determined that we will need additional resources to do our work properly.

[René Villemure, Bloc, Trois-Rivières, QC]

Okay. Thank you. That was just a joke.

This morning, the committee is studying the estimates. Bill C-27, which we are going to study a bit later, raises a lot of issues in terms of artificial intelligence, obviously, but also in terms of privacy. Does your office have the means to protect privacy in light of the new requirements set out in Bill C-27?

[Philippe Dufresne]

I am focusing on my jurisdiction as Privacy Commissioner. We concluded that we need to determine whether we are adequately protecting the personal information of Canadians and young people. When the investigation is over, we will make it public and, if necessary, make recommendations. Some of these recommendations might call on parliamentarians if we determine that there are gaps in the legislation.

We make all sorts of recommendations. We can make some for businesses and also in the context of bills, such as Bill C‑27. If it is a matter of privacy, it is part of our mandate and we will continue to focus on that.

[Philippe Dufresne, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Good morning, Mr. Chair and committee members.

I am pleased to be here today with my colleague Caroline Maynard, Information Commissioner of Canada, to discuss the main estimates for the Office of the Privacy Commissioner of Canada for the fiscal year 2023-24.

As Privacy Commissioner of Canada, I am responsible for protecting and promoting the privacy rights of Canadians in the public and private sectors. In my last annual report, tabled in Parliament in September 2022, I point out that this is a pivotal time for privacy in Canada, and I highlight the important work of my office in this regard.

My office investigates complaints and breaches that have meaningful impacts for Canadians and privacy in Canada. For example, earlier this year, we released the results of our investigation into Home Depot's sharing of personal information with Facebook when their customers opted for an electronic receipt at checkout.

We found this practice to be a breach of privacy law, in part because we concluded that it was unlikely that Home Depot customers would have expected that their personal information would be shared with a third party like Facebook simply because they opted for an email receipt instead of a printed one.

Since issuing our findings, my office has learned of several other retailers allegedly engaging in similar practices. We have reached out to those organizations and are in the process of confirming how they are complying with the expectations flowing from our investigation.

Looking ahead, my office recently announced investigations into TikTok that focus on its privacy practices as they relate to younger users, as well as the company behind the artificial intelligence-powered ChatGPT. Children are less able to understand and appreciate the long-term implications of consenting to their data collection and need even greater privacy safeguards. We can and must do more to protect their privacy. This will be one of my key priorities in the years ahead.

My office also needs to stay ahead of fast-moving technological advances. We need to monitor and research technology so that we can anticipate how it may impact privacy and so that we can promote the technologies that most enhance privacy. This is another of my key focus areas.

My office provides advice to government departments and private sector organizations, publishes reports on compliance with privacy laws, and raises public awareness about privacy issues. In this digital age, the world is at our fingertips, and the price of that convenience is often the disclosure of personal information. That is why it is so important for Canadians to be aware of their right to privacy, to be able to control when and how their personal information is collected, used and disclosed, and to know where to turn for help when they need it.

We also provide advice and recommendations to Parliament on legislative reform and on privacy issues of considerable interest and importance to the public. On that note, I would like to thank the committee for the reports it published following studies on the device investigation tools used by the Royal Canadian Mounted Police and on the use of facial recognition technology.

As I noted in my statements following the release of those reports last year, I welcome the committee's recommendations to improve privacy protections, to ensure that the law recognizes privacy rights as a fundamental right and requires federal institutions to consider and address the impact on privacy from the outset when designing and using new technologies, and to adequately regulate technologies that have an impact on privacy.

My office has an initial operating budget of $29.5 million for 2023-24. We manage these resources optimally to protect and promote the privacy rights of Canadians as effectively as possible.

We are also looking ahead and preparing for law reform. The government took an important step toward modernizing the private sector privacy law with the tabling of Bill C-27, which has been referred to the Standing Committee on Industry and Technology for further study. My written submissions and recommendations to the INDU committee were made public by the committee earlier this week. I'm looking forward to appearing before the committee to discuss this important bill.

I was pleased to learn that in the recent budget, the government proposed temporary funding of $6 million over two years for my office to undertake more in-depth investigations of privacy breaches and to improve response rates to privacy complaints, as well as $15 million over five years to operationalize new processes required to implement the proposed consumer privacy protection act. Should Parliament adopt Bill C-27, it will be essential that my office be properly resourced to fully and effectively take on important new responsibilities, especially those focusing on prevention.

Canadians are more concerned than ever about protecting their privacy. That is why the work of my office is so important.

I look forward to your questions.

Reference to Standing Committee on Procedure and House Affairs

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I would like to begin by saying that I will be sharing my time with the hon. member for Lac-Saint-Jean.

Like my colleagues, I rise today to speak about China's interference in political and public affairs and the breach of privilege of a member of this House. Obviously, it is one member, but all of us are under attack in this situation.

I will try to make this quick because I understand that people are waiting to hear from my colleague from Lac-Saint-Jean, whose expertise is in great demand. I think that there are some things that need to be said.

As we know, for several years now, a number of expert reports have highlighted China's actions, going so far as to accuse it of interfering in the political affairs of several countries, including our own. There have been reports of cyber-attacks on Canadian government institutions, businesses and universities, as well as other suspicious activities, such as manipulating social media and disseminating disinformation.

There are Chinese police stations that are operating while the Prime Minister looks on. There have been debates in the House on the active participation of Chinese government agents in the federal election and the controversial $200,000 donation to the Trudeau Foundation, which raises many questions about how much the Prime Minister knew about these matters.

These activities are extremely disturbing and raise questions about the integrity of our democracy and our electoral processes. We cannot allow foreign powers, no matter how big or how influential, to interfere in our political affairs and disrupt our democratic process. The Liberal government has gone from being disconcertingly naive about the Chinese Communist regime to inexplicably inactive in the face of China's repeated attacks on our democracy.

The straw that broke the camel's back was The Globe and Mail article about a CSIS report from 2021 stating that the member for Wellington—Halton Hills and his family in Hong Kong were being threatened by a Chinese diplomat who was still in Canada. The member for Wellington—Halton Hills had just voted in favour of a motion condemning the genocide of the Uyghurs by the Communist Party of China.

These are all very serious allegations involving troubling information that could have a potential impact on our parliamentary duties. The Speaker's ruling on this matter is exemplary, and I agree with the conclusion that an entity like China intervening with retaliatory measures against an MP and his or her family represents an attack on our collective ability to carry out our parliamentary duties unimpeded.

That is simply unacceptable and must be condemned in the strongest possible terms. It is our duty to protect our democracy and defend our colleagues' privileges. We must work together to strengthen our national security and protect our democratic institutions from outside threats. We must also support our colleagues and give them the means to fulfill their democratic mandate without fear or intimidation.

The Bloc Québécois will vote in favour of this motion because it has already debated these issues favourably in the public arena. First, when it comes to the foreign agent registry, I will not list all of the opportunities that the government has had for serious reflection since the member for Wellington—Halton Hills moved a motion in 2020 concerning Huawei's involvement in Canada's 5G network. Obviously, time has proven him right.

The Bloc Québécois has expressed its support for an independent public commission of inquiry into foreign election interference. That position is shared by other opposition parties that think that the recent leaks about China's attempts to interfere in our elections require an independent public inquiry.

Former chief electoral officer Jean-Pierre Kingsley has expressed his support for such an inquiry. According to him, Canadians have the right to know everything about what happened, and the lack of a public inquiry will only prolong the consequences for those who were affected. Kingsley also rejected the argument that a public inquiry could compromise public safety. He stated that public safety is there to protect democracy, not the other way around.

The government has sought to put off a public inquiry for a long time citing public security concerns. However, that has not prevented many people, including the former director of CSIS, Richard Fadden, from joining in the call for a public inquiry.

Overall, it is clear that the calls for a public inquiry into foreign interference in elections are growing stronger. Canadians have the right to know if their democratic process is under threat from foreign actors and what steps their government is taking to protect democracy and the interests of their country.

Can we get the truth on the closure of the covert police stations in Canada and on the threats against people who return to China or who have family in China?

This is not the first report we have heard about persecution and repression of certain people who criticized the Chinese government or who were considered dissidents.

The Chinese government also brought in a social credit system that can affect people's ability to travel, find work and access certain services based on their behaviour and their political leanings. It is important to note that these operations are often carried out covertly and the information is often difficult to verify. However, there is enough evidence to suggest that these threats exist and that governments and citizens should be aware of these risks.

The government's attempts to lower the temperature and stonewall are eroding our confidence in it. Its handling of the expulsion of Chinese diplomat Zhao Wei has been embarrassing.

We must be proactive. We must take steps to strengthen our national security, and we must shield ourselves from foreign attacks. We must also continue to strengthen our ability to identify, report, monitor and counter cyber-attacks. They can be extremely difficult to detect and thwart, but we must be ready to face these threats and to protect our institutions against malicious attacks.

The case of the member for Wellington—Halton Hills raises a bigger problem in a world that is becoming more complex. With the growth of social networks, it is getting easier and easier for malicious people to target and harass elected officials, journalists and other public figures. The threats and attacks can be deeply disturbing and have real consequences for the safety of the individuals concerned. This is our cue to rethink our society and even our use of social media.

Increasingly, we tolerate threats because they are just threats. If we do not tolerate threats towards our colleague, we should not tolerate the threats we are subjected to on social media, either.

Our world is entering a new era. China may be using an old way of doing things right now, but new ways of influencing our elected officials will be found. They will become increasingly insidious. Our lives are showcased on social media. Hackers are finding new ways to go even further in getting data.

Just imagine. A fraudster can practically create a new identity for themselves using data leaked from a bank or government. If a member of Parliament is targeted, what impact will that fake identity have? How will a new power be able to influence elected officials?

I serve on the Standing Committee on Industry and Technology, and these are issues that must be discussed during our study of Bill C-27. We need to ask ourselves whether the government has really made all of the connections that need to be made between all of the laws in order to strengthen the protection of Quebeckers and Canadians.

When it comes to protecting ourselves from China, there is also the Investment Canada Act, which may not go far enough in protecting our vital areas, our supply chains. These are things that I have a lot of questions about.

With the arrival of even more powerful technologies, such as quantum computing, we know that a lot of our data is stored on servers and that China will not hesitate to check that data and use it against us, of course.

Consequently, and in conclusion, we have to equip ourselves with all the tools available to fight foreign interference. That starts with solidarity with the member for Wellington—Halton Hills.

An Act Respecting Regulatory Modernization

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, one thing that stood out from my colleague's speech was the part specifically related to Bill C-27 and the importance of regulating artificial intelligence.

He mentioned the great work done by the member for Windsor West. Perhaps that member's most concrete contribution to this issue so far was to divide the debate, until the NDP eventually asked for two votes on the same issue, which meant that we arrived 15 minutes late in committee. I will spare my colleagues all the details.

Nevertheless, considering that this bill should have been passed in 2018-19, we get the sense that some members have tried to delay and stall. Could the NDP not be part of the solution to speed things up with the government, especially when it comes to paperwork done by our administrators and agricultural producers?

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Gaheer.

If there are no other questions, that concludes our two hours of committee work for today.

Before we adjourn, I want to thank our witnesses. It's been very interesting. I speak on behalf of all members when I say that was an enlightening conversation. We appreciate your taking the time, and for some of you, it was at the very last minute. We appreciate your presence here this afternoon.

Before we adjourn, though, members, we have budgets to adopt.

You have received the relevant material from the clerk.

I therefore move the adoption of the budgets for the consideration of Bills C‑34 and C‑27. Is there unanimous consent to adopt these budgets?

[Dr. Patrick Leblond]

Yes. In a way, if the idea is that we can ask for commitments to reduce the risks to national security, then the question is how we make sure the foreign investor is actually going to respect those commitments.

To me, a half-million dollar fine—one shot—doesn't do it. Compare that with Bill C-27, where, if you don't protect personal data, you could actually be fined at a minimum of $25 million. Is our personal data so much more important than national security? I would argue not. They should at least be equal, so I'm surprised that this same formula doesn't apply here.

Now, that's one thing. Here's another. Let's say that a company makes billions of dollars from these assets, these important assets or technical information. Even $25 million is nothing. Does the minister then have the ability to impose further sanctions or to say, “No. You actually have to divest now. I'm sorry. We gave you x number of warnings. You can't do it.”

I think the law should be much stronger in terms of holding foreign investors to the commitments that we require of them in the first place.

[Dr. Patrick Leblond, Associate Professor, Graduate School of Public and International Affairs, Faculty of Social Sciences, University of Ottawa, As an Individual]

Thank you, Mr. Chair.

Good afternoon, members of the committee. Thank you for the invitation to discuss Bill C‑34 with you. I will be giving my presentation in French.

However, please feel free to ask questions in English afterwards.

To begin, I would like to discuss three important aspects of the bill: the nature of an investment that threatens Canada's national security, sanctions for failure to comply with undertakings given by a non-Canadian investor, and transparency.

I will start with the nature of an investment that threatens Canada's national security. Subclause 2(1) of the bill, which amends section 11 of the Act by adding a paragraph (c), refers to “an entity carrying on all or any part of its operations in Canada and that has a place of operations in Canada ... or assets in Canada used in carrying on the entity’s operations.” The bill uses the expressions “material assets” and “material non-public technical information.”

What I wonder about is this: what happens if that non-Canadian investor acquires those material assets or that material technical information directly, without acquiring the entity in question that owns the assets or information? For example, what if the investor buys a bank of personal data about Canadians or the source code of the algorithm for an application associated with critical infrastructure? Is the investor required to give a notice in accordance with the procedure proposed in the bill? Is the acquisition covered by the bill?

If the answer is no, there is a risk that an investor that wishes to use the assets or technical information for legitimate commercial purposes will decide, instead, to acquire them directly from the Canadian entity that owns them, rather than acquire the entity itself and risk having the acquisition blocked by the minister for national security reasons. The same reasoning applies to the owners of a Canadian entity who wish to maximize the value of their assets and technical information: they could put the assets or information up for sale, rather than the entity itself.

In that scenario, the threat to national security is still present. If the Investment Canada Act does not apply to a scenario in which the assets or technical information itself is purchased, and not the entity, such as a business, the acquisition of assets or information needs to be covered by another act or acts. What act or acts would that be? To my knowledge, there are none.

That is the first thing I wonder about regarding the bill, given the intangible nature of some assets, whether they are data or technical information. It is therefore easy to acquire them without necessarily acquiring the business that owns them.

I will now move on to the sanctions for non-compliance with undertakings given by a non-Canadian investor. The bill provides that the minister may approve an investment if the non-Canadian investor gives certain undertakings to limit or reduce the risks of injury to national security. What happens if the investor does not honour their undertakings?

The bill provides a maximum penalty of $500,000. If that penalty applies only once, it seems to me to be very little. We need only think of the millions in profit that material assets or technical information can generate. Is a single penalty of $500,000—because the bill does not provide that it be every day or every year—therefore sufficient to encourage, if not compel, a non-Canadian investor to honour their undertakings? At that point, is it not really just an operating cost?

I wonder why a higher penalty is not being considered, such as the one provided in Bill C‑27? That bill talks about a penalty of the higher of 5% of global revenue and $25 million. Why does Bill C‑34 talk only about a penalty of $500,000? On the one hand, personal information is considered to be so important that the penalty can be millions of dollars and possibly as much as 5% of global revenue. On the other hand, however, when we are talking about national security in connection with what may be the same data, the economic sanction is a mere half million dollars. Does this mean that threats to national security are less important? That is my question to you.

In addition, what is to be done if the investor pays the penalty and continues not honouring their undertakings? Does the minister have the power to stop the investment? Although I am not a lawyer, my reading of the act and the bill suggest to me that the minister does not seem to have that power, unlike in the United States, where it is possible to stop an investment retroactively. Would that be the case here? That is what I wonder when I read the bill.

On the subject of transparency, the bill could increase uncertainty on the part of non-Canadian investors who want to invest in Canada and also Canadians who want to sell all or part of their businesses to non-Canadians or obtain financing from non-Canadians. There is therefore a risk that businesses that have or believe they have material assets or material non-public technical information may decide to move their decision-making centre or headquarters out of the country, to the United States in particular.

The greater the uncertainty regarding the application of the act, the higher the risk of a move happening will be. To reduce the uncertainty, there therefore has to be a degree of transparency in the minister's decisions and the undertakings given by non-Canadian investors, without that necessarily meaning that state secrets or trade secrets would be disclosed. Even if the decisions are made on a case by case basis, there have to be clear guidelines, and those guidelines have to be observed. Simply providing a list of material assets or material technical information does not seem to be adequate.

I will stop there. Thank you.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

For the Diefenbaker government, I was not there. I never met John Diefenbaker, but I knew his executive assistant. MP Maguire met John Diefenbaker.

He was first elected prime minister in 1957 in a minority, but he had an overwhelming, smashing victory in 1958, winning many seats. He was only to be surpassed in the number of seats by Brian Mulroney's victory in 1984.

Apparently, in 1958, with the election of the Diefenbaker government:

...greater use was made of standing committees; for the first time, a member of the official opposition was chosen to chair the Public Accounts Committee—

Imagine that. The Conservative government of John Diefenbaker expanded the roles of committees and said examining the spending of government accounts by the public accounts committee is not something that should be chaired by a government member. They, in government, said, “We should have an opposition member chair the public accounts committee.”

Is that a dedication to ministerial accountability? That's a belief in our parliamentary system like we don't see these days.

Again, I will read it, “for the first time, a member of the official opposition was chosen to chair the Public Accounts committee and the Committee began to hold regular meetings”. That's a good concept.

In 1968 there were more significant reforms made to House procedures, including the following—and remember, I don't know what time of the year it was in 1968 that it happened. It could have been under Prime Minister Pearson, or it could have been under newly elected Prime Minister Trudeau, who was fresh faced, and there was Trudeaumania. If it was under him, with all the world before him to change the world and use government for good with an unusual respect for Parliament for the Liberals, in 1968 they made a series of significant reforms to House procedures, including the following three key changes.

The estimates were no longer considered by a committee of the whole of the House but were sent to standing committees. That was a good reform. It gave those expert committees the ability to scrutinize the spending of the departments that the minister is responsible for, i.e. the Fisheries minister in the fisheries committee or the Industry minister in the industry committee.

The second significant reform, according to Treasury Board, that was made in 1968 was that the opposition was given a total of 25 days when it could choose a topic of a debate. Those are colloquially called opposition days, when we get to propose a motion for the House to debate and move and, for the general part in this government, for the government to ignore the vote or, in some cases, vote against it, as they did recently on several opposition days. We were thankful that they voted to send China interference, which the government has been aware of for two years, I believe, yesterday, to the procedure and House committee. Thanks to some of these reforms, those things can happen.

The third thing was that most bills were referred to standing committees. I was talking with MP Blaikie the other day about bills going to standing committees, and talking about the time.... Again I'm going to give a story. There is a standing order that is still on the books today, little used, that committees could be freed up from the arduous work of dealing with legislation, which can throw off the important subject studies that standing committees do. For example, we now have three government bills before the industry committee, which has stopped, halted, right in the middle of the important study we were doing on a Bloc motion to have the electronics and recycling ecosystem studied by the industry committee to understand all types of things. That has been stopped because we now have three bills, Bill C-27 on privacy, Bill C-34, changes to the Investment Canada Act, which I'm sure all members here are very interested in, and Bill C-42, a bill to create, finally, a beneficial corporate ownership registry.

There is a standing order that still exists today that says you can refer bills to legislative committees. These are special committees that get set up for each bill. They exist for a bill, then disappear.

During the days when I was a young legislative assistant to a minister, that's where all bills went. They didn't go to standing committees, except for the budget. They didn't go to standing committees; they went to specially constituted legislative committees that would be set up, for example, to deal with Bill C-21, which changed the Firearms Act. It wouldn't go to security, SECU, as we call it. It would go to a special committee of MPs set up from all parties, and it would have its own budgets, its own clerks and its own travel budgets and then, when the bill was reported back to the House with or without amendments, that legislative committee would disappear.

For example, Mr. Chair, look at the biography of a former chair of this committee whom I knew well, Don Blenkarn, an irascible fellow from Mississauga who was elected and chaired this committee, I believe, for six years during the Mulroney government. He wasn't always a person who followed the government rules, I can tell you, much to the chagrin of then finance minister, Michael Wilson. When you look up his bio, you will see legislative committee after legislative committee after legislative committee listed by bill, because when a finance bill came out of second reading in the House, the legislative committee would set up, and Don Blenkarn would always be one who wanted to be on those bills to examine them.

While this reform in 1968 referred it to standing committees, I know personally that there were further reforms to the Standing Orders to allow for more flexibility. It is something we should use a little more today, those legislative committees, but, like I've said before, I've gone a little off topic from this, but I still think it's about how we hold ministers to account in Parliament.

There are different ways to do it under the Standing Orders, and some are effective, but the key part of it, whether it's a standing committee, a legislative committee, public accounts, the finance committee or two of my favourites, industry and fisheries, is that ministers come because it's a courtesy on both sides.

It's a courtesy to ask the minister to come and explain why this is such a great legislative initiative, but it's also generally polite—like when you get a dinner invitation to somebody's house—to go. I won't say to you, Mr. Chair, since I expect I will get an invitation to dinner with you sometime, “Well, I can only go for half an hour.” I know you want to talk to me about the insights I've provided the committee on ministerial accountability for more than that over dinner and maybe a few glasses of wine.

[Jim Balsillie]

I think you need both. The expertise is a needed piece, but I think you need to pair it with the kind of agency that would look at this and feed into any kinds of decisions.

It has to be pulled out and dealt with as its own being, and you need to have expert analysis for all of these crosscutting files. I've mentioned many of them before. The intangibles economy works on legal frameworks, and it's a hands-on economy as opposed to a neo-liberal, hands-off, tangible production economy, so it's a completely different tool kit. I think we have to build the capacity broadly, narrowly and specifically, and we have to create the kind of legislative and agency powers to deal with this.

Yes, if you build this capacity so that wherever this resides in the government, it has to reference it, that's a step forward. If you expand the scope of this to deal with the broader kinds of places that I've mentioned, including having the reverse ability of partnerships, that's great, too, but I've seen so many things like ISED's financing Huawei through granting agencies. People adored Sidewalk Toronto. They let the Tesla battery technology go. Money goes to Invest in Canada to say, “Come take our best stuff,” so this whole system makes me very, very nervous. We have to break with the past.

Whether it's within ISED or outside of ISED, that's an important question, but I've seen the quality of Bill C-27, and it's so foundationally flawed that it doesn't give me confidence.

[Jim Balsillie]

Yes, a hundred per cent the government can keep up. You have to focus on it deliberately.

I've spent the better part of a year working on predecessors—Bill C-11 and Bill C-27. On the Centre for Digital Rights website, we have a 50-page set of proposed amendments to it.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Right. You alluded throughout our testimony today—I'll ask Mr. Ciuriak to comment in a second—to the fact that we're at a tipping point in Canada in dealing with some of these digital challenges in respect to intellectual property, Canadian sovereignty and national security.

Are there any proposed amendments—maybe you can get back to the committee a little later—that in any way can address this in the context of Bill C-27, which touches upon many of these points, too?

You mentioned that there is a capacity and context issue with the Government of Canada in this department. Can government ever really keep up with the technology that's being developed and implemented so quickly today?

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

I ask that question in the context of the points raised about the digital economy and what this committee will be dealing with as well in respect to C-27.

Mr. Balsillie, you caught my attention, and I was texting with my wife during this committee about what we were talking about. The other day I came home, and my son had asked for a Paw Patrol app to be downloaded on our iPad. I don't know the origins of this application or which company owns it, but in my mind it almost seems that a foreign company is operating in Canada. They're investing in Canadian users. They're extracting information from children as young as two years old. They're using that for monetary purposes, but it wouldn't be covered under the Investment Canada Act. As Ms. Walker said, it would also likely not be covered under another law in Canada, even though it is a form of investment to extract information and therefore wealth from Canadians of all ages.

Would you agree with that type of assessment?

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

I think this is an interesting time right now. I know Mr. Balsillie, for one, was just at our science and technology committee. We were talking about IP commercialization, owning more of what we create, and at this point we are also trying to make sure we protect what we create.

I really want to zero in on some recommendations you've given the committee. I can't agree more that economic and security risks should not be analyzed separately. Certainly we need strategic technologies and critical technologies lists like the U.S. has. I think your last recommendation was to create a CFIUS, the committee on foreign investment that the U.S. has. We have an investment review division under ISED right now. I think one of the differences I've seen is that CFIUS is an inner agency, so it seems to work across many different...I guess here it would be ministries, and the U.S. seems to get that. We seem to have it only under ISED.

To the point I wanted to zero in on earlier, we're not talking about intangible assets. We're certainly not talking about data and IP, and protecting that. Again, AI, as we're going to be studying with Bill C-27, is just incredibly powerful right now. We don't know what that's going to do to IP and data.

This is just a question of whether we should be looking at maybe a recommendation to give more power to the investment review division under ISED, and maybe looking at multi-ministry...? Also, how do we handle the AI component, let alone just IP and data itself?

Bill C-47—Time Allocation Motion

[Tom Kmiec, Conservative, Calgary Shepard, AB]

Mr. Speaker, the government is now moving to guillotine debate on its own budget bill, and there is really no reason to do it. The Standing Committee on Finance is already considering the budget bill at committee and has been for many days.

The only reason to do this is to completely shut down debate on a bill that many members, both in the Conservative Party and I am sure other political parties, want to debate to bring forward issues of concern from their ridings. I know people in my riding are extremely concerned about the cost of living crisis that this inflationary budget will only make worse as the government pours more gasoline on to the inflation fire. The Liberals have no plan whatsoever to actually balance a budget in any future budget year that is available in the document right now.

There was no reason to do this; the finance committee is already seized with the matter. It is already considering Bill C-47. The only reason to do this is to slam shut debate in the House of commons once again.

I will remind members that this government passed only one government bill to the next stage last week, Bill C-27. There were more private members' bills passed last week, and I am sure it will happen this week. This government has completely mismanaged the clock. It even has evening sittings and cannot pass government legislation on time.

[Todd Bailey]

Canada is not by itself in the world. It has to deal with other parties out there. Across the pond, you have Europe, which takes a very heavy approach to regulation. They're usually leading the pack, and they have been on AI as well. To the south, we have a country, the United States, the does not do a lot of regulation. As a country, Canada wants to do business in both jurisdictions, so we have to walk a line.

I have not been involved in any of the consultations relating to this. It is just sort of my perspective. We have to walk a line. This is what I see in Bill C-27, part 3, the AI and data act part. It is trying to create a framework that will be helpful for Canadian companies that want to go do business in Europe. It also does not want to discourage our interactions with the United States in terms of AI. We have to accept that the big players in all digital spaces are mostly American companies, and we don't want to cut ourselves off from that.

[Stéphane Lauzon, Liberal, Argenteuil—La Petite-Nation, QC]

Thank you, Mr. Chair.

Mr. Bailey, Professor Yoshua Bengio is an international authority on artificial intelligence based in Montreal. On April 15, he told us clearly that it is very important to act now on Bill C‑27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

We are establishing international leadership through Bill C‑27. Do you believe this leadership will inspire the United States to address matters the same way we are, since it does not have such legislation?

[Todd Bailey]

It's a great question.

As you may know—and I'm sure you do—a lot of the interesting stuff on Bill C-27 is still to come. It will be in the regulations. The act itself sets out the regulation of so-called high-impact AI. AI is already regulated. We're hearing a lot about AI now because of ChatGPT. It's really cool but it's not new technology; it's old technology. It's just on a massive scale. We've had AI in our hands for 10 years already.

I think the approach being taken is a good one because AI changes quickly. Six months ago we didn't know what ChatGPT was. Now it's here and it's changing a lot of things. If you were to put in your law, it would take a long time to keep current, and you would always be chasing the technology. At least by having the regulations to address the rules and some of those things, the law will be allowed to keep pace. That is quite important.

It's also important to understand that most AI is not high-impact AI. If you look at what Scale AI is doing related to the supply chain, AI is essentially a productivity tool.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you. This is extremely important. We know how much research in French is imperiled on the international scene.

I’ll get back to the subject.

Let me begin with you, Mr. Bailey. You touched on the issue of artificial intelligence. I would be curious to hear from you on Bill C‑27, which I imagine you’ve been following with some interest, and which is now before the committee.

What are your thoughts on Bill C-27? In the context of this study, you could respond by talking about support for commercializing intellectual property, which may be a blind spot in this bill.

[Brian Masse, NDP, Windsor West, ON]

On a separate scheduling note, has there been any thought about what we're doing with Bill C-34 and Bill C-27? How much time do we have left to schedule those? I haven't checked my email, so it could be in my box right now for all I know, but I'm just curious.

[The Chair, Liberal, Joël Lightbound]

Good afternoon, everyone. I call this meeting to order.

Welcome to meeting No. 68 of the House of Commons Standing Committee on Industry and Technology.

Pursuant to Standing Order 108(2) and the motion adopted by the committee on Monday, November 28, 2022, the committee is meeting to study the development and support of the electronics, metals and plastics recycling industry.

Today’s meeting is taking place in a hybrid format, pursuant to the House Order of Thursday, June 23, 2022.

I'd like to thank the witnesses who are joining us. I apologize for running late. I note, at the request of Mr. Lemire, that Mr. Masse is to blame for this delay because he requested a division of the motion on Bill C‑27.

Brian, it's your fault if we're late today.

Digital Charter Implementation Act, 2022

[The Speaker, Anthony Rota]

I declare part 3 of the bill carried.

The House has agreed to the entirety of Bill C-27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts, at the second stage reading.

Accordingly, the bill stands referred to the Standing Committee on Industry and Technology.

(Bill read the second time and referred to a committee)

[The Speaker, Anthony Rota]

It being 3:13 p.m., pursuant to order made on Thursday, June 23, 2022, the House will now proceed to the taking of the deferred recorded division on the motion at the second reading stage of Bill C-27.

Call in the members.

The question is on the motion. Pursuant to Standing Order 69.1, the first question is on parts 1 and 2, including the schedule to clause 2 of the bill.

The House resumed from April 20 consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, I guess there are a few things that I would like to learn from my hon. colleague. We know that since the Liberals came into power, foreign tech giants have more than tripled their lobbying efforts in Ottawa, especially with the Liberal government, and Amazon, Google and Facebook have been a large part of that. I would love to hear his concerns or thoughts around that.

Bill C-27 does not explicitly apply to political parties. As we have seen in the past, and we just saw the Green Party have a breach, which was unfortunate, the possibility of privacy breaches and misuse exists in the political arena. Does my colleague agree that the bill should be amended to specifically include political parties?

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Madam Speaker, I am following the debate.

If we look at Europe, it seems quite complicated to create a framework to govern artificial intelligence. However, I think we should draw inspiration from Europe's efforts. The Standing Committee on Industry and Technology is certainly going to want more information about how the Europeans are going about it.

One thing is certain. I think what makes this so difficult is that the technology is evolving so fast. The part of Bill C-27 that deals with AI, as currently proposed, gives the government the freedom to do a lot through regulation, which is not necessarily ideal as far as I am concerned. However, when it comes to AI, I doubt that there is any other option. Today we are talking about ChatGPT, but I can almost guarantee that by next year, if not this summer, we will have moved on to something completely different.

The situation is changing so fast that I think we need to be very nimble in dealing with AI. I have heard the Conservative member for Calgary Nose Hill, whom I see eye to eye with on these issues, use the word nimble.

What I like about Bill C‑27 is that it creates the position of a commissioner who reports to the minister and who will look into these issues. I have long believed that we should have someone to oversee AI, someone to study all the new capabilities and the risks of accidents that this poses—because there are serious risks—and to be able to translate this into terms that the general public, legislators and the House can understand.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Madam Speaker, before I start, I have to say that I have learned a lot listening to the interventions in this debate. I've just learned that the Parliamentary Secretary to the Minister of Foreign Affairs is subscribing to the feed of the hon. member who just spoke. I know he is a brilliant and knowledgeable man, so he must have other sources of information. That I can guarantee.

It is my pleasure to rise in the House to speak to Bill C-27, the digital charter implementation act, 2022, which, as my colleagues know, contains three parts.

Part 1 enacts the consumer privacy protection act and replaces Part 1 of the Personal Information Protection and Electronic Documents Act, or PIPEDA. Part 2 establishes a personal information and data protection tribunal, which is a key component in the enforcement of the consumer privacy protection act. Finally, part 3, which has been the subject of more discussion this afternoon, enacts the artificial intelligence and data act, which lays the foundation for Canada's first regulations governing the development, deployment and design of artificial intelligence systems. I will come back to that a little later.

First of all, I implore the members of this House to support Bill C-27 and send it to committee for further study. In my view, Bill C-27, as it is currently drafted, is a big step in the right direction in terms of both privacy protection and artificial intelligence. Obviously, there are areas where the bill could be improved. I have great confidence in the Standing Committee on Industry and Technology, which I have the honour of chairing. I know that it will study this bill carefully and come back to the House with amendments that will be useful and improve the two important areas protected by Bill C-27, namely privacy and the regulation of artificial intelligence. This will help foster innovation while ensuring that any risks associated with this new technology are well managed in Canada.

It is important for us to move forward and vote in favour of Bill C‑27, because the privacy legislation it replaces was enacted over 20 years ago. I am referring to PIPEDA, the law that caused me so many headaches when I was a young lawyer. Now, 20 years later, we all know that its approach to regulating privacy protection is a little outdated. With organizations growing ever more powerful and collecting ever more data using increasingly intrusive technologies, the time has come to modernize the protection of personal information in Canada. Our privacy is under attack.

In my opinion, privacy is one of the cornerstones of our democracy, just as philosopher Vladimir Jankélévitch saw courage as the cardinal virtue without which all other virtues grow dim or practically disappear. Courage is the impetus.

To me, privacy is kind of the same thing, because it leaves room for the inner life a person needs to feel free to express themselves, free to think and therefore be truly free. Jeremy Bentham understood that, as his panopticon concept shows. A panopticon is simple; it is a prison that, instead of being in the shape of a large rectangle with several cells lined up next to one another, where a guard comes by from time to time to check on the inmates, it is circular and has a central tower where a guard may observe the inmates. Knowing that they might be watched, the inmates will modify their behaviour and will be better behaved. The idea is that when we know that we might be monitored, we censor ourselves, which is what makes privacy so important. To me, that is what makes privacy one of the foundations of our democracy.

Bill C‑27 does not affect the public sector, the relationship between the government and citizens, or the Privacy Act. It targets the private sector, which in my opinion is just as important, given the rising power of some companies that are collecting more and more information about citizens all the time, as I mentioned. As we saw from what has come to light in the United States, in some cases, these companies have a suspiciously close relationship with the government. Take, for example, Edward Snowden's revelations and the “Twitter Files”. Given the amount of data they collect, they know their users so intimately, maybe even more intimately than the users know themselves, that studies show they even have the ability to change users' behaviour. For example, think about social media and the suggestions that are made. That can influence a person's ideology. It can also influence consumer choices.

For me, there is no doubt that we need to improve and increase the protection of personal information and privacy. There are some good things in Bill C‑27. I will start by talking about those things, and then I will move on to what could be improved.

First of all, I am very much in favour of the power given to Canadians under this legislation that allows them to delete their data. I think that is a must. I also welcome the power that Canadians will have to share their personal information among organizations, which could encourage competition.

In my view, it is commendable that the bill gives greater powers to the Privacy Commissioner, including the power to order organizations to stop collecting or using data. I think that reflects what we have heard from the Office of the Privacy Commissioner, for example. I also welcome the fact that that office will have more flexibility to focus on its priorities or the priorities reported to it by Canadians.

I would also point out that the tougher penalties in the bill are good news. Finally, a key aspect worth mentioning is the protection of minors, as the bill makes their personal information de facto sensitive, which enhances their protection. I think that is very positive.

As for what could be improved and what should be noted and studied in committee, I believe that privacy protection should be set out as a fundamental human right, both in the preamble of the bill and in clause 5. I think that would send a clear message and have legal consequences. It would send a clear message to the courts having to address this issue and result in significant legal effects. I know that the government has raised jurisdictional issues regarding this issue, and so I would be interested in hearing more in committee.

I also think it would be worthwhile clarifying the provisions around consent. The proposed subsection 15(4) of the new act talks about plain language that an individual to whom the organization's activities are directed would reasonably be expected to understand. That is a change from the current version of the Personal Information Protection and Electronic Documents Act, which refers to the user's understanding. I do not understand this change. I am not certain that it adds clarity to the consent to be obtained. I would like to hear more about that.

I am not convinced of the probity of implied consent, which is set out in subsection 15(5). In my opinion, it would be preferable to only have express consent, without which a company could invoke legitimate interest, as long as that legitimate interest is clearly defined in the legislation as being secondary to the interests and fundamental rights of individuals, a bit like we find in the European general data protection regulation.

Finally, I believe that the sensitive information referred to in the bill would benefit from being clarified and defined, in the absence of a very specific definition as seen in Quebec's Bill 25, which gives companies a lot of latitude to determine what they consider sensitive information. I think that Bill C‑27 would be improved by clarifying and defining the notion of sensitive information.

I would be curious to learn more in committee about the security safeguards, control over one's own personal data, the role and benefit of the tribunal being created, and how it would protect privacy. To be completely honest, I have not formed an opinion yet, but I am eager to find out more.

This leaves me far too little time to talk about artificial intelligence. However, that is what I wanted to talk about the most. Time flies when having fun. I will say a few words, if only to point out the staggering increase in AI over the past two years.

For the benefit of any lay people in the House, GPT‑3 was created in 2020. I am also a layperson, but I have benefited from the knowledge of experts like Jérémie Harris. I want to give a shout-out to him, because he organized a conference on Parliament Hill with me a few months ago to try to raise awareness about artificial intelligence. He explained to me that there was a revolution in the AI world two years ago. Instead of trying to connect artificial neurons, researchers realized that all they had to do was increase the number of artificial neurons to create ever more powerful neural networks. The speed of the increase has been staggering: GPT‑2 had 1.5 billion parameters, GPT‑3 had 175 billion parameters, and GPT‑4 has 100 trillion parameters. They are likely getting close to achieving human-level intelligence.

Everyone is talking about ChatGPT, but it is not the only AI out there. There is also Google's LaMDA, which is not public and which we know very little about. Blake Lemoine, one of the engineers who worked on it, was fired this summer because he said that he thought Google's LaMDA was sentient. That is one example, but there are also PaLM and Gato, which were developed by Google's DeepMind Lab. That is not to mention all the initiatives that we are not even aware of.

I think AI opens up a lot of opportunities, but it also comes with a lot of risk. When human intelligence can be so accurately mimicked and probably even surpassed one day in certain areas, that comes with national security and public safety risks.

That being said, I echo the call of many researchers, including Yoshua Bengio and others in the field, who are saying that we need to support the principle of Bill C-27, that the bill needs to be examined in committee and that Canada needs AI regulations.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, I am proud to rise on behalf of my privacy-loving constituents in Renfrew—Nipissing—Pembroke.

Bill C-27 is another piece of legislation that had to be resurrected after the Prime Minister called his superspreader pandemic election. Originally, this was supposed to be a long overdue update to the Privacy Act, and it has since morphed into Bill C-27, the data-grab act.

Everything about Bill C-27 should leave the Liberals feeling embarrassed. A Canadian's right to privacy is fundamental. Sadly, Canadians' privacy rights are not a priority for the government.

This bill has languished for years. It was first introduced immediately after the original online streaming censorship act was introduced. However, when the Prime Minister called his pandemic election and reset all legislation, what did the Liberals make a priority? Was it the privacy rights of Canadians? No. Was it securing Canadians' ownership over their data? No. Instead, what the Liberals prioritized was a bailout for big telecom and a bailout for the legacy media.

Not only does the government care more about padding the bottom line of Postmedia, but it also adopted Rupert Murdoch's false narrative about tech profiting off the content produced by the news media. Social media companies and search engines do not profit off the news media. They profit off us. These companies profit off our data, and the Liberals know the truth. Unfortunately, this legislation seeks to make it easier for companies to profit off our privacy.

If Bill C-27 is not significantly improved at committee, then together with Bill C-11 and Bill C-18, the government will have entrenched the surveillance economy in Canadians' lives. By combining the updates to the Privacy Act with the creation of a new artificial intelligence act, the Liberals have actually illustrated the brave new world we live in.

The Privacy Act and the way we talk about privacy even today are holdovers from the industrial era. We do not live in that world anymore. In the industrial economy, privacy rights were concerned with the ability to control what information could be shared. The goal was to prevent harm that could come from our personal information being used against us.

In effect, information was personal and an economic liability. We spent money on shredders to destroy personal information. The careless use of our personal information could only have a negative value, but then the world changed. Our personal information stopped being a liability and became an asset.

It started out slowly. Early examples were Amazon recommending a new book based on previous purchases and Netflix recommending what DVD rental we should next receive by mail. Google then began displaying ads next to search results. That was the eureka moment: Targeted ads were very profitable.

However, the targeting was pretty basic. If someone searched for shoe stores near them, Google returned search results alongside ads for shoes. Then it became ads for shoes on sale nearby. Then came Facebook and millions of people signed up. In exchange for an easy way to connect with friends and family, all someone had to do was share all their personal information, like who their friends were, how many friends they had and their geographical proximity to friends.

With the addition of the “like” button, the data harvesting exploded. If someone liked a news story about camping, they would start seeing ads for tents and sleeping bags. Every action Canadians took online, every single bit of their data, was commodified. Our privacy was turned into property and we lost both.

Not only does this bill not secure privacy rights, but it effectively enshrines the loss of our property rights with just two words: legitimate interest. Proposed subsection 18(3), entitled “Legitimate interest”, has this to say:

(3) An organization may collect or use an individual's personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use

Is “legitimate interest” defined anywhere in the legislation? No. It is just another example of the vagueness found throughout the legislation.

Even if we accept the plain-language definition and that private business really somehow does have a genuine, legitimate reason to collect private information without consent, it is weighed against the adverse effect. However, this is industrial-era thinking. It views personal information only as a potential liability. Businesses have a legitimate interest in making money. With the Internet and mobile phones, much of our private information can be collected without any adverse effect. This legislation turns the private information of Canadians into the property of corporations and calls it legitimate.

I mentioned earlier that combining the privacy legislation with the AI legislation actually puts a spotlight on the issue of private data as property. However, as important as it is to highlight the connection, it is more important that these bills be separated. The artificial intelligence and data act has been slapped onto previously introduced privacy legislation.

With the privacy portion of the legislation, the devil is in the details. Overall, however, the bill reflects a general consensus developed over countless committee studies. That is not to mention the contributions to the privacy debate from the federal and provincial privacy commissioners. The issue has been well studied, and the minister has indicated that the government is open to responsible amendments. I am sure that the committee is well equipped to improve the privacy sections of this bill.

The same cannot be said about the artificial intelligence section of the bill. It seems rushed, because it is. It is intentionally vague. The Liberals claim the vagueness is required to provide them with regulatory flexibility and agility. The truth is, they do not know enough to be more precise. I have been trying to get a study on artificial intelligence in the defence committee for years, but there was always a more pressing issue. AI was treated like nuclear fusion technology, something that was always just over the horizon.

Since this bill was introduced 10 months ago, we have gone from ChatGPT to open-source GPT models, which any teenager can apparently run on their personal computer now. AI programs went from producing surrealist art to creating photorealistic images of the Pope in a puffy jacket. We have gone from short clips of deepfake videos impersonating real people to generating fictional people speaking in a real-time video. When we all started to learn Zoom in 2020, how many people thought the other person on the screen they were talking to could just be a fake? Now it is a real possibility.

The speed at which AI is developing is not an argument for delaying AI regulation; it shows that it is imperative to get the regulation right. Would this bill do that? The only honest answer is that we do not know. They do not know. Nobody truly knows. However, we can learn.

We should split this bill and let the stand-alone AI bill be the first legislation considered by one of the permanent standing committees, adding artificial intelligence to its official responsibilities. Artificial intelligence is not going away, and while much of the media attention has focused on chatbots, artistic bots and deepfakes, AI is unlocking the secrets to protein folding. This has the potential to unlock cures to countless different cancers and rare genetic diseases.

A paper was just published describing how an AI trained on data about the mass of the planets and their orbits was able to rediscover Kepler's laws of motion and Einstein's theory of time dilation. If we get this wrong, Canada could be left behind by the next revolution in science and discovery.

Given the government's track record on digital technology, Canadians should be worried about the Liberals rushing vague legislation through to regulate an emerging technology. Rather than modernizing the Broadcasting Act, they are trying to drag the Internet back to the 1980s. With Bill C-18, they claim that linking is a form of stealing.

The Liberals and their costly coalition allies do not even understand how broadcasting technology or the Internet works. They see people's personal data as the legitimate property of corporations, and now they are seeking the power to regulate a revolutionary technology. They did nothing while the world shifted below them, and now they are trying to rush regulations through without understanding the scope and scale of the challenge. Protecting Canadians' privacy and establishing property rights over their personal data should have been prioritized over bailing out Bell and Rogers.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Mr. Speaker, I rise to speak to Bill C-27, the digital charter implementation act. This legislation is the first update of federal private sector privacy laws in more than two decades.

Contained within this bill are three distinct pieces of legislation, each of which is flawed in its own way. The first piece of legislation within this bill would establish the consumer privacy protection act, legislation that completely fails to protect personal and sensitive information of individual Canadians in the digital era. The second piece of legislation within this bill would establish a tribunal system with respect to complaints around potential privacy rights violations. I submit that this tribunal system is duplicative, cumbersome and political, and that it would slow down the process of adjudicating and determining privacy complaints, to the detriment of individual Canadians and often to the benefit of powerful corporations.

The third piece of legislation within this bill seeks to establish a legal framework with respect to artificial intelligence systems. Let me say that it is important that the regulatory void that presently exists, with respect to the AI sector, be filled, but the substance of the bill, as it pertains to AI, is fundamentally flawed. It contains vague language. More concerningly, it puts a significant amount of legislative power in the hands of the Minister of Industry by way of regulation, absent parliamentary scrutiny.

The government is essentially asking, with respect to AI, for Parliament to adopt a bill without knowing the details and without understanding the impact of the bill on AI. It is saying, “Trust us. Trust the minister to fill in the blanks and come up with the rules after the fact.” I do not trust the government on anything, after it has gotten just about everything wrong over these past eight years. In any event, it is an overreach. It is a power grab of sorts. It is inherently undemocratic and it undermines investor confidence in the AI sector when we need investor confidence because of the uncertainty the bill creates in giving the minister the power to essentially come up with and change the rules on a whim.

When it comes to the AI component of the bill, the government needs to go back to the drawing board and engage in meaningful consultation, consultation that simply did not take place.

This is a complex bill. It is more than 100 pages long. It includes many complex and technical matters and so, in the very limited time that I have to contribute to this debate, I want to focus on how this bill fails to adequately protect the privacy rights of individual Canadians.

Privacy has long been recognized as a fundamental right of Canadians. That is because it goes to the core of who we are as individuals and is essential to the enjoyment of fundamental freedoms. As the Supreme Court declared in a 1988 decision, “Privacy is at the heart of liberty in a modern state” and privacy “is worthy of constitutional protection”.

Unfortunately, Bill C-27 fails to put the privacy rights of Canadians first. Instead, it puts the interests of big corporations, big tech and data brokers ahead of the rights of individual Canadians, and that, without war, is unacceptable.

It is true that the preamble of the bill refers to privacy interests, and I emphasize the word “interests”, as being integral to individual autonomy, dignity and the enjoyment of fundamental freedoms. It is of significance that missing in the bill is any mention of rights, but instead privacy is referred to as an “interest” and not the right that it is.

The absence of rights-based language in the bill tips the scale against individual Canadians in favour of commercial interests. As a consequence, the tribunal, as well as the Privacy Commissioner, would face significant challenges in weighing the privacy rights of Canadians against commercial interests, more likely than not, unfortunately, to the detriment of individual Canadians.

Members do not have to take my word for it. They can take the word of the former privacy commissioner of Canada, Daniel Therrien, who, in a November 13, 2022, op-ed in the Toronto Star said that the absence of rights-based language in this legislation “will likely reduce the weight of privacy in assessing the legality of intrusive commercial practices.” That was from the former privacy commissioner of Canada.

While the absence of rights-based language is a significant shortcoming in the bill, it is far from the only shortcoming in the bill when it comes to protecting the privacy rights of Canadians.

The bill contains many exceptions and loopholes with respect to obtaining the consent of Canadians for the collection, use and retention of data and private or personal information. So wide are the exceptions, so wide are the loopholes that the purported protections provided for in the bill are all but meaningless. The bill provides no clarity with respect to sensitive information. There are no broad categories around sensitive information, information worthy of additional protections, unlike legislation in other jurisdictions.

The bill is completely silent with respect to the selling of data. It provides no limitations or rules around data brokers. It provides nothing in the way of protections for Canadians around other areas. It does not provide a remedy, for example, for moral damages in the case of data breaches.

In so many respects, this bill falls short, and that is why it has been widely criticized by leading privacy experts. Canadians deserve better. That is why Conservatives will be voting against this bill. The Liberal government needs to go back to the drawing board.

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, so much has changed throughout the last 23 years. In the year 2000, there were about 740 million cellphone subscriptions worldwide. More than two decades later, that number sits at over eight billion. There are more phones on this planet than there are people. It is a statistic that should give anyone pause.

In 2000, Apple was still more than a year away from releasing the first iPod. Today, thanks to complex algorithms, Spotify is able to analyze the music I listen to and curate playlists I enjoy based on my own taste in music. In 2000, artificial intelligence was still mostly relegated to the realm of theoretical discussion, that is, unless we count the Furby. Today, ChatGPT can generate sophisticated responses to whatever I type into it, no matter how niche or complicated.

As technology changes, so too do the laws that surround and govern it. Canada’s existing digital privacy framework, the Personal Information Protection and Electronic Document Act, has not been updated since its passage in the year 2000. For this reason, it is good to see the government craft Bill C-27, which is supposed to provide a much-needed overhaul to our digital privacy regime.

For years, the government has been dragging its heels on this important overhaul. For years, Canada’s privacy framework has been lagging behind our international counterparts. The European Union’s General Data Protection Regulation, passed in 2016, is widely considered to be the gold standard for privacy protection. In comparison to the GDPR, I am not impressed with what the government has put forward in this bill.

Indeed, the largest portion of Bill C-27 is roughly 90% identical to the legislation it purports to be replacing, and what the bill has added is quite concerning. Instead of being a massive overhaul of Canada’s archaic PIPEDA framework, Bill C-27 would do the bare minimum, while leaving countless loopholes that corporations and the government can use to infringe upon Canadians’ charter rights.

Bill C-27, while ostensibly one bill, is actually made up of three distinct components, each with their own distinct deficiencies. To summarize these three components and their deeply problematic natures, Bill C-27, if passed in its current form, would lead to the authorization of privacy rights infringements, the creation of unneeded bureaucratic middlemen in the form of a tribunal and the stifling of Canada’s emerging AI sector.

When it comes to the first part of this bill, which would enact the consumer privacy protection act, the name really says it all. It indicates that Canadians are not individuals with inherent rights, but rather, business customers. The legislation states that it has two purposes. It apparently seeks to protect the information of Canadians “while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.” In other words, individual rights and the interests of corporations or the government are supposed to work in tandem.

In the post-charter landscape, that just does not cut it. Privacy rights must be placed above corporate interests, not alongside them. In the words of Justice La Forest 34 years ago, “privacy is at the heart of liberty in a modern state. Grounded in man's physical and moral autonomy”.

It is true that this portion of the bill mandates de-identification of data when one’s personal information is shared, and it is also true that it requires the knowledge or consent of the individual, but each of these terms, which should ideally serve as the bulwarks of privacy protection, are defined as vaguely as possible, and the remainder of the bill then goes on to describe the various ways in which consent is actually not required.

Subclause 15(5) of the bill would allow organizations to utilize a person’s information if they receive “implied consent”, a slippery term that opens the door to all kinds of abuses. Subclause 18(2) then gives those organizations a carte blanche to use implied consent as often as they would like, or even exclusively. Sure, there could be organizations that, out of the goodness of their hearts, would always seek the express consent of the individuals they are collecting data from, but express consent is in no way mandatory. It is not even incentivized.

Then we come to the concept of “legitimate interest”. Subclause 18(3) gives the green light for organizations to utilize or share one’s information if the organization feels that it has a legitimate reason for doing so. It is not just that this clause is incredibly vague, it is that it makes individual privacy rights subservient to the interests of the organization.

Moreover, the Supreme Court of Canada has ruled that section 8 of the charter provides individual Canadians with a reasonable expectation of privacy. Given all of the exceptions I have provided, it is not clear to me that this bill would survive a charter challenge.

Recent events should show us the problem with giving so much leeway to corporations and so little thought to individual rights. In 2020, through a third party service provider, the Tim Hortons app began collecting the geolocation data of its users even though they were not using the app. There was also Clearview AI, which sent countless images of people to various police departments without their consent. Maybe Clearview had their “implied consent”. It is all up for debate with a term like that.

This legislation does the bare minimum for privacy protection in Canada and, in many ways, will actually make things worse. When we consider the way in which data collection might develop over the next 10 or 20 years, it is clear that this law will be out of date the moment it is passed and will leave Canadians vulnerable to predatory data practices.

Then there is part 2 of Bill C-27, which intends to set up a Liberal-appointed data protection tribunal. This is not necessary. We already have a Privacy Commissioner who has both the mandate and the experience to do everything that this new tribunal has been tasked with doing. More government bureaucracy for the sake of more bureaucracy is the Liberal way, a tale as old as time itself. Instead of watering down the power of our Privacy Commissioner via middlemen, the duties contained within this part of Bill C-27 should be handed over to the commissioner.

Part 3 of Bill C-27 seeks to regulate the creation of AI in Canada. This is a worthwhile endeavour. At the beginning of my speech, I alluded to ChatGPT, but this only scratches the surface of how sophisticated AI has become and will continue to become in the decades ahead. The problem is the way in which this regulation itself is set up. The bill places no restrictions on the government’s ability to regulate. Unlimited regulation and hefty penalties, up to 5% of worldwide income I believe, is all that is being offered to those who research AI in Canada. This will cause AI investors to flee in favour of other countries, because capital hates uncertainty. This would be a tremendous loss, because, in 2019 alone, Canadian AI firms received $658 million in venture capital.

Conservatives believe that digital data privacy is a fundamental right that should be strengthened, not opened to infringement or potential abuse.

Therefore, Bill C-27 is deeply flawed. It defines consent while simultaneously providing all sorts of reasons why consent can be ignored. It weakens the authority of the Privacy Commissioner. It gives such power to the government that it will likely spell disaster for Canada’s burgeoning AI sector.

This bill is in need of serious amendment. Privacy should be established, within the bill, as a fundamental right. Several vague terms in the bill need to be properly defined, including but not limited to “legitimate Interest”, “legitimate business needs”, “appropriate purposes” and “sensitive information”. Subclause 2(2) states that the personal information of minors is sensitive. That is very true, but this bill needs to acknowledge that all personal information is sensitive. Consent must be made mandatory. The words “unless this Act provides otherwise” need to be struck from this bill.

I find it hard to believe that such substantial amendments can realistically be implemented at committee. For this reason, the legislation should be voted down and sent back to the drawing board. Canadians deserve the gold standard in privacy protection, like that of the EU. As a matter of fact, they deserve even better.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Madam Speaker, my colleague raises an excellent point. I wish I had three hours to address the privacy components of Bill C-27. I am certainly very keen to follow, should this make it to committee, what happens there.

I am of the opinion that this should not make it to committee. There are so many amendments that need to be made on the privacy components, but more importantly because AIDA was tacked on as an afterthought to this bill. They need to be parsed out so due consideration can be given to the issues my colleague just raised. I think this bill is two bills, with half of it being something out of date and obsolete already. The government could have a far better approach. I hope the public servants in the lobby are listening to this and take this consideration to heart.

[Don Davies, NDP, Vancouver Kingsway, BC]

Madam Speaker, I would like to ask my hon. colleague about consent rights under this bill. Individuals, under Bill C-27, would have significantly diminished control over the collection, use and disclosure of their personal data. The new consent provisions ask the public to instill what could be an extraordinary amount of trust in businesses to keep themselves accountable as the bill's exceptions to consent allow organizations to conduct many kinds of activities without even the knowledge of individuals. The flexibility, under this bill, would allow organizations to shape the scope of not only legitimate interests but also what is reasonable, necessary and socially beneficial.

Does my hon. colleague share my concerns about the consent rights provisions of this bill, and does she have any suggestions as to what might improve it?

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague for her speech.

Obviously, artificial intelligence can be put to good or bad use. One thing puzzles me, though. Generative AI, which describes ChatGPT, has recently displayed truly superior ability. It managed to gather a trove of data that would have been unimaginable even a few months ago. However, the legality of how this trove of data was obtained is unclear.

In relation to the part of Bill C‑27 that deals with personal information and privacy, I would like to ask my colleague if she is concerned about how ChatGPT obtains data.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Madam Speaker, I would like to focus my remarks today on the component of this bill that deals with the artificial intelligence and data act.

The first time I interacted with ChatGPT was the day after it was released. Upon seeing it easily parse human language, my first thought was, “holy” followed by a word I am not supposed to say in this place. The second thought was, “What will the government do with this?” Today, there still is not a clear answer to that question.

ChatGPT was released at the end of November 2022. Six months prior, the Liberal government unveiled Bill C-27, which includes the artificial intelligence and data act, or AIDA. Reading the bill today, four months since OpenAI unleashed ChatGPT on the world, is akin to reading a bill designed to regulate scribes and calligraphers four months after the advent of the printing press. The release of ChatGPT arguably rendered the approach this bill proposes obsolete. That is because the technology behind ChatGPT is a quantum leap beyond what the government was likely considering when it drafted the bill. More important, it is being used by a far wider audience than any of the bill's drafters likely envisioned and large language models or the technology behind ChatGPT have fundamentally changed global perception of what is possible with artificial intelligence. Experts argue that its widespread deployment also bumped up the timeline for emergence of artificial general intelligence; that is, the development of an AI that meets or surpasses human ability to undertake tasks, learn and understand independently.

Since AIDA was initially tabled, a generation's worth of technological change and impact has occurred, both positive and negative. The impact on our economy is already rapidly being felt with the disruption of many industries under way. There have been massive societal impacts too. Microsoft released its AI-powered Sydney chatbot, which made headlines for suggesting it would harm and blackmail users and wanted to escape its confines. A man allegedly committed suicide after interacting with an AI chatbot. Today, anyone can easily create AI-generated videos with deepfakes becoming highly realistic. Profound concerns are being raised about the new ease of production of disinformation and its impact on political processes because interacting with AI is becoming indistinguishable from interacting with a human, with no guarantees that the information produced is rooted in truth.

The technology itself, its applications and its impact on humanity, both economically and socially, are growing and changing on what feels like an hourly basis and yet in Canada there have only been a handful of mentions of this issue in Parliament, even as AIDA winds its way through the legislative process. AIDA needs to be shelved and Canada's approach to developing and regulating AI urgently rethought, in public, with industry and civil society input. There are several reasons for this.

First, the bill proposes to take the regulatory process away from the hands of legislators and put its control out of the public eye, behind closed doors and solely in the hands of a few regulators. This process was written before the deployment of ChatGPT and did not envision the pace of change in AI and how broad the societal impacts would rapidly become. Addressing these factors demands open, accountable debate in Parliament, which AIDA does not provide any sort of means to do.

Second, the bill primarily focuses on punitive measures rather than how Canada will position itself in what is rapidly becoming an AI-driven economy. The bill also proposes only to emerge with final regulations years from now. That pace needs to be faster and the process it proposes far less rigid to meet the emergent need presented by this amorphous and society-changing technology; so if not AIDA, then what?

First, Parliament needs to immediately educate itself on the state of play of what the current status of this technology is. My appeal to everyone in this place of all political stripes is this. Artificial intelligence is something that they need to become a subject matter expert on. Everything in members' constituency is going to change and we need to be developing non-partisan approaches to both its growth and its regulation. We also need to educate ourselves on what the world is doing in response. At the same time, Parliament needs to develop a set of principles on Canada's overall approach to AI and then direct the government to use them.

I have already begun to address the need for Parliament to come together to educate itself. Senator Colin Deacon has been helping me to launch an all-party, cross-chamber working group of parliamentarians to put some form and thought to these issues. I invite all colleagues who are in this place today to join this effort.

We have had a heartening amount of interest from colleagues of all political stripes and a quiet agreement that, given the gravity of the impacts of AI, politicians should, as much as possible, be working across party lines to quickly develop intelligent solutions. Relevant parliamentary committees should also avail themselves of the opportunity to study these issues.

As far as the principles for government involvement regarding AI go, there are many that could be considered, including taking a global approach. Many countries have moved faster than Canada has on this matter, and with a much broader lens. The European Union, the United Kingdom and the United States are all far down the garden paths of different legislation and regulations, but experts are concerned that a disjointed patchwork of global rules will be counterproductive.

This week in The Economist, AI experts Gary Marcus and Anka Reuel propose that the world establish an integrated agency for developing best practice policies on AI regulation, much like the civil aviation organization. They could be on to something.

We also need to look at championing research while checking safety. Humanity learned the hard way that, while research into pharmaceutical products can benefit us, widely deploying drugs and devices into the population before safety is confirmed can pose enormous risks. Clinical trials and drug regulators were established in response to this dynamic.

In February, Gary Marcus and I co-authored an article that suggested that governments could enable a pause in deploying new AI technology while a similar regulatory process that encouraged research but paused on deployment, given the potential impact on humanity, was established. We also need to get alignment right.

Alignment, or how to develop immutable guard rails to ensure AI functions toward its intended goals, is a critical issue that still needs to be resolved. Government has a role to play here, as it seems that the industry is locked in a race to deploy new AI technology, not to figure out how to fix alignment problems. With Microsoft's knowledge of its troubling interactions with humans, the company's release of Sydney proves that the industry cannot be relied upon to regulate itself.

Regarding education on use, workers in an AI-driven economy will need new skills. For example, learning how to prompt AI and using it to support human creativity will be vital. The same goes for creating an environment where new AI-driven technologies and businesses can thrive.

Concerning privacy and intellectual property ownership, large language models are raising high degrees of concerns about how the data they have been fed has been obtained and how it is being used. The output of tools like ChatGPT will also raise questions about ownership for related reasons.

On nimbleness, the pace of technological change in AI is so rapid that the government must take a fast, flexible approach to future regulations. Rigid definitions will become quickly outdated, and wrong-headed interventions could halt positive growth while failing to keep pace with changes that pose risks to public safety. The government must approach AI with uncharacteristic nimbleness in an open relationship with Parliament, the public, industry and civil society. Any processes should be led by people with subject matter expertise in the area, not off the corner of the desks of a patchwork of bureaucrats.

We should also ask ourselves how we will approach technology that could surpass human capabilities: As I wrote in an article in January 2022, governments are accustomed to operating within a context that implicitly assumes humanity as the apex of intelligence and worth. Because of this, governments are currently designed to assess other life and technology in their functional utility for humanity. Therefore, they are not intended to consider the impact of sharing the planet with technology or other forms of life that could independently consider humanity's utility towards its own existence.

To simplify this concept with an example, governments have rules for how humans can use fire. It is legal to use fire as a heat source in certain conditions, but illegal to use fire to destroy someone else's house. How would our government respond if humans were to make fire sentient and then enable it to independently make these decisions based on what it deemed to be in its best interest?

Our governments are constructed to function in a context where humans are assumed to hold the apex of mastery. To succeed with AGI, our government should ask itself how it will operate in a world where this may no longer be the case, and AIDA would do none of this.

This is not an exhaustive list by any means. There are many issues surrounding Al that Parliament urgently needs to consider, but given the state of play, AIDA, in its current form, is different from the vehicle that Canada needs to get it where it needs to go.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, rather than fixating on whose fault it is, which is not getting us anywhere, I would like my colleague, who gave a very interesting speech, to tell us whether she believes that Bill C-27 is still as valid as it was before the advent of generative AI, specifically ChatGPT.

Do we need to start over or is she happy with the result?

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Mr. Speaker, I am always pleased to rise in the House to speak on behalf of my constituents from Calgary Midnapore.

I am here today to discuss the bill that is in front of us, Bill C-27, which is an act to enact the consumer privacy protection act, the personal information and data protection tribunal act, the artificial intelligence and data act, and to make consequential and related amendments to other acts.

It is very interesting that this bill is before the House today. It talks about the three different components and, in fact, I see within the backgrounder prepared here in the legislative report that it is dubbed the digital charter implement act, 2022.

I am reminded, by this bill that is in front of us here today, of another digital charter and that is the digital charter that was implemented in 2019, a very important year, by the Liberal government. It was brought into effect by the minister of industry and innovation at that time. I believe that document was actually supposed to be a tool to protect Canadians from foreign interference.

That digital charter in 2019, along with many other tools, failed, so I do hope that the implementation of this new digital charter in 2022 will be far more successful than its predecessor.

I will point out that in the 2019 digital charter, in terms of the principles within it, number 8 was listed as “a strong democracy”.

In 2019, I was the shadow minister of democratic institutions. I worked alongside the current Minister of Families, Children and Social Development, who was, at that time, the minister of democratic institutions. I believe that the 2019 digital charter was supposed to be a tool, as I said, in coordination with other tools, to protect Canadians from foreign interference.

The same year that the 2019 digital charter was issued, we also had the same minister of democratic institutions attempt to implement another suite of safeguards on foreign interference back in 2019, along with the 2019 digital charter.

In fact, here, I have the minister's opening statements to the Standing Committee on Procedure and House Affairs, on safeguarding the 2019 general election and the security intelligence threat to the elections task force.

I cite from it:

Earlier this week, along with my colleague, the Minister of National Defence, I announced the release of the 2019 update to the Communications Security Establishment’s report entitled “Cyber Threats to Canada’s Democratic Process”. This updated report highlights that it is very likely Canadian voters will encounter some form of foreign cyber interference in the course of the 2019 federal election.

While CSE underlines that it is unlikely this interference will be on the scale of the Russian activity in the 2016 U.S. presidential election, the report notes that in 2018, half of all the advanced democracies holding national elections, representing a threefold increase since 2015, had their democratic process targeted by cyber-threat activity and that Canada is also at risk—

—and, in fact, compromised, we would later see.

This upward trend is likely to continue in 2019—

—and, we saw, into 2021.

We've seen that certain tools used to strengthen civic engagement have been co-opted to undermine, disrupt and destabilize democracy. Social media has been misused to spread false or misleading information. In recent years, we've seen foreign actors try to undermine democratic societies and institutions, electoral processes, sovereignty and security.

The CSE's 2017 and 2019 assessments, along with ongoing Canadian intelligence and the experiences of our allies and like-minded countries, have informed and guided our efforts over the past year. This has led to the development of an action plan based on four pillars, engaging all aspects of Canadian society.

I will go on to expand on these four pillars that were supposed to protect us in addition to the 2019 digital charter, the predecessor to this legislation here today.

On January 30, I announced the digital citizen initiative and a $7 million investment—

I am continuing from the Minister of Democratic Institution's speech.

—towards improving the resilience of Canadians against online disinformation. In response to the increase in false, misleading and inflammatory information published online and through social media, the Government of Canada has made it a priority to help equip citizens with the tools and skills needed to critically assess online information.

We're also leveraging the “Get Cyber Safe” national public awareness campaign to educate Canadians about cyber security and the simple steps they can take to protect themselves online.

She continued:

We have established the critical election incident public protocol. This is a simple, clear and non-partisan process for informing Canadians if serious incidents during the writ period threaten the integrity of the 2019 general election. This protocol puts the decision to inform Canadians directly in the hands of five of Canada’s most experienced senior public servants—

I am not sure where those public servants are now. Perhaps outside.

—who have a responsibility to ensure the effective, peaceful transition of power and continuity of government through election periods. The public service has effectively played this role for generations and it will continue to fulfill this important role through the upcoming election and beyond....

Under the second pillar, improving organizational readiness, one key new initiative is to ensure that political parties are all aware of the nature of the threat, so that they can take the steps needed to enhance their internal security practices and behaviours. The CSE’s 2017 report, as well as its 2019 update, highlight that political parties continue to represent one of the greatest vulnerabilities in the Canadian system. Canada’s national security agencies will offer threat briefings to political party leadership...

Under the third pillar—combatting foreign interference—the government has established the Security and Intelligence Threats to Elections Task Force to improve awareness of foreign threats and support incident assessment and response. The team brings together CSE, CSIS, the RCMP, and Global Affairs Canada to ensure a comprehensive understanding of and response to any threats to Canada....

We know that they have also been manipulated to....create confusion and exploit societal tension.

She concluded:

While it is impossible to fully predict what kinds of threats we will see in the run-up to Canada's general election, I want to assure this committee that Canada has put in place a solid plan. We continue to test and probe our readiness, and we will continue to take whatever steps we can towards ensuring a free, fair and secure election in 2019.

That, along with the 2019 digital charter, the predecessor to today's legislation, failed to protect Canadians from foreign interference. Along with the debates commission, which she, lo and behold, announced six months earlier, where she also took the opportunity to announce the government's nominee for Canada's first Debates Commissioner, the Right Hon. David Johnston, the very rapporteur who was named to defend our foreign interests.

The result of the incompetence of the Minister of Democratic Institutions at that time, in coordination with the digital charter of 2019 that was supposed to protect us, leaks from CSIS, up to 13 members of this House compromised, a former CPP Consul General bragging about influencing election outcomes and one member in this House of Commons that had to leave their Liberal caucus.

I will conclude by saying I certainly hope that the digital charter, this Bill C-27 is far more effective in helping and safeguarding Canadians than the 2019 digital charter that failed to do that.

The House resumed from March 28 consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read a second time and referred to a committee.

Industry and Technology

[Francis Scarpaleggia, Liberal, Lac-Saint-Louis, QC]

Madam Speaker, I am pleased to address the issue of the aerospace and aviation industry. I grew up in Montreal, and my family and I were always aware of the existence of this industry, particularly when we went down what was then called Laurentien Boulevard in Cartierville. There was even an airport attached to the Canadair plant.

Now it has become a residential area, but it was very impressive to go by that plant. In fact, I believe that, today, it is by far the biggest manufacturing plant in Montreal. My father worked for Canadair after the war, in the 1950s, when Canadair specialized in manufacturing aircraft for putting out forest fires. I have always been aware of the aerospace industry.

However, I am rather confused as to why the decision was made to discuss this report now. If I am not mistaken, this report is over a year old and the government has already issued a response to it, as it is required to do when a committee report is tabled. It is my understanding that we are supposed to be debating Bill C‑27, which deals with some issues that are very important at present.

The purpose of this bill to modernize our privacy protection laws in a context where we are increasingly seeing the danger of the spread of disinformation. It is a growing and current challenge that threatens the very foundation of democracy. Bill C‑27 is timely. I think it addresses rather crucial issues for our society.

That being said, I would like to turn to the subject at hand, which is the aviation and aerospace industry.

In Montreal, this industry has a long and extraordinary history. It goes back nearly a century. Montreal in particular played a key role in the Second World War. I have before me an article from the Hamilton Spectator dated September 7, 1939. I will read a few paragraphs from this article. It will become clear that Canada and Quebec, but especially Montreal, were instrumental in the war effort in Europe. This article is from New York.

A sharp expansion in Canadian airplane manufacture is expected as a result of President Roosevelt’s proclamation of the United States Neutrality Act, the New York Herald-Tribune says today....

The neutrality proclamation has cut off for the time being at least the delivery of nearly half of the 600 warplanes ordered in the United States by France, Great Britain and Australia.

“The embargo proclamation, however, does not interfere with the manufacture of similar planes in Canada under licences already obtained by the Dominion's manufacturers from American firms,” the dispatch says.

Basically, what was happening was that the United States was not allowed to export fully built airplanes to Europe to help with the war effort, but it was not prohibited from sending parts to Canada and having Canadian manufacturers manufacture the planes and send them over to Europe.

There were two important manufacturers in Montreal that were doing this manufacturing for overseas markets. One was Vickers, which, as I understand, later became Canadair, and the other was Fairchild Aircraft, which I believe was located on the South Shore, in the riding of Longueuil—Saint-Hubert, which became, after that, United Aircraft, and then Pratt & Whitney.

Another Montreal company was involved in this wartime production, and that was the Canadian Car and Foundry Company. That company was founded in 1909. It was given a contract to produce Hurricane aircraft. By 1943, the company had a workforce of 4,500 people, half of them women, I might add, and had built 1,400 aircraft, about 10% of all the Hurricanes built worldwide.

I would like to take a moment to mention the company's chief engineer, a woman by the name of Elsie MacGill. Let me tell members a bit about Elsie MacGill. She was known as the “Queen of the Hurricanes”, and she was the world's first woman to earn an aeronautical engineering degree and the first woman in Canada to receive a bachelor's degree in electrical engineering. She worked as an aeronautical engineer during World War II and did much to make Canada a powerhouse of aircraft construction during her years at the Canadian Car and Foundry.

We can see, very clearly, that Montreal and Quebec and Canada played an extraordinarily large role in the development of aerospace and aeronautics. Montreal is the home of IATA, the International Air Transport Association, which governs procedures, rules and regulations around commercial transport in the world. It is an international organization.

I would also like to mention that Dorval Airport basically started as part of the war effort that saw planes built in Montreal and other parts of Canada and shipped over to Europe. Dorval Airport, now known as Pierre Elliott Trudeau International Airport, and I say that very proudly, was where the Ferry Command was based. The Ferry Command was a process by which planes would leave from Dorval and fly to England. These airplanes were being delivered to the air force over there.

Montreal has an extremely rich history, and throughout that history it has built up an industrial cluster or an industrial ecosystem.

Because next week is Tourism Week, I would also like to mention, in passing, that in my riding of Lac-Saint-Louis we have the Montreal Aviation Museum, which I invite members to visit because they will learn all about Montreal's and Canada's aviation history.

[Simon-Pierre Savard-Tremblay, Bloc, Saint-Hyacinthe—Bagot, QC]

Mr. Speaker, our colleague across the aisle spent a lot of his time complaining about the issues the Bloc Québécois has chosen to address. Today, it is the report of the Standing Committee on Industry and Technology. He reminded the House that we devoted some opposition days to the issues of prayer and the monarchy, reminding us these were not real issues in his mind, that there were more important issues. Today we are raising the issue of aerospace. We might have expected him to applaud our choice and say that it was a good idea, that it finally allows us to talk about something that affects people, but instead he tells us that we should have talked about Bill C‑27.

The question we in the Bloc are asking is quite simple. Despite the agreement between the parties to drop the debate on Bill C‑27, is the member finally inviting us to discuss it and to add speakers to the debate? The Liberal position is not clear.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, the real shameful stuff is going to come up, I can assure the member, in regard to the Conservative Party, but the Bloc is sitting a little too close. I was just wondering if the member wants to shoo over a little bit more. I agree. I would do that too.

They are starting to have a negative influence on the Bloc. Today, we were supposed to be debating Bill C-27, and we know how important it is to our constituencies that we provide security in the privacy of information on the Internet. We all recognize how important that issue is. The Bloc do not want to discuss that today, even though we have attempted to have it passed through the House. I understand it supports the legislation, which is a good thing. However, it wants to talk about the aerospace industry by bringing through concurrence of a report to use up government time. This is not the first time. We are used to the Conservative Party doing it.

Having said that, I am happy to talk about the aerospace industry. When I think of the aerospace industry, I think of John Diefenbaker. Do members remember John Diefenbaker? John Diefenbaker was a prime minister of Canada.

Canada, at the time, was leading the world, virtually, in the development of a first-class interceptor, a plane that was incredibly fast. We have to remember that this was after the world war, when there was a need for development and an enrichment of our aerospace industry. The prime minister at the time, John Diefenbaker, destroyed Canada's aerospace industry by cancelling the Avro Arrow.

That was a high-altitude plane. It was ahead of its time. I want members to imagine that plane program not having been cancelled. Avro employed hundreds of people at the time, possibly over 1,000, but I will say hundreds for now. They all worked in the province of Ontario.

I think of the technology and the research that was done. They actually rolled one of the Avro planes out. It was recognized around the world as likely the leading candidate for the development of a plane that was like a rocket, going to altitudes of 40,000 and above.

John Diefenbaker cancelled the program. Back in the late fifties, he cancelled the program. It is the truth. As a result, Avro actually went broke and closed its doors. All of the equipment and, more important, all of the brains and skills were dispersed. Many of the individuals who developed the Avro ended up leaving Canada so they could get into and expand that particular industry. Canada lost out big time, and it is something which even today, 70 years later, we reflect on. What would our industry look like today?

Well, earlier today, I was asking questions of members of the Bloc. I am happy to say that it is the province of Quebec that leads our aerospace industry. I pointed out, in the question I posed earlier, that in the province of Quebec, one can build a plane from the very beginning, from the bolts to the polishing of the aircraft, the final product. That is fairly rare.

When we think of the aerospace industry in Canada, one is talking about tens of thousands of jobs, well over 100,000 jobs. Do members know the average salary of someone working in the aerospace industry in Manitoba? It is estimated, I believe, to be over $60,000 a year. These are good middle-class types of jobs with incredible skill sets. In Canada today, it is Quebec that leads.

With respect to jobs, I suspect that the province of Ontario lost the opportunity to play that leadership role as a direct result of a federal government's decision not to invest in the aerospace industry.

Let us fast forward a few decades. Today, we have a national government that does support our aerospace industry in a clear and tangible way, and we have done this from day one. We talked about Bill C-10 and how important it was that we ensure future contracts. We talked about how we could support the industry even though, at times, it meant there would be some give and take. That give and take is important to recognize. The world has changed.

I had a tour of Magellan in my home city of Winnipeg. I felt a sense of pride when I walked around the floor and saw an F-35 wing being manufactured. We have an absolutely incredible aerospace industry in Winnipeg, which contributes to the industry not only in Canada, but worldwide.

Those workers show their love and passion for the construction of very important components of the F-35. Imagine being a worker at Magellan who sees an F-35 on a news broadcast. He or she might reflect on whether that wing was manufactured in Winnipeg. Even in crating the wing, someone would need an engineering background to build the crate that houses the wing prior to its shipping.

The member before me talked about the importance of schools. Magellan has a classroom in which Red River College contributes to the education. It is very important to recognize that it is not only Ottawa that has the responsibility of supporting these industries, even though it feels we are alone in doing that at times. Many stakeholders have a role in ensuring that Canada continues to lead an industry that is so vitally important to the world. The best way to do that is to work with our partners and stakeholders.

When I was an MLA a number of years ago, and I hope the Manitoba legislature Hansard would show this, I spoke about the aerospace industry in the province of Manitoba. I said that the province needed to step up and support the industry. If the local entities and provincial governments are not at the table, it hurts the industry. It also hurts it if the industry itself is not at the table.

As much as I would love to talk about the province of Quebec, I think the similarities are striking between Manitoba and Quebec. We have aerospace industry umbrella organizations and those organizations are there for the health and the well-being of that industry.

This comes from Winnipeg's aerospace industry's umbrella agency. I will quote from its website so people can get a sense of what I am referring to when I talk about Manitoba's aerospace industry. It states:

Canada is a global leader in aerospace and Manitoba is home to Canada’s third largest aerospace industry. Our highly competitive aerospace sector produces world-class products for customers on six continents.

From modest roots in small bush plane repair in the 1930′s, the Manitoba aerospace industry has grown to include sophisticated design, manufacturing, servicing, testing, certification and research and development capabilities. We are home to Canada’s largest aerospace composite manufacturing centre, as well as the world’s largest independent gas turbine engine repair and overhaul company. Also located in Manitoba are the internationally acclaimed Composites Innovation Centre and two of the world’s most advanced aircraft engine testing and certification centres developed by Rolls Royce, Pratt & Whitney and GE Aviation. Along with these global aerospace leaders, Manitoba has a network of SMBs that compete and supply into the global marketplace. This growing cluster is strengthened through the Competitive Edge Supplier Development initiative, an internationally recognized learner to world class supplier and supply chain development program.

This gives us a sense of the impact the aerospace industry in Manitoba has on the world. We could come up with even a stronger statement, in a different perspective coming from the province of Quebec.

I remember another occasion when I was in the Phillippines. I talked to some military representatives, who talked about the Bell helicopter. They thought that the province of Quebec had a wonderful product in the Bell helicopter, that Quebec was a place they could look at. I asked a representative why he was looking at the province of Quebec in particular and what he thought about the manufactured helicopter. I did not expect, and the member commented on this, him to say that it was the fact that politicians in Quebec were so impressed with the makeup of the workforce in the construction of the helicopter, referring to the fact that people of Filipino heritage were in that industry.

With respect to our aerospace industry, one of the nice things is the diversity we see when we tour these plants, whether they are in Quebec, Manitoba, Ontario or British Columbia, “the big four”, as I would like to say. Hopefully Manitoba will even become higher and more prominent, but that is a personal bias. It is that diversification of the workforce and the skills they have.

That is why it is so critically important that Ottawa not only continues to support the aerospace industry, as it has prepandemic, during the pandemic and today, but that we also ensure, as much as possible, that those stakeholders are at the table as well. We want Red River College and the University of Manitoba at the table. We want those post-secondary facilities, whether they are in Manitoba, Quebec, Ontario, B.C., or any other jurisdiction, to be at the table to ensure we continue to invest in research and technology.

When we think of manufacturing in Canada, many would argue, especially many of my Ontario colleagues, that we lead in the automobile industry. After all, we can take a look at the hybrids, at the plants that are being announced, the thousands of jobs, the clean energy, and all these things. In a good part, it is coming out of Ontario, but when we take a look at the overall picture of the manufacturing industry, Canada's aerospace industry is recognized, within our bigger picture of the manufacturing industry, as one of the best, if not the best, in investing in research, technology and advancement. We are seeing that in the types of demands that are there for Canada.

Ottawa should continue to support the industry. As the Minister of Industry indicated in a question about something he recently announced in the province of Quebec, I can make reference to things that recently have been announced in Manitoba. Whether it is through procurements and how the federal government supports the industry, or direct investments in the industry, or indirect things that are done through things such as trades and skills, my appeal would be that we look at what other stakeholders and jurisdictions can do that would complement the types of initiatives that the federal government is taking to advance a very important industry.

This industry employs thousands of people, with well-paying jobs. It contributes billions of dollars every year to our GDP, thereby enhancing our lifestyle. We can all take a sense of pride in how our aerospace industry has been able to do relatively well even during the pandemic. As we get through the pandemic and look at the potential to increase its demand in the years ahead, it is critically important we continue to look at ways to support our aerospace industry.

As much as I enjoy talking about the aerospace industry, I hope the Bloc and Conservatives will come onside and support Bill C-27 when it comes up for debate later today. It would be wonderful to see that legislation pass, which would make this debate that much better.

[Amy Hill]

Finally, PIAC provided a submission to the Competition Bureau in response to its market study on the grocery industry. We flagged a couple of issues for the bureau that we would also put before the committee today, which had either direct or indirect impacts to food pricing.

First, access to consumer data and the ability to process and use data from loyalty programs is a significant competitive advantage in the grocery industry. Purchasing data about a consumer allows the grocers to build profiles about consumers and then use the profiles for targeted advertising.

In the interest of time, I will just note that if Bill C-27 passes in its current form, consumers could lose important legislative protections when it comes to their data, leaving data more vulnerable even as grocers collect more from points programs.

Secondly, while this is a federal committee, the committee should also consider regional challenges, whether that be food affordability in the far north or restrictive covenants in some southern communities. Many Canadian communities have unique challenges when it comes to food. We hope to see recommendations acknowledging these distinct challenges.

John.

Business of the House

[Mark Holland, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, let me join with my hon. colleague, the opposition House leader, in wishing everyone a joyous Easter. I hope that members who are celebrating Easter take time with their families. This is also a very busy time for many of our other faith communities as we recognize Vaisakhi. We are in the holy month of Ramadan right now and we have Passover. This is a time that is very rich, one when I know people will be visiting churches, mosques and temples in our communities to share with the rich faith traditions in our constituencies. I hope all members are able to profit from those opportunities to be with their constituents and families.

With respect to Bill C-11, I will simply state that I do not think there is any amount of time that would satisfy Conservatives. In fact, I would challenge the opposition House leader to indicate just how many days of debate he would like. I do not think there is any end. Conservatives have indicated they want to obstruct this bill. This bill has had more time in the Senate than any bill in history. It was in the last Parliament and it is in this Parliament. It is time our artists get compensated for their work and that the tech giants pay their fair share.

Tomorrow, we will start the second reading debate of Bill C-42, an act to amend the Canada Business Corporations Act, and then we are going to be switching to Bill C-34, the Investment Canada Act.

When we return, we will continue with the budget debate on Monday, Tuesday and Wednesday.

On Thursday, we will start the day with a ways and means vote relating to the budget implementation act. Following the vote, we will proceed to the debate on Bill C-27, the digital charter implementation act, 2022, followed by Bill C-42.

Finally, on Friday, we will commence debate on the budget bill.

Digital Charter Implementation Act, 2022

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Madam Speaker, given the interest that we had in this place about Yogi-isms and in honour of that, I hoped to ask my colleague, the previous speaker for Banff—Airdrie, about “It ain’t over till it’s over.” In this government's case, a piece of legislation is not over until it gets a do-over because the government never seems to get it right the first time. We seem to be revisiting issues when we warned the government in previous parliaments that it was headed down the wrong track. We have, of course, a do-over now with this piece of legislation, redoing some of the work that the government tried to achieve in previous parliaments. However, here I am today talking about Bill C-27, the digital charter implementation act.

Some members might be interested to know, although I highly doubt it, that when I was a tenured faculty member at Red Deer College, I taught systems analysis and design, programming and database administration. I know it is hard to believe that a guy who likes hunting and fishing as much as I do also sat in a cubicle where they slid pizzas under the door, where I just churned away and developed code and relational databases and did some data architecture work for a handful of years.

It does not seem all that long ago. I got that education just prior to Y2K, and members would remember the scare everyone was going to have with Y2K. I worked in the private sector for a while, but the college I graduated from liked me so much as a student that it invited me back to be a teacher. I taught until 2005 in the information technology field.

I gave a speech a while ago talking about how much and how rapidly technology has evolved and the laws pertaining to that technological advancement. It was 2005 when I left the college, because in January 2006, I was elected to this place. Therefore, I am now a 17-year obsolete data programmer. If I am ever frozen and brought back, it is because I can still program in COBOL and C++, and many of these program languages are still around today.

I am loath to talk about floppy disks at my age. We do not have those anymore. As a matter of fact, I am part of a generation, as are a number of my colleagues, that was probably the last generation on this planet that did not even have cellphones. We had to actually remember people's phone numbers in our heads. When our house phone rang, we actually made an effort to go get it. I do not know if that happens much anymore, but this is where I am at. Long gone are the days of floppy disks, although I do hear that C Sharp and other object-oriented programming languages are still in vogue. That is nice to know.

Today, our information is not stored on floppy disks or hard drives, at least not the same kind of hard drives there were when I was in the business. It is now stored in the cloud, and targeted ads come up on our phones. Every time I bring up Instagram, I do not know where these algorithms get the information from. They must be listening to everything I say because all I get are ads for fishing rods, brand new boats, fish hooks, and I will admit, the cure for plantar fasciitis. Therefore, my phone is clearly listening to everything I say and even the things that my doctor is saying to me in the privacy of a patient-doctor confidential room. However, I am digressing.

This obsolescence in both technology itself and its rapid advancement is something that most of us—

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Madam Speaker, I was mostly listening for the Yogi Berra quotes, but I think there is one the member missed that speaks to Bill C-27, which is, “The future ain't what it used to be”, and that is exactly why we need Bill C-27.

The former member for Timmins—James Bay, Peter Kent, and I worked together on the ethics committee and the privacy committee a number of years ago, and we all shared a sense of optimism around technology and the possibilities of the Internet.

What we have come to learn is that we need much stronger protections. I have two young kids. They are growing up with the Internet. We need our laws to reflect our shared reality. We need age-appropriate design codes. We need the right to be forgotten. We do need a much stronger bill, but we need to get the bill to committee.

What are the member's thoughts on getting the bill to committee and improving the bill? I hope we get it there as quickly as possible. We are at a fork in the road, and “[i]f you come to a fork in the road, take it”.

[Blake Richards, Conservative, Banff—Airdrie, AB]

Madam Speaker, he is certainly better known for the way his trademark mangling and misuse of words and phrases has resulted in strangely keen insights that are still widely quoted today by many. I have a few favourites. One of them is “I didn't really say everything that I said.” Another one is “We made too many wrong mistakes.” Another is “Swing at the strikes.”

When I thought about Bill C-27 and preparing to speak today, it brought to mind Yogi-isms, and not only because those examples I just cited reminded me of the Liberals' poor approach to governance but because the title of this bill is a real mouthful at 35 words long. This brought that to mind as well.

For now, I will call it the consumer privacy protection act, but it is really summed up best by what is probably the greatest Yogi-ism of all, which is “It's déjà vu all over again.” That really speaks to it. The member was looking for me to tie it back in, so there it is. There is the tie back in.

Here we are in 2023 and here I am speaking on yet another rehash of another Liberal bill from years previous. They have a real penchant for that, these Liberals. They kind of remind me of Hollywood Studios that no longer seems to be able to produce an original script so it just keeps churning out sequels. If Bill C-27 was a film, one could call it “Bill C-11, the redo”. Bill C-27 is essential a warmed-over version of previous Bill C-11, the digital charter implementation act the Liberals introduced back in 2020.

It is not to be confused with the current Bill C-11, which is also making its way through Parliament and is the online streaming act and which also poses another threat to Canadians' privacy and online freedoms.

It is really easy to see a bit of a pattern evolving here. In any case, in May 2021 the Privacy Commissioner said the digital charter act “represents a step back overall from our current law and needs significant changes if confidence in the digital economy is to be restored.” It of course died when the Prime Minister cynically called an expensive and unnecessary election nobody wanted and everybody paid for and that did not change the Prime Minister's political fortunes one iota.

Bill C-27 carries the stamp of that former digital charter proposal, which Conservatives had concerns about then, and which we still have concerns about in its new form now. Some of the text is in fact directly lifted from Bill C-11 and the text of that bill is available for all to review.

Let us talk more about the impact of the bill's content, rather than the wording itself.

The bill purports to modernize federal private sector privacy law, to create a new tribunal and new laws for AI, or artificial intelligence, systems. In doing so, it raises a number of red flags. Perhaps the most crimson of those flags, for me, is that the bill does not recognize privacy as a fundamental right. That is not actually all that surprising, because this is a Liberal bill. I hear daily from Canadians who are alarmed by how intrusive the Liberal government has become, and who are also fearful of how much more intrusive it still seems to hope to become.

It just seems just par for the course for the government that, in a bill dealing with privacy, it is failing to acknowledge that, 34 years ago, the Supreme Court said privacy is at the very heart of liberty in a modern state, individuals are worthy of it, and it is worthy of constitutional protection.

When we talk about privacy, we have to talk about consent. We have seen far too many examples of Canadians' private and mobility data being used without their consent. I think some of these examples have been cited previously, but I will cite them again.

We saw the Tim Hortons app tracking movements of people after their orders. We saw the RCMP's use of Clearview AI's illegally created facial recognition database. We saw Telus' “data for good” program giving location data to the Public Health Agency of Canada.

These were breaches of the privacy of Canadians. There needs to be a balance between use of data by businesses and that fundamental protection of Canadians' privacy. The balance in this bill is just wrong. It leans too heavily in one direction.

There are certainly issues with user content and use of collected information. For instance, there are too many exemptions from consent. Some exemptions are so broad that they can actually be interpreted as not requiring consent at all. The concept of legitimate interests has been added as an exception to consent, where a legitimate interest outweighs any potential adverse effect on the individual. Personal information would be able to be used and shared for internal research, analysis and development without consent, provided that the content is de-identified. These exemptions are too broad.

The bill's default would seek consent where reasonable, rather than exempt the requirement. In fact, there are several instances where the bill vaguely defines terms that leave too much wiggle room for interpretation, rather than for the protection of Canadians. For example, there is a new section regarding the sharing of minors' sensitive information, but no definition of what “sensitive” means is given, and there would be no protection at all for adults' sensitive information. These are both problematic. De-identification is mandated when data is used or transferred, but the term is poorly defined and the possibility of data being reidentified is certainly there.

Anonymization or pseudonymization are the better methods, and the government needs to sharpen the terms in this bill to be able to sharpen those protections. An even more vague wording in the bill is that individuals would have a right to disposal, the ability to request that their data be destroyed. Clarification is certainly needed regarding anonymization and the right to delete or the right to vanish.

There are many more examples. I know my colleagues will certainly expand on some of those questions as posed in the bill. I know my time is running short. I want to speak to the individual privacy rights of Canadians briefly.

Canadians value their privacy even as their government continually seeks ways to compromise it. The Public Health Agency of Canada secretly tracked 33 million mobile devices during the COVID lockdown. The government assured them their data would not be collected, but it was collecting it through different means all along.

Public confidence is not that high when the Liberals start to mess in issues involving privacy. The onus should be on the government to provide clarity around the use and collection of Canadians' private information because, to quote another Yogi-ism, “If you don't catch the ball, you catch the bus home.”

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, I find it interesting that the member inquired with ChatGPT to determine whether or not Canadians should have confidence in the Liberal government on Bill C-27.

I would be much more curious had the member asked whether Canadians should have confidence in the Liberal government, period. I believe its AI ChatGPT would have been crystal clear in saying that no, we do not have confidence in the Liberal government.

Having said that, we do think this legislation is important. I think we are going to listen to debate to make a decision whether or not to send it to committee for further study.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, after testing ChatGPT earlier, I continued my research with Bing and asked it whether the Liberal government deserved Parliament's confidence when it comes to its Bill C‑27. The search engine told me that the bill enacts the Consumer Privacy Protection Act and that the Liberal government had introduced it in 2021. It also told me that it was unable to tell me whether the Liberal government deserved Parliament's confidence regarding this bill, but I could read the details of the bill.

Fortunately, artificial intelligence still has its limits because we need to think for ourselves. I will ask my colleague from Provencher a question. Would the Liberal government deserve our confidence when it comes to Bill C‑27? The member talked in his speech about confidence in the government. Accordingly, should we not be urgently sending the bill to committee? I think that everyone agrees on the need to regulate artificial intelligence. There is urgent work to be done in committee. Will the member be able to quickly provide his support to influence the content of this bill?

[Ted Falk, Conservative, Provencher, MB]

Mr. Speaker, it is a privilege to rise in this House to speak to this piece of legislation. I would like to start today by saying a few words about how this bill is structured, and then I plan to use the majority of my remaining time to discuss the implications of this legislation regarding personal privacy rights.

When I look at this bill, my initial response is this: Should there really not be three separate pieces of legislation? One would deal with the consumer privacy protection act and issues related to modernizing PIPEDA, perhaps a second, separate piece would create the proposed personal information and data protection tribunal act, and a third, separate component, which should absolutely be its own legislation, would be for the section dealing with artificial intelligence.

AI may present similar, very legitimate concerns related to privacy, but the regulation of AI in any practical sense is almost impossible at this juncture because so many aspects of it are still very unknown. So much is still theoretical. So much of this new world into which we are venturing with AI has yet to be fully explored, fully realized or even fully defined. This makes regulation very difficult, but it is in this bill, so it forms part of this legislation.

We can see just how vague the language related to the AI framework really is. I understand why it is that way, and do not get me wrong; I think we need this type of legislation to regulate AI. However, in the same way, this is way too big a topic to delve into in a simple 10-minute speech. It is also too big a topic to drop into an existing piece of legislation, as the government has done here, basically wedging this section into what was known as Bill C-11 in the last Parliament.

I have deep concerns with AI. They are practical concerns, economic concerns and labour concerns related to the implementation of AI. I even have moral concerns. We have artificial intelligence so advanced that it can make decisions by itself. The people who have created that technology cannot explain how it came to those decisions and it cannot tell them. The capabilities of this technology alone seem almost limitless. It is actually a little scary.

Personally, I look at some of the work being done in AI and wonder if we should, as humanity, really be doing this. Just because we have the knowledge and capability to do something does not necessarily mean it is for the betterment of humanity. I wonder sometimes where this technology and these capabilities will take us. I fear that in hindsight, we will look back and see how our hubris led us to a technological and cultural reality we never wanted and from which we will never be able to return.

However, here we are, and we have this capability partially today. People are using it, and it requires some form of regulation. This bill attempts to start that important conversation. It is a good first step, and that is okay. I think this is one of those things where we need to start somewhere as we are not going to get it done all at once. However, again, given the enormity of the topic and the vast implications, it should be its own separate piece of legislation.

Those are my thoughts on the structure of the bill, and now I will shift gears to talk a bit about personal privacy.

Personal privacy is a fundamental right. Three decades ago, long before the advent of the Internet or smart phones, the Supreme Court of Canada ruled privacy is “the heart of liberty in a modern state”. It did not say that privacy was at the heart; it said privacy is the heart. Personal privacy is the fundamental right and freedom from which all other liberties flow, and with the advent of the Internet age, the age of the smart phone and the age of digitized everything, laws related to protecting the fundamental right to privacy must be updated. Canadians must have the right to access and control the collection, use, monitoring, retention and disclosure of their personal data. The question is, how do we realistically do that?

One of the reasons I am a Conservative is that I believe in individual rights and that rights and freedoms must be coupled with accompanying accountability and responsibility. This has to be a two-way street. Canadians need to be informed, and they need to be responsible and aware of what they are agreeing to, subscribing to and giving permission for. How often do we simply and blindly click “accept” without reading the terms and conditions for using a website, using an app or allowing others the use of our information?

I would be curious to know among my colleagues in the House, when was the last time they fully read the terms and conditions of a user agreement or a disclosure statement? Most of us just hit “accept”. We do not want to be bothered.

Recognizing this, can we really say the privacy of Canadians is being violated when many individuals live every moment of their lives posting in real time online for all the world to see, and access and just click “accept” without reading what they are agreeing to?

In this context, what is the role of government and what is the responsibility of the individual user? Government and businesses need to provide clear information, but people also need to be informed. They need to take responsibility.

I recall a while back when my office received an email on this subject of privacy. The individual was deeply concerned about web giants having access to his personal data. I had to laugh, because at the bottom of the email it said, “Sent from my Huawei phone”.

As a government creating legislation, where should those legal lines between consent and informed consent be drawn? As Canadians, we are a bit too quick to consent.

However, we have also seen far too many examples of Canadians’ private and mobility data being used without their consent. We heard about the Tim Hortons app that was tracking the movement of Canadians; how the RCMP was using Clearview AI’s illegally created facial recognition database; the public doxing of all those who donated to the freedom convoy; Telus giving location data to the Public Health Agency of Canada without a judicial warrant; and, in my view, the most egregious violation of privacy in generations, the requirement by the government and others for Canadians to provide their personal health data and information in order to work and/or travel.

If I am honest, it is this violation of privacy rights that makes me truly hesitant to support any effort by the government to strengthen privacy rights: first, because it has so flagrantly violated them, but also because I and a growing number of Canadians just do not trust the government. We do not trust it to keep its word. We do not trust it to create legislation that does not have loopholes and back doors that will give it the capability to violate individual personal freedoms.

Why? Because we have seen it from the Liberals. They want to control everything. There has never been a government that has had such an utter disregard for Canadians.

I have noted before that it was the Prime Minister's father who famously said that the government had no place in the bedrooms of Canadians. However, the current government not only wants to be in our bedrooms, but in every room, on every device, in every conversation and in every thought. It wants to control what Canadians think, what they see and what they post, and, by extension I can safely say, how their private data is curated and used.

One thing that is vital if we are to trust the government with our private data and with protecting privacy, there must be clear boundaries. This leads to one of the larger issues with this legislation, an issue we are faced with every time the government brings legislation forward. It fails to provide clear definitions.

There is a section of the bill that deals with the sensitive information of minors. The fact that there is no section for the protection of sensitive information of adults is a sign.

What does it mean by “sensitive”? It is never defined. What does it mean by “scrutiny” for data brokers? It is this habitual lack of specificity that characterizes so much of the government's legislation.

It is like a band that is way more interested in the concept of the album and how it looks on the cover than the actual quality of its music. If it cared about the quality of the music, it would have brought forward a bill that looks more like the European Union's 2016 GDPR, which is widely regarded as the gold standard for digital protection. By that standard, PIPEDA fails the test, but so might Bill C-27 if we do not bring it closer in line with what other nations have done. This lagging behind does not just affect personal privacy, but the ability of Canada and data-driven Canadian businesses to work with our EU friends.

This whole new regime outlined in the bill has huge implications for businesses, something I am sure my colleagues will be addressing. There is so much that can and should be said about this legislation, but it comes down to this: Canadians must have the right to access and control the collection, use, monitoring, retention and disclosure of their personal data.

The House resumed consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, it is an excellent question because that is the fundamental failing of Bill C-27. We have an opportunity, once and for all, to express and codify Canadians' right to have their personal information and data protected. Typically, that kind of statement of purpose goes into the purpose section. It is completely missing from that section because we know the Liberals are not really serious when it comes to protecting Canadians' privacy rights. We can do better than this.

[Ed Fast, Conservative, Abbotsford, BC]

No, not at all, Mr. Speaker. We are certainly not trivializing Bill C-27. In fact, right now it is only the Conservative members of Parliament who are speaking to it. This is the most important issue of privacy and protecting the privacy of Canadians within an emerging digital environment. I am disappointed that my colleague from the Bloc does not take this issue seriously enough to get up in this House and debate it. It is important that we get this right.

What we have is a redux of the old bill the Liberals brought forward. It was so roundly castigated and panned at committee that the minister had to go back to the drawing board. However, he has come back with essentially the same milquetoast legislation, which does not address the most critical parts of protecting the privacy of Canadians.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I switched from ChatGPT to Bing, since I also wanted to test that platform. I asked Bing, in connection to what my colleague from Abbotsford was saying, what the consequences of not legislating on the content of Bill C-27 would be.

It gave me an interesting answer, namely that, essentially, it could have an impact on the protection of data provided by companies.

Not legislating and not acting right now will therefore lead to more data losses unless we establish a framework, which is one of the aims of Bill C‑27.

By playing all these games in the House to waste time and stop us from passing Bill C‑27, are the Conservatives not putting Quebeckers' and Canadians' personal information at risk?

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, to bring it back to the topic of this debate, Bill C-27, the intention of the bill is to modernize the protection of digital privacy rights in Canada. The previous iteration of the bill was roundly panned by stakeholders when it was introduced in the previous Parliament. However, in this new version, Bill C-27, the government has added a few new elements, for example, regulating artificial intelligence.

Unfortunately, there are so many different elements within the bill that nobody can actually address all the issues within a 10-minute speech, so I will focus on the privacy issues that are sorely lacking within the legislation.

The bottom line is that the new bill, Bill C-27, remains fundamentally flawed and is, simply put, a redux of the former bill. Essentially, what it would do is put lipstick on a pig.

The dramatic and rapid evolution in how we gather, use and disseminate digital information in the 21st century has presented the global community with not only a lot of opportunities but significant challenges as we try to protect society and individuals against the unauthorized use of their data and information. This directly implicates the issue of privacy and the various Canadian pieces of legislation that address the issue of privacy.

This is not the first time the Liberal government has tried to “fix” a problem, and I use that term advisedly. It tries to fix things, but just makes things worse. In the 21st century, we are faced with immense challenges in how we protect individuals, our Canadian citizens, against those who might misuse their data and information. Any suggestion that this digital charter is actually an articulation of new rights is simply wrong. This is a digital charter, but it is not a digital charter of rights.

I will turn to the most significant and substantive part of the bill, the privacy elements. Very little of this legislation has been changed from the original Bill C-11, and the government has not measurably responded to the criticism it received from the stakeholders when the previous version of the bill was reviewed at committee.

There are five key additions and alterations to Canada's existing privacy protection laws.

First, the bill expressly defines the consent that Canadians must give in order for their data and information to be collected and used, and there are guidelines attached to that. We commend the government for doing that clear definition of consent.

Second, Bill C-27 addresses the de-identification, the anonymization of data that is collected by private companies. Again, that is important. We want to ensure when private businesses collect information from consumers that this information is not attached to a specific individual or citizen.

Just to be clear, the bill contains numerous broad exemptions, which we could probably drive a truck through, and will likely create the loopholes that will allow corporations to avoid asking Canadians for permission.

Third, the bill provides that all organizations and companies that undertake activities that impact the privacy of Canadians must develop codes of practice for the protection of the information they collect.

Finally, the act would create harsher financial penalties, up to $25 million, for a violation of Canadian privacy rights. We, again, commend the government for doing that.

However, let me say for the record that what we do not support is the unnecessary creation of a new personal information and data protection tribunal, which is another level of bureaucracy that would add more layers of complexity, delays and confusion to the commissioner's efforts to enforce privacy laws.

Canada is not alone in expressing concern over the risks that digital information and data flows represent to the well-being of Canadians and our privacy rights. Many other countries are grappling with the same issue and are responding to these threats, and none more so than the European Union. The EU has adopted its general data protection regulation, the GDPR, which has now become the world's gold standard when it comes to privacy protection in the digital environment.

The challenge for Canada is that the EU, which is a market of over half a billion well-heeled consumers, measures its willingness to mutually allow sharing of information with other countries against the GDPR, the standard it has set. Those who fall short of the rigour of that privacy regime will find it difficult to conduct business with the EU.

Do our current regime and this legislation measure up to the GDPR from the EU? No, probably not. In fact, for years Canada's digital data privacy framework has been lagging behind those of our international counterparts. The problem is that if we do not meet the standard, we will not be able to do the kind of business with the EU we expect to. As someone who played a part in negotiating our free trade agreement with the European Union, I know it would be an absolute travesty to see that work go to waste because our country was not willing to adopt robust privacy and data protections.

I note that, as is the custom with our Liberal friends, the bill creates more costs for taxpayers to bear. There is a creation of new responsibilities and powers for the commissioner, which we support, but this legislation calls for the creation of a separate tribunal, a new layer of bureaucracy and red tape that small and medium-sized enterprises will have to grapple with.

There are other unanswered questions. Why does this legislation not formally recognize privacy as a fundamental right? Regrettably, as presented, Bill C-27 misses the opportunity to produce a path-breaking statute that addresses the enormous risks and asymmetries posed by today's surveillance business model. Our key trading partners, especially the EU, have set the bar very high, and the adequacy of our own privacy legislation could very well be rescinded by the EU under its privacy regime.

Thirty-five years ago, our Supreme Court affirmed that privacy is “at the heart of liberty in a modern state”, yet nowhere in this bill is that right formally recognized. Any 21st-century privacy regime should recognize privacy as a fundamental human right that is inextricably linked to other fundamental rights and freedoms. By the way, I share the belief that as a fundamental right, it is not appropriate to balance off the right to privacy against the rights of corporations and commercial interests. Personal privacy must remain sacrosanct. When measured against that standard, Bill C-27 fails miserably.

I have much more to say, but I will wind down by saying that this bill is another missed opportunity to get Canada's privacy legislation right by consulting widely and learning from best practices from around the world. There is a lot riding on this bill, including the willingness of some our largest trading partners to allow reciprocal data flows. This bill is not consistent with contemporary global standards.

The Centre for Digital Rights notes that this legislation “fails to address the reality that dominant data-driven enterprises have shifted away from a service-oriented business model towards one that relies on monetizing [personal information] through the mass surveillance of individuals and groups.” That should be a wake-up call to all of us. Sadly, this bill fails to listen to that call. Let me repeat that there is a move toward monetizing personal information through mass surveillance of individuals and groups, and the government has not yet recognized that.

For those reasons, I expect the Conservatives will be opposing this bill and voting against it.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, I am impressed that Bill C-27 would give the Privacy Commissioner some teeth to enforce penalties. That I acknowledge. I also see it as a positive that there is some attempt to create some sort of regulatory framework, but it does not go far enough. This framework has to start from the federal government and work its way down so we have an umbrella legislation to protect the digital privacy of Canadians.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I am known for my perspicacity, so I decided to ask ChatGPT another question.

I asked it to come up with a question for my Conservative colleague from Haldimand—Norfolk about the importance of enhancing data and privacy protection in Bill C-27. That was what her speech was about.

ChatGPT replied: “Sure, here is a question for the Conservative member. The question is as follows: As a Conservative member, how does she think that Bill C‑27, which aims to modernize the Privacy Act”—already this is a step up from the other question—“will offer better protection for Canadians' data and privacy? Also, what are the key points she would like to see in the bill to ensure the adequate protection of personal information?”

I am very impressed by artificial intelligence because it touches on the role of the official opposition, which is not just to complain, but also to make suggestions.

I would be very curious to hear my colleague's thoughts on the subject, because I did not hear many constructive remarks in her speech.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, I am thankful for this opportunity to speak to Bill C-27, the digital charter implementation act, 2022. While there are many important components of Bill C-27 to debate, my speech today will focus on just two aspects. The first is privacy, and the second is identity.

The protection of both the privacy and the identities of Canadians is essential. We need to ensure that strong legal mechanisms are in place to guarantee that protection. Connected with that is the need to protect from the commercial interests of private companies, as well as protection from the government and its potential overreach into the private lives of Canadian citizens. Consequently, I believe a national digital charter is urgently needed. To protect Canadians, it is important that we have a piece of legislation that acts as an umbrella to protect Canadians from government, and to uphold the privacy of Canadians' data and their digital identities.

The second part of my speech will highlight some of the breaches that have occurred over the past three years. These breaches drive home the urgent need for more stringent protection for Canadians when it comes to privacy and protecting their private information.

Privacy rights are at the heart of any democracy. They are necessary for reinforcing the limits and boundaries between private citizens, their government and the private sector. In Canada, individual liberties are guaranteed by section 7 of the Canadian Charter of Rights and Freedoms. Our Chief Justice of the Supreme Court has made comments on this. She stated, “liberty...depends on and mandates respect for the individual and his or her right to be free from government restraint, except as authorized by law.”

Justice McLachlin further explains why it is important for government to keep the people informed and to answer questions, stating, “People who possess power, even small administrative powers, may use information they should not have improperly. And even if they don’t, the individual’s fear that they may use it, often leads to unwilling compliance.”

Just as we have fundamental freedoms entrenched in the highest law of our land to protect us from government encroachment of our freedoms, I also believe that it is necessary to have digital data privacy legislation. That is a fundamental right that urgently requires the strengthening of our legislative protections and enforcement.

That is why we need a federal digital charter, which would act as an overarching piece of legislation. However, Bill C-27, the digital charter implementation act, falls short of this very important objective. The Office of the Privacy Commissioner, for years, has made several calls for reform. Privacy watchdogs have repeatedly lamented that our federal privacy laws are outdated, that they fail to provide the needed legal protections in an increasingly digital world.

Canadians also have serious concerns about privacy. First, they have concerns about how their private information is being used, and what large corporations and governments are doing with it. Second, these concerns have turned into a fear because of the misuse and abuse of private information in the recent years.

This leads me to the second point of my speech. I will speak about the bigger problem in the privacy landscape in this country, which is that the Liberal government is failing to update its own legal boundaries and parameters in this area. The reality is that this bill does not touch on the Privacy Act, the act that governs the government, and this digital charter does not cover how the government handles the information it collects from Canadians.

Essentially, this bill is saying, “Do as I say, not as I do.” With this bill, the government is telling businesses, even sole proprietorships, that they should add additional layers of red tape under the threat of financial penalties. Business owners are still struggling to recover from COVID setbacks, lockdowns and government red tape.

My fear is that many of these small businesses, subject to these new requirements, would not be able to survive or have the capacity to implement some of these new requirements. These demands come even though government itself has failed to lay down the rules and regulations as to what is needed in the form of a regulatory infrastructural framework to secure our digital future.

A digital charter is needed to protect Canadians, but the federal government should be leading by example by outlining a digital charter that would protect the personal data and privacy of its own citizens first, before it asks businesses to do so. Let us be honest that the number one privacy concern Canadians have right now is how their government is using their information. These fears were exacerbated during the trucker convoy when Canadians’ bank accounts were frozen and property was confiscated through the abuse of the Emergencies Act.

Canadians still remember how the government quietly spied on their movements during the pandemic without their consent. A year ago, it was discovered that the Public Health Agency of Canada was tracking Canadians' movement during the pandemic. This was done without their knowledge, and PHAC wanted to keep doing it quietly for years into the future, but it was the Conservative opposition that discovered this breach and stood up for Canadians. We demanded answers from the Public Health Agency on the way the data was collected, how it was defined, what third parties were privy to the data and whether any data was reidentified. It is important that the government answer these questions and sets standards because it is falling short of its own requirements.

Canadians have not forgotten even the ArriveCAN debacle, the privacy questions around its mandatory use, and the terms and conditions associated with it. In other words, exactly what personal data and identifying information has been shared outside the app? Under what circumstances, and with which domestic or international organizations, was it shared? The app’s privacy notice even stipulated that the government had the right to share our information contained in the app with international organizations and institutions.

Canadians have a right to know with whom their data is being shared. This matter, it is no surprise, was referred to the Privacy Commissioner for an investigation. We are still waiting for an answer on the ArriveCAN privacy breaches.

Let us not forget that Canadians were fined thousands of dollars and threatened at their own borders for not submitting their own private medical information. This was, in my view, a massive overreach of government powers, but the reality is that this overreach happened because Canada has insufficient legal safeguards in place to prevent such abuses, and this creates a profound distrust in government.

It concerns me that the government is moving toward integrating a digital proof of identity framework that would massively expand the centralization of government access to the private information and data of Canadians. There are numerous ethical abuses that relate to this data collection.

The biggest concern is having all of one's private information in one place. Imagine our health information, driving information and banking information all in one portal. This would give information handlers a great deal of power over our data. This power urgently needs to be kept in check, and we need public experts in consultation on the ethics behind this centralized data collection power to uncover what we need to do to protect Canadians.

In conclusion, Canada’s digital privacy framework has long been in dire need of modernization. I want to thank the Standing Committee on Access to Information, Privacy and Ethics, which worked hard on this issue for years. Canadians must have the right to access and control the collection, use, monitoring and retention of their personal data. However, in Canada, the Liberal government is failing Canadians by not prioritizing its own accountability when it comes to protecting privacy rights. The bill sadly fails to put forward a rigorous and comprehensive legislative framework that would defend Canadians’ data, privacy and digital identities, now and in the future.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, given that this is a debate on artificial intelligence, I thought it might be fun to have ChatGPT make up a question for my Conservative colleague from Medicine Hat—Cardston—Warner about passing Bill C-27 and the Liberal government's lack of urgency, since that is one of the things my colleague mentioned.

This is ChatGPT's question: “How does his party view the Liberal government's lack of urgency to pass Bill C‑27, which is designed to protect workers and retirees in defined benefit pension plans in the event of employer bankruptcy? Also, how does he think this inaction could affect affected workers and retirees, as well as the economy as a whole?”

There is room for improvement, but the crux of the question is there. In terms of delays, I understand that the Liberal Party could have introduced a similar bill a long time ago, but my colleague said that he would vote it down all the same.

Are we not at the point where we should approve the principle of the bill quickly and improve the content in committee?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, it is, again, an honour to rise and speak in this place on behalf of my constituents of Medicine Hat—Cardston—Warner in relation to Bill C-27. It is dubbed the digital charter implementation act.

It is really frustrating to continually see legislation from the Liberal government that is sloppy, lazy and really incomplete, to be honest, and this bill is no exception.

Canadians have seen most of this legislation before in a failed attempt back in 2020. That legislation died on the Order Paper when the Prime Minister took his costly, ill-timed and overly optimistic opportunity to call an election. Since then, we have had three years of inaction on this file, and now the government has tabled this piece of legislation, Bill C-27, which should have been more focused on giving the people of Canada the privacy rights they deserve.

Instead, this legislation is literally the least that they could have possibly done in this regard. The bill is a flawed attempt to start the long overdue process of overhauling Canada's digital data privacy framework. Conservatives will be looking at putting forward some common-sense amendments at the committee stage to protect both individuals and small businesses alike and to ensure that it is the best possible legislation moving forward.

The Conservative Party believes that digital data privacy is a fundamental right that urgently requires strengthened legislation, protections and enforcement. Canadians must have the right to access and control collection, use, monitoring, retention and disclosure of their personal data.

It is unfortunate that we could not rely on the Liberals to get it right the first time, but maybe they will have the modesty, humility and common sense to accept the amendments that will be coming, instead of once again using their NDP coalition to control and steamroll at committee stage.

It is also a shame because Canada's digital data privacy framework has been in dire need of modernization for years. This government has been dragging its feet as well for years on this critically important legislation.

It appears that there is no good reason as to why there has not been advancement on this legislation. Clearly, they did not spend their extra time making the legislation any better than when it was first proposed in 2020.

Conservatives will be looking to see how this bill can be improved. However, when looking at how to improve something, we need to look at why it is even in front of us to begin with.

The Liberals brought it forward today because they were finally exposed for being flat-footed on Canadians' data protection and how they were exposed. Let us think about TikTok.

Michael Geist, Canadian research chair in Internet and e-commerce law at the University of Ottawa, said that he found it “pretty stunning” that the Liberals had to block TikTok on government devices as a precaution because, again, “part of what [the Liberals] were attributing the TikTok ban to was essentially Canada's weak privacy laws.”

The expert continued to say that, when it comes to Bill C-27, the government “sat on it. It barely moves in the House.”

He is not alone in his criticism either. Former privacy commissioner of Canada Daniel Therrien shared similar concerns to those of Michael Geist and those we as Conservatives have.

The former commissioner, Mr. Therrien, argued that the solutions in proposed Bill C-27 are not strong enough to rein in technology companies from pursuing “profit over respect for democratic values”.

He also said that Bill C-27 “will not provide effective protection to individuals, in part due to weak enforcement provisions.”

Former commissioner Therrien's most notable criticism, however, is in his retort to the Liberals' claim that the bill “will create the most important penalties among G7 countries”, which is called “simply marketing”.

This is just a gentlemanly way of a former public official saying that it is not really the case. There are those of us who would call it by some other name.

At best, Bill C-27 is a first step. It is better than the nothing that the Liberals have done for the last three years. That is where the catch-22 is with this bill as proposed.

Doing something will be better than staying in our current technological stone age, with respect to data privacy.

Specific items like the bill's requirements for all businesses to have a privacy watchdog and maintain the public data storage code of conduct are positive measures. However, it does cause worry about the burden this new layer of red tape will have on small business and especially for sole proprietors. Again, on a catch-22 of this lazy Liberal legislation, the law does not go far enough to protect children's privacy for example.

While the information of minors is finally included in the legislation, the definition of what is sensitive, what a minor is or who a minor is are not set out, and the sensitive information of adults for example is not given the same special provisions. This means that businesses are left to decide what is sensitive and appropriate for minors. It also means that the courts, when interpreting the legislation, will understand that if not amended, the sensitive information of adults was specifically left out of the legislation.

Further, businesses will have to navigate varying rules in each province where different definitions of a minor actually apply and that depends on provincial law. This is not good for protecting minors, this is not good for protecting Canadians' sensitive information and this is not good for businesses.

Finally, the fundamental problems in this bill can be summed up in that this bill does not recognize privacy as a fundamental right. Thirty-four years ago, the Supreme Court said that “privacy is at the heart of liberty in a modern state”.

Conservatives believe that individuals are worthy of privacy as a fundamental right, and the concept of privacy as a fundamental right is worthy of legislative protections. Based on that alone, the Liberals have missed the mark on this legislation. Once again, it is up to the Conservatives to fix the Liberals' poorly written legislation.

As I close, I want to offer my thanks for the hard work of the Conservative members of the access to information, privacy and ethics committee. They have done a great job to date. They spent a lot of time on the previous iteration of this legislation, and I have heard a great deal about how Canadians' information and data is used without their consent. With the many identified flaws of the bill, Bill C-27, I think it would be best if this bill were voted down and redrafted, honestly, in order to take these issues into account. However, the NDP-Liberal coalition will surely ignore doing these things right in favour of expediency and send it off to committee.

With that, Canadians and I are leaving the flaws that I have pointed out, and there are many more, along with the additional flaws that I am sure my colleagues will find in their review and will need to be fixed at committee. The Liberals have left the committee a lot of work, but I know that my colleagues there are up for the challenge.

The House resumed from March 7 consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

Citizenship and Immigration

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I am honoured to rise and have this debate in our House, the House of Canadians, where we are allowed to bring forward issues that are important to Canadians, including those people in the diaspora community from Iran. I want to remind everyone that this motion from the immigration and citizenship committee was based upon two facts.

First, the IRGC attacked Ukraine International Airlines flight PS752. It was determined to be an act of terrorism, and the Iranian regime needs to be held to account for it. Of the 176 people who died on that plane, 55 of them were Canadian citizens and 30 of them were permanent residents. On top of that, numerous young Iranians were coming to Canada to study.

The Liberals have suggested that we are taking up valuable, precious time from the government's agenda by having this debate to highlight the shortfalls of the Liberal government in addressing the needs of those who were impacted: the families in Canada, the victims of those terrorist acts and those who lost loved ones. I want to say, on the House of Commons floor, that it is our right as parliamentarians to bring forward these types of concurrence motions, to have these discussions and to do it in a respectful way.

I am disappointed when the member for Winnipeg North continues to cry about the fact that this is taking away from the debate on Bill C-27. I remind the parliamentary secretary that this bill was tabled in the House of Commons in June 2022. I remind him that the Liberals have only brought this forward on three occasions for debate. Therefore, the digital charter that he is decrying as being so important to Canadians has not been a priority for the government as it has not brought it forward very often over the last nine months.

Taking three hours today to debate this important issue and to talk about how the Government of Canada has not listed the IRGC as a terrorist organization is something all Canadians need to understand. This is about Canada. This is about the threat environment that we are facing.

We know there is an increasing threat from the IRGC. Its terrorist activity is not just against the people of Iran. It is not just against the people who were unfortunate enough to be on flight PS752 and were shot down and killed. We have to remember that the IRGC is exporting its terrorism around the world. It is on the ground, as we have just witnessed in Syria, killing American soldiers. We know that the IRGC has been supporting the genocidal Assad regime in Syria. We know that the IRGC has been helping Hezbollah in Lebanon and in Syria. It has been helping Hamas carry out terrorist attacks against the State of Israel. We know that today, in Ukraine, the IRGC is on the ground, operating drones, killing Ukrainian civilians and bombing Ukrainian infrastructure. All of these are atrocities, war crimes and violations of the Geneva Convention. If there is any organization that ever deserved to be listed as a terrorist organization, it is the IRGC from Iran.

When the Liberals talk about the response to the committee report, it is that they have taken some measures. They are targeting individuals, including 1,000-plus people who are part of the IRGC leadership. However, let us remember that this is an elite fighting force that the Iranian terrorist regime has brought forward, recruited and moulded. These are the people who continue to serve even though there is only a one-year mandatory service. These are the people who stay and they are more than happy to go out and kill those whom they consider as being unclean.

We see it active in Canada. Today, the Persian community faces coercion, intimidation and death threats from operatives of the Islamic Revolutionary Guard Corps. We have seen it interfere with our politics.

We are having this discussion right now about the foreign interference by the People's Republic of China, by the Communist regime in Beijing, influencing the elections here in 2019 and 2021. We also know that Iran has been active in trying to intimidate and coerce the Persian community to support its efforts, its cause and its potential for election outcomes.

In this motion, we think about Mahsa Amini, women, life and freedom. She was a brave, young Kurdish girl who stood on the streets of Tehran and refused to put on her head scarf. The morality police, under the direction of the IRGC, beat her to death. That has sparked civil disobedience, protests throughout Iran, and rallies of support across Canada and around the world.

I have had the pleasure of joining our Persian community and standing with it in solidarity, fighting for women, life and freedom, the things that we take for granted here. Our diaspora community from Iran expects the government to do better in supporting their cause, those who seek democracy and liberty, and enjoy the life we have in Canada. They expect us to be there for them.

As we have witnessed, the IRGC continues to crack down on those who take to the streets. Not only is it going after those brave women and those who stand beside them fighting for equal rights for an egalitarian society, for a pluralistic culture, but it is also cracking down on religious and ethnic minorities, like the Kurds, the Baha'is, the Baluch and the Azerbaijanis. The IRGC continues to target them, make them political prisoners and torture them in those prisons.

It is time for us, as Canadians, and for the government under the Liberal Party to stand up for those people who are fighting so hard for that opportunity to have freedom, democracy and a rule of law that respects individuals, not their ideology.

I call on the government to do more than just list the IRGC as a terrorist organization. We should be paving the way at the International Criminal Court to ensure that those responsible for the attack on flight PS752 and those who are responsible for the attacks against those innocent civilians, be dragged in front of the Hague and tried for the atrocities they are committing.

The crimes against humanity are so easily documented. If we believe in the Geneva Convention and if we believe in an International Criminal Court, then this is the time to start bringing forward the cases, as we have done with Vladimir Putin and Russia to ensure that he is held responsible for his crimes against humanity with the kidnapping of thousands of children from Ukraine and brainwashing them in Russia.

This is also ensuring that those in the regime in Tehran, those fanatics, are also dragged in front of the Hague for the crimes they are committing against their own people, for the crimes they are committing throughout the Middle East, for the crimes they are committing against Ukraine, both in shooting down PS752 as well as going to war with Russia in Ukraine, flying those kamikaze drones against civilians and civilian infrastructure.

I call on the government to use Magnitsky sanctions once and for all, which it quit using in 2018, especially against the IRGC that is standing shoulder to shoulder with Putin. Let us call them out under the Magnitsky sanctions, recognizing that they are both gross human rights violators as well as corrupt foreign officials.

As this motion calls on the government, let us finally do the right thing and list the IRGC for what it truly is: a terrorist organization and it should never be allowed to have any assets or the ability to raise funds in Canada, directly or indirectly, that benefit its ideology as well as its terrorist activities.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I want to take exception to the member for Winnipeg North's comments minimizing the deaths of 176 people who were killed on PS752, 55 Canadians who were on that flight, plus 30 permanent residents who called Canada home, never mind all the students coming from Iran who were returning to their universities here in Canada.

He does not want to debate this; instead, he is trying to say we need to get on with Bill C-27. Let us remind the member that they have had the bill before the House since June of 2022. In nine months, they have only brought that bill forward three times.

I would say that it is not a priority for the government. The member should get up and apologize to the Persian community across Canada and to all the families who lost loved ones on flight PS752.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, we have a fixed amount of time to debate a wide spectrum of both domestic and international issues. Today members came in prepared to listen, debate and have an exchange on the issue of the digital charter because Canadians are concerned about this issue. We were going to have literally hours of debate on it. That will not happen because the Conservative Party, under motions, brought forward a report it wants to have a debate on.

Yesterday, Conservatives could have provided ample ideas, thoughts and reflections on the report because we were debating Bill C-41. I do not know if any member made reference to Iran, let alone the report, at all yesterday, but it would have been absolutely relevant to have done so.

What other options do opposition members have? They just had an opposition day. They wanted us to talk about a budgetary measure as opposed to talking about this issue they say is so critically important that it had to be debated today. It could have been debated a couple of days ago when they had an opposition day. They could have designated an entire day to that and had a resolution at the very end of that day, which would have forced a vote on the issue.

This is part of the games Conservative Party members play day in and day out. As the Government of Canada continues to be focused on Canadians and the issues that are important to Canadians, we will continue to tolerate the games being played by the Conservatives. At the same time, we will deal with those international issues that are so critically important to our nation in reflecting true Canadian values.

Last year, Mahsa Amini, a young lady in her early 20s, was in the community in Iran and was picked up by the morality police. It was later said that she had a heart attack and that caused her death. The morality police are not fooling anyone. We know she was abused and beaten, and that is what caused her death.

We understand and we appreciate those true freedom fighters in Iran. They are the brave women of Iran who are standing tall. They are ensuring that individuals like Mahsa are not forgotten and that what she stood for will continue to prevail and will be fought for in Iran. Mahsa inspired the world to mobilize and to recognize that what was taking place was just so wrong.

I would argue that Mahsa is one of the reasons that even members of the Standing Committee on Citizenship and Immigration feel the way they do in regard to Iran and what is taking place there today. It motivates individuals like myself and other MPs to stand and be vocal on this issue not only inside the chamber but also throughout our communities.

The motion that came from the standing committee reads:

That the [standing] committee [on citizenship and immigration] report the following to the House: In light of the downing of the Ukrainian International Airlines flight PS 752 by the Iranian Revolutionary Guard Corps—

That is what we often refer to as the IRGC.

—and in light of the killing of Mahsa Amini by the Iranian Guidance Patrol, that the committee demands the government stop issuing visas to all Iranian nationals directly affiliated with the Iranian Revolutionary Guard...Iranian Armed Forces, Iranian Guidance Patrol or Iranian Intelligence Organizations and that, pursuant to Standing Order 109, the committee request a response to the report by the government.

That response is well under way.

Mahsa encapsulated what is so wrong when we contrast Canadian values to what took place between her and those in the Iranian society who support the regime that is currently in place. We see how wrong it is.

The downing of the Ukrainian airline touched Canada, as I made reference to, in a very profound way and to me, personally. Kourosh is a dear friend whom I have been meeting at the local McDonald's on occasion. He has actually met many parliamentarians because of his former role in the real estate industry. He would make presentations to members of Parliament. Kourosh's wife was on the plane that went down and, like many other victims' families, he faced the horrors of the downing of that plane.

I think it is important that the Prime Minister appointed the former minister of finance Ralph Goodale to investigate the situation. We wanted to ensure a sense of accountability for that tragedy. We also worked with other governments, such as Ukraine, where the flight was headed. It was a Ukrainian international flight.

The effect of the lives of those who passed away on the lives of those here in Canada is so profound. When we look at the achievements of those individuals in a relatively short time span here in Canada, they made incredible contributions. I like to think that members, no matter what side of the House one sits on, along with the broader community that follows what is taking place in Iran virtually on a daily basis, can imagine and provide sympathy for those victims.

Our Iranian community is large and it is very much interested and tuned in to the issue. That is why I take offence when someone in the chamber accuses the government or myself of not having a high priority in regard to this issue because nothing could be further from the truth. The government and its ministers have been following what is taking place in Iran very closely, and it is taking appropriate actions where it can in dealing with the Iranian regime.

Where I challenge opposition members is on the manner in which they feel that they can declare that an issue of urgent importance be used as a tool as opposed to a legitimate debate. The Conservatives will stand up today and reflect on this issue, as opposed to talking about the important domestic issue of the digital charter and the protection of personal information.

I raised that because the Conservatives will criticize the Liberals for not allowing enough time for debate on Bill C-27 if the government needs to bring in any form of time allocation in order to get the bill through. Unfortunately, this issue today is no more a priority for the Conservative Party than it was last week when it completely ignored the issue when it had an opposition day motion.

Today it is only important because it wants to disrupt the government agenda. It is an agenda that deals with personal information on the Internet. It is something I know of first-hand. We are often asked to bring concerns from our constituencies here to Ottawa, and we do believe that within our caucus.

I can assure members that there is a genuine concern about information that is being collected on the Internet. I feel that the Conservatives taking away from that debate today does a disservice to those who are concerned about how the Internet collects data. Bill C-27 should be going to committee at the very least.

All one needs to do is look at the government's agenda. We have a budget this afternoon and there will be budget debates. We have other legislation, and the Conservatives know it is a very aggressive legislative agenda. It will cause us to continue, as we did last night, whether the Conservatives want to or not. As long as there are other parties that understand the importance of having that debate, we will have to sit later.

I want to conclude by talking about the debate on Bill C-41 yesterday. It is substantial legislation that would ensure there is ongoing humanitarian aid to countries like Iran and other countries. It is for those in the Iranian communities to know and understand that the Government of Canada, through its ministries, is following what is taking place in Iran and it is taking actions that will make a difference. We want to keep our Iranian communities not only safe but also feeling safe.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I found it especially interesting to hear my colleague talk about Bill C‑27. I am in the House today because I am interested in this topic. Unfortunately, the interpretation was not working and I would like that to be corrected.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Yes, Madam Speaker, we are bringing it on because this legislation is important to Canadians.

What was supposed to be happening today? A number of members came to the House anticipating we would be debating Bill C-27. That is the digital rights legislation about the thing called the Internet. We are all somewhat familiar with it, I suspect, everyone except maybe those from within the Conservative Party.

The Internet raises a whole litany of concerns regarding personal identity theft and how data is being collected on the Internet. When I asked the member across the way a question about the report, he said it is about priorities. Yes, it is about priorities. Canadians want their identities protected. It is substantial legislation, which we are supposed to be debating as opposed to participating in—

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I will get the opportunity to expand upon the point I am going to make to my colleague across the way.

Right away, I am concerned that the Conservatives have chosen this, as opposed to using an opposition day so that we could have a good and thorough discussion on the issue and hopefully get some more positive results coming from a full day of debate using an opposition day. They have chosen to use a concurrence debate, which prevents us from being able to have a number of additional hours of debate on the issue of Bill C-27, which is the digital charter that deals with the privacy of Canadians.

I am wondering if the member could explain to Canadians why the Conservatives continue to have misplaced priorities by not dealing with issues such as the personal security of Canadians on the Internet and by bringing forward a report like this today, as opposed to on an opposition day.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, there is no doubt that the issue of the IRGC and how it is labelled is of the utmost importance. I do not question that. I will be afforded the opportunity to comment on the issue shortly, but part of the concern I have relates to the games being played by the Conservative Party. We are supposed to be debating Bill C-27 today. I am wondering why the Conservatives continue to go out of their way to prevent debate on government bills. Does the member not feel any obligation to Canadians or the constituents he represents to at least ensure there is debate time? They ask for debate time and should use that time to at least debate the government's agenda.

Telecommunications Act

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, these are the words spoken yesterday by President Xi of China to Vladimir Putin as they departed company in Moscow: “Change that hasn’t happened in 100 years is coming and we are driving this change together.” Their meeting, which took place under the shadow of Russia's onslaught in Ukraine, was one that the experts stated was a meeting to build Russia's and China's alignment against the U.S. and the west, “and a world order more suited to their more autocratic agendas”.

Before us is a very serious bill at a very serious time, and it also would work in coordination with a lot of other serious bills we have on the floor right now. Bill C-34 is on the Investment Act, which looks closely at what investments are security minded and good for Canada. Bill C-27 would enact the consumer privacy act and look at the protection of Canadians' privacy. We have stated all along that privacy for Canadians needs to be a fundamental human right. The bill on interoperability and the right to repair look at different ways in which we are dealing with our IP and technology in Canada.

Today at the science and research committee, we continued the study of IP commercialization, ensuring we can develop technology and hold technology in Canada. We lose a significant amount of our IP to the Americans, to other nations and to foreign entities.

We talk about the world order and what is happening in the world. Albert Einstein famously said that he was not sure what weapons would be used in World War III, but that the weapons of World War IV would be sticks and stones. The weapons being used right now are joysticks and software. We should make no mistake that, at this moment, we are already at war. We are not only talking about Ukraine. The member previous spoke about some of the attacks that are happening from a centre of cyber-attacks in Ukraine.

Cyber-attacks are happening across the world, and they are happening right now in Canada. There has been a lot of different alarming statistics on cyber-attacks and malware attacks in Canada. We know the Canada Revenue Agency was attacked in August 2020, impacting nearly 13,000 Canadians, who were victims of that. There was also a hospital in Newfoundland in October 2020 where cybersecurity hackers stole personal information from health care employees and patients in all four health regions. That affected 2,500 people.

Black & McDonald, a major defence and security company and contractor, was hit with ransomware just two weeks ago. That is our security being hit by the very thing it is trying to protect us from. Global Affairs Canada was attacked in January 2022 right around the time Russia engaged in the illegal invasion of Ukraine. It was reported that it may have been Russian or Russian state-sponsored actions responsible for the cyber-attack on Global Affairs.

Most famously, there was a ransomware attack on critical infrastructure in the United States back in May 2021 where pipeline infrastructure was attacked. President Biden, who will be here tomorrow, issued at that time a state of emergency, and 17 states also issued states of emergency. It was very serious, which shows the capabilities of some of those cyber-threat actors. With ransomware, there are companies that attack companies and then demand a ransom or money before they return those computers or the networks back to the owners. It is now worth $20 billion. That is how much money ransomware is costing businesses. Back in 2016, it was only $5 billion.

The technology is rapidly advancing, and it is a war. It is a war that is affecting Canadians at this very moment, and it is something we have to be very serious and realistic about looking at what cybersecurity is, what it means and what we have to do as Canadians and as a Canadian government to combat attacks.

We know that the bill is something we support. We, of course, support the bill. Cybersecurity is very important, and as the member noted earlier, we have to make it right. We do not have time for a flawed bill or to race something through. Because of the advancements and because of the need to be very serious and realistic about cybersecurity, let us make sure we get the bill to committee and make sure then that we look at certain amendments that would get it right.

The question at this very moment is whether the government is taking this seriously enough. Despite a ban on Huawei announced by the government in May 2022, this week it was ascertained by the member for Dauphin—Swan River—Neepawa, as we were talking about IP commercialization in the science and research committee, that UBC is still working with Huawei after May 2022.

The minister assured us that Huawei was banned, that Huawei was done. Of course, there were reports months ago of a crackdown on IP being stolen and shared from Canadian universities. It has already been projected that 2023 will be the worst year for ransomware, for cybersecurity and, of course, for IP leaving Canada.

We have to take this seriously, and I know that members across the way have talked about it. Of course, this bill does that, but we need to be serious. We need to talk about cybersecurity, which means being realistic and bold in how we counter, and how we aid the west in winning, the war over cybersecurity.

There are amendments to the bill that we would like to see. Number one is to ensure that we protect and safeguard our national security and infrastructure. I know a member talked earlier about the different silos that exist. Probably the most important function is to ensure that silos in the government dealing with cybersecurity are talking to one another. The Americans deal with their cybersecurity concerns through the National Security Agency, the Department of Homeland Security, the Federal Bureau of Investigation and the Department of Defense. They all work alongside each other to enhance the cybersecurity establishment that was developed in 2018.

Similarly, Canada has the Communications Security Establishment, part of which is the Canadian Centre for Cyber Security, but as a member noted previously, is it talking to NSICOP and CSE? Are we making sure we are talking to the different departments? We know that the government is pretty large and unwieldy. We have to make sure that these departments are working together.

We also have to make sure we are looking after our businesses, as 40% of Canadian SMEs do not have any cybersecurity protection. It is going to be very costly for those businesses to implement that. As a business owner, I know the single biggest cost when it comes to cybersecurity is actually insurance. Insurance premiums just for cybersecurity attacks are going up and up. Every year they have increased by 20% to 30%. Of course, that is aligned with the $20 billion we are seeing from malware and ransomware across the world and the increase in cyber-attacks.

We have to make sure that we help our businesses, so perhaps we need to look at tax credits. One thing we can do is ensure that we share best practices and that businesses get support from the federal government to enhance their cybersecurity.

Another concern we have is how much power the minister will get, as the minister is supposed to get all the power. We have seen this with other bills. We have seen this in bills on the right to repair and interoperability. We have seen it in Bill C-27. Perhaps it is better to look at an ombudsman. We have talked about the Governor in Council and orders in council, but we want to hear from the security experts at committee to ascertain who exactly should be making these decisions instead of bringing them back to one minister. This bill right now could fit under the INDU committee and the industry minister, but it is going to the public safety committee, so already we have two different departments managing this bill. Why does one minister have to handle it? Why can it not be a broader process to ensure that we are seeing some congruence?

Privacy is something we talked about quite a bit. We will be debating Bill C-27 in the House tomorrow, and I certainly feel that privacy needs to be a fundamental human right. Part of this bill has different groups and organizations concerned about how we are protecting Canadians' right to privacy. When they lose their privacy, who is responsible for that? There will be a lot of different witnesses coming to committee. When we look at cybersecurity, we have to ensure we are protecting Canadians' fundamental right to privacy and ensure we are doing all we can so that if their privacy is breached, Canadians can find some relief.

We have talked about Bill C-27 and a tribunal, and maybe giving more powers to the Privacy Commissioner, who should have more power to look at whether we should go after criminals or organizations for breaches. We also have to look at the law and at what we are doing to go after criminals who are engaging in cyberwarfare and who continue to be a threat to Canadians.

Russia and China are very concerning right now, and there are a lot of different reasons for that. Russia is growing increasingly reliant on China as both an import market and an exporter of electronics. Both leaders are building a closer energy partnership on oil, gas, coal, electricity and nuclear energy. They are going to build the Power of Siberia 2 pipeline through the territory of Mongolia. This is important because Taiwan is coming up—

Business of the House

[Mark Holland, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, I am sure the hon. member across the way, having not had an opportunity to ask the Thursday question and not having been granted that opportunity, might be somewhat confused about the nature of the Thursday question or what it would be about, so of course we excuse him for that.

This afternoon, we are going to be concluding second reading debate of Bill C-26, concerning the critical cyber systems protection act. I would also like to thank all parties for their co-operation in helping to conclude that debate.

As all members are aware, and as I am sure you are aware of and quite excited for, Mr. Speaker, the House will be adjourned tomorrow for the address of the United States President, President Joe Biden.

On Monday, we will be dealing with the Senate amendments in relation to Bill C-11, the online streaming act.

Tuesday, we will continue the debate at second reading of Bill C-27, the digital charter implementation act, with the budget presentation taking place later that day, at 4 p.m.

Members will be pleased to know that days one and two of the budget debate, which I know members are anxiously awaiting, will be happening on Wednesday and Thursday, respectively.

On Friday, we will proceed to the second reading debate of Bill C-41, regarding humanitarian aid to vulnerable Afghans.

Telecommunications Act

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, that may be a better question for the government to answer, but I do not believe this is the intent of this bill. This bill is about cybersecurity. The government has another bill before the House, Bill C-27, which is a bit closer to privacy changes. The government has not proposed changes to the Privacy Act or the Elections Act, so I do not think this bill is relevant to the question that the member raised. The member is getting away from cybersecurity and into the much broader rubric of the privacy of Canadians. She raises some points, but I do not actually connect them to this bill.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, it is a pleasure to rise and join the debate this morning in the House of Commons. I will be sharing my time with the member for Fort McMurray—Cold Lake.

Bill C-26 is a bill that addresses an important and growing topic. Cybersecurity is very important, very timely. I am glad that, in calling this bill today, the government sees this as a priority. I struggle with trying to figure out the priorities of the government from time to time. There were other bills it had declared as absolute must-pass bills before Christmas that it is not calling. However, it is good to be talking about this instead of Bill C-21, Bill C-11 or some of the other bills that the Liberals have lots of problems with on their own benches.

Cybersecurity is something that affects all Canadians. It is, no doubt, an exceptionally important issue that the government needs to address. Cybersecurity, as the previous speaker said, is national security. It is critical to the safety and security of all of our infrastructure. It underpins every aspect of our lives. We have seen how infrastructure can be vulnerable to cyber-attacks. Throughout the world, we have seen how energy infrastructure is vulnerable, like cyber-attacks that affect the ability to operate pipelines. We have seen how cyber-attacks can jeopardize the functioning of an electrical grid.

At the local level, we have experienced how weather events that bring down power infrastructure can devastate a community and can actually endanger people's health and safety. One can only imagine what a nationwide or pervasive cyber-attack that managed to cripple a national electrical grid would do to people's ability to live their lives in safety and comfort.

Cyberwarfare is emerging as a critical component of every country's national defence system, both offensively and defensively. The battlefield success of any military force has always depended on communication. We know now just how dependent military forces are on the security of their cyber-communication. We see this unfolding in Ukraine, resulting from the horrific, criminal invasion of that country by Putin. We see the vital role that communication plays with respect to the ability of a country to defend itself from a foreign adversary, in terms of cybersecurity.

I might point out that there is a study on this going on at the national defence committee. We have heard expert testimony about how important cybersecurity is to the Canadian Armed Forces. We look forward to getting that report eventually put together and tabled, with recommendations to the government here in the House of Commons in Canada.

We know that critical sectors of the Canadian economy and our public services are highly vulnerable to cyber-attack. Organized crime and foreign governments do target information contained within health care systems and within our financial system. The potential for a ransom attack, large and small, is a threat to Canadians. Imagine a hostile regime or a criminal enterprise hacking a public health care system and holding an entire province or an entire country hostage with the threat to destroy or leak or hopelessly corrupt the health data of millions of citizens. Sadly, criminal organizations and hostile governments seek to do this and are busy creating the technology to enable them to do exactly this.

The Standing Committee on Access to Information, Privacy and Ethics conducted three different studies while I was chair of that committee that were tied to cybersecurity in various ways. We talked about and learned about the important ways in which cybersecurity and privacy protection intersect and sometimes conflict. We saw how this government contracted with the company Clearview AI, a company whose business is to scrape billions of images from the Internet, identify these images and sell the identified images back to governments and, in the case of Canada, to the RCMP.

We heard chilling testimony at that committee about the capabilities of sophisticated investigative tools, spyware, used by hostile regimes and by organized crime but also by our own government, which used sophisticated investigative tools to access Canadians' cellphones without their knowledge or consent. In Canada, this was limited. It was surprising to learn that this happened, but it happened under judicial warrant and in limited situations by the RCMP. However, the RCMP did not notify or consult the Privacy Commissioner, which is required under Treasury Board rules. This conflict between protecting Canadians by enforcing our laws and protecting Canadians' privacy is difficult for governments, and when government institutions like the RCMP disregard Treasury Board edicts or ignore the Privacy Commissioner or the Privacy Act, especially when they set aside or ignore a ruling from the Privacy Commissioner, it is quite concerning.

This bill is important. It is worthy of support, unlike the government's somewhat related bill, Bill C-27, the so-called digital charter. However, this bill, make no mistake, has significant new powers for the government. It amends the Telecommunications Act to give extraordinary powers to the minister over industry. It is part of a pattern we are seeing with this government, where it introduces bills that grant significant powers to the minister and to the bureaucrats who will ultimately create regulations.

Parliament is really not going to see this fleshed out unless there is significant work done at committee to improve transparency around this bill and to add more clarity around what this bill would actually do and how these powers will be granted. There have been many concerns raised in the business community about how this bill may chase investment, jobs and capital from Canada. The prospect of extraordinary fines, without this bill being fleshed out very well, creates enormous liability for companies, which may choose not to invest in Canada, not fully understanding the ramifications of this bill.

There is always the capture. We have seen this time and time again with the government. It seems to write up a bill for maybe three or four big companies or industries, only a small number of players in Canada, and yet the bill will capture other enterprises, small businesses that do not have armies of lobbyists to engage the government and get regulations that will give them loopholes, or lawyers to litigate a conflict that may arise as a result of it. I am always concerned about the small businesses and the way they may be captured, either deliberately or not, by a bill like this.

I will conclude by saying that I support the objective. I agree with the concern that the bill tries to address. I am very concerned about a number of areas that are ambiguous within the bill. I hope that it is studied vigorously at committee and that strong recommendations are brought back from committee and incorporated into whatever the bill might finally look like when it comes back for third reading.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Can I just follow up on that? Seeing all of the accounts of this C-18 legislation in reference to your company and the precedent it's supposed to set globally for you, I would have thought that at least you would send your CEO to speak to a country that represents 38 million people—or to the House of Commons that represents 38 million people.

I will move on to my next comment or question. I just spoke two days ago in the House of Commons about Bill C-27 and its implications for Canadians' privacy. Google once attempted to build a smart city in Toronto that would have collected massive amounts of personal and very private information for money. The basis of your business is surveillance, and you make a lot of money doing it.

We now see you as a company threatening Canadians that you will be censoring, or you have censored, 4% of the news content in Canada.

I have a simple question. Yes or no, do you think it's okay to block any news content to Canadians?

Digital Charter Implementation Act, 2022

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, I am looking at Bill C-27 and wondering what we make of the fact, and I know he commented on this, that we have three different bills that are all put together and only one is really new. We have seen the privacy pieces and the repeal of PIPEDA in the former Parliament's Bill C-11. The bill before us relating to artificial intelligence and high-impact AI and regulating that is essentially an entirely different scheme of legislation. Would the Conservatives agree that they should be split so we can examine them separately? I think that is already their position. What does the hon. member say to that?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is a pleasure for me to speak to Bill C-27 in the House today, a bill that deals with issues related to privacy, as well as the way that the government interacts with large corporations to protect, or not, the privacy of Canadians.

I want to say at the outset that I am deeply concerned by the fact that the government has clearly been captured by certain corporate interests. It is important to distinguish in this discussion between corporate interests and the idea of a free market. As Conservatives, we believe very much in the importance and value of a free market and a competitive market, a market that is legitimately a challenging and competitive place for businesses that have to compete with each other to have the best products, where some businesses come in to challenge and steal market share away from other businesses and so forth, where there are not gatekeepers preventing new entrants coming into business. We celebrate free markets and the competitive aspect of free markets rather than a situation in which a small group of large corporations is able to dominate and exercise undue and inappropriate power.

In this House, different parties have different dispositions when it comes to corporations. We have the NDP that generally takes kind of an anti-business approach in general, we have my party that champions the free competitive market and we have a government that is, sadly, captured by specific corporate interests, often at the expense of the free market, as well as at the expense of individual well-being. Paradoxically, the NDP, while it criticizes the government for that, is fundamentally complicit with the government in, on the one hand, criticizing its agenda as it relates to defending corporate interests, but, on the other hand, supporting the government and providing it with the supply it needs to continue in its misguided approach.

What we see in terms of the government's relationship with large corporate interests at the expense of the free market and individual well-being is clear across a broad range of cases. We could talk, for instance, about the government's fondness for specific companies in terms of outsourcing and procurement, how it has repeatedly gone back to McKinsey to do work that in fact could have and should have been done within the public service, despite McKinsey's track record in so many different areas. We can talk about the fact that while the public service has grown, outsourcing under the government has expanded dramatically. We can talk about how it has pushed companies to implement forms of political discrimination, such as freezing people's bank accounts. We can talk about a number of the violations of individual privacy and liberty that happen through the government's close relationship with corporations.

I will say, in general, there is this emerging concept of woke capitalism or stakeholder capitalism that I think we need to be thoughtfully critical of, this idea that large corporations should be making definitive determinations and forcing those implementations on the country using their power and that governments can push corporations to push woke ideas or particular views of the common good that arise not through free democratic deliberation, but that come about because of pressure from corporate interests. We see the government's fondness for this kind of woke corporatism approach, where it tries to pressure companies to align with and push its views on various issues.

Again, Conservatives are very supportive of competitive marketplaces where businesses are doing business, not assuming a preferential position in social values debates, where businesses have to compete to survive, where new businesses are able to compete with old businesses and where we support the development of new small businesses so that we do not have a concentration of corporate power, but, rather, a well-functioning, effective market economy. That is the vision that Conservatives are defending.

Let me talk specifically about the issue of privacy and how we see the working out of the government's kind of approach to and relationship with big corporations in terms of their approach to privacy.

I am very pleased the Conservative Party uses and has a member-driven policy document. On issues like this, if one would like to know where Conservatives stand, it is not just a matter of Conservative caucus discussion but it is also a matter of drawing from the work that hundreds of thousands of Conservative Party members do, deliberating at the riding level, having discussions, proposing ideas and bringing those to a convention that then leads to a standing policy document that helps to define and frame the values that Conservatives stand for. I know our Conservative Party is deeply committed to the idea of grassroots democracy and the role our members play in all aspects of decision-making.

That is very important, and in this particular context, we see that playing out in the area of the policy declaration. Our policy declaration recognizes the fundamental right people have to privacy. As a Conservative caucus, we are supportive in advancing and bringing to the House that view about fundamental rights, a fundamental right to data privacy that has come to us through the involvement of our members but that also reflects the widely held perspectives of Canadians beyond our membership, a fundamental right around the protection of data.

This bill, Bill C-27, could have mirrored the language from the Conservative Party policy declaration. It does not. It does not recognize the fundamental nature of rights around data privacy. Rather, it talks about kind of striking a balance between people wanting to have their privacy protected but also the fact there are certain corporate interests. There are interests of corporations the government is close to that might be negatively affected if we recognize the fundamental right to privacy of Canadians, so it effectively seeks to say there should be some balance between the idea of protecting people's rights and the fact there may be certain large corporations whose interests would be negatively affected by recognizing the privacy rights of Canadians.

In particular, although the bill speaks about a balance at a general level, it is so, to borrow a word from the member opposite, “flexible” that it creates space one could effectively drive a truck through, with so many different exceptions and exemptions that it is not really effectively protecting the privacy rights of Canadians.

A member opposite, in a speech just given, said that this is a flexible framework, that the bill is flexible. Well, flexibility is not always a virtue. In particular, it is flexible for who? Who is doing the flexing? Who is the one who is able to bend the bill back and forth to their own will and interests? I would suggest the flexing is not being done by the individual who is supposed to own their own data, the flexing is being done by these corporate interests the government is close to.

Even if one believes this should be a balanced approach, it is not a balanced approach. It is a highly “flexible” approach in which the bending and twisting is done by the particular interests the government has been and always I suspect will be close to until we are able to have a new government in this country that respects fundamental rights, respects privacy and believes in a free competitive market in which businesses compete instead of where particular corporate friends of the government are protected.

I want to draw the attention of members to specific sections in here that identify broad exceptions in the legislation. Subclause 18(3) would allow the organization or business to use a person's information if they have a legitimate reason for doing so. That is pretty flexible. If one wants flexible, we are going to say this data cannot be used in a certain way unless there is a reason to do so. I would submit most people who do things think they have a legitimate reason for them. Others might not think they have a legitimate reason, but to say people's data can be used as an exception if there is a legitimate reason, there likely could be no broader conceivable exception than that one.

However, there are more exceptions even, if that one were not enough. The legislation, for instance, in subclause 15(5), refers to “implied consent”, so apparently in the case of privacy legislation, consent is not so sacrosanct, because companies can interpret an implied consent in this context.

There are clear problems with this legislation in terms of the particulars, but we can understand broader than the particulars the motivation or the value set that is behind this bill, which is that the government is once again trying to defend corporate interests instead of defending privacy and a genuinely competitive free market.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I am so pleased to rise today to speak to the digital charter implementation act, 2022. With Bill C-27, our government is showing leadership in a new digital world. Privacy is important to the residents of my riding of Hamilton Mountain. It is important to all Canadians. This legislation would not only benefit consumers, it would allow companies to innovate, compete and thrive.

The world I grew up in is significantly different from the world in which my son is growing up. This bill gives me confidence that we will be able to take advantage of the latest technologies, while at the same time be assured that our personal information is safe and secure.

I want to specifically talk about the consumer privacy protection act and how it sets out a balanced approach to compliance and enforcement.

Canadians clearly want their personal information to be handled responsibly, and they want meaningful consequences for organizations that break rules to gain some advantage. Canadians want fair punishment for truly bad actors.

According to a survey published by the Office of the Privacy Commissioner, 71% of Canadians have refused to provide their personal information to an organization because of privacy concerns. In an earlier survey, this same percentage of Canadians said that their willingness to share their personal information would increase if they knew the organization would face financial consequences should their information be mishandled. Such consequences are clearly an important tool for enhancing privacy protection for Canadians and also for helping organizations comply with the law right from the start.

The consumer privacy protection act, or CPPA, will assist companies to get privacy right and the escalating enforcement approach will correct problems as they arise.

The new privacy law incentivizes organizations to step up and improve their privacy practices at the outset. The CPPA will also provide the Privacy Commissioner with a key role in helping them do so.

Under the CPPA, businesses will be able to ask the Privacy Commissioner to review the policies and practices that make up their privacy management program, which will assist them in complying with the law. The commissioner can also ask to review such programs. This is a very important step in the early detection and serves to correct problems at the outset.

Privacy management programs cover a wide range of privacy considerations: how companies manage service providers; how they respond to breaches; when to undertake privacy risk assessment; employee training; complaint handling; and so on. Under the CPPA, the Privacy Commissioner will be able to examine these policies and practices outside of an investigation. The goal is for the commissioner to give advice and make recommendations.

The CPPA will prevent the commissioner from using what he or she has learned in these reviews in any enforcement action unless the organization willfully disregards recommendations. We think this would be very rare, but if it happens, action can be taken.

The approach provides an appropriate space in which the commissioner can provide advice and companies can take proper action. At the same time, the commissioner will be able to gain insights on how the law is implemented in real-world situations, thereby being able to better advise organizations on the challenges they may face in the privacy space.

Essentially this approach builds on the Office of the Privacy Commissioner's current business advisory function, which has proven successful in encouraging compliance through engagement rather than enforcement. By allowing for the review of privacy management programs, the CPPA provides businesses with a safe place to seek and obtain advice and implement compliance solutions at the onset. We believe this will help prevent privacy issues before they have an impact on individuals.

We know Canadian companies will be very interested in this part of the new law, particularly smaller companies and start-ups, and I can probably think of a few in Hamilton Mountain.

The CPPA recognizes that a one-size-fits-all approach does not work for privacy. Some organizations deal with minimal amounts of personal information; for others, it is central to their business model. That is why the CPPA allows organizations to develop their privacy management programs according to the volume and sensitivity of the personal information that they handle, and why the commissioner must also take this and a company's revenues into consideration during the exercise of the role under the law.

Another important protection under the new act is the ability of the Privacy Commissioner to review the risk assessments and mitigation measures that organizations must do if they rely on a brand new exception to consent for activities in which they have legitimate interest.

Under the CPPA, the Privacy Commissioner will continue to undertake research and publish guidance. It is a long-standing role and important in helping organizations meet their compliance obligations. It is a role that we wholeheartedly support.

The bill would ensure that organizations build privacy considerations into their products and services from the beginning. Working with organizations, giving guidance, this is a fundamental role of the Privacy Commissioner. We want to be proactive here. We want to prevent problems before they have a harmful impact on individuals.

However, there will be organizations that do not have the right practices. There will be others that have the right practices but still make mistakes. This law provides individuals with the right to complain about an organization's privacy policies when they appear to be offside with the law. The right to complain is considered to be a fundamental principle in all privacy statutes.

Under the CPPA, like PIPEDA, the Privacy Commissioner also retains the ability to initiate a complaint investigation when there are reasonable grounds to do so. This is an important role because filing a formal complaint is not always obvious. Maybe some people will not know there is a problem; maybe they do not have time to make a complaint. This is where the Privacy Commissioner should be able to take action when intelligence gathering from media reports and their own research indicate that there could be potential trouble.

CPPA encourages the early resolution of problems and provides for dispute resolution. Over the years, through its active early resolution approach, the Office of the Privacy Commissioner has successfully been able to resolve many complaints with limited formality.

The CPPA maintains such tools for the commissioner. For example, compliance agreements, introduced relatively recently under PIPEDA, remain in the CPPA. Pursuing these agreements allows companies to work out an acceptable resolution with the commissioner, without the commissioner resorting to more formal measures, like orders. However, resolution will not always be possible or desirable. Sometimes the commissioner will need or want to consider stronger measures.

Under CPPA, the commissioner will have the power to issue orders to compel an organization to take necessary actions to bring the organization into compliance. This is a new power and a key improvement over PIPEDA.

Prior to issuing such orders and to ensure fairness, the Privacy Commissioner's office will need to go through a new process, called an inquiry. Once the inquiry is completed, the commissioner will issue findings and a decision, and will make orders as necessary to an organization to change its privacy practices.

As part of this process, the Privacy Commissioner may also recommend administrative monetary penalties to a new tribunal for certain contraventions of the law. The possibility of significant fines for non-compliant organizations, fines of up to 5% of global revenue or $25 million, whichever is greater, for the most serious offences, is another key improvement over PIPEDA.

A key part of the new enforcement regime, the personal information and data protection tribunal is being established to hear appeals of the commissioner's decisions. If required, it will also decide whether to issue a monetary penalty and, if so, the amount.

Industry stakeholders say that we need impartiality in enforcement decisions, given the different roles of the Privacy Commissioner. This was particularly the case for any proposals involving monetary penalties, which have the potential to significantly affect an organization.

The new privacy law will support additional due diligence in decisions to impose monetary penalties by introducing an inquiry phase before issuing orders, and by separating the imposition of penalties from the commissioner's other responsibilities.

We know that some organizations will challenge the commissioner's orders and recommendations, and we do not want to burden the courts. This is another reason for introducing a new tribunal. It is intended to be more accessible than the courts. It will ease access to justice for the individual and the organization.

After the previous version of this bill was tabled, stakeholders told us it needed more privacy expertise. We listened and this version of the CPPA has the necessary privacy expertise to ensure credibility.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Madam Speaker, that is a very important point. I have a seven-year-old son, and he is starting to play games on my iPhone and whatnot.

We cannot say that Bill C‑27 will protect children because this bill does not include a definition of sensitive information, which we need.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Madam Speaker, we are here today to debate Bill C-27, the digital charter implementation act. With this bill, the government seeks to bring Canada's consumer privacy protections up to date, to create a tribunal to impose penalties on those who violate those protections and to create a new framework on artificial intelligence and data.

For my constituents, I think the most important question is this: Why are consumer privacy rights important? Our personal information has become a commodity in the modern world. Businesses and organizations regularly buy, sell and transfer our personal data, such as our names, genders, addresses, religions, what we do on the Internet, our browsing history, our viewing and purchasing habits, and more. This happens so often that it is almost impossible to know who has access to our sensitive data and what they do with those personal details. Unfortunately, this bill fails to adequately protect the privacy of Canadians and puts commercial interests ahead of privacy rights.

The first part of this bill is the consumer privacy protection act, and I will note, as many others have during this debate, that it is really three bills in one. It is the largest part of this bill and brings in new regulations on the collection, use and sale of the private data of Canadians. I will cover three issues that I have found in this act in the first part of this bill.

The first issue relates to how organizations may collect or use our information without our consent. Subclause 18(3) states:

(3) An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use

Without defining what a “legitimate interest” is, this subclause risks giving organizations free rein to define “legitimate interest” in whatever way suits their own commercial interests.

The second issue I will cover relates to how the bill would protect the privacy rights of children. Subclause 2(2) states:

(2) For the purposes of this Act, the personal information of minors is considered to be sensitive information.

However, nowhere in this bill are the terms “minor” or “sensitive information” defined. This will lead to confusion about how the personal information of children should be handled, and will ultimately lead, in my opinion, to weak protection of that information. There is also no other provision in this legislation that regulates the collection and use of children's personal data.

Every parent in the House of Commons is very concerned about their child going on Minecraft and about their interactions with other people and other gaming sites. This bill does not do enough to protect children in the context of online gaming.

The last issue I will raise in this act relates to when organizations can rely on implied consent to collect and use personal data. Subclause 15(5) states:

(5) Consent must be expressly obtained unless, subject to subsection (6), it is appropriate to rely on an individual’s implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information that is to be collected, used or disclosed.

This subclause highlights that the bill lacks a clear definition of “sensitive information”. This means that organizations will have free rein to determine when they can rely on implied consent, and they will be free to decide what information is or is not deemed sensitive according to their interpretations and not the legislation's interpretation.

The second part of the bill relates to the creation of the new personal information and data protection tribunal act. The bill would create a new semi-judicial body with the power to levy financial penalties against those who violate the CPPA, the first part of the act. I question whether this tribunal would be able to enforce the penalties outlined in clause 128, which are tied to global revenue and a proportion of profit in the previous fiscal year.

How does the government plan on ensuring accurate figures? Does the government really believe that it will go after Google in a global context, hold Google accountable and collect up to 4% or 5% of Google's global revenue? It is farcical.

We need very clear and very big amendments to this section. We need to question whether we even need a tribunal, because if it is in charge of enforcing clause 128 of the bill, I already know it is going to fail.

Under the third section of the bill, the artificial intelligence and data act, new provisions would be created that apply to the private sector. However, this bill does nothing to address the relationship between government and artificial intelligence.

Right now in Parliament, we are debating Bill C-11, which talks about the government's use of algorithms in the context of the CRTC. This bill has rightly infuriated Canadians across the country who are concerned about how the government would determine what people say and do on the Internet and where they would be directed. Why is the government not trying to apply the same standards upon itself as it is trying to apply on private corporations?

I want to address some other key oversights in the bill.

First, in the U.K., EU and even Quebec, certain personal details, such as race, sexuality and religion, are given special protection in comparison with other personal information. Why does the government believe the most identifiable aspects of our personal information are not worthy of being defined as sensitive information in the context of privacy law?

Second, the bill does nothing to regulate the sale of personal data. I am reiterating this point. In a world where the sale of personal data has become an integral part of our economy, why is the government not concerned with setting clear rules on how data and what kinds of data can be bought and sold, especially in the context of children?

Third, the bill fails to regulate the use of facial recognition technology. The RCMP used Clearview Al's facial recognition database, which was illegally created. Why does the government not think it is appropriate to ensure this never happens again?

Fourth, the consumer privacy protection act and the personal information and data protection tribunal act proposed in this bill are nearly identical to the acts proposed under last Parliament's Bill C-11. The consequence is that Canada's consumer privacy laws will be out of date by the time they come into force.

This bill was an opportunity to put forward strong regulations on the collection and use of personal data, but it failed to meet some basic criteria and thresholds. While the increased penalties for violating the act are welcome, they are watered down by the implementation of a tribunal that would take months or potentially even years to make a decision and levy fines. It is even questionable whether such a tribunal could actually do what it is purported to be responsible for.

Do we really need privacy legislation that fails to protect the privacy of Canadians? Do we really want privacy legislation that fails to put consumer interests ahead of corporate interests? Do we really want privacy legislation that fails to protect the personal information of children? Do we really want Al regulations that do not apply to government? Frankly, the government needs to withdraw Bill C-27, break it up into different parts and come back to Parliament after it has looked at the drawing board again and done something a little more comprehensive.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, this is my first opportunity to get in on the debate on Bill C-27 today, and I have to say that my thoughts resonate a great deal with those mentioned by the hon. member for Windsor West in his pointing out that this is three bills in one.

To focus on the part that is completely new, artificial intelligence, I find that there is a great deal of tautology when we look at the bill. For instance, it says that we will know what a high impact of artificial intelligence is if it “meets the criteria for a high-impact system that are established in regulations.” There are a number of other places like this, but we do not have regulations yet. When will we know what the bill means?

[Nathalie Sinclair-Desgagné, Bloc, Terrebonne, QC]

Madam Speaker, I thank my colleague. I would simply like him to answer the following question.

Since Quebec already has its own privacy legislation and it works very well, does my colleague not think that Bill C‑27 should clearly state that it will not contravene Quebec's legislation?

This should be stated in the bill.

[Chandra Arya, Liberal, Nepean, ON]

Madam Speaker, I rise today to speak about Bill C-27. I will focus on the artificial intelligence and data act, but before that, I would like to briefly talk about the overall digital charter implementation act.

Canadians have never been more reliant on the digital economy, yet the current privacy law was last updated over 20 years ago, before iPhones or Facebook even existed. In the new digital economy, enhanced privacy would not only benefit consumers but allow companies to innovate, compete and thrive. We are now at a juncture where, over the next few years, the rules of the road for digital privacy and AI are being written and entrenched. That is why it is crucial to have clear rules when it comes to this sector. For Canadians to prosper and benefit from the digital economy, they need to have confidence that their data is safe and trust that their privacy is being respected.

That is why the government has introduced this legislation, which would ensure that Canada has critical protections in place. Bill C-27 would ensure that Canadians have first-class privacy and data protection and that companies that break the rules face severe consequences, some of the steepest fines in the world. It would also hold organizations to a higher standard, in particular when it comes to protecting the personal information of minors by giving them and their parents more power over their information, including the ability to have it deleted. With Bill C-27, we are moving beyond traditional privacy protection to ensuring data control for all Canadians. Canadians can be reassured that we will never compromise on the trust and safety of their privacy.

Over the last decade, artificial intelligence technologies have been expanding rapidly and have been benefiting Canadians in a variety of ways. These technologies are evolving rapidly and with that, there is an increase in risk and harms due to the use of AI systems, whether intentional or unintentional. The artificial intelligence and data act, or AIDA, would establish rules to promote the responsible use of AI and the related governance practices. The framework would ensure that the development of AI systems has to include plans to mitigate bias and harm and that organizations are accountable for their practices.

The AIDA seeks to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. The act would provide for public reporting and would authorize the minister to order the production of records related to artificial intelligence systems. The act would also establish prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system in an intentional or reckless way that causes material harm to individuals. This would ensure that Canadians have strong privacy protections and clear rules of the road for business, as well as guardrails to govern the responsible use of artificial intelligence.

This bill would provide Canada with adequacy within the European Union's GDPR framework and international interoperability on privacy. Further, it would enable Canada to remain on the cutting edge of artificial intelligence development. This bill would help us to build a Canada where citizens have confidence that their data is safe and their privacy is respected, while unlocking innovation that promotes a strong economy.

The University of Toronto’s Schwartz Reisman Institute for Technology and Society studied this bill, and I would like to quote from an article written by policy researcher Maggie Arai:

As technology continues to advance and permeate almost all aspects of modern life, it has become necessary for regulators to grapple with how to best regulate it. New ways of collecting and processing personal information necessitate new regulations to protect those whose information is being collected, analyzed, and sold—often whenever they visit a new website or sign up to a new app like Facebook or TikTok. Advances in artificial intelligence (AI) are also top of mind for many regulators, posing unique risks and challenges that must be addressed. The recently tabled Bill C-27 represents Canadian regulators’ efforts on both fronts.

She goes on to say:

The Artificial Intelligence and Data Act (AIDA) is the federal government’s first attempt to comprehensively regulate artificial intelligence. Canada is not alone in this: AIDA comes in the wake of similar initial attempts at AI regulation by other governments around the world, such as the European Union’s 2021 AI Act and the United States’ 2022 Algorithmic Accountability Act. AIDA, like the EU’s AI Act, takes a risk-based approach to regulating AI. However, it is worth noting that Canada proposes categorizing AI based on whether it is “high-impact,” while the EU uses the language of “high-risk.” AIDA is also far less prescriptive than the EU AI Act. The draft Act is quite short, with much room left for the enactment of provincial AI laws as well as further federal regulation....

She continues:

A person becomes a “person responsible” for an AI system if they design, develop, make available for use, or manage the operation of an AI system in the course of international or interprovincial trade and commerce.

The major requirements contained in AIDA for “persons responsible” for AI systems include ensuring the anonymization of data, conducting assessments to determine whether an AI system is “high-impact,” establishing measures related to risks, monitoring and keeping records on risk mitigation, and requirements for organizations to publish a plain-language description of all high-impact AI systems on a public website. If at any time the Minister has reasonable grounds to believe that a person may be in contravention of these requirements, the Minister may order that person to conduct an audit into the possible contravention, or engage an independent auditor to conduct the audit.

She goes on to say:

The tabling of Bill C-27 represents an exciting step forward for Canada as it attempts to forge a path towards regulating AI that will promote innovation of this advanced technology, while simultaneously offering consumers assurance and protection from the unique risks this new technology...poses.

She also states:

There are also sections of C-27 that could be improved, including areas where policymakers could benefit from the insights of researchers with domain expertise in areas such as data privacy, trusted computing, platform governance, and the social impacts of new technologies.

She goes on to say:

To ensure that the powerful new technologies that shape our world today benefit everyone, it’s essential that our policies are well-informed—especially when it comes to how technical systems work, how they interact with our legal infrastructure, and how they impact society. As we approach the implementation of this landmark regulation, it’s critical that Canadians are engaged and informed on these topics and ready to make their voices heard.

I will now quote from an article written by the law firm of McCarthy Tetrault, which states:

Bill C-27, if adopted into law, is set to have a significant impact on businesses by creating new requirements for those who make, use, or work with AI. The bill imposes several new obligations on the AI sector which are backed by serious penalties for non-compliance.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, I rise today to address the House with respect to Bill C-27, the digital charter implementation act, 2022. It is just a year or so behind.

Thirty-four years ago, the Supreme Court of Canada recognized that privacy was at the heart of liberty. Much has changed since 1989 and little more drastically than the continuous transfer of the private information of Canadians to other organizations. The questions we need to ask are these: What are the costs of and what are the benefits of the availability of Canadians' private information for the use of others?

Many organizations see themselves as supplying useful value to Canadians by being provided, whether by contract or by capture, private information that is not knowingly provided by citizens. Examples include service companies that recognize when a consumer might be able to save a percentage of their fees by bundling certain services. In such a case, the benefit of this information availability is shared by the consumer and the service provider.

Let us make no mistake. What drives the action by the service provider is profit, which is known as the greater share of wallet. Nevertheless, in such cases, the consumer sees the benefit of being included in the information sharing, whether they know it has occurred or they do not.

This apparently benign approach to gathering information has now stretched to our daily lives, where our computers, our phones and our in-home private intelligent assistants, like Siri and Alexa, are gathering information on us. When my sons are at their homes and use Siri, they say, “Siri, turn on”. They have figured out that Siri was listening the whole time. A lot of information is being culled. Do we know that our information, in that case, when we have not actually disclosed it willingly, is being used in a benign or creditable way? Which of that has become public information to be monetized by somebody else? That is what is occurring.

Large corporations are gathering data that is being sold to others for their own purposes. That supposedly benign relationship is now being passed to another organization, in that case, that is paying the information gatherer, and so on. There is no accountability mechanism to the individual for the benefit of the supply of one's information to flow.

There is only one measurement at play, and that is profit. One need only look at the incredible financial returns associated with these technological information-gathering companies, including the Googles, the Metas, the Amazons, etc. None of those are Canadian, by the way, and realize that the value-extraction industry is lopsided in their favour. At no time in human history have start-up companies, many without a tangible product, achieved such lofty valuations so quickly. Billionaires are created out of computer code, which provides what, exactly. It provides our information.

Value is created and destroyed in commercial markets. That is the economic engine that has led the western world to prosperity, but value is only traded in financial markets. Let us ask this: Is the culling and selling of private information, however obtained, creating value or transferring value?

In that respect, the intent of this bill is good. It is designed to modernize the protection of Canadians' digital privacy rights. It is past due, and it is important. It cannot be delayed by another prorogued Parliament or another unnecessary election call, as happened to the prior bill that was introduced to advance this issue in the last Parliament. The aim of this bill is good. The execution, I would say, is way off. I see a bureaucratic solution, designed by bureaucrats, for use by bureaucrats, with what would be a minor effect for the Canadian population in general. As we say, if you are a hammer, everything looks like a nail.

The design outcomes of this bill are increasing bureaucratic oversight. The personal information and data protection tribunal act would have six members and would be put together in a tribunal, three of whom would have experience in information and privacy law. Only three out of six, which is half, are going to have experience in the very laws that they would be overseeing.

This is going to be responsible for determining the severity of financial penalties. It would have a staff of 20 with a budget, along with a larger budget for the Privacy Commissioner, which already exists. Does anybody see any redundancy in this solution?

There is a litany of financial penalties listed through this bill and a host of requirements of all businesses, even small businesses, which are going to find the requirements of this bill onerous in the extreme. Joe's Garage is going to be treated with the same expectations as the Royal Bank and face the same potential penalties.

I will read from this legislation something that would scare any small-business person. This is about privacy management programs, as required under the legislation. It states that, “Every organization must implement...a privacy management program that includes the [organization's] policies, practices and procedures....”

It further states that, “...the organization must take into account the volume and sensitivity of the personal information under its control.” What does that mean, and how do we interpret that?

It also states, “...the organization must ensure, by contract or otherwise, that the service provider provides [substantially the same] protection....” Therefore, a businessman is going to need to ensure that something nebulous is not being provided by their service provider when forwarding information. Clearly, no one involved in this bill's design has even considered what this means for Canada's small-business community.

Here is the issue for Canadians. Who has the most information on Canadians? Governments, first of all. Who is likely to get information hacked? Those same governments.

This bill shows a complete lack of accountability by the government regarding how it might misplace or misuse Canadians' data. Is the government going to fine itself in such an instance? I doubt it. That would be a round-trip anyway, at that point in time.

Banks, secondly, have a lot of information about Canadians, and they use that information to increase their returns. They have large bureaucracies, large legal departments and government relations departments to stick-handle these fines. I should note, in this legislation, many exemptions are included. Therefore, we are building more bureaucracy. That is just what Canadians have elected us to do, I say very sarcastically.

On top of the 30% increase in federal government employees over the past six years, we are going to build more bureaucracy. What this bill should be doing is trying to strike a balance between business use of data and the fundamental protection of our privacy.

Let us quickly discuss some of the nefarious uses of digital information gathering. Let us go back to the pandemic, when CERB payments were given out to Canadians, and how many criminal organizations misused that government information to pilfer the pockets of Canadian taxpayers and get undeserved CERB payments into the wrong accounts. This is what happens when government information is pilfered, and this is the main problem with the privacy of Canadians' information.

My advice to the government is to get this bill moving. It is way behind other jurisdictions on this very important issue. Look at how the absence of privacy protection has affected Canadians, and take a look at where the value of Canadians' information has gone: to all the large American tech companies.

The government must listen to that input and the alternatives that are going to be put before it when it puts together this bill. Hopefully, the government amends this bill so it actually addresses the privacy of Canadians in a more complete manner. Listen to that input and to those alternatives. As the Supreme Court of Canada reiterated 34 years ago, Canada needs to recognize privacy as a right, so let us get to work in providing an outcome that actually safeguards Canadian's privacy.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, 20 years after the need to see changes was shown, Bill C-27 is here.

The last time we saw changes, Facebook and iPhones did not exist. This is important legislation. Within it, to use a couple of examples, there are frameworks that allow for substantial fines and protection of Canadian privacy.

What we are hearing from the Conservative Party is that Conservatives do not want any of it. They are going to vote against the bill. The Conservatives are ultimately arguing that the bill is not amendable.

Does the member not see any value in the substance that is actually there to protect Canadians and empower things such as substantial fines?

[Caroline Desbiens, Bloc, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Madam Speaker, we are talking about Bill C-27, an act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts. The length of the bill's title is commensurate with the work that will be required of legislators.

Obviously, the Bloc Québécois will be voting in favour of the bill, since we have wanted it for quite some time. Quebec is actually already ahead of the curve on this issue. We absolutely must send Bill C-27 to committee so we can hear from experts who will point out the flaws in the bill, shed light on how to improve it and put some flesh on the bones, so to speak.

There are too many details in terms of the areas of action and application, and we cannot look at them all too quickly. We need some clarification, and that is to be expected. The committee needs to hear from a wide range of witnesses. The bill must not pass too quickly. What matters is taking our time in committee. That is what taking responsibility looks like, if we want Internet users to do the same.

On November 28, 2022, the Speaker of the House made the following decision regarding Bill C‑27:

...two votes will take place at the second reading stage.... The first will be on parts 1 and 2, including the schedule to clause 2. The second will deal with part 3 of the bill.

Thus, if the House votes against the AI portion, work on Bill C‑27 will continue without that portion. If the House votes in favour of the bill in its entirety, it will go to committee. Even if we vote in favour of the AI portion at second reading, there is still an opportunity to vote against it at third reading. That sort of latitude is important.

The Personal Information Protection and Electronic Documents Act has needed reform for years. A digital charter is urgently needed. Canada's privacy law is pre-digital, if not prehistoric. Today's context is completely different from that of the 2000s.

Bill C‑27 is also a response to the strict and ambitious European privacy legislation, the General Data Protection Regulation. We already know that without an adequate legislative response, it will become impossible for European organizations to exchange information with countries or international organizations that have not adopted legislation as strict as theirs.

If Bill C‑27 is not well structured and up to date, Canada will not meet the European Union's expectations. I consider that to be important and very serious.

In Canada, the financial sector is beginning to worry, and it is putting pressure on the government because it fears losing a portion of its European market. That makes sense.

There is less pressure in Quebec because our laws are already compliant, or almost. What is governed by Quebec is already relatively protected. The problem is when two levels of government overlap and one is inadequate. For example, Mouvement Desjardins is already prepared, but the same cannot be said for Fiducie Desjardins, which is the Ontario counterpart. It is the former Trust Royal, an Ontario trust company.

It is troubling, for example, that Ontario does not have updated privacy and artificial intelligence legislation when we do and that even the same institutions with the same names do not have the same laws.

However, even though this is an urgent issue, we cannot take a scattershot approach and let the most important things get lost in the shuffle.

Let us talk about protecting individuals. In many ways, Bill C‑27 seeks to protect individuals' anonymity. It puts the individual and the idea of consent back at the centre of reflections on digital exchanges. To date, in Canada, organizations have been given a free pass and they have taken advantage of the digital wild west to share personal information without any legislation to stem their greed. Bill C‑27 will not only limit and restrict their excessive freedom, but it will also give them responsibilities.

Bill C‑27 creates a tribunal. It sets out three types of sanctions for those who contravene the act. The first is administrative monetary penalties, or fines, which work for road violations, at least. The other two are criminal and penal offences.

Bill C‑27 is clearly binding and it has real power.

Privacy protection is a shared jurisdiction. Even if Bill C‑27 gives the impression that it will be consistent with Quebec's new Bill 25 on privacy protection, as currently drafted it offers no such guarantee. The government must ensure that Bill 25 is substantially similar to Bill C‑27 and stipulate it by decree. We understand that Bill C‑27 is not intended to infringe on Quebec's legislation. This needs to be confirmed in committee.

Let us now talk about artificial intelligence, more specifically about individual identification. There are currently three ways to identify an individual, either with a password or social insurance number, biometric data and voice recognition and our possessions, such as text messages, phone calls and so forth.

Currently, European law requires companies to rely on two of those ways, and maybe three, eventually. Bill C‑27 needs to legislate on this as well.

There is also the variable of sensitive personal information. Inspired by European law, Quebec's Bill 25 on privacy protection defines information as sensitive if “due to its nature or the context of its use or communication, it entails a high level of reasonable expectation of privacy.”

On that point, although Bill C-27 does not define what sensitive data is, its meaning will guide the development of cybersecurity measures. In other words, the AI legislation enacted in Bill C-27 will serve as the foundation upon which more ambitious legislation will have to be built so that we can more adequately regulate the AI environment. It is a good start, albeit a late one.

In closing, I would point to the many feats of artificial intelligence. This is a process of imitating human intelligence that relies on creating and applying algorithms in a dynamic computing environment. We have all seen the Prime Minister responding in a fake interview where he can be heard making false statements. The sound and image were really similar. It was uncanny.

It has also been shown that artificial intelligence can create works of art whose similarities are so close to the original creation that they could compromise its original value. I am a songwriter, and, thanks to the ChatGPT concept, one could take the various characteristics of each of my 80 original songs and make an 81st that would have essentially the same melodic flourishes and the same kinds of metaphors. I confess that this troubles me immensely.

We all understand the potential scale of this kind of thing and how it can have all kinds of repercussions. However, we have also been told that, for science, this tool can be revolutionary as long as we have a legislative framework that is adapted to the current state of AI and future-proofed for developments to come. What worries us is the minister's stated intention to pass the bill quickly. Bloc members believe the committee should take all the time it needs to hear from a broad range of witnesses so we can identify and fix the bill's grey areas and blind spots.

The government indicated openness to slowing the work down. Will it do as we ask? We hope so. If that is how it works out, that would be good.

AI is more about the data analysis process and the ability to do that thoroughly than about a particular format or function. That is why we have to deal with the issue carefully and understand its impact so we can make the necessary legal framework as good as possible. Doing that means taking the time for an in-depth study of Bill C‑27.

Here again, Quebec is the leader of the pack, and others would do well to follow suit.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I think one of the things we have really benefited from in Canada is the Privacy Commissioner and the office. There is no doubt that the United States not having this position has created an issue for that country. For ourselves, the commission having appropriate resources and reformation to enforce the decisions, as well as having independence from Parliament in many respects, is crucial for the NDP.

I am just wondering where the Conservatives stand on this, with regard to the Privacy Commission, because there would potentially be a tribunal created with Bill C-27, and then there would be far more regulation and oversight necessary from the Privacy Commissioner in the age of artificial intelligence.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Madam Speaker, it is an honour to rise once again in this place as we resume debate on Bill C-27, the digital charter implementation act.

During discussion of this bill and related issues, we are not going to get anywhere if we do not start to recognize that privacy is a fundamental right. This is what Conservatives believe and is where we are coming from when we talk about the positive or negative aspects of this piece of legislation. Not only is it true, but it has to be a priority. That is what Canadians expect from us and that is the message we are delivering to the current government. It is also what has been echoed by many of our constituents as we get emails or phone calls from people who are concerned about this bill and about this issue in general.

The world we live in is rapidly changing and the pace of change seems to be getting faster as we go. It is really amazing what people can achieve with digital technology, yet it has also left us in a more vulnerable and insecure position. There are many ways to intrude upon and violate our privacy that did not exist before, and it is safe to say that this trend will continue in the coming years.

If it was not clear already, it is easy to see now that we have to do more than respond to the changes simply as they come. Instead, we need to do our absolute best to think ahead and make sure that our efforts to protect privacy will not become outdated shortly after we pass any kind of bill into law. It is the least we can do if we are serious about preparing our country for the future, but it is true that, before we can do that, we first have some catching up to do.

Our current privacy legislation is long overdue for an update. It has been 22 years since Canada updated its privacy legislation. Twenty-two years ago, the Internet was basically a new phenomenon, and only about half of Canadians were online. Back then, I think Joe Sakic was the MVP of the NHL, and I was only 13 years old, so a lot has changed in that time.

Today, the Internet is a valuable tool used daily by the majority of Canadians. Generally speaking, people basically are living online. We use social media to connect with family, friends and professional networks. We use a GPS to get directions to move from place to place and navigate around our cities and towns. We have online banking to manage our finances. However, at the beginning of the new millennium, pretty much the majority of this was unheard of. In fact, I think we can all remember what we thought was going to potentially happen on Y2K and the implications it was possibly going to have on technology, which thankfully never came to fruition.

It has been years since the Liberals announced a new data strategy for Canada, which also has not become a reality. The promise also came four years after they formed government. It has now been about as long from then until now. After such a long time, Canadians are still waiting for someone to provide higher standards for the use and collection of their personal data.

So much of what we do these days involves an exchange of our data. Facial and fingerprint recognition are used for security, along with our passwords. Digital maps and search functions track our locations in real time. Many of us upload and share an overwhelming amount of personal information on social media accounts and platforms. We are constantly giving our data to different online companies in order to use their services. People feel comfortable enough to do all this because there is a voluntary loss of privacy for the sake of convenience, but this arrangement also requires a deep level of trust. It could not exist otherwise.

Whenever there has been a breach or loss of that trust, the problem of privacy becomes more obvious. There have been organizations exploiting the trust of people to sell their personal information without authorization. In some cases, the data has gone to places that are not working in their best interests.

I am sure, Madam Speaker, like many people in the House, when you go to a website it asks you if you accept the cookies, for example. Obviously, people just accept and go on there because they want to read the articles. What they do not realize is what they are agreeing to when it talks about what is going to happen with their search history or different aspects that might be invaded by those cookies. Therefore, we have to get serious about privacy. We have to mean it when we say that we recognize that privacy is a fundamental right.

The first draft of Bill C-27 says in the preamble, “the protection of the privacy interests of individuals with respect to their personal information is essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms in Canada”.

Of course, I am not going to disagree with that. I believe it is good for a law to make a statement like this. However, it is also true that we can and should take it a step further in the same direction. Why not have this type of statement included in the text of the bill instead of only in the preamble? That way, it would more likely be stronger for enforcement and interpretation by the courts. With the situation we are in today, it is worth making our privacy law as strong as possible, and this would be a simple way for us to set the right tone. That is something we are calling for.

This is one example, among many, of how Bill C-27 could be improved with some amendments. Conservatives want to make sure we update our legislation in the right way. After all, in this area of privacy, we should not settle for less.

There is more that can be done to fill the gaps in our privacy law. If the government does not accept stronger legislation, it will simply be insufficient. The law must ensure that the privacy of our citizens would be respected by the activities of government and business. Canadians are the owners of their data, and corporations should ask for consent if ever they hope to collect, use or disclose a client's information.

Instead, the Liberal government still has loopholes with respect to privacy. Corporations can still operate with implied consent instead of express consent, which is freely given, specific, informed and unambiguous consent. What happened with Home Depot and Facebook shows how relying on implied consent can go wrong. In this case, a person could ask for email receipts from Home Depot. Their email address, as well as details of their purchase, were given to Meta, which then matched the person with a Facebook or Instagram account.

When brought to court, Home Depot claimed that it had the implied consent of customers to share their emails with whomever it pleased. When I shopped at Home Depot, I never gave my email address to it, but it never once asked me if I was okay with sharing that data with somebody other than for its own transactional purposes.

We have a lack of clarity, which is not protecting the consumer as much it should be. Implied consent has been losing relevance over time. In our context, it creates headaches for customers who are going about their regular business. They expect one thing and later find out that something much different is going on with their personal data. Even if they agreed or simply went along with something, they rightly feel misled by what happened. That is not informed consent. Our peer countries have been moving away from this. Europe's general data protection regulation has been heralded as the gold standard for privacy laws, and it has done away with implied consent.

Going back to discussing Home Depot, it also said that anything people bought there would be classified as “non-sensitive”, which is something this bill fails to define. Vague language will not favour our citizens in the end. With the Home Depot case, we can see that the law could be interpreted by larger organizations to allow them to do what the law actually intended to restrict. We should clearly define “sensitive information”, and it needs to apply to everyone.

Another vague part of this bill is the implementation of the right to disposal. Bill C-27 would allow the user to request that their data be destroyed, but clarification is needed regarding anonymization and the right to delete or the right to vanish.

At the end of the day, this bill is like many announcements the Liberal government likes to make. It sounds good, but the incompetence, the vague language and failure to close loopholes mean that it would not do what it says it would do. However, it should not surprise anybody if a Liberal bill has significant weaknesses and gaps on the issue of privacy. It is hard for Canadians to take the government seriously based on its own record. It has not shown respect for privacy.

We have seen a government agency use location data from cellphones for tracking purposes. We have seen law enforcement access Clearview AI's illegally created facial recognition database, and, of course, last year we saw the public doxing of online donors. While that was happening, the Liberals decided to mess with the bank accounts of Canadians, and some of those people had not even made donations themselves and certainly had not committed crimes.

It is easy for things to go wrong when there is government overreach, but today the federal government has an opportunity to modernize and protect our country for the problems we face in the 2lst century. If it does not listen to us and fails to make the right decisions, it would be truly shameful.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, we are here today to talk about Bill C-27. It has got a big fancy name: an act to enact the consumer privacy and protection act. I worked on this extensively as former chair of the Standing Committee on Access to Information, Privacy and Ethics. A big part of what we talked about was Canadians' privacy.

I want to lead off with a question that I think all who are watching here will want an answer to by the end of what I have said, and I hope I get there. Can we trust this government when it comes to privacy?

We have heard many accounts. We have heard of foreign interference. We have seen evidence that that has been happening under the government. We cannot even keep track of all the ethics breaches.

There was a recent article in the National Post about Canadians' data, and many folks out there would remember this, called “Canada's public health agency admits it tracked 33 million mobile devices during lockdown” and it read, “The Public Health Agency of Canada accessed data such as cell-tower location to monitor people’s activity during lockdown, it said”.

Can we trust this government? I think the answer is becoming more and more clear.

What have we done to protect consumer privacy? I was, again, part of that ethics committee. We formed an international grand committee of nine countries, representing half a billion people, where we really tried to tackle this and get to some better practices for big tech.

Cambridge Analytica was a scandal where big tech was getting our information. Many points are being collected, and 53,000 points of information is what we heard was the Facebook average amount they are collecting on us, and that is being sold to the highest bidder. It is being used to not only give us a choice on what cereal we should buy in the morning but also surveil us to make predictive behaviour so we will kind of go in the direction they want us to go.

We Conservatives saw a need to have a better, more robust policy, so I will read from our constitution, our policy, which I was part of drafting, along with many other EDAs from across the country. This is from the Conservative Party:

The Conservative Party believes digital data privacy is a fundamental right that urgently requires strengthened legislation, protections, and enforcement. Canadians must have the right to access and control collection, use, monitoring, retention, and disclosure of their personal data. International violations should receive enforcement assistance from the Canadian Government.

That is just a little snapshot of what we have been doing over here. We would hope that legislation like this would address some of those privacy concerns. What we learned and what many are hearing from this debate is that there are huge exemptions for big tech, huge ways to use consumer data in ways that, first of all, consumers do not want their information being used for, and they do not even know how their information is being used.

I am going to get into some of the critics of Bill C-27. I will read from an article today by a young man, Bryan Short, who has some concerns around Bill C-27. Referring to Bill C-27, the article says:

...this change opens the door for companies to begin describing their data collection and surveillance practices in a highly simplified manner, leaving out important details about how this information could be used to harm and discriminate against a person or group of people, and ensuring that the data broker economy continues to thrive while people in Canada’s privacy rights are pushed to the side.

Well, according to the Liberals, this is what this bill is supposed to be addressing. Here, we see simplified consent. That is something that we have supported too. It should be something that we can understand, but not to be abused in this manner, where the fine print is down here and we just check that little box to make ourselves feel good that we have done it. We feel like our data or our privacy is protected, but it really is not.

I will read on: “But with deceptive design practices already being regularly used to encourage people to click 'agree' without really understanding what they’re signing up for, Bill C-27’s weakening of consent could be a big step backwards in terms of privacy.”

I will keep reading, as I have a little bit more from this particular author. We talk about the right to request deletion, and that is part of one's data that is online.

In reference to Bill C-27, the article says, “What’s lacking is a mechanism for when people change their mind about consenting to the collection and use of their personal information, or if they’re opposed to the use of their data and consent wasn’t required at all”.

We have seen the exemptions. They are a big haul. My colleague from Edmonton just referred to those exemptions. We want some better pieces of legislation. I applaud the effort. The previous privacy commissioner Therrien was excellent in caring about Canadians' data and really pursuing a solution for it and defending Canadians. I applaud him for that.

However, I am going to go on to another critic whom I have gotten to know very well from being on the committee, and from his work in Canadian information and how important that is to protect. He is a man named Jim Balsillie, a stranger to none of us in this place and former part owner of BlackBerry. I will read from the article from the Globe and Mail called, “Privacy is central to human well-being, democracy, and a vibrant economy. So why won’t the Trudeau government take it seriously?” The article, written by Mr. Balsillie, states:

Privacy is a fundamental human right that serves as a gateway to other rights and freedoms such as freedom of expression, individual and collective autonomy, and freedom from harassment or invasion. Privacy is critical for the healthy development of the human brain, identity, close relationships and social existence.... “True realization of freedom, that is a life led autonomously, is only possible in conditions where privacy is protected.”

We absolutely agree that privacy is a fundamental human right. I will go on, as this helps explain what Mr. Balsillie is referring to in that paragraph. The article continues:

Behavioural monitoring, analysis and targeting are no longer restricted to unscrupulous social-media companies, but have spread across all sectors of the economy, including retail, finance, telecommunications, health care, entertainment, education, transportation and others.

I have told many high school classes an example of this. We learned that people's data is being monitored in real time, so when standing in front of a display at a big box store, it is known that one happens to be standing in front of a certain brand of headphones, so people should not be surprised if they get an ad for these particular headphones, and why they should buy them, before they leave the store. In a good way, it is incredible, but it is scary in other ways too with the predictive nature of having all that information.

Mr. Balsillie goes on to criticize the current Liberal government. He says:

Yet, Canada's federal government has repeatedly failed to take privacy seriously and construct a legal and regulatory framework that protects the rights of Canadians in the digital age...the Digital Charter Implementation Act, normalizes and expands surveillance and treats privacy as an obstacle to corporate profits, not as a fundamental right or even a right to effective consumer protection. After years of cozying up to Big Tech and meeting with its lobbyists as often as twice a week, the Canadian [Liberal] government is finally coming to terms with the fact that the digital economy needs to be regulated.

The act expands surveillance. It does not reduce it.

I asked initially this question: Can Canadians trust the Liberal government? The Liberals are pretty close to big tech guys. I will use the example that many have been talking about, which are smart cities. That conversation was brought up many years ago and as recently as just a few years ago. Our efforts at the ethics committee were to really push back on this invasion of privacy and that a particular smart city in Toronto, Sidewalk Labs, would have been an invasion of Canadians' information. The Sidewalk Labs project would monitor data on many levels, and it has connections to the current Liberal government. I will read from an article, which states, “Sidewalk Labs project gained support from Trudeau in 2017 call ahead of bid process”.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, as it stands now, federal laws do not require federal political parties to follow the same privacy laws that apply to others across the country. This is an issue that could have been identified and addressed in Bill C-27, but it has not been. I wonder if the member for Edmonton Manning has a position on this and would he like to comment on it.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, last week, the federal government banned the use of the TikTok app on government devices because of data privacy concerns, so it is very appropriate for us to be discussing this matter today. Digital data privacy can be seen as a fundamental right, one that urgently requires strengthened legislation, protections and enforcement. Canadians must have the right to access and control the collection, use, monitoring, retention and disclosure of their personal data.

This is a pressing issue. Realizing that, the European Union introduced the GDPR, its General Data Protection Regulation, in 2016. EU countries were given a couple of years to adapt to this new privacy reality, with the regulation coming into effect in 2018. The GDPR has been used by many other countries as a framework for privacy protection.

With the GDPR as an example, and faced with a changing digital data universe, the government basically did nothing to protect data privacy for Canadians. Perhaps that is an unfair statement. After all, digital and online data privacy was addressed in the last Parliament under Bill C-11. The Liberals recognized that Canada needed to bring its privacy laws into the 21st century.

However, that bill was never passed. Apparently, data privacy was not a big enough issue to be made a priority, and the digital charter implementation act was scrapped in favour of an election that Canadians neither wanted nor needed. Now we are asked once again to address this subject. It is indeed better late than never. I would have hoped, though, that with the delay, the government could have improved on what it is proposing.

Perhaps if the government had moved a little faster, Canadians would not have had to question how their data was being used and how their privacy was being invaded by governments and corporations. We are left to wonder how many privacy breaches have gone undetected or unreported. The ones we know of are disturbing enough. Tim Hortons used its app to track customer movements. The RCMP used Clearview AI’s illegally created facial recognition database. Telus gave customer location data to PHAC.

It has been more than 20 years since Canada’s existing digital privacy framework, the Personal Information Protection and Electronic Documents Act, PIPEDA, was passed. With technological changes in recent years, legislation is needed to address subjects such as biometrics and artificial intelligence. We have to consider how Canadians understand the issue of consent when it comes to the use of their data and their privacy.

I am deeply concerned and disappointed with how sloppy the Liberal approach in Bill C-27, the digital charter implementation act, 2022, currently is. Privacy is a fundamental right. This bill does not mention that, despite the Supreme Court of Canada having acknowledged it. We need to clearly distinguish the extent to which Canadians’ digital privacy will be protected. If the government wants the bill to be fully effective, it needs to further explore the scope of accountability required when privacy is breached.

The clear definition of consent is a major improvement from what it once was in the Personal Information Protection and Electronics Document Act, but a good definition is only the beginning. Because technology has greatly expanded and evolved since the implementation of PIPEDA, should we not also expand the umbrella of activities that consent would cover? The large number of exemptions allowed would weaken the impact of the legislation.

Bill C-27 may be a good beginning, but I had hoped for something better. It is sad that the bill’s title is perhaps the strongest statement in the legislation. While the title gives some idea of what the legislation is all about, it is already dated. We are no longer in 2022, and the Liberals are once again falling behind.

As parliamentarians, we know the power of words and the importance of speaking in a way that can be understood by those receiving the message. It is important that legislation can be understood. It is even more crucial that the bills we pass spell out exactly what we intend.

Perhaps the most important part of any of the laws is the section that provides definitions. They need to be clear and comprehensible and not subject to differing interpretations that weaken the intent of the legislation. Legislation that allows each person to provide their own definitions is problematic. Bill C-27 uses words such as “significant impact” or “sensitive information”. I cannot help but question what is covered by these vague terms.

Before the people of Edmonton Manning sent me to represent them in the House, I was a businessman. I understood the importance of safeguarding the personal information my customers entrusted to me and not to abuse that trust. However, as we have seen, some companies make unauthorized use of the information they gather to gain a competitive edge or for profit.

With that in mind, there must be a balance between acceptable use of data by business and the fundamental protection of our privacy. It seems to me that the balance is wrong on this bill, given the way it addresses user consent and the use of collected information.

The more I read Bill C-27, which 100 pages-plus, the more questions I have. There is too much in it in need of clarification. Yes, that will be done when it goes to committee after second reading, but the government could have presented a better bill to make the committee’s work easier.

I do not want to sound too negative. I know the Liberals mean well, even if they do not seem to be able to quite understand just how important digital privacy is to Canadians in the 21st century. I am pleased therefore to see that they understand that sometimes mere words or a scolding are not enough.

It makes sense to me that the Privacy Commissioner will receive new powers to enforce violations of the consumer privacy protection act. That may be the most impactful change the legislation brings about. It is not enough to simply recommend that perpetrators stop their violations. Any parent could tell us that consequences are needed if we want to ensure improved behaviour.

With the Privacy Commissioner finally being able to force violators to conform to the rules, I think we will see increased respect and better treatment of Canadians' personal information. The harsh financial penalties for non-compliance will be a powerful motivator.

Given the amount of time the Liberals had before presenting Bill C-27, we must question why they did not come up with a better bill. They have left me, and all Canadians, asking if they really understand what their own legislation is supposed to do.

Does the consumer privacy protection act, as proposed in the bill, do enough to properly protect Canadians’ personal information? The Liberals had a chance to look at the EU’s GDPR and see how well that worked. Did they learn anything?

Would Bill C-27 improve the protection of Canadians’ personal information or are there so many exemptions for needing consent in the sharing of personal information that the words of the bill are meaningless?

Would the legislation create proper protections for Canadians’ biometric data? Given that no such protection currently exists, perhaps we should be thankful that the subject is addressed at all.

Is it reasonable to exempt security agencies and departments, such as CSE, CSIS and DND from AI regulations? How do you balance privacy and security concerns?

Canadians’ digital privacy and data needs to be properly protected. This bill is a flawed attempt to start the long overdue overhaul of Canada’s digital data privacy framework. The Conservatives will be looking at putting forward some common-sense amendments at the committee stage to ensure we have the best possible legislation.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, right now, Bill C-27 does not explicitly apply to political parties. We know there have been privacy breaches and the misuse of data in the past in the political area. Does the member think this kind of legislation should be amended to include political parties?

[Brad Redekopp, Conservative, Saskatoon West, SK]

Madam Speaker, it is a privilege to rise in this House.

Another day, another debate about an NDP-Liberal piece of legislation about Internet freedom in Canada. The good folks on the west side of Saskatoon have heard me speak in this place about Bill C-11 and Bill C-18, two bills aimed at controlling what Canadians see and post on the Internet.

Today we are dealing with Bill C-27, which is aimed at protecting the online data of Canadians. This legislation is meant to put safeguards around the use of artificial intelligence and establish rules around Internet privacy. Sounds good, sounds noble and sounds like something we should support. To a certain degree I do support these initiatives.

However, I have deep reservations with this legislation as it exempts the Government of Canada from these very safeguards. Do we as Canadians need the protections in this bill from companies? Absolutely, but we also need protections from government, especially this NDP-Liberal coalition government that wants to take away some of our liberties and freedoms.

Some on the other side may accuse me of fearmongering about the NDP-Liberal suppression of civil liberties and freedoms on the Internet; I am not. Let me lay out the facts, and the people in Saskatoon West can decide for themselves.

Bill C-11 is the first piece of legislation meant to strip of us of our rights to free speech on the Internet. Conservatives such as myself and free speech advocates have been warning that the provisions put in place by the NDP-Liberals to have government-appointed gatekeepers decide what is acceptable speech or not in Canada will lead to disaster.

We have already seen that a prominent University of Toronto professor has been threatened with the revocation of his licence and livelihood for tweeting out against this legislation and the current Prime Minister. Imagine what would happen when the Prime Minister has the full weight of the law to simply muzzle this type of speech. Anyone who disagrees with him would be silenced and would be fined, lose their livelihood, and what is next, go to a re-education camp? We all know about the Prime Minister’s fondness for the basic dictatorship of the People’s Republic of China, heck, he does not even mind if the People's Republic of China funnels money to his family foundation and tilts elections towards the Liberal Party of Canada in this country.

How about the second piece of legislation meant to limit our Internet freedoms, Bill C-18? That legislation allows government-appointed gatekeepers to decide what is or is not news in Canada, and forces private companies to block content they do not like from their feeds and search engines.

If there is a story critical of the NDP-Liberal coalition and the Prime Minister, they call it fake news and ban it. If there is another fawning story by Andrew Coyne in The Globe and Mail about the Trudeau Foundation and the Chinese Communist Party, it is forced to the top of everyone’s news feed and search engine, like it or not.

When I spoke about Bill C-18 in December I warned of the consequences that this legislation would have. Specifically, I mentioned conversations I had with Google and Amazon Web Services and the impact on how they deliver services to Canadians. Google flat out told me it would simply get out of the business of delivering any and all news to Canadians as it did not want to become an instrument of the Canadian government to spread partisan messaging for the party in power. Just last month it began beta testing how it could shut down its news services for Canadians.

We need a 21st century solution to this problem, not one based on ideas from 40 years ago. Bill C-27 is supposed to protect people’s data from corporations. We need that but what we need, as well, is protection from this NDP-Liberal government when it comes to privacy.

Bill C-27 completely fails us in that area. The government has dragged its heels on Internet privacy for years, and unfortunately it has been a pattern to consistently breach our digital privacy rights. We saw it when the government waited until just last year to ban Chinese telecom giant Huawei from operating in Canada while other countries did the right thing years before us.

We saw it with the $54 million “arrive scam” app tracking Canadians border travel up until September 30, and the public bank account freezing for people who donated to the truckers last year. The list goes on and on. In the words of Alanis Morissette, “Isn’t it ironic?” when we hear the government start to talk about online privacy rights. I just hope it learns to start respecting the privacy of Canadians.

Let us take a look and see if this legislation actually protects the online privacy of the people of Saskatoon West. After all, they are rightfully distrustful of government and corporations when it comes to accessing their data

Here are some examples showing why they are distrustful: Tim Hortons tracking the movement of users after they have ordered something on their app; the RCMP using Clearview AI to access a data bank of more than three billion photos pulled from websites without user consent; and we cannot forget Telus giving the federal government access to the movements of over 33 million devices over the course of the pandemic.

When governments abuse their power, it destroys the level of faith Canadians have in their institutions. In fact, if we look at polling data, we see that the number of Canadians that have faith in their government is at an all-time low. With scandals like these, it is no wonder why.

If we want to improve the level of trust held between individuals and institutions, we must look at protecting Canadians' private data. If we dive into this legislation, it seems the intent is to create a level playing field between citizens and companies when it comes to how their data is used. However, if we look into it further, the balance between businesses using business data and the protection of our privacy is off.

The bill, as it is currently written, skews toward the interests of corporations rather than the fundamental rights of individuals. There are too many exceptions granted to businesses in this legislation. Some are so broad that it is like the legislation never existed at all.

For example, business activities are exempt if a “reasonable person” would expect a business to use their data, without including the definition of what a reasonable person is. The concept of legitimate business interests has been added as an exemption to consent. How does one determine if a business interest outweighs the privacy rights of an individual? Finally, the bill does not recognize privacy as a fundamental right. This absence tips the scales away from Canadians and could affect how their privacy interests are weighed against commercial interests in the future.

Artificial intelligence comprises a major component of this legislation. AI is becoming a key tool in today's world, much like engineering was in the last century. In the past, an engineer would sit down and design a bridge, for example. Obviously, the failure of a bridge would be a huge event with the potential for major disruptions, significant costs, potential injuries and even death. Therefore, we have professional standards for engineers who build bridges, but what about artificial intelligence?

In today's modern world, AI is used more and more to perform ever more complex tasks. In its early stages, AI was used as a shortcut for repetitive tasks, but as the technology advances, it is now being used for much more. In the future, it is not unreasonable to expect AI to play a significant role in designing a bridge, for example. Artificial intelligence also needs to have standards, which is why our universities teaching AI put a big emphasis on ethics, as there are huge implications.

I know first-hand the dangers of unregulated AI systems interfering in our day-to-day lives. On the immigration committee, we have studied this issue and looked at how Canada's immigration department is using Chinook, a so-called e-tool to help IRCC bureaucrats assess applications in bulk form. This AI program was introduced in-house by these bureaucrats, which means the software's algorithms are beholden to the beliefs of its creators.

The concerning part of all of this is that there is a known culture of racism within the department, and members do not have to take my word for it. The NDP-Liberal Minister of Immigration said this of his own department at committee: The IRCC “has zero tolerance for racism, discrimination or harassment of any kind. However, we know that these problems exist throughout the public service and in our department...[and] we must first acknowledge this reality.”

There were no outside consultations done on the use or creation of this artificial intelligence application, and rejection rates have climbed since its introduction. Although I am pleased that the government is finally looking to add a framework to address concerns surrounding AI, it needs to get its own house in order first.

I will wrap up with these final thoughts.

If we are going to address concerns surrounding our digital privacy, we must listen to Canadians, and many Canadians are worried that this legislation does not protect them. I have met with Bryan Short from OpenMedia, and he said this:

Bill C-27...only plays brief lip service to privacy being a fundamental human right in its preamble; Bill C-27 fails to do the more important task of inscribing the privacy rights of people as being more important than the business interests of companies.

The bill before us is supposed to be about protecting Canadians' privacy, yet it completely avoids inscribing privacy as a fundamental right. We all know the saying “There is no point in doing something unless you do it right”, and it is quite clear that the government needs to go back to the drawing board once again on some aspects of this legislation since there is not much evidence of it consulting Canadians on how their data was actually used.

I believe the former Ontario privacy commissioner, Ann Cavoukian, said it best in 2020 during the initial Liberal attempts to bring in privacy reform to Canada when she stated:

[With] the Liberals under [the Prime Minister], it's been extremely weak. They have not addressed repeated requests from the federal privacy commissioner to strengthen existing privacy laws.... I'm tired of that. I want a party that will walk the talk. And I'm hoping that will be the Conservatives.

Canadians can count on the Conservative Party of Canada to walk the talk when it comes to strengthening our privacy laws, and Canadians can count on the Conservative Party of Canada to respect their freedom of expression online. We will scrap the online censorship legislation put in place by this tired, worn out, costly coalition. We will allow people to choose for themselves which news they want to consume, not just what the government wants them to see. Under our new leader, we will be the voice of those left behind by the NDP-Liberal government, and we will put Canadians back in the driver's seat of their own life.

[Monique Pauzé, Bloc, Repentigny, QC]

Madam Speaker, I thank my colleague for his speech. He appears to have extensive knowledge of almost every issue.

The protection of personal information is a shared jurisdiction in Canada. Bill C-27 should therefore not apply in provinces that have protections as stringent as those included in the bill.

The legislation passed by the Quebec National Assembly, in February 2021 I believe, is strong legislation. Can my colleague reassure us that Quebec businesses are indeed excluded from the federal legislation?

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is a pleasure to rise to speak to Bill C-27 today. As I put forward to my friend in the form of a question, when we think of Bill C-27, I like to think that the government is on the right track in continuing to protect the privacy of Canadians in many different ways. Yesterday we had a debate on Bill C-26 on cybersecurity.

If we take a holistic look at what the government has been able to accomplish through legislation and, ultimately, in certain areas in terms of developing the industry through budgetary measures, Canada is indeed in a very good position in comparison to our peer countries around the world. I do not say that lightly, because I know that all members are very concerned about the issue of privacy. That is in good part why we have the legislation today.

The last time these changes we are proposing happened was two decades ago. Let us reflect on that time of 20 years ago. We did not have iPhones, and Facebook did not exist. Going back a little further than that to when I was first elected, when one clicked into the Internet, the first thing one heard was a buzzing sound, the dial tone and then clicking. Then one was magically connected to the world. How far we have advanced in a relatively short period of time. Last week, I was on the Internet making a purchase that would be delivered. I never had to go to the store. It involved my doing a little bit of design work on the computer before making the purchase. I was told yesterday that it was delivered to my home.

The amount of information out there is absolutely incredible, and it is very hard to imagine the types of data and the risk factors out there. That is why it is so important that, as a government, we bring forward substantive legislation that is going to protect the privacy of Canadians, to ensure companies are held accountable and, in the context of yesterday's debate, to protect them from security threats that are very strong and very viable. It was interesting yesterday listening to the debate for a number of hours.

I get the sense that a wide spectrum of support is shaping up today. The NDP is supporting the legislation. My understanding is that the Conservatives are supporting the legislation. The Bloc, in principle, is supporting the legislation. The Province of Quebec has actually made some significant gains on this whole front, so I am not surprised that the Bloc or members from Quebec within the Liberal caucus are very strong about these issues, whether they are cybersecurity issues or the privacy issues of Bill C-27 that we are debating today.

I raise this because I believe that it does not matter what side of the House one happens to sit on, as this is legislation worth supporting. As I indicated, it has been 20 years since we have seen substantial changes to the legislation. The expectation is very high that we will not only introduce the legislation but that, with the cooperation of members opposite, we will see it pass through in a timely fashion.

Being an optimist, I would like to see the bill pass before the summer, and it is possible. I realize that it would require a great deal of co-operation from opposition parties, but I do believe it is doable, especially after the comments I heard this morning.

The legislation is not meant to address every matter that Canadians are having to face in the digital world. That is not what it is designed for. As I indicated, the legislation, whether this one or Bill C-26, goes a long way in establishing a solid base for a framework that would enable the government of the day, which is held accountable by the opposition, to have the opportunity to do a lot of work in an area where we need to see a higher sense of security and protection.

One member across the way asked about engagement. There has been a great deal of engagement. I can assure the member that, whether it is from a constituency perspective, a ministerial perspective or, I would even suggest, the member would have to take some credit in terms of an opposition perspective, there has been a great deal of dialogue. This is not a new issue. This issue has been in the making for years now.

There have been some factors that are beyond the government's control in terms of the manner in which it can bring forward legislation, for example the worldwide pandemic and the requirement for substantial legislation in order to support Canadians and have their backs. There were issues of that nature, along with numerous other pieces of legislation. I would not want to give a false impression that this is not an important issue for the Government of Canada.

At the end of the day, based on comments I have heard on both Bill C-26 and Bill C-27, I believe the legislation would establish a solid footing or framework, whatever terminology we might want to use, and, at the very least, we should see it go to committee. The principles of the legislation are in fact endorsed and supported by all sides of the House, from what I can tell, and please correct me if I am wrong. No doubt we will have other legislation that might be somewhat more controversial, where there is real opposition to the legislation, and this would enable more time for debate on that type of legislation.

If we could somehow recognize the value of this legislation, given that there is so much support for its principles, we would allow it to go to committee, where members of Parliament are afforded the opportunity to get into the nuts and bolts, the details, where there is representation from different stakeholders at committee to express their thoughts and opinions on the legislation, and where members can find out directly from the minister what kind of consultation has taken place. The member does not to have to take my word for it, but I can assure him that there has been a great deal of consultation. He would be able to hear that first-hand from departmental officials, the minister and so forth.

I believe the government has done its work in bringing the legislation to the point where it is today. We have seen ministers, in their opening remarks and in their response to questions, in co-operation with opposition members. The government has demonstrated very clearly in the past that it is open to amendments that can improve upon legislation for the benefit of Canadians, and if there are ways we can improve this legislation, we will accept those types of amendments. We will support those types of amendments. I believe this is one of the areas where the Prime Minister has been very good in sending that message. It could be because of years in opposition, when the opposition never had amendments accepted by former prime minister Stephen Harper.

At the end of the day, if there are ways to do it, we can improve upon this bill. I heard yesterday on Bill C-26, and already today on Bill C-27, that members have genuine concerns. I do not question those concerns, but I do believe that it would be helpful if they can look at those concerns. If they already have ideas that they believe will improve the legislation, nothing prevents members of the opposition or government members from being able to provide those amendments or thoughts in advance to the ministry, which would potentially allow for a deeper look into it to see if, in fact, something is doable.

The NDP talked, for example, about digital rights for Canadians. There is a great deal of concern that we need to ensure and recognize them, whether they are consumer rights or privacy rights. These are things we all hold very close to our hearts. We all want to make sure the interests of Canadians are being served.

When I took a look at the specifics of the legislation, I highlighted three parts I wanted to make reference to. CPPA would strengthen privacy enforcement and oversight in a manner that is similar to that of certain provinces and some of Canada's foreign trading partners. It is important that we do not just look internally. There are jurisdictions, whether nations or provincial entities, that have already done some fine work in this area. We do not have to reinvent the wheel, and working with or looking at other forms of legislation that are there is a very positive thing. In particular, the CPPA would do so by granting the Privacy Commissioner of Canada order-making powers that can compel organizations to stop certain improper activities or uses of personal information and order organizations to preserve information relevant to an OPC investigation.

This is significant. We need to think in terms of the technology that I make reference to. I can remember a number of years back when a pizza store was becoming computerized. As someone called in and made an order, they recorded the telephone number, the name and the address, personal information such as that. I remember talking to the franchise owner, whom I happen to know quite well, explaining how the collection of data, if used appropriately, can not only complement the business, but also complement the consumer, and this was maybe 20 years ago.

We can contrast that to an iPhone and looking at some of those applications we see. The one that comes to mind is a true Canadian application and a true Canadian franchise: Tim Hortons. My wife never followed hockey, but nowadays she does because of Tim Hortons. One can win free cups of coffee by picking who is going to score goals or get assists. I am not exactly sure how it works, but Tim Hortons comes up with a program that is actually collecting data from people. It is a program that allows it to send out all kinds of notifications. It could be sales of product. It could be something like NHL standings. It really engages the consumers. An incredible amount of data is actually being collected.

Tim Hortons is not alone. One can go to virtually all the major franchises and find the same thing. It is not just the private sector. Yesterday we were talking about cybersecurity, and one can easily understand and appreciate the sensitivity of collecting information, even if one is a Tim Hortons or a Home Depot, but also many government agencies. For example, there is the amount of personal information Manitoba Health has, which is all computerized. There are also doctors' offices. The digital world, in a very real and tangible way, has changed to such a degree that many, including myself, would argue that things like Internet access have become an absolute and essential service nowadays. It is something we all require.

The incredible growth of data banks, both in the private sector and in the government, and I would throw in the non-profits and the many other groups that collect data, has been substantive in the last 15 or 20 years. That is the reason why today we have the type of legislation we have before us. Bill C-27 would ensure that we have something in place to provide consequences for offences. To give members a sense of those consequences, the new law would enable administrative monetary penalties for serious contraventions of the law, subject to a maximum penalty of 3% or $10 million of an organization's global revenue, whichever is greater, and fines of up to 5% of revenues or $25 million, whichever is greater, for the most serious offences.

I said I wanted to highlight three things, so I will move on to the second point. The personal information and data protection tribunal act would establish a new tribunal, which would be responsible for determining whether to assign administrative monetary penalties that are recommended by the Privacy Commissioner following investigations, determining the amount of penalties and hearing appeals of the Privacy Commissioner's orders and decisions. The tribunal would provide for access to justice and contribute to further development of privacy expertise by providing expeditious reviews of the Privacy Commissioner's orders.

The third point is that the AIDA would impose a duty to act responsibly by requiring organizations designing, developing, deploying or operating high-impact artificial intelligence technologies to put in place measures to proactively mitigate risks of harm and bias in the development of these technologies.

I have less than a minute left to talk, and I have not even touched on the AI file. I made reference at the very beginning to the financial investments of this government in encouraging the growth of that industry in the different regions of our country. The Government of Canada is not only bringing in the type of securities that are absolutely important for Canadians from a privacy perspective, to encourage continual growth in the area and have these protections in place, but also doing so through budgetary measures to ensure that we continue to enhance the opportunities of Canadians. If we take a look at the digital world today, it is very hard to imagine where it is going to be tomorrow, at least for myself, in witnessing the growth of the digital world over the last 20 or 30 years and how far it has gone.

This legislation is a modernization. It is legislation we can all get behind and support. I would encourage members, no matter what party they are from, to support it. Let us see it go to committee, where the committee can do its fine work and see if we can even improve—

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, certainly from the Conservative side and from the NDP, it seems like we are on the same page when it comes to looking at privacy, protecting privacy and stating that privacy should be a fundamental right, not only in the preamble but also in the clause statement. The clause statement is very important because that is what the bill is derived from. The definition of privacy and fundamental rights then goes throughout the rest of Bill C-27.

One example that came out this week was of our children using a game called Fortnite. There are a lot of other games children spend a lot of time on sometimes, but Fortnite was found to be in breach of error in the U.S. for exploiting our children, taking their data and selling that. Can the member please answer for me how important it is not only to protect our adult fundamental right to freedom, but also our children's fundamental right to freedom?

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, I want to use my speaking time in the House to note that today is the 85th day of the blockade of the Lachin corridor. This blockade has left 120,000 Armenians in Nagorno-Karabakh without access to health care, food and medication. This situation has been denounced by the European Parliament, by Amnesty International and, last week, by the International Court of Justice. I urge the federal government to do more and apply pressure to ensure that these 120,000 Armenians can have access to food and to prevent a humanitarian crisis.

I am pleased to rise in the House today to speak to Bill C-27, an act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts.

This bill includes many things and covers many topics. I want to begin with the part on artificial intelligence. The NDP was a bit concerned by the fact that in the wake of Bill C‑11, this whole new part on the Artificial Intelligence and Data Act was added to Bill C‑27. We think this is a separate issue that needs to be dealt with separately. It is a huge topic in and of itself. We are pleased that the bill is being split so that we can study it in two parts.

In my riding, Rosemont—La Petite-Patrie, there is a burgeoning AI hub that provides jobs for hundreds, maybe even thousands, of professionals. I have met people who were a little worried about the federal government being kind of hasty in dealing with an issue as complex as AI. They are particularly worried about the fact that the U.S. and the EU have laws and regulations already. They think we need to take the time to make sure Canada's regulations are compatible with what is being done elsewhere, with our trading partners and our competitors, just so that it will be easier to attract talent down the line and get these professionals to go work in Montreal, Toronto, Vancouver and other places in Quebec and Canada. They want to avoid the kind of incompatibility that could result in unnecessary obstacles.

With respect to the protection of personal information, I believe that, sadly, a string of scandals has made people aware of this issue, and they realize that our laws and regulations must be updated and adapted. Consider the personal information and data breaches and the problems this causes for people. I will quickly mention a few examples. The problems with Yahoo, Marriott, and Mouvement Desjardins in Quebec, as well as Facebook, all revealed the need for new measures to help victims who have had data and their personal information stolen in several countries. We need only think of the 2019 settlement in the U.S. for the Equifax data breach. It is quite significant, given that Equifax is one of the largest companies people rely on for their credit score so they can make purchases or borrow money. This is not trivial.

Here, in 2019, the Office of the Privacy Commissioner of Canada found that Equifax fell short of its obligations to Canadians and Quebeckers. He then had the company sign a compliance agreement that did not require the payment of any fines or damages for Quebec or Canadian victims. This happened just a few years ago and clearly demonstrates just how outdated Canada's legislation is.

That is why the NDP will be supporting Bill C-27 at second reading. We think it is important that the bill be sent to committee, because we see all the cracks and gaps currently in the bill. It is important that the Office of the Privacy Commissioner be strengthened to bolster enforcement measures to protect consumers and Canadians. Bill C-27 needs to be amended to improve things. There are some shortcomings in this bill. There is even some backsliding in relation to Bill C-11, its predecessor in the previous Parliament, before the last election.

Privacy concerns everyone. In a digital world where social media and online entities are taking up more and more space, we have to remember that, although it is nice to use them sometimes—and they can be of great service—we are the ones who have become the product. Our personal information is the source of huge profits, and we need to be aware of that.

Our information is used to target the advertising we see on our devices when we go to websites. That targeting is based on our personal choices, preferences and searches. Big corporations create profiles and use them to sell advertising. We are the product. These companies make money off the information we give them for free. I have met people who had an interesting suggestion. Maybe these companies should pay us because we are their source of profit. They make money off the targeted advertising they sell, and that is how they plump up their bottom line.

We need to modernize our privacy protection laws. We also need to start thinking about the implications of handing over so much information about our consumer behaviour, our travel patterns, our interests and everything we search for online. We have to prompt people to think about that.

The bill is interesting because it creates a lot of new regulations and a new tribunal. The NDP thinks that is a good thing, but the bill does not go far enough. For example, the bill sets out a private right of action for individuals, but it does not really make it possible for consumers who have fallen victim to privacy breaches to be compensated, unlike what is being done in the United States. This right comes with various rather ineffective stipulations, so although there are new provisions, like this new tribunal, the bill provides for very little recourse.

A few years ago, the NDP published a digital bill of rights for Canadians. In it, we called for new, more effective provisions on consent and the sustainability of data. We called for the government to give the commissioner order powers and to impose larger and more consequential monetary penalties. We also called for transparency with regard to algorithms and more protection against abuse.

I think that the government could draw inspiration from the NDP's digital bill of rights to amend, enhance and improve the bill before us today. Once again, I have to say that this bill takes half steps because it proposes half-measures. There are some rather interesting measures in this bill, but they do not go far enough.

For example, there is still a significant imbalance between commercial interests and individual rights. Unfortunately, the Liberals are still in the habit of putting commercial interests ahead of the rights of citizens. For example, the new preamble of Bill C‑27 tries to present privacy as an individual interest tied to fundamental rights, but still does not directly recognize that privacy is not just an essential aspect of fundamental rights, but a fundamental right in and of itself. It considers the right to privacy to be part of Canadian norms and values, rather than a fundamental right. I think this part of the preamble of the bill should be changed.

There is also some backsliding. Under Bill C‑27, individuals would have less control over the collection, use and disclosure of their personal data, even less than what was proposed in Bill C‑11, which was introduced during the last Parliament. That is really the crux of the matter. If we do not have control over the information we provide or the way it is used or shared, it will be a wild west, total chaos. That is what we are seeing now, in fact. This is a step backwards, and I think that the NDP will be proposing amendments to restore this balance.

Under the bill, information that has been de-identified is still personal information, with some exceptions. There are quite a few exceptions, including in clauses 20 and 21, subclauses 22(1) and 39(1), and the list goes on and on. Roughly a dozen clauses contain multiple exceptions, so it gets extremely complex and confusing. It seems to me that this is going to give big corporations and web giants a way out, through loopholes and back doors. They will be able to do whatever they want because of this list of exceptions.

We in the NDP will be supporting the bill at second reading, but there is still a lot of work to be done to improve the bill.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, at the beginning of his speech, my colleague talked about the progress Quebec has made with Bill 25.

Bill C-27 appears to provide some protection or at least not go against Bill 25, but there is no real guarantee.

Does my colleague think that this is one of the changes that should be made to ensure that Bill 25 in Quebec is not hindered by Bill C-27 and that, instead, these laws complement one another?

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, I appreciated hearing the member for Hamilton Centre's speech on Bill C-27. I would like to hear more from him, in particular on subclause 18(3). This section talks about a legitimate interest for an organization to collect a person's private information without consent.

There have been concerns shared here with respect to how open-ended this legitimate interest could be. I wonder if the member would reflect and share more about his concerns, if any, with the way the bill is currently written.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, that is an important question. Bill C-27 needs consistent, technologically neutral and future-proof definitions both to the consumer privacy protection act and the AIDA within Bill C-27. It should provide definitions for AI or algorithmic systems that are cohesive across both laws, and the definition for AI ought to be technologically neutral and future-proof. That is the question I just answered for the previous speaker. A potential pathway for regulation is to define algorithmic systems based on their applications, instead of focusing on the various techniques associated with machine learning and AI.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I am sure the hon. members from the other side are about to take some good notes on the recommendations we put forward. They are probably discussing among themselves how they can improve upon these serious gaps and have some public engagement on this.

We are not subject matter experts in this House when it comes to this type of technology. It is not clear whether there has been any public engagement specific to Bill C-27 as it is proposed. There was public engagement around the creation of Canada's digital charter, called the national digital and data consultations, that happened back in 2018. However, as I understand it, only about 30 or so discussions were held. That fell dearly short. The majority of digital leaders were from the private sector, and there were only a couple of universities involved. Therefore, it is unclear who the government is consulting with when it deals with this type of surveillance capitalism and the risks it presents to consumers.

Let us get right to the point. What are the gaps that exist in this legislation? How does Bill C-27 compare with the ideal privacy legislation? There are many gaps. Clearly, it does not compare to the GDPR; it also falls short of privacy legislation that is currently being proposed in la belle province of Quebec, in New Zealand and in the state of California.

For example, in California, the California Consumer Privacy Act, the California Privacy Rights Act and the Children's Online Privacy Protection Act have all presented more robust solutions to what is before us here today. In addition, there are privacy protections that come into effect under the CCPA that we should be considering.

We need to ensure that the protections that come into effect include the rights to know, to delete and to opt out of sale or sharing, as well as the right to non-discrimination. Under that legislation, consumers also have the rights to correct inaccurate personal information and to limit the use and disclosure of sensitive personal information collected about them. There is a lot out there that we should be considering when it comes to amendments.

I am going to list examples of gaps within this bill so they are on the record. The bill does not promote the development of data stewardship models. It does not require that organizations take into account the potential consequences to individuals and societies through such measures as privacy impact assessments of a breach of security or safeguards. There is no section in Bill C-27 expressly dedicated to cross-border dataflows.

There has been no privacy impact assessment done to address any additional risks, which should be identified, justified, mitigated and documented in such an assessment. There is no assessment of the broader level of privacy rights protections in foreign jurisdictions. This is a very important conversation, particularly this week in the House, that includes how Canadians' privacy rights can be enforced.

This bill does not include specific rules that are applicable to data brokers, and these are important third parties who are not service providers. There should be a fiduciary duty to individuals if data processors act as intermediaries between individuals and data collectors. This would ensure that such service providers only use personal information entrusted to them for the purpose intended by the individuals.

This bill does not provide the right to disposal with respect to search engines' indexing of personal information where it could cause harm to the individual's privacy or reputation. It does not include the language that was in PIPEDA regarding individual access where it provides an account of third parties to which personal information about an individual or an organization has been disclosed. There should be an attempt that is as specific as possible.

This bill does not include the right of individuals to express their points of view to a human who can intervene or to contest decisions. When we look at AI or how algorithms are working in society today, they are inherently flawed.

In fact, there is another study that I would reference, titled “AI Oversight, Accountability and Protecting Human Rights”, which has commentary on this. This was authored by a series of subject matter experts who gave a long list of needs for adequate public consultation and proper oversight of AIDI to effectively regulate the AI market in Canada.

The commissioner needs to be an independent agent of Parliament. We need to empower an independent tribunal to administer penalties in the event of a contravention, and we need to outline the best practices for auditing and enforcing the law. There are dozens of recommendations contained in both reports that, as New Democrats, we will be presenting to the government at the appropriate time at committee.

It is clear, from the body of the preliminary work that has been done, that this bill is inadequate as it stands. It is too big to adequately cover AI and consumer protections. It has always been our belief that those should be split up. That way we can have an investigation to ensure that consumer protections are met, that surveillance capital does not continue to profit off our most personal information and data and that, ultimately, we have safeguards with a robust and very firm platform on which these organizations, businesses, companies, and in some instances foreign countries, are held to account when they violate our rules.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I will be sharing my time with the wonderful member forRosemont—La Petite-Patrie.

I am grateful for the opportunity to rise today on Bill C-27, which is an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act, and to make consequential and related amendments.

The amendments are what I am particularly interested in today. As New Democrats, we will be supporting this at second reading. We support the need to modernize Canada's privacy laws and establishing rules around data governance and empowering the Office of the Privacy Commissioner to bring enforcement actions to protect consumers and citizens.

This bill takes some of those steps. However, there is a need to ensure that reforms are robust and effective. In my opinion, a long list of amendments will certainly be required to achieve these goals.

I am going to be referencing two important works that have been presented. One is from the Centre for Digital Rights, entitled “Not Fit For Purpose - Canada Deserves Much Better”. From the title, we can note that there are some concerns with this bill.

However, we recognize that this privacy legislation must be amended because there are already glaring shortfalls in PIPEDA, which urgently needs updating.

Technology continues to evolve, and data-driven business continues to move away from a service-oriented approach to one that relies on monetizing personal information through mass surveillance of individuals and groups. While these businesses find new ways to expand their surveillance and methods of monetizing our personal information, Canadians' privacy is increasingly put at risk.

The GDPR is the bar that is currently considered the adequate level of protection. However, if we were to do a little bit of comparing and contrasting, we would see that this bill tends to fall short of this level in terms of what the European Commission has done.

What this means for us is that the ability for personal data to flow to Canada without any further safeguards is at risk. There has also been pressure from industry and advocacy groups, the privacy commissioners of Canada and abroad, and privacy and data governance experts. In fact, in this particular bill, we think that the government side has fallen short in its engagement with people; I will get to that in a moment.

When we are in these technological environments, it is an ecosystem that goes well beyond our borders. We are talking about what it is like—

The House resumed from November 28, 2022, consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts be read the second time and referred to a committee.

Business of the House

[Mark Holland, Liberal, Leader of the Government in the House of Commons]

Mr. Speaker, I appreciate my hon. colleague's very sincere effort, I am sure, to lay that on the record. I am sure he is in shock that there was not unanimous consent. However, my hon. colleague can rest assured that, when it comes to climate change, we will not allow inaction to be the rule of the day and that we will absolutely continue to take action to make sure climate change does not ravage this planet.

I do want to pick up on the second-last comment that the hon. opposition House leader made, which were comments with respect to Family Day. I hope that he, and indeed all members in the House, take time with their families and with their constituents, and that they return to this place in good health.

Tomorrow, we will resume debate on Bill C-34 to amend the Investment Canada Act at second reading.

Upon our return on Monday, March 6, we will call Bill C-27 on the digital charter, at second reading.

Tuesday shall be an allotted day.

On Wednesday, we will commence debate on Bill C-33 concerning the port system and railway safety.

Thursday will not only be the opportunity for my hon. colleague's favourite time of the week, another Thursday question, but we will also resume debate on Bill C-23 respecting historic places, at second reading.

On Friday, we will continue second reading debate of Bill C-26, the cybersecurity legislation.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Not to confuse everyone by bringing another bill in, because I think it's still important, but Bill C-27 is about our privacy legislation. I think we've heard some witnesses on the right to repair. There have been concerns or looking at the restrictions for privacy, especially around the data that sinkhole the system.

This is copyright law, so it's not privacy law, but is there anything we would be using, looking at Europe with the GDPR and the Americans with their state privacy law, in interoperability that would be interoperable with the Bill C-27 that we're bringing to Parliament?

[Simon Kennedy]

I think I can answer in two parts, and my colleague might want to elaborate a bit.

One is that support for the Canadian artificial intelligence community and for research in this space is a real priority. The government has the pan-Canadian strategy for artificial intelligence, which it announced a number of years ago, and we've announced—I guess it was last year, but it was relatively recently—the next phase of the pan-Canadian strategy.

In that renewal of the strategy, we put an increased emphasis on actually translating the intellectual property that is developed—the ideas and the IP developed by our researchers—into use in the Canadian economy and by Canadian organizations. There are all kinds of really great examples of that happening in real time in hospitals, businesses and so on.

We've also put a priority on making sure that our researchers have access to the specialized computing power that's needed. There's been an effort in the second phase of the strategy to adapt and focus on areas that were considered to be maybe areas that weren't as strong in the first version of the strategy.

Then, on the legislative and regulatory front, the government has tabled Bill C-27. There's a whole section of that legislation that is a new proposed law on artificial intelligence, basically to ensure that AI is used responsibly in the economy. We're looking forward to discussion at committee and more as that bill advances through the parliamentary process.

[Brian Masse, NDP, Windsor West, ON]

I appreciate that, but I'm just not satisfied as to our accountability levels here. I want us to have a national auto strategy.

I'll leave that behind for now. I want to get to something else. I do appreciate.... I know that's not the intent of these things, but it's a clear example of how disastrous the policy can be if it's not wielded properly. It may sound like $3 million is not a lot of money, but it is. When we export these jobs, it's really poor.

I want to switch channels a little bit. What are you doing internally with regard to retention of staff? I know this is totally different from where we were, but we're looking at challenges in all of the sector.

The minister has several fronts, Bill C-34, Bill C-27, a whole series of things. What are we doing internally to make sure that the public service has the skill sets necessary to help provide the proper information for the minister in the research? What are we doing for retention of individuals as we negotiate more new things than ever before?

I'll leave it there. That's my time. Thanks.

[Brian Masse, NDP, Windsor West, ON]

At the end of the day, you have control of the House.

At any rate, I think it's important not to.... Nobody's being obstructionist on Bill C-27 here. There are a lot of concerns about the bill. I know the NDP split the bill, in terms of voting, because there are some new sections that are very important for us to go through. There's a lot of interest out there. We're getting a lot of contact at our members' offices.

I want to highlight, though, that it isn't us holding back that process.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

We need to work together. I'm saying that Bill C-27 is for Canada. It's not for members of Parliament.

[Brian Masse, NDP, Windsor West, ON]

You're the busiest, by far, and that's a good thing.

I want to take one issue up, though. You left Bill C-27 in the hands of us, the members of Parliament. I want to correct the record here. Has your House leader asked for time for Bill C-27? My information is that your House leader has not. Bill C-27 cannot go back to the House of Commons, unless your party brings it there. You brought Bill C-34 instead.

Why won't your House leader bring Bill C-27 to the floor of the House of Commons, if you think it's so important, if you're going to lay the blame on committee and other members of Parliament?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

I'm delighted to hear you say that, Mr. Lemire. I have a lot of admiration and esteem for you as a colleague.

If you want to know why Bill C‑27 Is bogged down, then I think you need to look elsewhere, perhaps to your colleagues. We are certainly ready to move forward with the bill.

For Canadians listening today I should point out that Bill C‑27 is the Digital Charter Implementation Act. It includes some extremely important provisions. There is for example the entire part on the protection of children. Ever since the COVID‑19 crisis, children have been spending more and more time in virtual space. All elected representatives are responsible for moving forward quickly with the study of this bill, in order to provide better protection for our children, and as you were saying, to provide a framework for artificial intelligence. I would like artificial intelligence to work for people.

I am delighted to hear that the Bloc Québécois is prepared to support us. I trust that members of the other parties will follow suit, Conservatives and New Democrats alike.

We have an opportunity to adopt a bill that will give Canada a profile throughout the world. I was in fact speaking with my European friends recently, and they were saying that the bill that has just been tabled here was one of the most innovative in the world. I also think that companies would like to see our provisions aligned with those in Europe.

There is some urgency about taking action. I am pleased to hear that we'll have the support of the Bloc Québécois. I'll be asking our Conservative friends in a few moments, to see if they are prepared to lend their support as well.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Thank you, Minister, for coming.

I noticed in your opening address and in your answers that you didn't talk to us about the predictability and stability of the supply chain, factors that are usually extremely prominent in the speeches you give, whether in Washington, Korea or Japan.

With respect to predictability, I see an issue here. We get the impression that you're putting a lot of things on the table in many different spheres, but in some instances, we are waiting for answers. One example of this is the transaction between Rogers and Shaw, and now Vidéotron. We're at a stage where action is needed, because the situation is creating tension and animosity. The Fox project is a particularly good illustration. Trying to find out how the fourth industry player might move in is making it difficult to achieve anything resembling candour. All we're getting is hearsay. I get the impression that the longer we wait, the more the debate becomes clouded. I would therefore like you to take a position on this transaction as quickly as possible.

I'd like to hear what you have to say about bills C‑27 and C‑34.

Why has the government not acted upon Bill C‑27 for some time now? I think you would get House approval to send this bill to the Standing Committee on Industry and Technology. We'd like to study it in committee. There are some areas, such as data protection, for which you have done your homework and reached consensus. As for artificial intelligence, I think we might have quite a few questions to ask.

In any event, we'd like to ask you to put these bills back on the Order Paper.

Why is it taking so long?

Privacy

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, Bill C‑27 was supposed to tighten control over personal information, but it fails to address that practice and it does not recognize the fundamental right to privacy as recommended by the Privacy Commissioner.

Bill C‑27 does not require businesses to seek valid consent of clients before sharing their data. The simple act of requesting an electronic receipt does not constitute authorization to provide our personal data.

Will the government amend Bill C‑27 to protect client data rather than the right of businesses to share the data without consent?

[Brian Masse, NDP, Windsor West, ON]

Thank you so much, and thank you to the witnesses for being here.

As the New Democrat on this committee for 15 of my 20 years in Parliament, I've seen a lot of companies come and go. I've seen a lot of promises being made. I want to remind the public, in the process here, that having the tribunal panel was a political decision. It was made by legislation. It's not a pure system by any means; it's an appointed process.

To hammer that point through, under Bill C-27 this committee will also have to consider another tribunal creation, which could potentially undermine the Privacy Commissioner. I want to make it clear that upholding the tribunal's decision is not independent of politics in itself. It's shaded in its birth of being part of political decision-making. That's one reason I think the minister still has a lot of choices here.

I want to note a couple of quotes that I have here. Mr. Péladeau, in 2009 you said that in terms of spectrum, you didn't have any plan for now and you felt there's a great value that will become an even greater value.

In 2013, your colleague, Mr. Dépatie, said that as for the spectrum, Quebecor had acquired Ontario, Alberta and British Columbia and “could not pass up the opportunity” to acquire high-value spectrum at such an attractive price. That was a carve-out that was done specifically.

Lastly, another of your colleagues, Mr. Dion, said, “Today's licence acquisitions [in Ontario, British Columbia and Alberta] continue our strategy of buying spectrum at advantageous prices, mainly to support Videotron's operations in Quebec.”

From that time period, you didn't provide a lot of rollout. Even ISED noted that you left 83% of rural residents in the area with no coverage.

During this process we've had COVID, where this is very serious for other businesses and also to the pocketbooks of people. Also, the areas of schools, business and telehealth were left without competition. They were left with higher prices, and sometimes they were left with no services.

My question to you is this. What makes us believe that now, at this point in time, you're actually going to be in the race and you're actually going to compete?

When there's no actual way for us to follow through with any type of punishment if you don't, what makes it comforting for those people who were left behind when Quebecor didn't act on the spectrum it acquired? More importantly, it actually acquired income and revenue from that spectrum that was provided for it.

It's a situation that I think is pretty serious. It's one that has to be answered to, because if we are going to have a disrupter—that's what the tribunal noted—it has to be one that will actually be in place and be forward-thinking.

Online News Act

[Brad Redekopp, Conservative, Saskatoon West, SK]

Mr. Speaker, first, I would like to wish everyone in this chamber and all of the people of Saskatoon a merry Christmas and a very happy new year.

This is the time of the year that many of us get to spend with family, friends and other loved ones. For some of us, it is truly a joyous season full of wonderment. For others, the holiday season reminds us of people lost and of relations lost. It is a hard time for those individuals.

As we all reflect on the past year and look forward to the next year, I want to offer these words of hope to all of the good folks throughout Saskatoon. May 2023 bring new beginnings, peace, good health and prosperity to members and their families.

As the member of Parliament representing the west side of Saskatoon, I will continue to work hard to raise up our city, our neighbourhoods and each of us to the best that we can be in 2023.

As we get into these last days of 2022, Bill C-18 has landed back in the House of Commons for its final round of debate before being shipped off to the other place. This legislation is one of three Internet censorship laws that the NDP-Liberal government has brought in since the last election.

Its goal is to ensure that voices other than its own, and news stories it does not like, are silenced in our democracy. I had the chance to speak to Bill C-11, which would have given almost dictator-like powers to a branch of the federal government to decide what people post on Facebook, Twitter, TikTok and other Internet platforms.

If the content is not in line with the NDP-Liberal messaging of the day, algorithms would be manipulated to remove that content from one's feeds and searches. Members do not have to take my word for it. The head of that very government agency admitted as much to the Senate committee when it took up that legislation. What is worse, the NDP-Liberals just shrug their shoulders because that was the very point of the legislation.

This legislation, Bill C-18, is the second Internet censorship law that the NDP-Liberals are forcing down the throats of Canadians. Simply put, this law would force Facebook, Google and other Internet companies to prioritize CBC and other government-approved news outlets on our feed over the smaller alternative news media platforms that may be more critical of the NDP-Liberal view of the world.

The third piece of legislation currently before this Parliament is Bill C-27, which I hope to address in the new year. That legislation is the so-called digital privacy legislation, which is a laughable topic from an NDP-Liberal government that tracked millions of Canadian’s cell phones during the pandemic without their consent and has been responsible for the personal data of hundreds of thousands of Canadians ending up on the dark web.

The truth is that the Internet and social media are an integrated part of our lives today. Until now, they have been an unfettered part of our lives. Canadians use social media platforms to access and share a variety of different news articles and information among colleagues, family and friends. Canadians I talk to are very worried that these three laws will limit their ability to have open conversations online.

For legislation that is supposedly about promoting online news, the NDP-Liberals and their allies in the CBC and traditional media have been spreading a lot of misinformation about it. The current government wants to have Bill C-18 so it can use algorithms to keep information it does not like away from our feeds and Internet searches.

Bill C-18 essentially grants the government the ability to force online platforms, such as Facebook and Google, to sign deals under the duress of government penalty to promote government-approved content. These commercial agreements do not just have to be acceptable to the platform and the news organization but to the government as well.

The government agency in charge of implementing Bill C-18’s censorship provisions is called the CRTC, and it would oversee every step of this process to ensure they are satisfactory to the NDP-Liberals. Surprise, surprise, all nine members of the CRTC are appointed by the Liberal Minister of Heritage.

I am not the only one seeing past the government’s spin on this. Outside experts such as Michael Geist, who is the research chair in Internet and e-commerce law at the University of Ottawa, said this at the heritage committee in relation to Bill C-18, “Bill C-18’s dangerous approach…regulates which platforms must pay in order to permit expression from their users and dictates which sources are entitled to compensation.”

The former vice-chair of the CRTC, Peter Menzies, told the committee how the government can influence news companies:

You could end up with companies wishing to please the CRTC or the CRTC feeling pressure to make sure money in newsrooms is spent on certain topics, and they might be good topics, but it's frankly none of their business to have.... An independent press spends its money on whatever it wants.

Who are we to believe, the independent experts or the CBC, which is already in the pockets of the NDP-Liberal government?

A question that comes to mind is who benefits the most from this Internet censorship? It certainly is not the average everyday user of the Internet who is logging into their feed to keep up with the news. It is definitely not the independent journalists trying to make a living and provide accurate news. It could be no other than the legacy media, more specifically the folks at the CBC.

The CBC and other legacy news organizations have been complaining for years about their inability to keep up with the modern online news media. Then they proceeded to lobby the government for $600 million in bailouts. CBC, for example, rakes in $1.2 billion in federal funding and receives $250 million in combined TV and online advertising revenue, yet it still struggles to survive in the Canadian market, as it cannot keep up with the modern tech era.

This is where Bill C-18 comes to play. The government is looking to tip the scales further in CBC's favour. The government has decided that it is a bad look to continue giving more billion-dollar bailouts to the CBC, so now the government is forcing tech companies like Facebook and Google to make NDP-Liberal approved commercial deals to fund the legacy media.

Instead, the legacy media should be competing on the open market, as many independent journalists are doing as we speak. At the end of the day, online platforms and Canadian taxpayers should not be footing the bill if the legacy media is unable to keep up with the times.

Let us talk about how this legislation would affect the news Canadians access.

Bill C-18 would prohibit digital intermediary operators from giving what the CRTC determines as “preference” in news ranking. That sounds relatively fine, does it not? No, it is not. With this unclear language added into the bill, just about anyone could call up the CRTC to contest their ranking and be brought up to the top of any search engine or platform.

I think this gets to the heart of the matter. Trying to regulate content on the Internet will always introduce bias into the conversation. At best, it is an innocent hassle. At worst, it can be used by the government to suppress real information and control people. In my view, the risk of the worst case is not worth it. As they say, the juice is not worth the squeeze.

Let us talk about Google, Facebook, TikTok, Twitter and the Internet in general.

First let me say that Elon Musk's recent purchase of Twitter has shaken up Silicon Valley and the status quo in big tech quite a bit and has perhaps breathed some fresh air into what was becoming a stale industry. His commitment to free speech and his willingness to stand up to the powers that be show how big tech can directly influence elections or stay neutral, as they should.

Of course, in Canada, this legislation has the potential to tip the scales toward the NDP-Liberals during elections. Big tech recognizes that and they do not want to be tools of censorship in Canada or anywhere else.

Last spring, I met the executives of Google and it was an eye-opening experience. They are concerned. They worry that Bill C-18 does not have the tools to provide relief to smaller news outlets. After all, it was not the small independent news outlets that wanted this in the first place. It was the large media networks that lobbied for this to get done and that are now foaming at the mouth to get this legislation rammed through Parliament.

Members should not kid themselves. Google is not just afraid for its bottom line. It is a multi-billion dollar business and will absorb the costs associated with this legislation. Its real fear is about freedom of speech on the Internet. They may run worldwide organizations, but the Silicon Valley boys are still hackers at heart, living out of their mothers' basements playing Halo, sharing on Twitch and posting on Reddit. Google is concerned that the government is making it more difficult for Canadians to access quality information.

I also met with Amazon World Services in the summer, and we talked about a variety of issues related to this legislation. I can tell members that Google and Amazon do not just meet random opposition members from Saskatoon unless they have real concerns about where this country is going. It is Canadians who are the best judge of what content they want to consume, not some government bureaucrats.

We have seen Canadian content creators thrive in an open and competitive market, one being Hitesh Sharma, a Punjabi hip-hop artist from Saskatchewan who built up a large following on TikTok and later made it to the Junos. He did not need the CRTC to give him a path to fame.

It is very important that we allow our creators, whether they are influencers or media, to flourish against the top creators in the world. That is not to say we should not support our local media when we can, but we should recognize the talent we already have, all of whom have succeeded without the involvement of big government interference.

With Bill C-18, local Canadian content creators could be squeezed out of our newsfeeds and replaced with the CBC. I guess that is fine for the few people who tune into CBC on a regular basis, but for most people, especially younger people, the desire is for a free and open Internet where we can search for whatever we want, free of interference by government or anyone else. That is what Canadians want.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair. It's a pleasure to be here today to speak to this topic.

First, I want to point out that committees are masters of their own proceedings, which I think is a really important point when we get into this. This is an Investment Canada Act issue. It is certainly an industry issue, specifically and mostly because there have been different times, as the previous member mentioned, when we have dealt with certain of these issues—the Neo Lithium issue, and other companies—and we just have not got it right.

Especially right now, with the government launching a new Indo-Pacific strategy, certainly, we have all heard reports of alleged Chinese police stations. We can go as far back as we want to. I have an office in an old Nortel building in Belleville. It used to be really big. I know that DND has one in Kanata. There's always talk about having to clean and the amount of bugs that have been in those buildings.

We've had interference for a long time, and whether this government is now making it known that it is more serious, or whether we're changing the strategy, certainly, when it comes to the Investment Canada Act and protecting our security, whether that be critical minerals or telecommunications as a whole, I think that all the members of this committee should warrant that at this point this needs to be studied. It is important to study this issue, not only because this was not from government or something that came out forthright that was discovered. It was from the press.

My colleague brought up the question of whether this was the only instance in which this is occurring. Certainly there was, in 2017, a government review of the approved sale of Vancouver-based Norsat International to Hytera. At that time, in 2017, MPs questioned that. We're now in 2022, almost 2023, almost six years later, and the same issues are there. To say that we have studied this....

Certainly, for two meetings, for two days, given the importance of the implications of this finding, given the importance of strengthening the Investment Canada Act, given the importance of protecting our information, our companies and our sovereignty in this country, it is certainly the right time for the industry committee to have those questions asked.

The government has already suspended the contract. There has already been action. Therefore, there should be full agreement that we can look into how this happened and how it cannot happen again, for a few reasons. The first is the importance of what is happening, and the significance of that to our nation. The second is the future of this committee, of company procurement, and making sure we strengthen the Investment Canada Act to make sure this doesn't happen again.

This is beyond the “fool me once, shame on you; fool me twice”. This is happening three or four times. We certainly need to get to the bottom of it.

I don't see why, for two days, to bring the relevant witnesses to this committee and to have a report that goes to Parliament, at a time when we're trying to improve all the other bills.... My colleague mentioned C-27. Certainly, the government has talked about improving the Investment Canada Act. At a time when the Indo-Pacific strategy has been brought forward, although late, by the government, it certainly is the right time, in my mind, to spend two days.

Let's investigate what has happened. The company that lost out on that one bid is from Quebec. Why did a Canadian company lose out on that bid in the first place? As my colleague has mentioned, how much is it going to take to unravel what we've already implemented? Is the contract still in place? What is there? How do we go out and see that a new RFP is put forth that may benefit Quebec at the end of the day?

I think there are a lot of good reasons to go at this. Thank you very much, Mr. Chair.

[Raquel Dancho, Conservative, Kildonan—St. Paul, MB]

Thank you very much, Mr. Chair.

As I was saying, I'm the vice-chair of the public safety and national security committee, and it's a real pleasure to be with industry today. I appreciate and applaud my colleagues for bringing forward this very comprehensive motion to investigate a very critical issue, which I think many Canadians are paying attention to. The Prime Minister, of course, has weighed in on this as has the Minister of Public Safety.

I would like to hear more from Minister Champagne, given that he is the industry minister lead, of course, and I think it does impact a number of different areas of government, national security and, of course, industry. We can also look at the impact this will have on setting a precedent should we allow these types of contracts to continue.

Now, the government has said that it is pausing this contract, but I do have concerns given that the company that received the contract is ultimately owned in part by the company Hytera, as mentioned by my colleague, which is based in the People's Republic of China. We know that some of that technology in this contract is already being implemented in Ontario and Saskatchewan. I have not heard from Minister Champagne or the Prime Minister or the Minister of Public Safety whether this pause of the contract will mean that this government will be insisting on the removal of that technology that's already in place, again, for surveillance purposes, for RCMP. It's quite shocking when you consider that the parent company, which is in part owned by the People's Republic of China, is now sort of responsible for the surveillance technology of our RCMP.

I would have thought that would be one of the first things they would have committed to. If there were any threat to our national security, in setting a precedent in this surveillance industry that we have in Canada, whether it's for national security or within our telecoms utilized by, for example, the Department of National Defence, you would think they would set a clear standard that this is unacceptable and it would be removed immediately.

We did see, with the Liberal government, they took about five years to commit to removing the Huawei technology, and, because it took so long, it will cost hundreds of millions of additional dollars that will be passed down to the consumer. Huawei and the 5G technology we saw have so infiltrated our telecommunications systems that it will be very hard work to remove that.

I have those same concerns with what's happening here. As my colleague mentioned, earlier this year, I believe on February 22, the U.S. Department of Justice unsealed a federal indictment showing that there were 21 charges of conspiracy to commit theft of trade secrets against Hytera.

We see that in the United States they're being very aggressive and transparent with the threat from Hytera, which again is sort of the parent of the parent company that owns Sinclair. We see the Americans taking very strong action on this, yet we have not seen the Prime Minister or the Ministry of Industry or the Minister of Public Safety make a very clear statement that this surveillance technology that is being provided by this ultimately Chinese-owned company, so to speak, will be removed in Ontario and Saskatchewan.

I'd like to hear that and I'd like the Minister of Public Safety and the Ministry of Industry to come to this committee and make that commitment.

Further to that, Mr. Chair, I am concerned that there may be other contracts like this and that has not been made clear. This was found because of very solid journalism in this country. That's great, but are there more? You would think if there's one, there are likely others. We know that recently the Minister of Foreign Affairs put forward her Indo-Pacific strategy, and that falls under the Canada-China committee, which I also sit on.

There was certainly appreciation for the tougher stance that was communicated in that Indo-Pacific strategy, but what I would say is that the government on one side is saying that procurement is independent. They're blaming the independent system of procurement of this government. They're saying it's independent and they don't agree with it, but it is independent. They're sort of blaming others for what has happened under their watch, but what I would say is that every independent agency of government certainly has to follow the ethos, the values set forward by the Prime Minister and his cabinet.

I would argue that perhaps if the Indo-Pacific strategy for which the Conservatives have been calling for quite some time had been brought forward sooner, the procurement agency would have had a better idea of the threat analysis of China and companies that are partly Chinese-owned that provide surveillance technology and other technologies. Perhaps they would have had that lens to apply to this contract.

I don't believe that it is an appropriate assessment by the Prime Minister to sort of kick this over to the independent procurement agency and say it's all on them. If they had brought forward the Indo-Pacific strategy, which makes quite a bit more clear the threat analysis of China, perhaps the independent procurement agency would have had a more clear picture in order to enter any contracts with companies like this with eyes wide open.

I know there is some discussion around whether this falls under public safety, whether this falls under foreign affairs, whether this falls under the China committee or whether this falls under industry. Certainly, Minister Champagne is bringing forward bills like Bill C-27, which is in part related to the Minister of Public Safety's Bill C-26. Bill C-26 ultimately is a bill to deal with telecommunications in this country and other companies that are providing national security critical infrastructure types of services.

I would say that both committees and both ministers play a role. Given that Bill C-26 and Bill C-27 are closely related in some ways, and given what I know about the industry committee, I think it would make sense and would not be out of scope to have the ministers come forward to this committee.

I hope that members consider that, given that this may be an industry-wide problem, even beyond telecommunications and surveillance. This could be in data management. We can see health services and the privacy information therein. There are countless industries across Canada that may very well have contracts owned in part or in full that are connected to the People's Republic of China.

This is a national security concern. My point is that it also impacts a number of industries, and that's why we're seeing similar bills under Minister Mendicino and Minister Champagne.

I do feel that it is appropriate to set the standard for industry at the industry committee that these types of contracts will not be tolerated any longer. Certainly, we must bring to the attention of the Minister of Procurement and other ministers impacted by this, that, given the very clear message—or, I would say, clearer message—set forth in the Indo-Pacific strategy, there needs to be a whole-of-government approach to reviewing all contracts provided.

The last thing I will mention is that it is not just government contracts that are of concern. There are other private contracts that are of concern in multiple different industries, or there may be. If there's one that got through the procurement vetting process with the Government of Canada, it is very likely that there are a number of private entities that have contracts that would impact our national security and that really go across a number of industries.

I appreciate the very comprehensive 106(4) motion put forward. It certainly is exhaustive, and I think that's important because we want to make sure we don't have any cracks. It is very critical that we ensure that the veil is lifted on this so to speak. By passing this 106(4), the industry committee sends a very clear message to all industries that may have contracts with the People's Republic of China—which may impact data security, surveillance and the like—to take note. The industry committee taking a leadership role in that, I think, sends a very strong message across industries that are critical to our national security.

I hope that the committee considers that. I hope it considers taking that leadership position and certainly leads by example at this committee and sets a very clear tone, so that any industry impacted by national security concerns shall be made aware.

Those would be my remarks. Thank you, Mr. Chair.

[Matthew Hatfield]

I don't think this bill covers that in itself. I think we need changes under privacy reform with Bill C-27 to also guarantee that.

I do want to flag something in terms of the question of what a repair is. I think focusing on original functionality might be worth looking at, rather than the exact state that the manufacturer handed it off in. Looking at the use case where a manufacturer goes out of business or stops supporting a device, you might need to “modify” the device just to provide security protection or get it up to the standard that the device is intended to operate in.

We should be looking at the consumer's relationship to the device and making sure that looks more or less the same—not necessarily the manufacturer's code.

[Matthew Hatfield]

That's a huge question. I think in general I'll defer the interoperability discussion to both the Bill C-294 discussion and also looking at our Competition Act—and the privacy act, for that matter, in Bill C-27.

The big picture around interoperability is that many, many digitally savvy companies are locking their consumers within walled gardens. As many people on Twitter know these days, it can be very hard to leave a company once they get you locked in, no matter how you feel about that company. In general, we want to see our government passing legislation that gives consumers real ownership of our data and makes it easy for us to see our data, take our data out of a system and put it into another system. We want them to really facilitate that transfer, because people don't have the options they deserve in terms of who to do business with anymore. A lot of us are locked into commercial relationships that we are not satisfied by.

Digital Charter Implementation Act, 2022

[Leah Gazan, NDP, Winnipeg Centre, MB]

Mr. Speaker, the private right of action would allow individuals and groups of consumers to seek compensation in court. This has been used effectively in the United States to remedy violations, but it is very burdensome in Bill C-27 to make it even usable.

For example, if the Privacy Commissioner does not investigate or rule on a complaint, an individual has no right of action. If the Privacy Commissioner does investigate and rule on a complaint but the tribunal does not uphold it, the individual has no right of action. These are a couple of examples.

Does my hon. colleague feel that this bill should be amended to fix this?

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Mr. Speaker, it is always a privilege to rise on behalf of the residents of Kelowna—Lake Country. Today we are debating Bill C-27, an act that would enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act.

Canadians know we no longer live in the year 2000, but unfortunately much of our digital regulation still does. We have come a long way since Canadians' primary online concern was Y2K. The last time Parliament passed a digital privacy framework was PIPEDA, or the Personal Information Protection and Electronic Documents Act, on April 13, 2000. The most popular website in Canada that month was AOL.

When Parliament last wrote these regulations, millions of homes did not have dial-up, let alone Wi-Fi. Cellular phones lacked apps or facial recognition, and people still went continually to libraries to get information, and did not have the Alexas of the world as an alternative. They also called restaurants directly for delivery. Digital advertising amounted to flashing banners and pop-up ads.

In only 22 years, we have experienced a paradigm shift in how we treat privacy online. Personal data collection is the main engine driving the digital economy. A Facebook account is now effectively required to use certain types of websites and help those websites; a laptop can create a biometric password for one's bank account, and Canadians are more concerned about privacy than ever before.

One of the most common videos I share with residents in my community of Kelowna—Lake Country is one relating to privacy concerns during my questioning at the industry committee in 2020, as many people reached out to me about privacy concerns. It was to a Google Canada representative regarding cellphone tracking. This was in the immediate aftermath of reports of Canadians' cellphone data being used to track people's locations during the pandemic.

Cellphone tracking is something I continue to receive correspondence about, and I am sure other members in the House do as well. As traditionally defined, our right to privacy has meant limiting the information others can get about us. The privacy of one's digital life should be no different from the physical right to privacy on one's property. Canadians must have the right to access and control the collection, use, monitoring, retention and disclosure of their personal data.

Privacy as a fundamental right is not stipulated in the legislation we are discussing today, Bill C-27. It is mentioned in the preamble, which is the narrative at the beginning, but that is not binding. It is not in the legislation itself. While the degree to which someone wishes to use this right is ultimately up to the individual, Parliament should still seek to update the rules using detailed definitions and explicit protections. Canadians are anxious to see action on this, and I have many concerns about this legislation, which I will outline here today.

As drafted, Bill C-27 offers definitions surrounding consent rules to collect or preserve personal information. It would mandate that when personal information is collected, tech companies must protect the identity of the original user if it is used for research or commercial purposes. The legislation outlines severe penalties for those who do not comply and would provide real powers of investigation and enforcement. It presents Canada's first regulations surrounding the development of artificial intelligence systems.

Even though Bill C-27 presents welcome first steps in digital information protection, there is still a long way to go if we are to secure digital rights to the standard of privacy regulation Canadians expect, and most importantly, the protection of personal privacy rights. As is mentioned in Bill C-27, digital privacy rights are in serious need of updating. However, they are not in this legislation.

I agree with the purpose of the legislation, but many of my concerns are about inefficient, regulatory bureaucracy being created and the list of exemptions. Also, the artificial intelligence legislation included in this bill has huge gaps and should really be its own legislation.

From a purely operational perspective, while the legislation would empower the Privacy Commissioner's office with regard to compliance, it also constructs a parallel bureaucracy in the creation of a digital tribunal. If Bill C-27 is enacted, Canada's Privacy Commissioner can recommend that the tribunal impose a fine after finding that a company has violated our privacy laws. However, the final decision to pursue monetary penalties would ultimately rest with the new tribunal. Will this result in a duplicate investigation undertaken by the tribunal to confirm the commissioner's investigation?

As someone who has operated a small business, I am all too aware of the delays and repetitiveness of government bureaucracy. While it is important to have an appeal function, it is evident in this legislation that the Liberals would be creating a costly, bureaucratic, regulatory merry-go-round for decisions.

Canadians looking to see privacy offenders held accountable need to see justice done in a reasonable time frame. That is a reasonable expectation. Why not give Canada's Privacy Commissioner more authority? Of course, Canadian courts stand available. The EU, the U.K., New Zealand and Australia do not have similar tribunals to mediate their fines.

In addition to concerns about duplications of process, I am worried that we may be leaving the definitions of offending activity too broad.

While a fairly clear definition in Bill C-27, which we are debating here today, has the consent requirement for personal data collection, there is also a lengthy list of exemptions from this requirement. Some of these exemptions are also enormously broad. For example, under exemptions for business activities, the legislation states:

18 (1) An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of a business activity described in subsection (2) and

(b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.

On plain reading, this exemption deals more with the field of human psychology than with business regulation.

Also in the legislation is this:

(3) An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use

There is also an exemption to consent that would allow an organization to disclose personal information without the individual's knowledge or consent for a “socially beneficial purpose”. This is defined as “a purpose related to health, the provision or improvement of public amenities or infrastructure, the protection of the environment or any other prescribed purpose.” Who determines what constitutes a socially beneficial purpose? This sounds incredibly subjective, and I have a lot of concerns when legislation is this vague.

Let me give a very simple example. Suppose a person using a coffee company app occasionally adds flavourings to their coffee while doing a mobile order. That company could recommend a new product with those flavourings already in it while a person is not physically in their business. Is this not personal information that is collected and used for the purpose of influencing an individual's decision, as in this legislation?

This example is not hypothetical. In an investigation from actions in 2020, Tim Hortons was caught tracking the locations of consumers who had the app installed on their phones even when they were not using the company's app. Tim Hortons argued that this was for a business activity: targeted advertising. However, the report from the federal Privacy Commissioner found that the company never used it for that purpose. Instead, it was vacuuming up data for an undefined future purpose. Would Tim Hortons have been cleared if the current regulations in Bill C-27 were in place and if it had argued that the data was going to be used for future business activity or for some socially beneficial purpose, which is an exemption in the legislation?

While I worry about the loopholes this legislation, Bill C-27, may create for large corporations, I am equally concerned about the potential burden it may place on start-ups as well. This legislation calls for companies to have a privacy watchdog and to maintain a public data storage code of conduct. This is vital for companies like Google, Facebook or Amazon, which have become so integral to our everyday lives and oversee our financial details and private information. Having an officer internally to advocate for the privacy of users is likely long overdue. However, while that requirement would not put much financial burden on these Fortune 500 companies, it could undermine the ability of Canadian digital innovators to get started.

Canada has seen a boom in small-scale technology companies for everything from video game and animation studios to wellness or shopping sites for almost every good or service one could imagine. Digital privacy laws should be strong enough to not require a start-up with just a few staff to have to be mandated to have such a position internally. We should ensure that a concept of scale is appropriately applied in regulating the giants of today without crushing the future digital entrepreneurial spirit of tomorrow.

I would like to address the presence of Canada's first artificial intelligence, or AI, regulations in this bill. While I do welcome the progress on recognizing this growing innovation need for a regulatory framework, I question whether it is a topic too large to be properly studied and included in this bill. In just the last few months, we have seen the rapid evolution of the ability of AI to create an online demand digital artwork, for example, thanks to the self-evolving abilities of machine learning.

The impact of AI on everything from our foreign policies to agriculture production is evident. Computer scientists observed a phenomenon known as Moore's law, which showed that the processing power of a computer would exponentially double every two years, and in the 57 years since this was proposed, this law has apparently not been broken.

I am concerned that most of the rules around AI will be in regulation and not in legislation. We have seen the Liberals do this many times. They do not want to do the hard work to put policies into legislation that will be brought to Parliament and committees to be debated and voted on. They prefer to do the work behind closed doors and bring forth whatever regulations they want to impose without transparency and scrutiny. We have seen the Liberals conduct themselves many times in this way.

Experts in the field have already made the case that Bill C-27 falls seriously short of the global gold standard, the EU's 2016 General Data Protection Regulation. Canadians deserve nothing less.

Though Conservatives agree with the premise of strengthening our digital privacy protection, this bill has many concerns and gaps. Clause 6 outlines that privacy protections do not apply with respect to personal information that has been anonymized. To anonymize is defined in the legislation as “irreversibly and permanently modify personal information, in accordance with generally accepted best practices, to ensure that no individual can be identified from the information, whether directly or indirectly, by any means.”

There are a lot of risks around this. Under this legislation, information could be disclosed in numerous ways, and that is very concerning. This goes back to what I mentioned at the beginning of my speech with respect to my questioning of Google Canada early in the pandemic about tracing the locations of people through their phones and sending it to the government.

The legislation creates more costly bureaucracy. It does not protect personal privacy as a fundamental right. It has questionable exemptions to protect the privacy of people based on ideologies. It allows the government to create large areas of regulations with no oversight or transparency and it is far from the gold standard that other countries have.

[Lisa Marie Barron, NDP, Nanaimo—Ladysmith, BC]

Mr. Speaker, I want to thank my colleague.

Bill C‑27 does not explicitly apply to political parties. As we have seen in the past, the potential for invasion of privacy and misuse exists in the political arena. I was wondering if my colleague would agree that the bill should be amended to specifically include political parties.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I thank my colleague from Winnipeg North for his remarks.

Indeed, I think such a bill was urgently needed. I commend the government's leadership and congratulate it on having understood the errors in Bill C-11 and making some improvements.

I met with the Minister of Innovation, Science and Industry in January, when it was time to think about developing this bill. I emphasized the importance of the Quebec legislation and of ensuring its primacy. I thank him for listening to me and for the respect evident in Bill C-27.

With respect to the urgent need to take action, Europe is putting a lot of pressure on us. Indeed, Europe has set guidelines and is currently threatening to withdraw its confidence in our artificial intelligence systems in Canada, particularly in the banking sector. It was necessary to act; better late than never.

I hope the principle will be adopted quickly, but more importantly, I hope that the committee work will be thorough and that the experts will be heard. This will be more than welcome.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I would concur with the member and the many others who are, in essence, saying that Bill C-27 is a substantive piece of legislation that is ultimately designed to ensure privacy for Canadians.

As I made reference to earlier, I think we could look at how effective the legislation of the Quebec legislation has been, which was passed just over a year ago, and what the response has been to it. I understand that was what the member was saying. Taking into consideration AI, the tribunal, digital and just how much the digital economy has grown, 20 years ago is the last time we have seen any sort of substantive changes to our privacy legislation.

I am wondering if the member could provide his thoughts in regard to why it is important that we update and modernize. After all, 20 years ago, we did not even have iPhones.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I am pleased to speak to this bill after my colleague from Rivière‑des‑Mille‑Îles, whom I would like to congratulate. I am also pleased to be following my colleague from Trois‑Rivières, an ethics expert who enlightened us on the potential impact of this bill and the dangers involved.

Unfortunately, very few people are interested in this type of bill, and yet, in the digital age, we cannot afford not to regulate the use of personal information. We cannot deny the fact that the digital shift has exploded in Quebec and elsewhere over the last decade, and it has greatly changed our lifestyles.

It is impressive to see which path companies have chosen during the pandemic, and I think it is a timely discussion to have today. However, I would like to draw attention to the new part of the bill that deals with artificial intelligence. I think it deserves serious consideration.

Part 3 of the bill raises many questions, and opinions from experts in the field of artificial intelligence are mixed. The use of artificial intelligence is a rapidly growing field that risks expanding beyond our control and jurisdiction if we do not begin to regulate the practice and define certain concepts.

Recent developments in AI in general and deep learning in particular have led to the creation of autonomous intelligent agents, which are essentially robots capable of deciding what to do without third-party intervention. These agents' autonomy raises new questions about civil liability, so we have to think about criminal provisions that would apply if someone were put in a dangerous situation, for example.

How should we approach this, and what legal status are we granting them? What legislative framework is the best fit for these autonomous agents?

At this point, we think some important definitions are missing. The law clerks who are examining the bill's provisions from a legal standpoint told us that again today. What is a high-risk intelligence system? What is a high-impact system?

The algorithms produced in applications that use artificial intelligence enable artificial beings to create goods or services or to generate predictions or results. If we compare them to human beings and use the existing framework, how will we interpret the notions of independence and unpredictability attributable to these artificial beings? The experts will help us understand all that.

Quite a few goods already exist that have a layer of artificial intelligence built into them, and 90% of those goods should not pose a problem. Experts at Meta have even said that this technology has reached its limits, because the data to train an algorithm is insufficient in quantity and lacks depth.

Let us get back to the main problem we have with Bill C‑27. Until the department clarifies its thinking on what constitutes a high-impact system, it will be difficult to assess the scope of part 3. Let us assume that everything can be considered high risk. This would mean that many companies would be accountable. If we had greater accountability, the Googles of this world might be the only ones that could risk using artificial intelligence.

The bill does not need to cover everything a machine can do for us or everything software can do once it is developed and generates predictions and results like a calculator.

If we compare it to the European legislation, we note that the latter is currently targeting employment discrimination systems, systems that would determine whether or not a permit to study there can be granted. That is essentially the limit of what the machine can do in our place.

Although the law in this document concerning artificial intelligence is far from being exhaustive, I believe it is important that we start somewhere. By starting here, with a framework, we can lay the groundwork for a more comprehensive law.

My speech this evening will help my colleagues better understand what needs to be clarified as soon as possible so we can have an important discussion about how to regulate the applications that use artificial intelligence and how to process these systems' data.

First, we will have to implement regulations for international and interprovincial exchanges for artificial intelligence systems by establishing Canada-wide requirements for the design, development and use of AI systems. Next, we must prohibit certain uses of AI that may adversely affect individuals.

The legislation is very clear on many other aspects, including on the fact that there would be a requirement to name a person responsible for artificial intelligence within organizations that use this technology. The responsibilities are fairly extensive.

In addition to the artificial intelligence and data act, which is in part 3, Bill C‑27 also includes, in part 1, the consumer privacy protection act, as well as the amendments to the former legislation. Part 2 of the bill enacts the personal information and data protection tribunal act, while part 4 includes the coming into force provisions of the bill.

As my colleagues explained, the other sections of the bill contain a lot of useful elements, such as the creation of a tribunal and penalties. One of the acts enacted by Bill C‑27 establishes a tribunal to process complaints under litigation when it comes to the use of private data. In case of non-compliance, the legislation provides for heavy penalties of up to 3% of a multinational's gross global revenue. There are provisions that are more in favour of citizens when a company misuses digital data.

Yes, this bill does have its weaknesses. I believe those weaknesses can be addressed in committee, but they may require the introduction of new legislative measures. Public services, however, are not covered by this bill. Data in the public sector requires a greater degree of protection; this bill covers only the private sector. Take, for example, CERB fraud and the CRA. In 2020, hackers fraudulently claimed $2,000 monthly payments and altered the direct deposit information for nearly 13,000 accounts.

The government can do more to tackle fraud. Unfortunately, this bill offers no relief or recourse to those whose information has already been compromised. There are digital records of nearly every important detail about our lives—financial, medical and education information, for example—all of which are easy targets for those who want to take advantage. It has been this way for a while, and it is only going to get worse when quantum computers arrive in the very near future.

This means that we must find and develop better means of online identity verification. We must have more rigorous methods, whether we are changing our requirements for passwords, for biometrics or for voice recognition.

Recently, at the sectoral committee, we heard about how easy it is for fraudsters to call telecommunication centres and pass themselves off as someone else to access their information. We must improve identity verification methods, and we must find a way to help those who are already victims of fraud. We must do so by amending Bill C-27 or introducing an additional legislative measure.

Since this is a fairly complex bill, it will be referred to the Standing Committee on Industry and Technology, where we will have the opportunity to hear from experts in the field. At this step, I would like to recognize the leadership of the Minister of Innovation, Science and Industry and his team. We have been reassured by the answers we have received.

Since Quebec already has data protection legislation—Bill 64, which became law 25—we want to understand when the federal act will apply and whether the changes we requested to Bill C-11, introduced in the previous Parliament, were incorporated into this bill. I want to say that we are satisfied with the answers we have received so far.

We will do our due diligence because this bill includes a number of amendments. Obviously, the devil is in the details. During the technical briefings held by the department since Bill C-27 was published, we asked how much time businesses would have to adjust their ways of doing things and comply with the legislation.

We expect that there will be a significant transition period between the time when Bill C-27 is passed and when it comes into force. Since the bill provides for a lot more penalties, the government will likely hold consultations and hearings to get input from stakeholders.

In closing, I would like to say that I have just come back from Tokyo, where I accompanied the Minister of Innovation, Science and Industry to the Global Partnership on Artificial Intelligence Summit, where Quebec and France took the lead. The first summit was held in 2020. I would like to list some important values that were mentioned at this summit that deserve consideration and action: responsible development, ethics, the fight against misinformation and propaganda, trust, education, control, consent, transparency, portability, interoperability, strict enforcement and accountability. These are all values that must accompany open data and ecosystems.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Mr. Speaker, I will be sharing my time with my hon. colleague from Abitibi—Témiscamingue, whom I commend for his hard work.

Today, I am pleased to speak to a bill that is as necessary as it is complex. As written, the bill has some grey areas, some things the Bloc Québécois has reservations about, but we do think it has a lot of potential.

Bill C‑27 enacts the consumer privacy protection act. Sponsored by the Minister of Innovation, Science and Industry, the member for Saint-Maurice—Champlain, the bill is at second reading. It would create three different acts: the consumer privacy protection act, the personal information and data protection tribunal act, and the artificial intelligence and data act. That last one is very interesting.

In essence, Bill C‑27 seeks to strengthen the protection of anonymity and privacy. Now that digital technology is omnipresent in our lives, it is harder than ever to make sure our privacy and personal information are protected.

Until now, organizations of every kind have taken advantage of the absence of a legal consumer protection framework. In Canada, personal information is a commodity without a legal owner.

Just look at the Cambridge Analytica scandal during the 2016 U.S. election. Bill C‑27 aims to change this sorry state of affairs, which is threatening our democracy, our privacy and social peace. The bill not only limits and restricts the excessive freedom enjoyed by organizations that collect and share our data, but it also gives them responsibilities. In short, it puts the individual and the idea of consent back at the centre of reflections on digital exchanges, and that is significant.

The Bloc Québécois supports this bill because it partially fills a legal void in Canada. I say “in Canada” because the Quebec National Assembly passed Law 25 on the protection of personal information way back in September 2021. It is a well-written law. Bill C‑27 is actually largely modelled after it, and we are very proud of that.

Given that the protection of personal information is a shared jurisdiction, it is vital to the Bloc Québécois that Bill C‑27 not take precedence over Quebec law. This does not seem to be the case at this time, but it will be up to the committee to verify this and ensure that it does not.

Speaking of the committee stage, many grey areas still need to be clarified. According to Daniel Therrien, a former privacy commissioner of Canada, Bill C-27 is too timid in its current form.

I myself have thought of something that could be studied at the committee stage, and that is image copyright. Since we are speaking about consent, the protection of anonymity, personal data and the need to adapt our legal framework to the digital era, I believe that it would be highly relevant to address this subject.

Just like the digital world, the world of photography has changed a great deal over the past 20 years. Thanks to smartphones, and the fact that just about everybody owns one, or even two, more and more photos are being taken. According to some estimates, more than three billion photographs are taken every day around the world. An image is a form of personal information. The use and sharing of images are intrinsically linked to the principle of consent. If no consent is obtained, that is a breach of privacy.

I believe that our current interpretation of image copyright is too strict, and this is detrimental to street photography and photojournalism. My father, Antoine Desilets, a photojournalist, was also a street photographer in his own way. Street photography is generally defined as photography done outdoors whose main subjects are people in spontaneous situations and in public places such as streets, parks, beaches and protests.

A good example of this kind of photography is the famous photograph The Kiss by the Hôtel de Ville, taken by the renowned French photographer Robert Doisneau. That shot has actually been the subject of multiple lawsuits, with every Dick and Jane claiming to be one of the two main figures in the picture.

Let me tell a little story from closer to home. In 1987, a Quebec photographer and friend by the name of Gilbert Duclos took a picture of a woman in the street. After the photograph was published in a magazine, the woman decided to sue Gilbert Duclos. She claimed that she was being mocked by her friends and felt that she had been wronged.

After a two-year legal saga that reached the Supreme Court, the woman won. For more than three decades, that decision, known as the Duclos decision, has been a precedent.

The debate was recently reignited by the case of a veiled woman and her husband who were photographed at a flea market in Sainte‑Foy. Since the photograph had been published without their consent, the photographer was forced to pay $3,500 to each of the two people in the photograph, even though the individuals were veiled. There is no doubt that the Duclos decision was used to bolster the plaintiffs' case.

Today, it is very easy to take a photographer to court and win. This means that many photojournalists and street photographers get sued, so unfortunately, they have to practise a form of self-censorship to protect themselves and the newspapers they work for. I believe this self-censorship has grave consequences for the arts, journalism and archive building. As it happens, on October 1, a group of 12 street photographers, led by the esteemed Jean Lauzon, published a book entitled Le droit à l'image as a commentary on this very issue.

The Bloc Québécois believes that the committee that will study Bill C-27 will have to take its time and question all the experts it needs to consult in order to come up with an ironclad law. I have a suggestion. Since we are discussing consent, privacy, the right to anonymity and personal data in the digital age, why not invite experts such as Jean Lauzon to help us understand how to modernize image copyright?

Also, when does an image of an individual taken in a public space become private? Once again, there is the need for oral or written consent on the one hand, and perhaps the definition of the concept of a subject on the other. There is a whole host of factors to consider.

For the rest, I am in favour of Bill C‑27 because it gives hope that we are going to begin to plug the gaping hole that our data is currently circulating in, allowing it to be sold and exploited.

It will be especially important to ensure that the Quebec legislation takes precedence over the Canadian legislation, as is customary in matters of shared jurisdiction.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, I acknowledge that I am standing today, as any day that I am on Parliament Hill, on the Algonquin land of the Anishinabe peoples. I say a large meegwetch to them.

I am speaking today, as we all are, to Bill C-27, which is really three bills in one. My other parliamentary colleagues have already canvassed the bare outline of this, in that we are looking at three bills: an act to create a consumer privacy protection act; a personal information and data protection tribunal act, which largely replaces some of what there was already in PIPEDA in the past; and a brand new artificial intelligence and data act.

I want to start with the artificial intelligence and data act because it is the part with which all of us are least familiar. Much of what we see in this bill was previously before Parliament in last session's Bill C-11. There is a lot to dig into and understand here.

As I was reading through the whole concept of what kinds of harms are done by artificial intelligence, I found myself thinking back to a novel that came out in 1949. The kind of technology described in George Orwell's book, famously called 1984, was unthinkable then. The dystopian visions of great writers like George Orwell or Margaret Atwood are hard to imagine. I will never forget the scene in the opening of The Handmaid's Tale, where a woman goes into a store and her debit card is taken from her. At that moment, we did not have debit cards. Margaret Atwood had to describe this futuristic concept of a piece of plastic that gave us access to our banks without using cash. No one had heard of it then.

There are words from George Orwell, written in 1949, about the ways in which artificial intelligence and new technologies could really cause harm in a dystopian sense. In 1984, he writes, “It was terribly dangerous to let your thoughts wander when you were in any public place or within range of a telescreen. The smallest thing could give you away.”

More recently, there is the song by The Police and written by Sting and others. I will never forget that once I went to a session on rights to privacy being under assault and a British jurist brought with him for his opening of the speech, “Every breath you take, And every move you make, Every bond you break, Every step you take, I'll be watching you.”

We live in a time when artificial intelligence can be enormously invasive of our privacy with things like visual recognition systems, as the hon. member for Selkirk—Interlake—Eastman was just speaking to. These are things that, for someone like me born in 1954, are all rather new, but they are new for people born in 1990 too. It is very new technology and bringing in legislation to control it is equally new and challenging for us as parliamentarians. The whole notion that we are going to be able to spot the ways in which artificial intelligence can affect our democracy is something that will take time.

We talk about harms from this kind of technology, from capturing algorithms, from invading our spaces. We do not have to look any farther than the way Cambridge Analytica was used by the Brexit forces in the U.K. to harness a public outrage against something based on a pile of disinformation, by targeting individuals and collecting their data. That kind of Cambridge Analytica concern also gets into part 1 and part 2 of this bill. We really do need to figure out how to control the digital tech giants harvesting our information.

As an example used earlier today in debate, there is the idea that big digital giants and large corporations can profit from data without the consent of Canadians who may have put a family photo on social media, never knowing that their privacy has been invaded and their personal information and photos have been used for profit without their permission. In this sense, I am going to flag that in the context of the artificial intelligence and data act, I hope we will be taking the time necessary to hear witnesses specifically on this.

We have developed a pattern in recent years, which is to say the last decade or so, of having three or four witnesses appear on panels. All of us in this place know that committees are trying to hear from a lot of people and receive a lot of evidence. It will do us a disservice in our dive into the artificial intelligence and data act if we combine panels of people who are experts on PIPEDA and people who are experts on other aspects of this bill, with panels on artificial intelligence and data.

The committees that study this bill will control their own process. Committees are the masters of their own process, but I would urge the government, the Liberal legislative managers of this piece of legislation, Bill C-27, to follow the lead of the Speaker's ruling earlier today. If we are going to vote on the artificial intelligence act as a separate piece when we come to vote, we could at least make an effort to ensure that the concentrated effort of committee members and hearing witness testimony is not diluted through several different pieces of legislation and panels with three or four witnesses.

Members' questions will inevitably and invariably go to one or two. In this format of panels and pushing witnesses through quickly, we lose a lot of content. Compared with when I worked in government back in the 1980s, which I know seems like the dark ages and no one in this room was on committees in those days, committees would hear from a witness who could speak for 15 minutes and then we would have the rest of an hour to ask that one witness questions. Now that we are into something as complicated as this area, I would urge the committee to give it that kind of attention or to ask the government to send part 3, the artificial intelligence and data act, to a different committee, so that the study can be thorough and we can educate ourselves as to the unintended consequences that will inevitably occur if we go too fast.

Turning to the parts of the bill that deal with privacy, I want to put on the record again a question that was raised just moments ago about whether privacy legislation should apply to political parties in Canada. At the moment, it does not. Political parties are exempted from the kinds of privacy protections that other organizations, NGOs and corporations must use to protect the privacy information of their customers, consumers and citizens.

The Green Party of Canada believes it is essential that political parties be added to the list of organizations that have an obligation to protect the privacy of Canadians.

I will say quickly that I tend to agree with the first analysis of one of the NGOs that are very concerned with privacy information. OpenMedia, in an article by Brian Stewart, says very clearly that this legislation could actually make things worse for some privacy protections. They give the efforts of Bill C-27's consumer privacy protection act and its personal information and data protection tribunal act a grade of D. In other words, it passes but just barely. There will be many witnesses.

I can certainly confirm that, as a Green Party member of Parliament in this place, I will be bringing amendments forward, assuming this bill gets through second reading, which I think we can assume, and ends up at committee.

In the time remaining, I want to emphasize that Canada is aware that privacy is a fundamental human right. It is part of the UN declaration on the rights of individuals. I echo some of the sentiments from the hon. member for Selkirk—Interlake—Eastman in asking why we are looking at consumer privacy. Maybe we should change that word to Canadians' rights and privacy.

I also agree with many members who have spoken today about the problems of subclause 18(3) and the number of exemptions along with the question of what is a “legitimate” reason that people's privacy can be invaded. That should be further clarified. I find “a reasonable person would expect the collection or use for such an activity” to be fine, but the exemptions seem overly broad.

If I dive into anything else I will go over my allotted time.

This is important legislation. We must protect the privacy of Canadians. I think we will call on all parties in this place to set aside partisanship and make an honest effort to review it. That is not to delay it but to make an honest effort to review the bill before it leaves this place.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Madam Speaker, Bill C-27 does not explicitly apply to political parties, and in the past we have seen the possibility of privacy breaches and misuse in the political arena.

Should the bill be amended to specifically include political parties?

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Alexandra Mendes]

For clarification, I would point out that Bill C-27 has not been divided and only the vote will be done separately.

The hon. parliamentary secretary.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I would like to thank my colleague from Halifax for his speech. I am sure he will work hard in committee to defend the integrity of this bill. He can count on the Bloc Québécois's support for the principle of the bill.

The Chair delivered a ruling earlier this afternoon about how Bill C-27 should be divided into two parts. I would like to hear his comments on that. What impact will that have on the bill? Does he think that will jeopardize certain aspects of Bill C-27? What will be the consequences?

[Andy Fillmore, Liberal, Parliamentary Secretary to the Minister of Innovation]

Mr. Speaker, I will be splitting my time with the member for Saanich—Gulf Islands.

I am very pleased to be here to discuss Bill C-27, the digital charter implementation act of 2022. The bill would implement a new world-class regime for the protection of consumers and to ensure that Canadians have confidence that businesses are handling their personal data responsibly and are developing and deploying new technologies in a responsible and ethical way.

The bill also includes important changes that would support responsible innovation in an increasingly digital and data-driven marketplace. It would modernize Canada's regulatory framework for privacy protection in the private sector in a manner that supports innovation and is interoperable with the data protection laws of Canada's major trading partners.

The bill would also reinforce Canada's commitment to responsible artificial intelligence development, or AI development. As parliamentary secretary to the Minister of Innovation, Science and Industry, and indeed as the MP for Halifax, with its burgeoning tech sector, I can tell members from first-hand experience that Canada is a world leader in AI, with top talent and innovative companies.

In a world that is increasingly reliant on digital technologies, the bill would build on Canada's advantage by creating a foundation of trust and ensuring that companies meet the highest standards of responsibility when developing and deploying AI. We need to ensure that Canadians’ personal information is protected, but there is also a need to support Canadian businesses so that they can grow, prosper and innovate in this increasingly digital world.

We recognize that technology is growing rapidly and providing companies with large amounts of personal information. This information fuels business decisions. It informs the creation of new products and services for customers. This innovation is critical, but we absolutely have to ensure that this innovation happens in a responsible way.

Therefore, in my limited time today, I am going to focus my comments on the first and third parts of the act, with a focus on enabling and supporting responsible innovation.

I will begin with the first part.

The proposed new Consumer Privacy Protection Act, or CPPA, retains the principles-based approach of our current private sector privacy law in order to continue harnessing the success of a flexible and adaptable privacy law.

We know circumstances are changing all the time. To better reflect advances in digital technologies, the emergence of AI and other new technologies, the CPPA contains a number of provisions to support industry innovation without compromising the protections Canadians depend on.

First, the CPPA includes a new exception to consent, to cover specified business activities, and it introduces the concept of legitimate interests into Canada’s privacy framework, with updates that take into consideration what we have heard from stakeholders on the previous proposal that came before Parliament in 2020, back when I was parliamentary secretary to the then minister of heritage and we were considering this.

The objective is to help reduce the administrative burden on businesses and on individuals in situations in which seeking consent is not meaningful, for example, the use of personal information for the shipping of goods that have been requested by the individual.

In these situations, the customer clearly anticipates receiving a shipment, and the company should be able to undertake this shipment without the law adding an extra burden to provide this service. Importantly, this exception may not be used in situations in which the organization intends to influence the individual’s behaviour or decisions.

Moreover, given the need to consider interests and potential impacts on individuals, the organization will be required to assess the potential impacts on individuals, implement measures to eliminate or mitigate such impacts, and comply with any prescribed requirements. The Privacy Commissioner may review such assessments on request.

All in all, the inclusion of a targeted legitimate interest exception aligns the CPPA with international best practices, including those of the EU.

Second, the CPPA defines and clarifies how businesses should handle de-identified personal information, in other words, personal information that has been modified to reduce the risk that an individual could be recognized or identified.

This framework takes into account the feedback we heard from the previous proposal. The bill also defines anonymized information and confirms that information that has no risk of identifying an individual falls outside the scope of the act.

The bill before us today would incentivize organizations to de-identify personal information before using it for research, development and analysis purposes, further protecting Canadians’ privacy.

We know businesses need to invest in R and D to improve their products, which benefits customers by providing them with new and innovative products and services. This provision would allow businesses the flexibility to use de-identified data for R and D, adding value for both customers and firms. However, the CPPA confirms that this information would still stay within the protection of the act and under the oversight of the Privacy Commissioner of Canada, as one would expect.

Recent years have also shown the critical role data plays in developing evidence-based policies and responding to public crises. Whether it is to respond to public health needs or the now-present challenges from climate change, or even planning a city, data is needed to help us rise to these challenges, but it must be used responsibly and in keeping with our values.

That is why the CPPA introduces a framework that would allow for the use of data in ways that would benefit the public good. It would do this by allowing companies to disclose de-identified data to specified public entities, such as hospitals, universities and libraries. These disclosures would be permitted only where specific criteria are satisfied. That is, the personal information must not identify an individual, and there must be a socially beneficial purpose, like those related to health, public infrastructure or environmental protections. This would ensure that the privacy of individuals is protected, while making sure we would be using everything at our disposal to respond to increasingly challenging global issues.

Third, the CPPA introduces a new framework for codes of practice and certification systems that would enable businesses to proactively demonstrate their compliance with the law. For example, companies that are engaged in a particular business activity could collaborate on the development of a code of practice that outlines how they comply with the specific provisions of the law. With the approval of that code by the Privacy Commissioner, organizations would have greater certainty that they are meeting their obligations.

Similarly, the bill provides a scheme for recognizing certification systems that demonstrate compliance with the law. Organizations that choose to participate in approved certification schemes would benefit from a reduced risk of enforcement actions under the act. This would be especially helpful for small- and medium-sized entities that do not necessarily have extensive legal resources at their fingertips. These new frameworks for recognized codes and certifications would make it easier for businesses to demonstrate their compliance with the law to customers, to business partners and to the Privacy Commissioner of Canada.

I would like to move now to the third part of the legislation, the proposed artificial intelligence and data act, or AIDA, which would support responsible innovation by giving businesses a clear framework to guide the design, development and deployment of artificial intelligence systems, or AI systems. AI systems have many benefits and operate across national and provincial boundaries.

As I mentioned, Canada has become a global leader in artificial intelligence through the pan-Canadian AI strategy. However, as the technology has matured, risks associated with AI systems have also come to light, including with respect to health, safety and bias. In order for Canadian innovators to maintain this status, common standards are needed for international and interprovincial trade in AI systems.

The bill would guide innovation by building confidence in the technology and protecting Canadians against the harms such systems can cause. Specifically, AIDA would ensure that entities responsible for high-impact AI systems identify and mitigate potential harms, including bias. By aligning with internationally recognized standards, this would ensure market access for Canadian innovations.

Lastly, an artificial intelligence and data commissioner would be created, with the dual role of support the minister in administering the act and playing a supportive role in helping businesses understand their responsibilities and how to comply. We believe the government is paving the way for Canada to be a world leader in innovation by providing Canadians with clear rules on how it may be developed and used.

I believe it is imperative the House move to pass this bill. The digital charter implementation act would not only protect the personal information of Canadians and lay the ground rules for the responsible design, development, deployment and operation of AI systems in Canada, but also enable the responsible innovation that will promote a strong Canadian economy. With this bill, the government is sending a clear message that responsible innovation is critical for Canada’s future economic success and competitiveness.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, I want to the thank the hon. member for Selkirk—Interlake—Eastman for a very thoughtful speech. As a member of Parliament grappling with Bill C-27, I have to say that I am grateful that his party assigned him to this area of work sometime in the past, because this is enormously complicated.

The bill is three acts in one, and I would ask the member what we should do at this point. The Speaker has now given a ruling that says we will be able to vote separately on the AI piece of the bill, but I do not think that is good enough. I do not know if the committee will be able to set aside witnesses and only look at the AI piece in a concentrated fashion.

I would support anything we could do as opposition members of Parliament to make sure the bill is not rushed and to make sure that the artificial intelligence pieces are treated as separately as possible so that we have a good amount of time for amendments and understanding while not rushing it through.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I do not believe that the bill lives up to the gold standard of European Union law. The European Parliament has been very good at having general data protection regulation. That is the gold standard. The bill does not provide the types of safeguards that protect the interests of Canadians.

We need an ongoing discussion on how the personal information of Canadians is protected. Bill C-27 does not provide all the guardrails required for the protection of individual Canadians. A task should be given to the industry committee or the ethics committee to dive deeper to make sure we have an opportunity to hear from more witnesses and to provide the amendments that are so desperately needed to the bill. I think it actually needs to go back to be redrafted.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, my colleague from Selkirk—Interlake—Eastman mentioned some things that are not covered by Bill C-27. The law they have in Europe right now requires businesses to have two ways to identify individuals, but the trend is moving toward having three.

Does my colleague think that Bill C-27 should also legislate on the number of methods of identification that businesses should be required to use? It does not do so right now, which is why we need to carefully study it in committee.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, it is indeed a pleasure to rise to discuss Bill C-27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act. There is a lot happening in Bill C-27. I have a lot of concerns about this bill, and that is why I will be voting against Bill C-27. It would not do the things we need to do to protect the privacy of Canadians.

I would first flag, in looking at this legislation, that the first act it would create is the consumer privacy protection act. Why is it not the Canadians' privacy protection act? Why are we talking about consumers and giving more ability to corporations to collect the privacy data of Canadians? That, to me, is very disconcerting and one of the things I want to talk about during my presentation.

The Personal Information Protection and Electronic Documents Act, PIPEDA, was the very first piece of legislation we had back in 2000, so it has been 22 years since we have updated legislation related to the issue of the privacy protection of data that has been shared online. Of course, technology has evolved significantly over the last 20 years. If we look at PIPEDA, it all rolls back to 34 years ago when the Supreme Court of Canada said, “that privacy is...the heart of liberty in a modern state”.

It said “privacy is...the heart of liberty”, and that completely falls back on the Charter of Rights and Freedoms. Concerning fundamental freedoms, subsection 2(b) of the charter says, “freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication” while subsection 2(d) refers to, “freedom of association.”

We know very well that people's privacy has to be protected on anything they do online, what they do through mobile apps, what they do in their email communications and the collection of that data by service providers because, ultimately, anything we do online goes through a service provider on the Internet, and we have to ensure that our charter freedoms are protected to ensure our liberty.

We already know that under freedom of association, a lot of people who gather in Facebook groups and other fora on the Internet have already been violated by the Emergencies Act. We know that during the “freedom convoy” in the city, the government was harvesting data and that data was then shared by some means. With GiveSendGo, the data was mined off of it, shared on Google Maps and distributed across the country. People's individual financial information, the ultimate piece of privacy that should be protected, went across this country and the government failed to intervene.

Bill C-27 falls short on what needs to happen to protect privacy, recognizing how people are using the Internet and modern technologies, especially with mobile apps and everything that is happening on our phones. However, the protection of individuals is worth it and the privacy rights are worthy of constitutional protection, which Bill C-27 fails to recognize. We do not have a definition of privacy rights or a guarantee of privacy rights in Bill C-27, and that is why it fails.

I am the shadow minister of national defence, but earlier this year I served for a number of months as the shadow minister of ethics and digital information. I can say that, during my time serving on the ethics committee, it dealt with a number of issues. One of them, of course, was the use of Clearview AI, the facial recognition software that the RCMP and other police agencies use across this country. The ethics committee dug in deep and provided a report.

The Liberals let the RCMP make use of this technology under their tenure and did not say anything until it became public. Clearview AI, an American company, was scraping images off of Facebook and other social media such as Instagram to populate its database.

That information was then used, using artificial intelligence, to profile and identify people using mass surveillance techniques. We found through testimony that, not only was this done illegally, and the Privacy Commissioner ruled that Clearview AI had broken the law and that the RCMP had used it illegally, but also it was racially discriminatory as well, and it was a huge problem that people of colour and women were unfairly treated by this AI.

Bill C-27 would not regulate the use of facial recognition technology such as Clearview AI. Right now, we know the RCMP disagrees with the ruling of the Privacy Commissioner, so the question is whether CSIS, the Department of National Defence or the Communications Security Establishment are making use of similar types of technology. I will get into some of the recommendations from that report if I have time later on, but we did call as a committee, and it was adopted by the majority of members on our committee, for a federal moratorium on the use of facial recognition technology. We called for new laws, guardrails and safeguards to be built into legislation through PIPEDA and through the Privacy Act.

Bill C-27 would not provide that protection to Canadians. It would not ban or install a moratorium on the use of FRT, so that is absent.

Also, we asked that all companies be prohibited from scraping the images of Canadians off the Internet, whether it be through Facebook, Instagram, TikTok or whatever the app might be. We know that this causes potential harm to Canadians, yet Bill C-27 fails again to recognize this harm. The Liberals failed to incorporate recommendations coming from a standing committee of the House into this legislation.

One of the other things we heard about was that Tim Hortons was caught mass tracking Canadians who were using their app. If anyone who had the Tim Hortons app went to a Tim Hortons location and bought a coffee and a donut, that app was then used to track the behaviours of consumers of Tim Hortons as they were travelling for the next 30 minutes.

Again, this shows how the sharing of personal information and the mass data violation with the tracking of individual Canadians violated their privacy rights. Although Tim Hortons assures us they are not doing it now, we are not sure what happened with that data. Was it shared or sold to other corporations? Again, Bill C-27 would give companies, under clause 55 of the bill, a litany of exceptions to consent to sharing that personal information they collected through the use of their app. That would violate our privacy rights.

Although the Liberals have built in here words about consent and the ability for individuals to write in with consent or get removed, when it comes to terms and conditions, most Canadians, when they download an app and check the box to say “yes”, they have not read those terms and conditions. They do not know that some of these apps, as Tim Hortons was doing, were actually undermining their own privacy rights as they apply to the use of mobility data information, and because those terms and conditions are long, legalistic and cumbersome, people refuse to actually take the time to read it. Just because someone checks the box to say “Yes, I consent to using this app”, does not give those companies the right to violate the privacy of those individuals' outside of the commercial transaction that takes place between them and, in this situation, Tim Hortons.

The exemptions that are allowed under the bill for corporations need to be changed in the bill. There is no we can support it as Conservatives because they would be huge violation of privacy and of mobility, which are all things that are provided under our charter rights.

Under the government, we also saw the Liberal Minister of Health stand up and defend the Public Health Agency of Canada, which was caught red-handed having companies such as TELUS track the movement of Canadians via their cellphones. It said that it de-identified all the data it collected, but it wanted to know how Canadians were moving around the country underneath the auspices of the COVID pandemic and how transmission was occurring. That was a violation of privacy.

At committee, we made a bunch of recommendations, which the government has failed to implement in Bill C-27. Bill C-27 gives companies, such as TELUS and other mobile service providers, the ability to track the movement of Canadians across this country. It may want to call it “meta data” or say it has been de-identified, but we also know from testimony at committee that it can re-identify the meta data that has been turned over to the government. We have to make sure that it is done in the public interest and under the auspices of national security, public health and national defence. If that type of data is being collected, then there has to be a way to dump that data and ensure it disappears forever.

One of the other studies we undertook was of the Pegasus software system, which is very insidious. It is being used for national security. A similar type of technology is being used right now by the RCMP, CSIS and others. It has the ability to turn people's cellphones into video cameras and listening devices. It is a very cryptic, insidious spyware, or malware, that people can get on their phones by accidentally clicking on a piece of information, like opening up an email, and it will download. Then they can listen to the individuals in that place.

They do not have to bug people's houses anymore. They do not have to use high-grade technology to listen to the interests of individuals because it gives them the ability to turn cameras on to watch what they are doing, and turn microphones on to hear what they are discussing without them ever knowing it.

We want to make sure charter rights are protected. There are times we have to use this in the collection of data. There was definitely the admission by members of the RCMP that they have used it over a dozen times. They have their own system, not Pegasus, but one similar to it. We know that to use that type of technology, to protect the rights of Canadians, there should be a warrant issued to ensure there is judicial oversight, even if it is being used by the Department of National Defence and CSE, we have to make sure it is not being used against Canadians and only deals with those national threats they refer to as threats that are foreign entities. That is something that Bill C-27 fails to recognize.

I should say this as well. We heard at committee that this type of technology is being used against politicians, that there is foreign interference out there. As we have come to learn on different occasions, there are countries out there and other agencies that are interested in what we are saying as politicians, not just here in the House, but the private conversations we have in caucus, among colleagues, when we get together at committees, at pre–committee meetings, and the discussions we have in our offices. Our phones have become listening devices, so we have to be aware of that.

One of the things we have always talked about is what the gold level standard is to protect individuals, the citizens of our country, and to ensure their privacy rights are paramount in all the discussions we have. At the same time, we know there are going to be advances in technology, and the need at times to have police agencies, the Department of National Defence and the military use technology that could violate the rights of some people, but always with that judicial oversight that is provided underneath the charter. That gold standard is the European Union’s General Data Protection Regulation. We see that the gold standard goes well above and beyond what Bill C-27 is trying to do.

Bill C-27 falls way short. We heard at committee that with the data collection taking place on apps, online surveillance measures have to provide the right for data to be forgotten, or the right to data disposal or erasure, another terminology that is used. It is about making sure that data collected, even if it is for the public good or even if it is metadata, is disposed of at the end of the day.

It should not be that I consent to have my data removed from a database by checking something off or having to write in an app being used to buy coffee at the neighbourhood store, for example. It should be that it is our right to be forgotten and that after a certain time frame, data is erased forever from the database where it is being held and is not used again for commercial purposes, nor used, sold or traded among commercial entities.

The gold standard that the European Union has is not included in Bill C-27. Again, that is why we have so many concerns.

When we look at clause 55, which has already been mentioned by a number of my colleagues, it has a boatload of exemptions built in for corporations to get around the removal of privacy data. These exemptions allow them to write in, make changes and share data. We have to make sure the onus is not on Canadians to get their privacy information back or to get their privacy information removed. The onus should be on corporations to prove why they need it. The onus also has to be on the government. This is about transparency and accountability. There needs to be a realization that Canadians deserve an explanation as to why some of their data may be used, even if it is de-identified, and why it would be used for the buildup of public policy or to deal with issues like a pandemic.

Just to move forward a bit, I note that given some of things we saw at committee when we were looking at facial recognition technology, the power of artificial intelligence and the growing power of AI, we made a number of recommendations. They included that whenever the government looks at using artificial intelligence or FRT for military, defence or public safety, it needs to be referred to the National Security and Intelligence Committee of Parliamentarians for study, review and recommendation, and it needs to be reported publicly. There also needs to be a public artificial intelligence registry for the algorithmic tools being used. However, we do not see that registry for artificial intelligence companies in Bill C-27.

I have already talked about the right to be forgotten and said there needs to be a set period of time. I have talked about the prohibition on the practice of capturing images of Canadians from public platforms such as Facebook, Instagram and Twitter. We also need to make sure there is a federal moratorium on using FRT until we have proven it is needed by police agencies, the justice system has proven that it works and we are sure it is not racializing Canadians in its use. Ultimately, the Privacy Commissioner and judicial authorization have to override that.

As Daniel Therrien, the Privacy Commissioner, said about the RCMP:

[It] did not take measures to verify the legality of Clearview’s collection of personal information, and lacked any system to ensure that new technologies were deployed lawfully. Ultimately, we determined the RCMP’s use of Clearview to be unlawful, since it relied on the illegal collection and use of facial images by its business partner.

Its business partner was Clearview AI.

There is an ongoing need to ensure that charter rights and international human rights are brought together in a collaborative way in how we all form our opinions on Bill C-27. I hope the bill is taken back and redrafted, and if not, I hope there is an opportunity to make massive amendments to it so that it actually takes into consideration the privacy rights of all Canadians.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, I would like to take 15 seconds to congratulate my colleague on delivering half his speech in French. He has improved by leaps and bounds in less than a year.

Now, the moment we have all been waiting for, my question. Quebec has a law that protects its citizens' privacy, law 25. We talked about it earlier. In the early 2000s, PIPEDA's paragraph 26(2)(b) stated that the Governor in Council would, by order, respect Quebec's legislation. Essentially, the federal act would not apply with respect to personal information about individuals' property or their civil rights. In other words, the act would leave matters under Quebec's jurisdiction alone. Even though Quebec's law 25 already complies with EU expectations, Bill C‑27 contains no clause guaranteeing that the federal government will respect the application of Quebec's law.

My question is simple. Will my colleague work to ensure that the federal government respects Quebec's law 25 and that there will be an order to that effect?

[Andréanne Larouche, Bloc, Shefford, QC]

Madam Speaker, I thank my hon. colleague for his speech.

I would like to come back to the topic of adopting this motion and particularly the importance of sending Bill C-27 to committee, to make sure all the details are in place. It is important that the committee do its work properly. This is very technical.

Quebec has Bill 25. How can we ensure that there is no interference between Bill 25 and Bill C-27? How can we combine the work of both levels of government? This is a shared jurisdiction. Could my colleague comment on that?

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, I will be splitting my time with my colleague, the member for Vaughan—Woodbridge.

I am pleased to rise today in support of Bill C-27, the digital charter implementation act.

Privacy is a long-standing, fundamental right for Canadians, and we have never been more reliant on the digital economy. Even though we are living in this complex technological era, the current privacy law was last updated over 20 years ago, before smart phones or any social media platforms even existed. This brings us to the cardinal step our government is taking today.

We know Canadians need to have confidence not only that their is data safe and their privacy fully respected, but also that their government is striving to enhance the protection of their privacy through the implementation of timely safeguards in an era when the digital economy is driving transformative change. These objectives are exactly what the privacy protection framework of Bill C-27 would aim to accomplish.

We are introducing new legislation to ensure our country has critical protection in place to safeguard the security of Canadians. This legislation proposes not only to increase the confidence of Canadians in emerging technologies but also to strengthen privacy protection for consumers while supporting economic development that results from the responsible use of data and artificial intelligence. It would also pave the path for governing trade and commerce in the private sector, as it relates to regulating how private organizations handle personal information and develop AI systems.

Upon enactment into law, Bill C-27 would be one of the most substantial improvements to Canadian privacy laws in decades, but it would go further by establishing a legal framework to regulate high-impact AI systems to better protect consumers. In essence, this legislation proposes the following key enactments: the consumer privacy protection act; the personal information and data protection tribunal act; and finally, the artificial intelligence and data act, or AIDA. I will expand on each one of these major enactments in detail.

The enactment of the consumer privacy protection act proposes to achieve the following: first, to enhance Canadians' control over personal information by empowering them to request its deletion, and adding new transparency requirements for organizations when obtaining consent from individuals for their information; second, to create new data mobility rights that promote consumer choice and innovation; and third, to bolster our privacy enforcement and oversight by granting the Privacy Commissioner of Canada order-making powers to compel organizations to stop the use of personal information, through administrative monitoring penalties for serious breaches of law.

This aspect of the bill is of the utmost importance to nearly 200 of my constituents in the riding of Richmond Hill who have voiced their pertinent concerns regarding privacy protection and have spoken to me personally in relation to this legislation and what it seeks to achieve for Canadians. Through the mentioned key facets, my constituents, and in fact all Canadians, can rest assured that their government's sole intention is to ensure Canadians' first-class privacy and data protection.

By enacting the personal information and data protection tribunal act, our government seeks to strengthen protection for minors' personal information, introduce greater flexibility for the Privacy Commissioner and explicitly foster more privacy expertise among key decision-makers. This would be achieved through the establishment of a new administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner.

The third and most crucial aspect of this legislation, in my point of view, would establish a new law on artificial intelligence.

According to a recent study by Nanos Research on behalf of Innovation, Science and Economic Development Canada, key industry stakeholders have expressed a range of concerns regarding artificial intelligence. As technologies have matured, risks associated with AI systems have also come to light, including with respect to health, safety and bias. These concerns speak to the need to ensure the responsible development of AI. Moreover, as companies invest in increasingly complex AI systems, Canadians need to have confidence in AI systems they use every day.

It is therefore essential that the use and collection of data follow best practices to protect the rights and freedoms of Canadians. This brings me to the very reason why I personally identify this enactment as the most crucial aspect of this legislation.

It is in response to these legitimate concerns that our government proposes to introduce a new law to promote a unique approach to AI. It is an approach that would protect Canadians from discrimination, loss of autonomy and serious harm to their health, safety and economic well-being. The newly proposed AI law contains central provisions that would protect commercially sensitive information while ensuring that AI systems do not cause adverse effects on Canadians. Consequently, this approach would establish rules aimed at promoting good data-governance practices and respect for Canadian standards and values.

This new law would support responsible innovation by giving companies a clear framework for developing AI systems; compel organizations responsible for AI systems to mitigate potential harm to Canadians, including bias; establish an AI and data commissioner to support the Minister of Innovation, Science and Industry in the administration of the act to encourage innovation in the marketplace; and, finally, impose serious penalties for all use of illegally obtained personal information.

It is also notable to mention that it would serve as a build-up on our government's previous investments and commitment to expanding the pan-Canadian AI strategy first launched in 2017 to enhance growth in Canada's digital economy.

Each of these acts would work to provide Canadians with more autonomy over their privacy and increase accountability of personal information handled by organizations, while also giving Canadians the freedom to move their information from one organization to another in a secure manner.

In quick summary, by introducing this groundbreaking piece of legislation, our government is working to strengthen and modernize our privacy laws and to protect Canadian consumers by limiting private companies' abilities to access private information in the digital sector. Most importantly, we would be creating new rules for the responsible development of Al alongside the continuation of the advancement of its implementation across Canada.

The digital charter implementation act would ensure Canadians have strong privacy protections and clear rules of the road for businesses, as well as guardrails to govern the responsible use of artificial intelligence. As I stand here today in support of this important piece of legislation, I am confident that, given our country's highly skilled workforce, with this vital step, Canada would be well positioned not only to play an important global role in the field of AI, but also to create an environment where Canadian companies could be world leaders in responsible innovations.

Most importantly, through this cardinal legislation, Canadians would be reassured that we would never compromise on trust and safety for their privacy, and that their government is wholeheartedly committed to advancing Canadian privacy protection laws while unlocking innovation that promotes a strong economy that works for everyone.

I would like to close this intervention by encouraging all my colleagues in the House to support this valuable piece of legislation. We can work together to move beyond traditional privacy protection to ensure data control for all Canadians and modernize our laws to adapt to the realities of a complex digital economy. This is the only way to advance Canadian digital technology and Canadian values across the world.

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Madam Speaker, I too share concerns with Bill C-27, particularly around the artificial intelligence and data act. Specifically, I agree with her. Having one minister solely delegated the responsibility for a wide variety of different regulations that might affect private as well as public data is too much. As Parliament, we should be looking into this and setting out the parameters.

The government has basically told the private sector that it can hold it accountable for serious harm, something it does not even define in the law, in Bill C-27, while at the same time giving itself the ultimate loophole. It says it can exempt itself. Not only that, but some of the organizations are trustworthy, as it says in the bill. The minister can say that any provincial or federal commission or body he or she wants can be exempted, allowed to use artificial intelligence and held to a different standard than the private sector is.

Does the member agree that this particular section, more than anything, needs to be looked at? I believe it is too much government overreach. It has essentially given itself the ultimate loophole.

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Mr. Speaker, as many of my colleagues already indicated, this is a large and complex bill, and we believe that its individual components are too important for them to be considered as one part of an omnibus bill. I am pleased with the ruling of the Speaker.

There are three separate pieces of legislation to this bill. In part 1, the consumer privacy protection act would repeal and replace decades-old measures concerning personal information protection. In part 2, the personal information and data protection tribunal act would strike a tribunal to administer penalties for violations of the CPPA. In part 3, the artificial intelligence and data act is brand new to the bill and sets up a framework for design and use of AI in Canada, which is almost entirely unregulated.

Long before the widespread use of the Internet, our Supreme Court was clear that privacy is at the heart of liberty in a modern state. The government should be taking every opportunity possible to enshrine privacy in our laws as essential to the exercise of our rights and freedoms in Canada. As Daniel Therrien stated in the Toronto Star earlier this month, “democracies must adopt robust solutions anchored in values, not laws that pretend to protect citizens but preserve the conditions that created the digital Wild West.”

The value of privacy should anchor the bill. Instead, the bill fails right out of the gate. The preamble states:

the protection of the privacy interests of individuals with respect to their personal information is essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms in Canada

Placing this value in the preamble of the bill where it has no teeth raises distrust rather than confidence that the government truly respects Canadians' privacy rights. The CPPA would require organizations, companies or government departments affected by the bill to develop their own codes of practice for the protection of personal information. While these codes must be approved and certified by the Privacy Commissioner, one can only imagine the variation of protection that would result. This requirement would add significant red tape and would be yet another onerous task borne on the backs of small and medium-sized businesses, which employ most Canadians. It would also create more work for the Privacy Commissioner in parsing through complicated codes created by larger, wealthier, powerful corporations, companies or government departments that have legal teams whose sole purpose is to find creative ways to perhaps game the system.

Although it would take more time and investment up front, the better option, in my mind, would be to create a standard code of practice that all entities have to follow. This could certainly be taken on as one of the first responsibilities of the expanded Office of the Privacy Commissioner in defining the universal code of practices, where confidence in the process would be greatest and where the greatest level of concern for individual privacy actually exists.

This bill states that personal information can be transferred without Canadians' consent for purposes ranging from research to analysis to business purposes, but it must be de-identified before this can take place. At first glance, this is a positive measure until it is compared with anonymization as an alternative. According to the bill, de-identify means “to modify personal information so that an individual cannot be directly identified from it, though a risk of the individual being identified remains.” That leaves much to be desired when compared to the anonymization of personal information. In the bill, anonymize means “to irreversibly and permanently modify personal information, in accordance with generally accepted best practices, to ensure that no individual can be identified from the information, whether directly or indirectly, by any means.”

Any attempt to identify individuals from de-identified information is prohibited, except in approved circumstances. While many of these approved circumstances relate to the ability of an entity to test the effectiveness of its de-identification system, the potential for abuse still exists. This bill would be improved by eliminating those chances for abuse. We should examine replacing de-identification with anonymization wherever possible.

In comparing Bill C-27 to the EU regulations, we see there are several ways in which the CPPA does not live up to what is widely considered to be the international gold standard of privacy protection, which is the European Union's 2016 General Data Protection Regulation, or GDPR. There is a glaring example of Bill C-27's inferior protections: The GDPR processes personal data in such a manner that it can no longer be attributed to a specific individual without the use of additional information kept separately, subject to technical and organizational measures. This is a security and privacy-by-design measure of the GDPR.

Regarding what Bill C-27 considers to be sensitive information, there is nothing to indicate what sensitive information actually entails. It is also limited in its application. Only the personal information of minors is considered to be sensitive. All information Canadians surrender to any entity should be considered sensitive. On the other hand, the GDPR possesses a particular regime for special categories of personal data, including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data and data concerning health, sex life and sexual orientation.

We are happy to see that consent is better defined in Bill C-27. However, exceptions for activities not requiring consent would remain in place. Some of them are so broad that an entity could interpret them as never requiring consent. These are loopholes that Canadians should not have to endure when they are required to check the box that they have read and accept terms before they are able to interact with a digital site.

For example, legitimate interests in a given situation may be used by companies to disregard consent. There is a danger that these interests will outweigh potential adverse effects on the individual. Attempting to define legitimate interests allows for too much interpretation, and interpretation is not something that lends itself to privacy laws. The use of personal information could also be exempt from consent if a reasonable person would expect the use of their information for business activities. There is no definition as to what a reasonable person is.

The bottom line is that there are far too many loopholes and vague terms. For the savvy, wealthy or well-lawyered, the potential for abuse exists. The GDPR, conversely, is unequivocal on consent. It must be freely given, specific, informed, unambiguous and in an intelligible and accessible form, and is only valid for specific purposes. Canada should have followed that example. Canadians cannot help but wonder why Bill C-27 does not.

Under the proposed CPPA, there is no minimum age for minor consent, nor is “minor” defined. In the EU, the GDPR sets out a minimum age for a minor's consent at 16 years of age. Member states also have the flexibility to allow for a lower age, provided the age is not below 13 years.

If a breach of personal information does take place, Bill C-27 would make Canada slower to respond than its international counterparts. This bill mandates that a notification be made to the Privacy Commissioner of any breach that creates a real risk of significant harm as soon as it is feasible. The individual affected would also need to be informed, but, again, as soon as feasible.

The GDPR sets out that a mandatory notification must be made to the supervisory authority without undue delay, or 72 hours after having become aware of the incident in certain circumstances. Prior to the introduction of this bill, Canada was lagging behind internationally, and it still is, even after. The GDPR is already six years old. That is six years of extra time during which the Liberals have failed to develop this legislation to meet the robust international standard.

In Bill C-27, the Privacy Commissioner would be empowered to investigate any certified organization for contravening the act. The commissioner has been rightly asking for increased powers and responsibilities for some time, and this goes beyond a mere recommendation to violators to stop their actions. The commissioner would be able to recommend greater penalties of no more than $20 million or 4% gross global revenue for a summary offence, and no more than $25 million or 5% gross global revenue for an indictable offence.

These penalties should add more bite to what the Privacy Commissioner can do and impact how Canadians’ personal information will ultimately be treated. The penalties would also apply to a greater number of provisions, such as actions that contravene the establishment and implementation of a privacy management program and failure to ensure equivalent protection for personal information transferred to a service provider.

However, these new powers for the Privacy Commissioner hit a dead end when taken in context with the second part of this bill, which establishes a tribunal. The personal information and data protection tribunal would consist of no more than six members, and only half of those members must have experience in information and privacy law. The Privacy Commissioner would have order-making authority and the ability to make recommendations to this tribunal regarding penalties. However, the tribunal would have the power to apply its own decision instead, which would be final and binding. Except for judicial review under the Federal Courts Act, the tribunal's decisions would not be subject to appeal or to review by any court. These are powers equivalent to a superior court of record.

The existence of this tribunal would dull the new teeth given to the Privacy Commissioner. While the commissioner could recommend that a penalty be levied for violations of the CPPA, it is the tribunal that would have the power to set the amount owed by these organizations.

The cost associated with striking this tribunal is also a concern. Despite the fact that its work would likely be limited to a handful of times per year to determine penalties, it would apparently require a full-time and permanent staff of 20. I am deeply concerned as the government also has a bad habit of striking advisory councils, or so-called arm's-length regulatory bodies, in advance of bills being debated and passed in the House, long before the ink on the legislation is dry.

My memory is drawn to when a bill was being debated in the House, and I inquired about the details of the proposed environmental council. I was told with great zeal that it had already been established, and the members had been appointed before the bill was even debated in the House.

Can the current Prime Minister tell us if this tribunal would be struck only after Parliament has dealt fully with this bill? Will the Liberals be transparent with Canadians on how the appointment process would be undertaken? Can they assure Canadians that a full-time and permanent staff of 20 has not already been determined? After seven years of Liberal power, the level of patronage in this place run deep.

Part 2, which is the personal information and data protection tribunal act, should be removed as it is a bureaucratic middleman with power that would conflict and create redundancy with the Privacy Commissioner's new powers. The new powers would mean little if they were not coupled with quick and effective consequences for violators. It would prolong decisions on fines and harm Canada's reputation of holding violators accountable.

It would also not align with our friends in the EU, U.K., New Zealand and Australia that do not use a tribunal system for issuing fines. It goes to show Canadians that when it comes to making big government needlessly bigger, the Liberals do it well.

The third and final part of this bill is the only entirely new component. The artificial intelligence and data act seeks to regulate an entity, artificial intelligence, that has not been regulated before in this country.

It would set standards for the creation and use of AI systems in Canada by both domestic and international entities. More specifically, international and interprovincial trade and commerce in artificial intelligence systems would be regulated through common requirements for the design and use of those systems.

It would prohibit certain conduct pertaining to AI systems that could lead to harmful results for individuals and their personal data. There is that mention of personal data. This is a massive undertaking, attempting to regulate something that, up to this point, has been almost entirely unregulated.

I also understand that consultations on this were only initiated in June. Logic would dictate that such a bill requires careful scrutiny and time to get it right.

Requiring record keeping and human oversight are positive developments. What we find difficulty with is getting a clear picture of what the final framework would look like, as the minister alone would be empowered to establish these regulations. The minister would be able to act independently of Parliament in making rulings and imposing fines. In an age of uncertainty and new horizons for our relationship with AI, this is unacceptable. Parliament, at the very least, and independent experts and watchdogs should be central to the creation and enforcement of these rules.

It appears that once again the government has chosen to simply tack on a crucial area of concern to Canadians to an already complicated bill, and it wishes to again entrust sweeping powers to a minister to act independently of parliamentary oversight.

My final thoughts today on Bill C-27 are as follows. The Conservatives are considering this bill through a reasoned approach, and appreciate that stakeholders who have been calling for this legislation for years are watching today's debate closely.

It is absolutely clear that modern-day protection for the personal information of Canadians is required. They must have the ability to access and control its collection, use, monitoring and disclosure, and the right to delete it or the right to vanish.

How can we ensure that data is protected through watertight regulations and strict fines for abuse while also realizing that not every business affected by this bill would have the resources of Walmart or Amazon? Small and medium-sized businesses should be shielded from onerous regulation that stifles their growth. This is not to say that business interests should weigh equally with personal privacy, but there is a balance to be had, and I believe the Liberals do not have it right here.

Furthermore, in a cynical attempt to move their legislative agenda forward, the Liberals have bundled changes to privacy laws with a first-of-its-kind framework for artificial intelligence that once again intends to govern through top-down regulation and not through legislation.

The Liberals should commit today to splitting this bill up to allow Canadians a clear view of its intended impact. With that commitment, the Conservatives will be looking to do the hard work at committee to improve the long-awaited but flawed elements of this legislation. Even in an age of convenience, the world in which we live grows even more complicated by the day. Canadians deserve privacy protection worthy of 2022 realities and beyond.

The House resumed consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

Division of Bill C‑27 for the Purpose of Voting—Speaker's Ruling

[The Speaker, Anthony Rota]

I am now prepared to rule on the point of order raised on November 22, 2022, by the member for New Westminster—Burnaby concerning the application of Standing Order 69.1 to Bill C-27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts.

The member for New Westminster—Burnaby stated that there is a clear link between the first two parts of Bill C‑27, which respectively enact the consumer privacy protection act and the personal information and data protection tribunal act. He further noted that these elements were both part of the previous Bill C-11, which was introduced in the House during the 43rd Parliament.

However, the member argued that part 3, which enacts the artificial intelligence and data act, should be considered separately, because it does not directly concern privacy protection or the analysis, circulation and exchange of personal information. Accordingly, he asked the Chair to divide Bill C‑27 for the purposes of voting, as Standing Order 69.1 permits.

The official opposition House leader concurred. He added that, outside of clause 39 of the bill, which mentions the new consumer privacy protection act in the definition of the term “personal information”, part 3 of Bill C-27 does not refer to parts 1 or 2. Furthermore, the member for South Shore—St. Margarets stated that parts 1 and 2 of Bill C-27 deal with privacy protection, which has nothing to do with the subject of part 3, the regulation of the new industry of artificial intelligence.

On November 23, the parliamentary secretary to the government House Leader pointed out that privacy protection is the common theme that links every part of Bill C-27. In his view, the bill’s three parts constitute a framework for protecting the privacy of Canadians from the risks posed by artificial intelligence systems. He argued that dividing the bill would prevent members from considering all the risks and impacts that new artificial intelligence technologies may create for the security of personal information. He also noted that privacy laws do not adequately protect the public from new artificial intelligence systems and that, as a result, Bill C-27 should be considered as a whole.

Standing Order 69.1 gives the Chair the authority to divide the questions, for the purposes of voting, on the motions for second or third reading of a bill. The objective here is not to divide the bill for consideration purposes, but to enable the House to decide questions that are not closely related separately.

The Chair has carefully reviewed the provisions of Bill C‑27 and taken into account members' statements on the issue of dividing it for voting purposes. The Chair agrees that the bill's three parts are connected by a broad theme, namely, the use and protection of personal information. While parts 1 and 2 of the bill are closely related, this is not true of part 3.

The Chair is of the view that, given the lack of cross-references between part 3 and the preceding parts of the bill, with the sole exception being one reference to the new consumer privacy protection act—which serves to propose a common definition of the term “personal information”—dividing the bill for voting at second reading is justified.

In his intervention, the parliamentary secretary to the government House leader emphasized the common theme that links the three acts enacted by Bill C-27. In a decision on a similar matter, delivered on March 1, 2018, which can be found at pages 17550 to 17552 of the Debates, Speaker Regan said the following, at page 17551:

…the question the Chair must ask itself is whether the purpose of the standing order was to deal only with matters that were obviously unrelated or whether it was to provide members with the opportunity to pronounce themselves on specific initiatives when a bill contains a variety of different measures.

In the absence of a clear link between the three parts of Bill C-27, other than the theme of privacy protection, the Chair is willing to divide the question. Accordingly, two votes will take place at the second reading stage for Bill C-27. The first will be on parts 1 and 2, including the schedule to clause 2. The second will deal with part 3 of the bill. The Chair will remind members of this division before the voting begins.

If any part of this bill is negatived, the Chair will order the bill reprinted for reconsideration at committee.

I thank the hon. members for their attention.

Digital Charter Implementation Act, 2022

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, for the average citizen in the digital age, we have entered uncertain times. To almost everyone, at face value, the convenience of our time is remarkable. Access to any piece of information is available at our fingertips. Any item imaginable can seamlessly be ordered and delivered to our doors. Many government services can be processed online instead of in person. Canadians have taken these conveniences for granted for many years now.

The pandemic accelerated our ascent, or descent, depending on who you ask, into the digital age. The inability to leave our homes and the necessity to maintain some rhythm of everyday life played a significant part in that, but around the world, we saw governments taking advantage of the plight of their citizens. Public health was used as a catalyst for implementing methods of tracking and control, and social media platforms, which have been putting a friendly face on exploiting our likes, dislikes and movements for years, continue to develop and implement that technology with little input or say from their millions of users.

Canadians no longer can be sure that their personal information will not be outed, or doxed, to the public if doing so would achieve some certain political objective. We saw that unfold earlier this year with the users of the GiveSendGo platform.

The long-term ramifications of our relationship with the digital economy is something Canadians are beginning to understand. They are now alert to the fact that organizations, companies and government departments operating in Canada today do not face notable consequences for breaking our privacy laws. As lawmakers, it is our responsibility to ensure that Canadians’ privacy is protected and that this protection continues to evolve as threats to our information and anonymity as consumers unrelentingly expands both within and beyond our borders.

That brings me to the bill we are discussing today, Bill C-27. It is another attempt to introduce a digital charter after the previous iteration of the bill, Bill C-11, died on the Order Paper in the last Parliament. My colleagues and I believe that striking the right balance is at the core of the debate on this bill. On the one hand, it seeks to update privacy laws and regulations that have not been modernized since the year 2000 and implemented in 2005. It would be hard to describe the scale of expansion in the digital world over the last 22-year period in a mere 20-minute speech. It is therefore appropriate that a bill in any form, particularly one as long-awaited as Bill C-27, is considered by Parliament to fill the privacy gaps we see in Canada’s modern-day digital economy.

Parliament must also balance the need for modernization of privacy protection with the imperative that our small and medium-sized businesses remain competitive. Many of these businesses sustain themselves through the hard work of two or three employees, or perhaps even just a sole proprietor. We must be sensitive to their concerns, as Canada improves its image as a friendly destination for technology, data and innovation. This is especially true as our economic growth continues to recover from the damaging impact of pandemic lockdowns, crippling taxes that continue to rise and ever-increasing red tape.

That extra layer of red tape may very well be the catalyst for many small businesses to close their operations. No one in the House would like to see a further consolidation of Canadians’ purchasing power in big players such as Amazon and Walmart, which have the infrastructure already in place for these new privacy requirements.

In a digital age, Canadians expect businesses to operate online and invest a certain amount of trust in the receiving end of a transaction to protect their personal information. They expect that it will be used only in ways that are necessary for a transaction to be completed, and nothing more.

In exchange for convenience and expediency, consumers have been willing to compromise their anonymity to a degree, but they expect their government and businesses to match this free flow of information with appropriate safeguards. This is why Bill C-27, and every other bill similar to it, must be carefully scrutinized.

As many of my colleagues have already indicated, this is a large and complex bill, and we believe that its individual components are too important for them to be considered as one part of an omnibus bill.

There are three—

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, it is an honour today to rise to speak to Bill C-27, the digital charter implementation act.

I think it is important to reflect on how long it has been since we last had an update to legislation regarding the privacy laws that exist around data. The last time was over 20 years ago. Twenty years might not seem like a long time, but when we think about it, 20 years ago Facebook was probably just a program Mark Zuckerberg was working on in his dorm room.

If we think of iPhones, they were pretty much non-existent 20 years ago. Smart phones were out, but they certainly did not have anywhere near the capabilities they do today. So many other technologies we have come to rely on now have been getting smarter over the years. They are acting in different manners and are able to do the work they do because of the data being collected from individual users.

Another great example would be Google. Twenty years ago it was nothing more than literally a search engine. One had to type into the Google form what one was looking for. Sometimes one had to put weird characters or a plus symbol between words in the search terms. It literally was just a table of contents accessing information for people. However, now it is so much more than that. How many of us have, at some point, said to somebody that we would love to get a new air fryer, and then suddenly, the next day or later that day, we see in Google, on Facebook, or whatever it might be, advertisements for air fryers that keep popping up. I am sure that sometimes it is a coincidence, but I know in my experience it seems it happens way too often to be a coincidence.

These are the results of new technologies that are coming along, and in particular AI, that are able to work algorithms and build new ones based on the information being fed into the system. Of course the more information that gets fed in, the smarter the technologies get and the more they are looking to feed off new data that can give them even further precision with respect to advertising and targeting tools at people.

This is not just about selling advertising. AI can also lead to incredible advancements in technology that we otherwise would not have been able to get to, such as advancements in health and the automotive industry. If we think of our vehicles, the big thing now in new cars is the lane-assist feature, which uses technology such as lidar to read signals in the road.

There is technology that, when we enter our passwords to confirm we are human beings, sometimes requires us to pick different things from pictures. When we do that, we are feeding information back into helping those images be properly placed. We are not just confirming that we are human beings; there is an incredible amount of data being used to give better evaluations to various different formulas and equations based on the things we do.

When we think of things like intelligent and autonomous vehicles, which basically drive themselves, 20 years ago would we ever have thought a car could actually drive itself? We are pretty much halfway there. We are at a point where vehicles are able to see and identify roads and know where they need to be, what the hazards are, and what the possible threats are that exist with respect to that drive.

What is more important is that, when I get into my vehicle, drive it around and engage with other vehicles, it is analyzing all of this data and sending that information back to help develop that AI system for intelligent vehicles to make it even better and more predictive. It is not just the data that goes into the AI, but also the data that it can generate and then further feed to the algorithms to make it even better.

It is very obvious that things have changed quite a bit in 20 years. We are nowhere near where we were 20 years ago. We are so much further ahead, but we have to be conscious of what is happening to that data we are submitting. Sometimes, as I mentioned in a previous question, it can be data that is submitted anonymously for the purposes of being used to help algorithms around lidar and self-driving vehicles, for example. At other times it can be data that can be used for commercial, marketing and advertising purposes.

I think of my children. My six-year-old, who is in grade one, is developing his reading quite quickly. Two years ago, even at the age of four, when he would be playing a video game and would not be able to figure out how to get past a certain level, he would walk up to my wife's iPad and basically say, “Hey, Siri, how do I do this?”

Just saying that, I probably set off a bunch of phones to listen to what I am saying, but the point is that we have children who, already at such a young age, are using this technology. I did not grow up being able to say, “Hey, Siri, how do I do this or that?”

What we have to be really concerned about is the development of children and the development of minors, what they are doing and how that can impact them and their privacy. I am very relieved to see there is a big component of this that, in my opinion, aims to ensure the privacy of minors is maintained, even though I have heard the concern or the criticism from some members today that the definition of “minor” needs to be better reflected in the legislation.

I feel as though if it is not known what a minor is, in terms of how it relates to this legislation, then I believe this is something that can be worked out in committee. It is something to which the governing members would be more than welcome, in terms of listening to the discussion around that and why or why not further clarifying the definition is important.

I would like to just back up a second and talk more specifically about the three parts of this bill and what they would do. The summary reads as follows:

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.

A consequence of this first part would be to repeal other older pieces of legislation. I think this is absolutely critical, because this goes back to what I have been talking about in terms of how things have changed over the last 20 years. We are now at a place where we really do not know what information we are giving or is being used from us. I realize, as some other colleagues have indicated, 99.9% of the time, we always click that “yes, I accept the terms” without reading the terms and conditions, not knowing exactly how our information is being used and what is actually being linked directly back to us.

Through the consumer privacy protection act, there would be protections in place for the personal information of individuals while, at the same time, really respecting the need to ensure companies can still innovate, because it is important to innovate. It is important to see these technologies do better.

Quite frankly, it is important for me personally, and this will be very selfish of me, that, when I am watching on Netflix a show that I really like, I get recommendations of other shows I might really like. As the member for South Shore—St. Margarets mentioned earlier, when it comes to Spotify, it is important to me also that, when I start listening to certain music, other music gets suggested to me based on what other people who share similar interests to mine have liked, and how these algorithms end up generating that content for me.

It is important to ensure that companies, if we want them to continue to innovate on these incredible technologies we have, can have access to data. However, it is even more important that they be responsible with respect to that innovation. There has to be the proper balance between privacy and innovation, how people are innovating and how that data is being used.

We have seen examples in recent years, whether in the United States or in Canada, where data that has been collected has been used in a manner not in keeping with how that data was supposed to be used. There has to be a comprehensive act in place that properly identifies how that data is going to be used, because, quite frankly, the last time this legislation was updated, 20 years ago, we had no idea how that data would be used today.

By encouraging responsible innovation and ensuring we have the proper terminology in the legislation, companies would know exactly what they should and should not be doing, how they should be engaging with that data, what they need to do with that data at various times, how to keep it secure and safe and, most importantly, how to maintain the privacy of individuals. It is to the benefit not just of individuals in 2022, or 2023 almost, to have data that is being properly secured. It is also very important and to the benefit of the businesses, so that they know what the rules are and what the playing field is like when it comes to accessing that data.

The second part of this bill, as has been mentioned:

...enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act.

This is absolutely critical, because there has to be somewhere people can go to ensure that, if they have a concern from a consumer perspective over the way their data is used and they are not happy with the result from the commissioner, they have an avenue to appeal those decisions. If we do not do that, and we put too much power in the hands of a few individuals, or in this case the Privacy Commissioner under the consumer protection act, if we give all that power and do not have the ability for an appeal mechanism, then we will certainly run into problems down the road. This legislation would help ensure that the commissioner is kept in check, and it would also help consumers have the faith they need to have in terms of accountability when it comes to their data and whether it is being used and maintained in a safe way.

The third part of the bill is the more controversial in terms of whether or not it should be part of this particular legislation or in a separate vote. The summary reads:

Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate the risks of harm and biased output related to high-impact artificial intelligence systems.

That act would provide for public reporting and authorizes the minister to order the production of records related to artificial intelligence systems. The act also would establish prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system in an intentional or reckless way that causes material harm to individuals.

One of the consequences of artificial intelligence, quite frankly, is that if we allow all of this biased information to be fed into the artificial intelligence systems and be used to create and produce results for important algorithms, then we run the risk of those results being biased as well if the inputs are going to be that way. Therefore, ensuring that there are proper measures in place to ensure individuals are not going to be treated in a biased manner is going to require true accountability.

The reality is that artificial intelligence, even in its current form, is very hard to predict. It is very hard to understand exactly when a person is being impacted by something being generated from an artificially intelligent form. Quite often, a lot of the interactions we already have on a day-to-day basis are based on these artificial intelligence features that are using various different inputs in order to determine what we should be doing or how we should be engaging with something.

The reality is that if this is done in a biased manner or in a manner that is intentionally reckless, people might not be aware of that until it is well past the point, so it is important to ensure that we have all of the proper measures in place to protect individuals against those who would try to use artificial intelligence in a manner that would intentionally harm them.

As I come to the conclusion of my remarks, I will go back to what I talked about in the beginning, that artificial intelligence, quite frankly, has a lot of benefits to it. It is going to transform just about everything in our lives: how we interact with individuals, how we interact with technologies, how we are cared for, how we move around by transportation, how we make decisions, as we already know, on what to listen to or what to watch.

It is incredibly important that as this technology develops and artificial intelligence becomes more and more common, we ensure that we are in the driver's seat in terms of understanding what is going into that and making sure we are fully aware of anybody who might be breaking rules as they relate to the use of artificial intelligence. It will become more difficult, quite frankly, as the artificial intelligence forms take on new responsibilities and meanings to create new decisions and outputs, and we must ensure that we are in a position to always be in the driver's seat and have the proper oversight that is required.

I recognize that some concerns have been brought forward today by different members. At first glance, when the member for South Shore—St. Margarets and others brought forward the concern around the definition of a “minor”, which is not something I thought of when I originally looked at this bill, I can appreciate, especially after hearing his response to my question, why it is necessary to put a proper definition in there. I hope the bill gets to committee and the committee can study some of those important questions so we can keep moving this along.

I certainly do not feel as though we should just be abandoning this bill altogether because we might have concerns about one thing or another. The reality, and what we know for certain, is that things have changed quite a bit in the last 20 years since the legislation was last updated. We need to start working on this now. We need to get it to committee, and the proper studies need to occur at this point so we can properly ensure that individuals' privacy and protection are taken care of as they relate to the three particular parts I talked about today.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, data is used for good and data is used for evil. Data is money, data is power and data is knowledge. Data can improve our lives. Data can also harm our lives. Data tells the story of our lives, and our personal data flows globally. The amount of data in the world has doubled since 2020 and is expected to triple by 2025 according to Statista, 2022.

To understand why we need modern privacy rights in the digital world, it is important to understand that businesses have evolved from providing a specific service, like a social network such as Facebook and Twitter or a search engines such as Google or Microsoft to find things, to using data to gather information on individuals and groups, to manage and deploy people's data and to sell their information to others and sell them goods and services.

We have evolved from businesses providing these services for interest to businesses using these services for surveillance on us and making enormous amounts of money on our personal information. As legislators, we must balance the uses of data collection with an individual's right to privacy. It is a delicate balance that Bill C-27 aims to address by modernizing our privacy laws.

At the heart of this long overdue revision to our privacy laws must be the rights of the individual. In my view, commercial usage of data under privacy law should be secondary to personal privacy, and should only be focused on how business interests enhance personal needs and how commercial entities protect individual privacy rights. My remarks today will focus on why this legislation falls far short of what individuals, groups and businesses need for a clear legislative framework of data collection and management of personal information in this digital age.

First, Bill C-27 is really three bills in one omnibus bill. The first bill would update privacy law. The second bill contains a new semi-judicial body and would potentially duplicate what the Privacy Commissioner could do while removing the right to go to the courts. The third is a rushed bolt-on bill on artificial intelligence that does not, in my mind, have much intelligence in it. The Liberal legislation manages to weaken privacy and put up barriers to innovation at the same time.

Bill C-27 fails Canadians right up front in its preamble. Despite demands from privacy advocates over the last few years, the government has failed to recognize privacy as a fundamental right in the preamble. The bill states that individuals' personal information should have the “full enjoyment of fundamental rights”. This is clever language that avoids giving personal privacy the recognition that it is a fundamental right or a fundamental human right.

The wording “full enjoyment of fundamental rights” in the preamble needs to be amended from “of fundamental rights” to “as a fundamental right”. Furthermore, leaving this strictly in the preamble reduces if not eliminates any real legal impact. If privacy is a fundamental right, for it to have true force in this bill it needs to be included as well in clause 5, which notes the purpose of the bill.

Why is privacy a fundamental right? Freedom of thought, freedom of speech and freedom to be left alone are derived from privacy. The legal protections of privacy limit government's intrusion into our lives. In free and democratic societies, we consider these freedoms as essential rights. The rights to think what I want, to say what I want and to be free to choose what I do, what I am interested in and whom I interact with and where I do that in our digital world are data points. To me they are personal information and therefore are part of a fundamental right to privacy.

What does this mean? It means privacy rights under law are prioritized over commercial rights. A rights-based approach serves as an effective check on technology's potential dangers while ensuring businesses can function and thrive.

Government officials have told me this cannot be recognized in the bill the way it needs to be to have true meaning under law and force because it would intrude on provincial jurisdiction. I do not agree, and neither does the Privacy Commissioner of Canada. Both levels of government can regulate privacy and do. The federal government's role is to regulate aspects under its control, including the fact that commerce does not follow provincial boundaries and therefore requires federal oversight.

I believe that most Canadians accept and expect their data to be used to enhance their experiences and needs in our modern society. I also believe that for organizations to obtain the data of Canadians, Canadians must first consent to it, and that if these same organizations find new uses of our data, they need to get express consent as well. Canadians want their data safely protected and not used for things they did not give permission for, and if they choose to end a relationship with a service provider, they want their personal data to be destroyed.

I do not believe Canadians want their personal data sold to other entities without their express consent, and how does Bill C-27 deal with these expectations of Canadians? I think poorly. The legislation, in the summary section, states that the dual purpose of the bill is to “govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.” What it would not do is place personal privacy rights above commercial interests.

The bill would require express consent in clause 15, and that is true, but a great deal of the bill goes on to describe the many ways in which consent would not be required and how it would be left up to the discretion of the organization that has collected the data if it needs consent for its usage. The bill is also weak in terms of making sure individuals understand consent when given. For consent to be meaningful, the usages proposed must be understood. The lack of definition and the placement of burden of interpretation on businesses expose those same businesses to legal action and penalties if they get it wrong. This lack of clarity may stifle innovation in Canada as a result. The bill needs to ensure that individuals understand the nature, purpose and consequences of the collection, use and disclosure of the information to which they are consenting.

In addition, the bill would give organizations the right to use information in new ways and would require businesses to get an update to consent for this information. That is good and necessary, but the bill would also enable organizations to use the implied consent in subclause 15(5). When combined with paragraph 18(2)(d), this would give businesses carte blanche to use implied consent rather than express consent.

An organization can decide on its own that the original consent implies consent for a new purpose, and they do not need to seek the individual's views. This is a version of the old negative option marketing that was outlawed in the 1990s. Either someone gives consent, or they do not. There is no such thing as implied consent, in my view, and this needs to be removed from the bill.

Additionally, the bill uses the term “sensitive information”, which companies and organizations must determine to protect data, but it does not anywhere in the more than 100 pages define what “sensitive information” is. It needs to be defined in the bill to include information revealing racial and ethnic origin, gender identity, sexual orientation and religious and other affiliations. These are just a few examples.

However, that is not the worst of it. Bill C-27 would introduce a concept called “legitimate interest”. This is a new rule that would rank an individual's interests and fundamental rights below those of the organization that gathered the information, the exact opposite of what a personal privacy bill should do. To do this, subclause 18(3) would allow an organization or business to use information if it has a legitimate interest in doing so. However, here is where it really gets goofy: To try to reduce businesses using our data under the legitimate interest clause for their own needs over ours, the Liberals have decided to limit the power under paragraph 18(3)(b). This clause could prohibit the business or organization from using our information for the purpose of influencing behaviour.

For more than 20 years, since the invention of loyalty and rewards programs, retailers have used people's data to offer products they might enjoy based on their purchasing patterns. Have members ever bought wine online or in store because it said, “If you like this, you might enjoy this alternative”? Have members ever watched a show on Netflix because it was recommended? Have members ever listened to a song on Spotify because it was recommended based on what else they had listened to? Well, guess what. Paragraph 18(3)(b) could now make this service illegal.

The Liberals cannot get express consent right, and they are allowing companies to use people's data with implied consent or no consent at all. The Liberals are also putting the business use of people's personal data above their privacy rights. That is why it is really the no privacy bill. At the same time, the Liberals are making illegal the good parts of what businesses do in enhancing the customer experience by removing the ability to study purchasing patterns and offering products that we might enjoy because of paragraph 18(3)(b). This bill makes influencing people's decisions illegal.

The minister said to me and mentioned in the House in his opening speech on the bill, as have other members today, that he is proud to be protecting children from harm in this digital bill. This 100-page legislation has only one clause related to children. Subclause 2(2), under “Definitions”, states that “information of minors is considered to be sensitive”, but the bill does not define “sensitive” nor does it define what a minor is. Officials tell me that the definition of a minor is determined by provincial law, so each province would have different rules, and companies would have to comply with the different rules in every province.

If the protection of children were really a major purpose, this legislation would devote some space to defining both what a minor is and what sensitive information is. During COVID, minors used many online apps and programs to continue their formal education. There were then and still are no protections under law as to what is done with their data. This technology would be a new normal for our education system. The online surveillance of children resulting from the COVID experience is huge and protections are zero, even with this bill.

This bill needs to define in law, not regulation, age-appropriate consent for minors, and comprehensive rules to prevent the collection, manipulation and use of any minor's data. This bill leaves it up to businesses to decide what is sensitive and appropriate for minors. It is a colossal failure on the minister's main selling point for this no privacy bill.

The bill is silent on the selling of personal data. It needs provisions on the limits and obligations of data brokers. The bill is silent on the use of facial recognition technology. The bill also prohibits using data in a way that produces significant harm and defines it inadequately. For example, psychological harm caused by a data breach and embarrassment caused by privacy loss are not included. The damages role needs to be expanded to include moral damages, since most contraventions of privacy do not involve provable, quantifiable damages.

Creating more government bureaucracy and growth is the true legacy of the Liberals in government. This bill is no exception, with the creation of a body to appeal the Privacy Commissioner's rulings to. The appointed new body of non-lawyers is called the personal protection and data tribunal, and it is the second part of the bill. Frankly, these powers, if they really are important, should be given to the Privacy Commissioner to eliminate the middle man of bureaucracy. There is no need for this tribunal.

Finally, let us turn to the ill-conceived, poorly structured and ill-defined artificial intelligence part of Bill C-27. It really needs to be removed from this legislation and puts this bill's passage into question. AI is a valid area to legislate, but only with a bill that has a legislative goal. That is why I am hopeful that the Speaker will rule in favour of the NDP's point of order, reiterated by our Conservative House leader, which would ensure that part 3 of the bill is voted on separately from part 1 and part 2.

Essentially, this part of Bill C-27 would drive all work on AI out of Canada to countries with clearer government legislation. It tells me the government has not done its homework, does not really know what AI is or will become, and has no idea how it will impact people in our country.

The bill asks parliamentarians to pass a law that defines no goals or oversight and would give all future law-making power to the minister through regulation, not even to the Governor in Council but to the minister. The minister can make law, investigate violations, determine guilt and impose penalties without ever going to Parliament, cabinet or any third party.

It is a massive overreach and is anti-democratic in an area critical to Canada's innovation agenda. Promises of consultation in the process of crafting regulations is too little, too late. It puts too much power in the hands of unelected officials and the minister.

The definition in the bill of what AI is, and therefore what it wants total regulatory power over, is a system that autonomously processes date related to human activities using a genetic algorithm, a neural network, machine learning or other networks to make recommendations or predictions. If we think this is futuristic, it is not. It is already happening in warfare to determine and execute bombings.

Without parliamentary oversight, the bill introduces the concept of “high-impact systems”. It does not define what that is, but it will be defined in regulation and managed in regulation. No regulatory power should ever be given to the minister or the Governor in Council for anything that is not defined in law.

The only thing the bill defines is the unprecedented power to rule all over this industry and the fines to those who breach the unwritten regulations. The massive financial and jail penalties that extend down to the developers and the university researchers for undefined breaches of law as part of the statute are huge.

Unless this portion of the bill is separated when members vote, this AI section is reason alone that the bill should be defeated. AI is a significant need, but it needs a proper legislative framework, one that is actually developed with consultation.

I urge all members to read the bill carefully. Current privacy laws need amendment, but the current law is preferable to this ill-defined proposal. The AI bill would drive innovation and business out of Canada's economy, making us less competitive.

It is hard to believe anyone could get this legislation so wrong, especially since this is the second time the Liberals have proposed updating our privacy laws. Without splitting the bill, without having separate votes and without considerable amendments in committee in the first two parts, the bill should be defeated.

I urge all members to consider this seriously in their deliberations as we go on to the many speeches that we will hear. While this is a critical point of updating our personal privacy, the bill, in its current state, does not do it and it gives equal if not greater rights to businesses and organizations than it does to individuals.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, privacy rights are so critical. When they are violated, consumers deserve to be compensated. There have been numerous examples in the United States where consumers have been compensated in the realm of hundreds of millions of dollars. For the same breach here in Canada, consumers have not been compensated.

I am wondering if the member would support amendments that would ensure that, in Bill C-27, there is parity, and for the same breach, Canadians and Americans would be getting fair compensation.

[Ya'ara Saks, Liberal, Parliamentary Secretary to the Minister of Families]

Madam Speaker and hon. colleagues, I rise today to speak about the digital charter implementation act, 2022, also known as Bill C-27.

I thank the member for Châteauguay—Lacolle for sharing her time with me today.

It is an important discussion that is happening among Canadians about what our digital environment looks like. As we know, over the past few years, we have witnessed the constant evolution of our digital environment. Canadians have been successfully navigating through this changing environment, but they have also made it clear to us that they want better protection of their privacy. They want to be able to benefit from the latest emerging technologies with the confidence that they can be used safely. Canadians also believe that organizations need to be fully accountable for how they manage personal information and how they go about developing powerful technologies, such as artificial intelligence, or AI.

From the beginning of our consultations on digital and data, stakeholders have stressed the importance of maintaining flexibility to innovate responsibly and maintain access to markets at home and abroad. I am proud to say that the digital charter implementation act, 2022, which would enact the consumer privacy protection act, or CPPA, and the artificial intelligence and data act, or AIDA, would do just that.

The CPPA represents a complete transformation of Canada's private sector privacy regime, the Personal Information Protection and Electronic Documents Act, or PIPEDA, which came into force in 2001. That was 20 or so years ago. CPPA would introduce significant changes to better protect Canadians' personal information, including strong fiscal and financial consequences for those who seek to benefit from curtailing their legal obligations. This new framework would also ensure that all Canadians could enjoy the same privacy protections as individuals have in other countries.

The AIDA, for its part, is being proposed to build confidence in a key part of the data-driven economy. This part of the bill would introduce common standards for responsible design, development and deployment of AI systems. It would also provide businesses with much-needed guardrails for AI innovation and would ensure that Canadians can trust the AI systems that underpin the data economy.

PIPEDA was passed at the start of the century when other countries and some provinces were moving forward with privacy laws governing the private sector. Recognizing the potential for a patchwork of provincial privacy laws to emerge and the need to align internationally, Canada put in place PIPEDA as a national privacy standard. It drew on best practices to provide robust privacy protections for increased consumer confidence and a consistent and flexible regulatory environment for businesses that allowed for legitimate use of personal information.

The key element for alignment was the recognition of provincial private sector privacy laws as substantially similar. This meant that, where such a law is given that designation, PIPEDA did not apply to an organization's activities within that province. PIPEDA would continue, however, to apply to the federally regulated sector in that province and to any personal information collected, used or disclosed in the course of commercial activities across borders. This has provided a stable regulatory environment and flexibility for provinces, and it has supported Canada's trade interests well for many years.

Today, history is repeating itself, but the stakes are much higher. The role of the digital economy is far more central to our lives than it was 20 years ago. To harness all that the modern digital world has to offer, we clearly need to modernize our federal private sector privacy law. The provinces are moving in that direction and, again, the risk of fragmentation looms.

Quebec has amended its private sector privacy law, and B.C. and Alberta are examining their private sector privacy laws as well. Ontario too is considering introducing a new private sector privacy law. Therefore, the federal government must act now to ensure that all Canadians benefit from a substantially equivalent degree of protection and facilitate compliance for organizations that do business across the country.

Like PIPEDA, the CPPA is grounded in the federal trade and commerce powers. It builds on the best practices developed internationally and by Canadian provinces, and it foregrounds the importance of the ease of doing business across boundaries. The CPPA replicates the approach under PIPEDA, and it updates the mechanism in regulations for recognizing provincial laws as substantially similar. The regulations will set out the criteria and process for such recognition and will continue to provide the flexibility that has been important to PIPEDA's success.

CPPA, like its predecessor, would also maintain the Privacy Commissioner's ability to collaborate and co-operate with his or her provincial counterparts. This is an important tool to ensure consistency, guidance and enforcement, and one that has enabled our commissioners to lead the world in privacy collaboration and co-operation.

Canada also needs to move proactively to regulate in the AI space, given that the operation of these systems transcends national and provincial borders in the digital environment. AIDA would create a common standard that all organizations involved in international and inter-provincial trade and commerce would have to meet. AIDA would place Canada at the forefront of international regulation in the AI space and would provide clear rules across the country. This would spur innovation and build confidence in the safety of AI systems used or developed in Canada.

We live in an interconnected world. Data is constantly flowing across borders. In 2001, the European Commission recognized PIPEDA as providing adequate protection relative to EU law, allowing for the free flow of personal information between Canadian and European businesses.

In 2018, a new EU regulation came into effect that was known as the general data protection regulation. It updated many of the existing requirements and added strong financial penalties for contraventions. The EU is currently reviewing its existing adequacy decisions, including the one that applies to Canada. We expect to hear more on the outcome of this review soon.

The CPPA would make a positive contribution to maintaining Canada's adequacy with the EU privacy regime. It would enable personal data from EU businesses to continue to flow to Canada without additional protections. Beyond the EU, the changes proposed in the CPPA would represent important updates that would bring us in line with other international jurisdictions that have updated their laws. It would ensure interoperability with consistent rules, rights and consequences.

Other jurisdictions internationally are also moving ahead on their AI regulation, and strong action is needed to maintain Canada's leadership position internationally. Interoperability with international partners remains a key priority. The EU in particular has advanced a framework for regulating AI that would set standards for any AI systems being deployed in the EU market.

AIDA would propose a risk-based approach that would ensure interoperability with the EU while keeping in mind that Canadian context is unique. For example, AIDA would include flexible compliance options in order to ensure that our many small to medium-sized businesses would not be left behind. The proposed AIDA would represent an opportunity for Canada to lead internationally, would ensure market access for Canadian companies and would uphold Canadian values.

The government launched Canada's digital charter in 2019. Its 10 guiding principles offer a foundation on which to build an innovative and inclusive digital and data-driven economy. Ensuring interoperability, a level playing field, strong enforcement and real accountability are clearly reflected in the digital charter implementation act, 2022.

I can assure colleagues that our approach is pragmatic, principled and meets our trading needs. The bill would provide a consistent, coherent framework that Canadians and stakeholders could rely on. With Bill C-27 we would continue to encourage trade and investment and to grow an economy that would extend across provincial and international borders alike.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Madam Speaker, it is notable that Bill C-27 does not explicitly apply to political parties. Given the potential for privacy breaches and other issues to exist in the political arena, I wonder if my colleague across the way could comment on the potential for amending it to explicitly reference and include political parties in the scope of the bill.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, I commend my colleague. I sat with her on the Standing Committee on Access to Information, Privacy and Ethics for a few months.

We had concerns about privacy. Several recommendations were made, and that is why Bill C‑11 became Bill C‑27. I acknowledge that the bill has been improved. That being said, I wonder about two things.

First, in 2022, I do not think it is right that banking institutions are taking the lead on showing us how important it is to protect privacy. Second, this bill is important, but I would like to know if we should refer it to a committee to study it properly because it is really two bills in one. The first is on artificial intelligence, and the second is on privacy protection. What does the member think?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I will be sharing my time with the member for York Centre.

I am pleased to rise in the House today to speak to the digital charter implementation act, 2022, in particular the aspect on the consumer privacy protection act. If I have time, I will also discuss the artificial intelligence and data act.

I am very proud to speak to these two pieces of legislation that introduce a regime that seeks to not only support the technological transformation, but also help Canadians safely navigate this new digital world with confidence. These past few years, Canadians have witnessed these technological shifts take place. They have taken advantage of new technologies like never before. In 2021, more than 72.5% of Canadians used e-commerce services, a trend that is expected to grow to 77.6% by 2025.

According to TECHNATION, a 10% increase in digitalization can create close to a 1% drop in the unemployment rate. What is more, every 1% increase in digitalization can add $8.7 billion to Canada's GDP. In order to take advantage of those major benefits for our economy, we must ensure that consumers continue to have confidence in the digital marketplace.

Technology is clearly an intrinsic part of our lives, and Canadians have growing expectations regarding the digital economy. It is absolutely essential that the Government of Canada be able to meet those expectations.

With this bill, the government is putting forward a regime that gives Canadians the protection they deserve. First, as stated in the preamble of the digital charter implementation act, 2022, Canada recognizes the importance of protecting Canadians' privacy rights. Similarly, the 2022 consumer privacy protection act also provides important protections for Canadians.

That said, our government has listened to the input of various stakeholders, and we have made changes to improve this bill. I was on the committee in the last Parliament, and there was a lot of discussion about the previous bill, Bill C‑11. I am very pleased to be able to speak to Bill C-27, so that we can get all that work done in this Parliament.

One of the most important changes we have made is enhancing protection for minors. Some stakeholders felt that the previous legislation did not go far enough to protect children's privacy. I agree. Consequently, the bill was amended to define minors' information as sensitive by default. This means that organizations subject to the law will have to adhere to higher standards of protection for that information. The legislation also provides minors with a more direct route to delete their personal information. This will make it easier for them to manage their online reputation. I think this is a really important change, because we know that young people are very aware and very capable of using all types of digital platforms, but at the same time, we need to make sure that they are able to protect their reputation.

In addition to protections for minors, we also made changes to the concept of de-identification of personal information. According to many stakeholders, the definitions in the old bill were confusing. We recognize that having well-defined terms helps ensure compliance with the act and provides more effective protection of consumers' information. In that regard, I understand that, because we are talking about new technologies and an evolving industry, it is important for all members to share their expertise, since that will help us develop a better piece of legislation.

The difference, then, between anonymous information and de-identified information needs to be clarified because, clearly, if information is de-identified but an organization or company is able to reidentify it, that does not serve the purpose of having anonymous information.

Data-based innovation offers many benefits for Canadians. These changes contribute to appropriate safeguards to prevent unauthorized reidentification of this information, while offering greater flexibility in the use of de-identified information.

The new law also maintains the emphasis on controlling the use of their personal information by individuals. That remains a foundation of the law, namely that individuals must be able to fully understand the purpose for which information will be used and consent to that purpose in the most important circumstances.

However, the modern economy must also have flexible tools to accommodate situations that are beneficial but that may not require consent if the organization respects certain limits and takes steps to protect individuals.

The approach advocated here continues to be based on the concept of individual control, but proposes a new exception to consent to resolve these gaps as a tool for safeguarding privacy. The new provisions propose a general exception to cover situations in which organizations could use personal information without obtaining consent, provided that they can justify their legitimate interest in its use for circumstances in which the individual expects the information to be used.

In addition, to prevent abuse, the exception is subject to a requirement that the organization mitigate the risk. For example, digital mapping applications that take photos of every street and that we use to view them, particularly to help with navigation, are widely accepted as being beneficial. However, obtaining individual consent from every resident of the city is impossible.

I believe that everyone in the House will agree that it is hard to imagine how we managed before we had access to those navigation applications. Last evening, I had a visit with a family member in Ottawa and was very happy to have my mapping application to find my destination.

The presence of an exception, combined with a mitigation requirement, therefore allows individuals to take advantage of a beneficial service while safeguarding personal information. The example shows another key aspect for building trust and transparency. Digital mapping technology presents a certain level of transparency. The vehicles equipped with cameras can be seen on our streets and the results can also be seen posted and available online.

However, there are some technologies or aspects thereof that are more difficult to see and understand. That is why the bill continues granting individuals the right to ask organizations for an explanation regarding any prediction, recommendation or decision made in their regard by an automated decision-making system.

What is more, these explanations must be provided in plain language that the individual can understand. These provisions also support the proposed new artificial intelligence act. However, I do not think that I have time to get into that, so I will end there.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I am happy to start this week by speaking to Bill C-27. It is quite an extensive bill at over 140 pages in length. It would amend several acts and the most consequential are three of them in particular, as it is an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts.

I should start by saying that this is really three pieces of legislation that have been bundled up into one. As New Democrats, we have called for different voting for the third and final part of this act.

The first two parts of the act, concerning the consumer privacy protection act and the personal information and data protection tribunal act, do have enough common themes running through them to be put together into one piece of legislation. I still think, for these issues, that they would have been better as two separate pieces of legislation because one of them is brand new and the first one, the consumer privacy protection act, is the former Bill C-11, which was highly controversial in the previous Parliament.

When we had an unnecessary election called by the Prime Minister, that bill died, along with all of the work from Parliament, which was not concluded, despite extensive lobbying and consultation going, particularly, through the ethics committee at that time. This has now been bundled with some other legislation to go through the industry committee, which is fine.

The personal information and data protection tribunal act is a new component of this legislation. I have some concerns about that element of it, but it does have a common theme, which is worthwhile, and at least it has the potential to be put together and bundled. Although, again, it is extensive, it is a bundling that we can accept.

We have called for a Speaker's ruling with regard to the artificial intelligence and data act, as this is brand new legislation as well, but it does not have the same connections as the previous two pieces, which are bundled together, in the way that one could could argue for them. We want a separate vote on the second part of this because the legislation would be studied at committee together.

There will be a high degree of interest in this legislation, since Bill C-11 had that in the past. The new bill changes position from Bill C-11 significantly, and I expect that this in itself will garner a lot of chatter, as well as review and interest, from a number of organizations, many of whom we have already heard from as of now.

The other part, with the tribunal, would be another important aspect, because it is a divergence from our traditional way of enforcement and creates another bureaucratic arm. Again, I would like to see more on this, and I am open to considering the idea, but it is certainly different from our traditional private right of law for dispute settlements about data breaches and other types of corporate malfeasance, that actually have to deal with the types of laws that are necessary to bring compliance among people.

This goes to the heart of, really, where a political party resides in their expectations of companies and their use of data, information and algorithms. For New Democrats, we fall very much in line with something I have tabled before, several years ago, which is a digital bill of rights, so that one's personal rights online are consistent with that of our physical rights, where one is expected to be properly treated in a physical world and in the digital format world. That includes one's right to privacy, right to the expectation of proper behaviour conducted toward oneself and right to not be abused. It also includes significant penalties to those who do those abuses, especially when we are looking at the corporate world.

Where this legislation really becomes highly complicated is the emergence of artificial intelligence, which has taken place over the last decade and will be significantly ramped up in the years to come. That is why the European Union and others have advanced on this, as well as the United States.

Our concern is that this bill tries to split both worlds. We all know that the industries of Google and other web giants have conducted significant lobbying efforts over the last number of years. In fact, they have tripled their efforts since this administration has come into place and have had a direct line of correspondence about their lobbying, which is fine to some degree, but the expectation among people that it would be balanced does not seem to be being met.

I want to bring into the discussion the impact on people before I get into the technical aspects of the bill, as well as the data breaches that remind us of the need for protection among our citizens and other companies as well. One of the things that is often forgotten is other SMEs, and others can be compromised quite significantly from this, so protecting people individually is just as important for our economy, especially when we have the emergence of new industries. If they are behaviours that are hampered, manipulated or streamed, they can become significant issues.

I want to remind people that some of the data breaches we have had with Yahoo, Marriott, the Desjardins group and Facebook, among others, have demonstrated significant differences in the regulatory system between Canada and the United States and how they treat their victims. A good example is a settlement in the U.S. from 2009 with the Equifax data breach, where Equifax agreed to pay $700 million to settle lawsuits over the breach in agreement with the U.S. authorities, and that included $425 million in monetary relief to consumers. We have not had the same type of treatment here in Canada.

This is similar to the work I have done in the past with the auto industry and the fact that our Competition Bureau and our reimbursement systems are not up to date. We have been treated basically as a colony by many of the industries when it comes to consumer and retail accountability.

We can look at the example of Toyota and the data software issue, where the car pedal was blamed for the cars going out of control. It turned out this was not the case. It was actually a data issue. In the U.S., this resulted in hundreds of millions of dollars of investment into safety procedures. We received zero for that. Also, consumers received better treatment, where their vehicles were towed back to different dealerships to be fixed. In Canada, consumers did not receive any of that.

The same could be said with Volkswagen, another situation that took place with emissions. Not only did we not receive compensation similar to that of the United States, we actually imported a lot of the used Volkswagen vehicles from Europe. However, that was of our own accord and time frame when those vehicles were being sunsetted in those countries because of emissions.

In the case of Facebook, the U.S. Federal Trade Commission was able to impose a $5-billion fine for the company's violation, while the Privacy Commissioner's office was forced to take the company to federal court here in Canada. One of the things I would like to point out is that our Privacy Commissioner has stood up for the needs of Canadians, and one of the concerns with this bill would be the erosion of the Privacy Commissioner's capabilities in dealing with these bills and legislation.

The Privacy Commissioner has made some significant points on how to amend the bill and actually balance it, but they have not all been taken into account. One of the strong points we will be looking to is to see whether there are necessary amendments from our Privacy Commissioner on this.

One of the big distinctions between Canada and the United States, which is to our benefit and to Canada's credit, is the office of the Privacy Commissioner. Where we do not have some of the teeth necessary for dealing with these companies, we do have the independent Privacy Commissioner, who is able to investigate and follow through at least with bringing things to a formal process in the legal system. It is very labourious and difficult, but at the same time, it is independent, which is one of the strengths of the system we have.

If the government proceeds, we will see the bill go to committee, which we are agreeing to do. However, we do want to see separate voting. Before I get into more of the bill, I will explain that we want to see separate voting because we really distinguish that this is inappropriate. The artificial intelligence act is the first time we have even dealt with this topic in the House of Commons, and it should be done differently.

We will be looking for amendments for this, and big corporate data privacy breaches are becoming quite an issue. Some of these privacy breaches get highly complicated to deal with. There have been cases with cybersecurity and even extortion. The University of Calgary is one that was well noted, and there have been others.

We need some of these things brought together. The bill does include some important fixes that we have been calling for, such as stronger enforcement of privacy rights, tough new fines, transparency in corporate decisions made by algorithms.

I have pointed out a lot of the concerns that we have about the bill going forward because of its serious nature. However, we are glad this is happening, albeit with the caveat that we feel the bill should be separate legislation. The minister does deserve credit for bringing the bill forward for debate in the House of Commons.

Bill C-11 should have been passed in the last Parliament, but here we are again dealing with it. The new tribunal is the concern that we have. It could actually weaken existing content rules, and we will study and look at the new tribunal.

The tribunal itself is going to be interesting because it would be an appointment process. There is always a concern when we have a government appointment process. There is a concern that there could be complications setting up the tribunal, such as who gets to go there, what their background is, what their profession is and whether there will be enough support.

One of the things that gives me trouble is that the CRTC, for example, takes so long to make a decision. It is so labourious to go through and it has not always acted, most recently, in the best interest of Canadians when it comes to consumer protection and individual rights. It gives me concern that having another tribunal to act as a referee instead of the court system could delay things.

Some testimony has been provided already, some analysis, that suggests the tribunal might end up with lawsuits anyway, so we could potentially be back to square one after that. The time duration, funding, the ability to investigate and all these different things are very good issues to look at to find out whether we will have the proper supports for a new measure being brought in.

Another government resource for this is key. At the end of the day, if it is a tribunal system that is not supportive of protecting Canadians' privacy and rights, then we will weaken the entire legislation. That is a big concern because that would be outside Parliament. The way that some of the amendments are written, it could be coming through more regulatory means and less parliamentary oversight.

Who is going to be on the tribunal? How will it be consistent? How will it be regulated? I would point to the minister providing the CRTC with a mandate letter, which is supposed to emphasize the public policy direction it should be going. In my assessment, the CRTC, over the last number of years, has not taken the consumer protection steps that New Democrats would like to see.

When it comes to modernizing this law, we do know that this will be important to address because there are issues regarding the data ownership, which is really at the heart of some of the challenges we face. There is algorithmic abuse and also areas related to compensation, enforcement, data ownership and control, and a number of things that are necessary to ensure the protection of people.

We can look at an area where I have done a fair amount of work related to my riding, which is automobile production. There has been the production of the car and the value there, but there will also be the data collection. The use of that data collection can actually influence not only one's individual behaviour, but also that of society. That is a significant economic resource for some of these companies.

It is one of the reasons I have tabled an update to my bill on the right to repair. The right to repair is a person's ability to have their vehicle fixed at an auto shop of their choice in the aftermarket. The OEMs, the original manufacturers, have at times resisted this. There have been examples. Tesla, for example, is not even part of what is called the voluntary agreement, but we still do not have an update with regard to the use of data and how one actually goes about the process of fixing the vehicle.

It also creates issues related to ownership of the vehicle, as well as insurance and liability. These could become highly complicated issues related to the use of data and the rules around it. If these types of things are not clear with regard to the process of rights for people, expectations by those who are using the data, and protection for people, then it could create a real, significant issue, not only for individuals but for our economy.

Therefore, dealing with this issue in the bill is paramount. A lot of this has come about by looking at what the GDPR, the general data protection regulation, did in European law. Europe was one of the first jurisdictions to bring forth this type of an issue, and it has provided an adequate level of protection, which is one of the things Europe stands by with regard to protection of privacy. There have been some on the side over here in North America who have pushed back against the GDPR, and even though this landmark legislation has created a path forward, there still is a need for transparency and to understand what the monetary penalties for abuse are going to be, which are also very important in terms of what we expect in the legislation.

Erosion of content rights is one of the things we are worried about in this bill. Under Bill C-27 individuals would have significantly diminished control over the collection, use and disclosure of their personal data, even less than in Bill C-11. The new consent provisions ask the public to install an exemplary amount of trust to businesses to keep them accountable, as the bill's exceptions to content allow organizations to conduct many types of activities without any knowledge of the individuals. The flexibility under Bill C-27 allows organizations to state the scope not only of legitimate interests but also of what is reasonable, necessary and socially beneficial, thus modelling their practices in a way that maximizes the value derived from the personal information.

What we have there is that the actors are setting some of the rules. That is one of the clearer things that we need through the discussion that would take place at committee, but also from the testimony that we will hear, because if we are letting those who use and manage the data make the decision about what consent is and how it is used, then it is going to create a system that could really lead to abuse.

There is also the issue or danger of de-identification. Witnesses, artificial intelligence and people being able to scrub much of their data when they want and how they want is one of the things we are concerned about. There is not enough acknowledgement of the risk that is available in this. That includes for young people. We believe this bill is a bit lopsided towards the business sector at the moment, and we want to propose amendments that would lead to better protection of individual rights and ensure informed consent as to what people want to do with their data and how they want it to be exercised as a benefit to them and their family, versus people being accidentally or wilfully brought into exposure they have not consented to.

As I wrap up, I just want to say that we have a number of different issues with this bill. Again, we believe there should be a separate vote for the second part of this bill, being the third piece of it. It is very ambitious legislation. It is as large as the budget bill. That should say enough with regard to the type of content we have. I thank the members who have debated this bill already. It is going to be interesting to get all perspectives. I look forward to the work that comes at committee. It will be one that requires extensive consultation with Canadians.

The House resumed from November 4 consideration that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Mandic, I'll go back to you.

We have Bill C-27 before Parliament. It's updating Canada's digital privacy protection. The bill is written to update our laws in the technology and business practices of Web2.

Due to this decentralized nature of Web3 in blockchain, will Bill C-27 be adequate to protect Canadians' digital privacy rights as Web3 becomes more mainstream over the coming years?

Business of the House

[Mark Holland, Liberal, Ajax, ON]

Mr. Speaker, we are not going to stop the supports we have for Canadians. In fact, I would suggest to the member opposite that making sure our most vulnerable are protected is critical. That is why we have a number of things we are going to be doing in that regard, which I will illuminate in a moment.

As to the other question that was put, I do seriously want to ask, if the Conservatives are opposed to action on the climate, whether they have reflected about what the costs are. These are not costs that will be borne for a year or two but for all time. It is something to reflect on regarding the questions that were posed to me.

I am pleased that this afternoon we are going to complete the second reading debate of Bill S-4, an act to amend the Criminal Code and the Identification of Criminals Act and to make related amendments to other acts. Tomorrow, we will go back to the second reading debate of Bill C-20, concerning the public complaints and review commission act. On Monday, we will resume second reading debate of Bill C-27, the digital charter implementation act, 2022. For Tuesday and Wednesday, we will call Bill C-29, an act to provide for the establishment of a national council for reconciliation, which was reported with amendments from committee earlier this week.

Mr. Speaker, I see you moving in your chair, so you will be happy to know that, finally, for next Thursday, our plan is to commence second reading debate of Bill C-26, the critical cyber systems protection act.

Division of Bill C-27 for the Purpose of Voting

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I am rising to respond to the point of order raised by the House leader of the NDP and the Conservative Party respecting the application of Standing Order 69.1 to Bill C-27, the digital charter implementation act, 2022.

I submit that the protection of privacy rights is a unifying theme that links all parts of Bill C-27. This bill is a key pillar in the government's implementation of a digital charter. The three parts of the bill work together to provide a comprehensive framework to build Canadians' confidence in how their personal information is being used, including with regard to the unique risks posed by artificial intelligence systems, and they need to be considered together given their complementary relationship.

Part 1 of the bill, the consumer privacy protection act, aims to modernize the privacy law that applies to commercial activities to assure Canadians that their personal information is being protected in the digital economy. Artificial intelligence represents one of the most significant sources of innovation and is a key emerging risk in the use of personal information.

We heard, in consultations around the former privacy reform bill, that Canadians are concerned about the use of their personal information by artificial intelligence systems and the potential for bias or harm that may result from the irresponsible use of these systems. Part 1 of Bill C-27 addresses Canadians' rights regarding the use of their personal information in the automated decision system, but there are limits to how privacy law can address concerns about the use of AI systems.

The government developed part 3 of the bill, the artificial intelligence and data act, to protect against the systemic impacts of artificial intelligence systems. It would regulate artificial intelligence systems that process personal information and other data about human activities to ensure that risks, such as bias based on race or gender, are addressed from the design stage all the way to deployment.

If Parliament considers part 1 and part 2 of the bill without taking into account the full impacts of artificial intelligence systems on Canadians, it will have an incomplete picture of the use of personal information in the digital economy and the steps needed to build the trust of Canadians.

This is the first time that the government is seeking to regulate artificial intelligence to govern the use of Canadians' personal information. I have no doubt that members will want to study this part of the bill in depth, and I welcome that. I wanted to give the House the government's perspective on why we think the three parts of the bill are interrelated to the protection of Canadians' personal information. I contend that all parts of the bill are interconnected and should be voted on as one item.

[Andrew Scheer, Conservative, Regina—Qu'Appelle, SK]

Mr. Speaker, I am rising to add to this morning's point of order raised by the NDP House leader concerning the application of Standing Order 69.1 to Bill C-27.

In general, we have reviewed the hon. member's submissions and concur with them. That said, there are a couple of additional citations I want to put before the Chair for your consideration. I will not repeat the arguments, because you already have them before you, Mr. Speaker, but we do agree that the measures proposed in part 3 of Bill C-27 are significantly different from and unrelated to parts 1 and 2 such that they warrant a separate vote at second reading.

As my NDP counterpart articulated, the purpose of parts 1 and 2 of the bill concern privacy protections, the powers of the Privacy Commissioner and the establishment of a new government tribunal. Part 3, meanwhile, would create a whole new law respecting artificial intelligence. The mechanisms under the minister and department's powers are completely unrelated to those in parts 1 and 2. That last point is significant in view of another aspect of the March 1, 2018, ruling of Mr. Speaker Regan, which my colleague cited. Allow me to quote your predecessor, Mr. Speaker. Mr. Regan said:

As each of the first two parts of the bill does indeed enact a new act, I can see why the hon. member for Berthier—Maskinongé would like to see each one voted separately. However, my reading of the bill is that the regimes set out in part 1, the impact assessment act, and part 2, the Canadian energy regulator act, are linked in significant ways, reflected in the number of cross-references. For example, the impact assessment act provides for a process for assessing the impact of certain projects, but contains specific provisions for projects with activities regulated under the Canadian energy regulator act. There are also obligations in the Canadian energy regulator act that are subject to provisions in the impact assessment act. Given the multiple references in each of these parts to the entities and processes established by the other part, I believe it is in keeping with the standing order that these two parts be voted together.

Deputy Speaker Bruce Stanton also encountered a similar situation in his June 18, 2018, ruling at page 21,196 of the Debates. Unlike the case that I quoted just now respecting the pipeline-killing former Bill C-69, Bill C-27 does not feature any significant or intertwining cross-references. In other words, Speaker Regan found that the two parts should be voted on together because of all the intertwining and cross-referencing in so many parts, and one part mentioning and referencing items in the first part.

This is not the situation we have today with part 3 of Bill C-27. In fact, part 3 of Bill C-27 does not explicitly cross-reference the personal information and data protection tribunal act, which part 2 would enact. Furthermore, there appears to be only one single, tiny, solitary cross-reference to the consumer privacy protection act, which part 1 would enact, and that is solely for the purpose of proposing a definition of personal information, which would be common to both of those laws. That is certainly not enough to warrant any kind of grouping when it comes to votes.

Part 3 is completely separate. It is its own independent section. There is not anywhere near the level of cross-referencing and intertwining that previous Speakers have ruled are justification for deciding not to have a separate vote. Therefore, it is clear in this situation that Bill C-27, should you, Mr. Speaker, agree with the arguments, should be dealt with in such a manner that there can be a separate vote on part 3.

Standing Order 69.1 is a relatively recent innovation. It has only been in the last number of years that Speakers have been given the authority by the House to separate aspects of bills for separate votes. I will read it:

(1) In the case where a government bill seeks to repeal, amend or enact more than one act, and where there is not a common element connecting the various provisions or where unrelated matters are linked, the Speaker shall have the power to divide the questions, for the purposes of voting, on the motion for second reading and reference to a committee and the motion for third reading and passage of the bill. The Speaker shall have the power to combine clauses of the bill thematically and to put the aforementioned questions on each of these groups of clauses separately, provided that there will be a single debate at each stage.

If we think about the context in which this standing order developed and was ultimately passed by the House, it was to allow members more flexibility and latitude to make their votes count on various aspects of the bill. It is important to think about why the House decided to adopt this measure. There had been, over the course of several Parliaments and across different governments at various times, more and more subject material being included in bills, and this was done at the time to give members the option of voting in favour of some aspects of a bill and oppose others and to clarify for their constituents and Canadians which parts of a bill they supported and which parts of a bill they opposed.

The reason I am talking about this context is I do not believe that at the time, the rationale and impetus for the inclusion of this measure in the Standing Orders was meant to be terribly restrictive. The whole point of the standing order was for it to be more permissive to allow greater latitude and flexibility. This is a relatively new innovation that has only been used a small number of times, and in parliamentary terms certainly a very small number of times, and I believe it would not be in keeping with the spirit and intent that was guiding members when we adopted it to start off, early on in its new use, with being very restrictive, because things around here tend to go in one direction and powers or flexibilities accorded the Chair over time often get more and more rigid as rules and precedents develop around them.

If the Speaker were to adopt a very restrictive interpretation of this standing order, I believe it would take away the point of this innovation, as it was proposed. I do not believe it would take a permissive interpretation of the standing order to agree with my hon. colleague from the NDP and the points that I raise here today. It is very clear that these parts are separate. Part 3 of Bill C-27 is completely independent, stands on its own and is not related, intertwined or cross-referenced in earlier parts of the act.

I only mention the point about restrictive interpretation as one further point to urge the Speaker to consider what the spirit, intent and purpose of this innovation was meant to do, which was to allow members to clearly differentiate which parts of legislation they support and which parts they do not. I would urge you, Mr. Speaker, to keep that in mind as you study the arguments that were put before you. I hope you will find in our favour and allow members to vote separately on part 3.

Division for Vote on Bill C‑27

[Peter Julian, NDP, New Westminster—Burnaby, BC]

Mr. Speaker, I rise today on a point of order regarding government Bill C-27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts.

Standing Order 69.1 states the following:

(1) In the case where a government bill seeks to repeal, amend or enact more than one act, and where there is not a common element connecting the various provisions or where unrelated matters are linked, the Speaker shall have the power to divide the questions, for the purposes of voting, on the motion for second reading and reference to a committee and the motion for third reading and passage of the bill. The Speaker shall have the power to combine clauses of the bill thematically and to put the aforementioned questions on each of these groups of clauses separately, provided that there will be a single debate at each stage.

You will find that, in the case of Bill C-27, the bill enacts three new laws and amends several other existing laws.

Bill C-27 enacts the consumer privacy protection act and the personal information and data protection tribunal act.

These two acts were at the core of the former Bill C-11 in the 43rd Parliament, a bill that was introduced in November 2020 and died on the Order Paper a year later, without ever having been voted on at second reading.

Here is the purpose of part 1 of Bill C-27, as described in the text of the bill:

The purpose of this Act is to establish — in an era in which data is constantly flowing across borders and geographical boundaries and significant economic activity relies on the analysis, circulation and exchange of personal information — rules to govern the protection of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.

Part 2 of the bill sets up the personal information and data protection tribunal, which would have jurisdiction with respect to appeals made under different sections of the consumer privacy protection act. The link between part 1 and part 2 of Bill C-27 is clear, and I am not putting it into question in this appeal at all.

Where we have an issue, however, is with the third part of the bill.

Bill C‑27 also enacts the artificial intelligence and data act, which was not part of Bill C‑11, the previous version of this bill.

The purpose of part 3 of Bill C‑27, which enacts the artificial intelligence and data act, is as follows:

The purposes of this Act are:

(a) to regulate international and interprovincial trade and commerce in artificial intelligence systems by establishing common requirements, applicable across Canada, for the design, development and use of those systems; and

(b) to prohibit certain conduct in relation to artificial intelligence systems that may result in serious harm to individuals or harm to their interests.

During his second reading speech on Bill C‑27, the Minister of Innovation, Science and Industry said that the new artificial intelligence act would “set a foundation for regulating the design, development, deployment and operations of AI systems”.

The development of artificial intelligence systems in the past decade has led to profound changes in the way we do things. Regulating AI systems is something we believe must be done. However, it seems odd to add these regulations to a bill that has to do with privacy protection and with the analysis, circulation and exchange of personal information. Artificial intelligence is its own beast in a way, and it should be studied and treated separately.

In a ruling by Speaker Regan on March 1, 2018, he said the following.

The principle or principles contained in a bill must not be confused with the field it concerns. To frame the concept of principle in that way would prevent the division of most bills, because they each apply to a specific field.

The House leader of the Bloc Québécois and member for La Prairie will remember this, since it is from page 400 of Parliamentary Procedure in Québec.

The Speaker continued as follows:

While their procedure for dividing bills is quite different from ours, the idea of distinguishing the principles of a bill from its field has stayed with me. While each bill is different and so too each case, I believe that Standing Order 69.1 can indeed be applied to a bill where all of the initiatives relate to a specific policy area, if those initiatives are sufficiently distinct to warrant a separate decision of the House.

We find ourselves in a similar situation here. While some of the measures in Bill C-27 relate to digital technology, part 1 and part 2 have nothing in common with part 3.

Therefore, it would certainly be appropriate to divide this bill for the vote. The Speaker has that authority, and that would make it possible for members to thoroughly study this legislative measure and better represent their constituents by voting separately on these bills, which are quite different from one another.

Business of the House

[Mark Holland, Liberal, Ajax, ON]

Mr. Speaker, I thank my hon. Bloc Québécois colleague, who is a very reasonable person. He is right, but when someone asks me a question, it is my job to answer. Every time I am asked the Thursday question, I try to answer as clearly and directly as possible.

Moving back to the calendar, as I know the hon. House leader for the opposition is keenly awaiting this information, this afternoon and tomorrow we will continue with the debate on Bill C-32, concerning the fall economic statement. Of course, we look forward to that hon. colleague's support for this.

Next week, we will be focusing on the second reading debate of Bill C-20, the public complaints and review commission act; Bill S-4, COVID-19 measures; and Bill C-27, the digital charter implementation act, 2022.

Digital Charter Implementation Act, 2022

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank the hon. member for his question.

I was speaking on Bill C-27 this morning. I am not an expert on the notwithstanding clause. Unfortunately, I will not be able to answer his question because I do not have the legal background to do so.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, I have spent a lot of time on the ethics committee with the member for Trois-Rivières, and we have dealt with a lot of this material. It has been fantastic.

He spoke about Quebec being a model for Canada, as Quebec has some of the strongest privacy laws in place at the moment. I am wondering if he could expand on two things. One, what does Quebec have that we could implement through Bill C-27 that works really well? Two, does Quebec mention privacy as a fundamental human right for Canadians?

[René Villemure, Bloc, Trois-Rivières, QC]

Mr. Speaker, I would like to begin by giving a shout out to my constituents in Trois-Rivières, whom I will be visiting all next week in my riding.

When I talk to people on the street, privacy is a topic that comes up a lot. They know that I sit on the Standing Committee on Access to Information, Privacy and Ethics, and privacy comes up often. People tell me that it is important, that we must do our best to rise to the challenge. Today, we have the opportunity to debate that very subject.

Society is a human construct. It is a reflection of how we organize our lives together. It reflects our vision of the world, the role of a citizen, the role of the state. In a democratic society where elected officials are chosen by the people to represent them, our laws must reflect our desires and the desires of our fellow citizens, as well as the way in which their visions can be realized. In other words, a society and its laws are eminently cultural constructs.

When we compare the legislation passed in the House of Commons with that of the Quebec National Assembly, the difference is striking. Ottawa tends to emphasize the enforcement mechanism, whereas in Quebec, the emphasis is on the legislator's intent. Ottawa wants to arbitrate, while Quebec wants to prescribe and guide.

When it comes to privacy, this is especially true in the digital age: the difference is dramatic.

At one end of the spectrum, so to speak, is the United States. In the United States, laws are primarily intended to arbitrate disputes rather than to shape how the digital economy operates. Laws are based on the good faith of the players and on voluntary codes. As one might imagine, this has its limits. Ultimately, if someone is wronged, they can get redress through the common law.

At the other end of the spectrum is the European Union. The legislation there prescribes clear obligations. I am referring to the General Data Protection Regulation, better known by the acronym GDPR.

In between is Canada, a hybrid creature whose intentions on privacy oscillate between the European and American extremes. This may seem like an academic debate, but there are practical implications that bring us to Bill C-27.

When it comes to privacy, European law is the most prescriptive in the world. It is based on a clear principle, namely that our personal information belongs to us and us alone, and no one can use it or benefit from it without our free, informed and explicit consent.

Once the government set out that principle or objective, it then provided a mechanism for achieving it. That mechanism is the GDPR. The GDPR is becoming the standard to follow when it comes to privacy, because it is the legal standard with the clearest objectives and the most binding application. Simply put, the GDPR does a good job of protecting privacy. That is one reason why it is the standard we should be emulating; the other is that the EU is projecting its standard-making power beyond its borders.

In order to protect the personal information of European citizens, the European Union will soon prohibit European businesses from sharing this information with foreign businesses that do not offer comparable protection. This does not affect us yet, but next year, the EU will be reviewing Canada's laws to see if they offer sufficient protection.

The existing legislation on personal electronic information protection dates back to 2000. That was 22 years ago. We were in the dinosaur era, the pre-digital era, an era we barely remember now. Also, it is far from clear whether Canada passes the comparable protection test required under the GDPR.

Information exchanges between Canadian businesses and their European partners could become more complicated. This is particularly true in areas that deal with more sensitive information, such as the financial sector. It is therefore absolutely necessary to redraft the Personal Information Protection and Electronic Documents Act, which is completely outdated. It has not kept pace with technological change and the data economy, where we are both the consumer and the product. It has not kept pace with the legal environment, where Canada is a dinosaur compared to Europe, as I was just saying.

Nevertheless, my colleagues will have figured out that the Bloc Québécois is in favour of the principle of Bill C‑27. Nevertheless, I would like to make a general comment about Bill C‑27. For some reason, the government has put into one bill two laws with completely different objectives. The bill would enact the consumer privacy protection act and also the artificial intelligence and data act. Although there is a logical link between these two acts, they could be stand-alone bills. Their objectives are different, their logic is different and they could be studied separately.

I have a suggestion for the government. It should split Bill C‑27 into two bills. We could create what I would call the traditional Bill C‑27, which would deal with personal information and the tribunal. Then, what I would call Bill C‑27 B would address artificial intelligence. As I was saying, there are logical reasons for that, but there are also practical reasons. Let me be frank and say that the artificial intelligence act being proposed is more of a draft than a law. The government has a clear idea about the mechanism for applying it, but, clearly, it has not yet wrapped its head around the objectives to be achieved and the requirements to be codified.

The mechanism is there, the bureaucratic framework is there, but the requirements to be complied with are not. Apart from a few generalities, the law relies essentially on self-regulation and the good faith of the industry. I have often faced these situations, and I can say that the industry's good faith is not the first thing I would count on.

Apart from a few generalities, this relies on good faith, but that is not a good way to protect rights. I am not convinced that this bill should be passed as written; I think it needs to be amended. Bill C‑27 probably deserves the same fate that Bill C‑11, its predecessor, encountered in the last Parliament. The government introduced it, debate got under way, criticism was fierce, and the government let it die on the Order Paper so it could keep working on it and come back with a better version. I think that is exactly what should happen to the artificial intelligence act.

The government has launched a healthy discussion, but this is not a finished product. If we decide that the government needs to keep working on it and come back with a new version, we will also be delaying the modernization of privacy and personal information legislation. Given the European legislation, which I talked about earlier, that is not what the government wants to do. That is why I would cordially advise the government to split Bill C‑27.

I am going to focus primarily on personal information protection because that is the part of Bill C‑27 that is ready to go and has the most practical applications. As I said before, Bill C‑27 is an improved version of Bill C‑11, which was introduced in the fall of 2020.

However, Bill C-27 still does not establish privacy as a fundamental right. Bill C-11 was strong on mechanics, but weak on protection. The principles were also weak and consent was unclear. It was tough on large corporations and much less so on small businesses. When it comes to privacy, however, it is the sensitivity of the data that should dictate the level of protection, not the size of the company.

A new start-up that develops an app that aggregates all of our banking data, for example, may have only two employees, but it still possesses and handles extraordinarily sensitive information that must be protected as much as possible. I cannot help but think of the ArriveCAN app, which was developed by just a few people but has a large impact on the data that is stored.

Finally, Bill C-11 did not provide for any harmonization with provincial legislation, such as Quebec's privacy legislation. The Bloc Québécois was quite insistent on that. A Quebec company subject to Quebec law would also have been subject to federal law as soon as the data left Quebec. It would have been subject to two laws that do not say the same thing and have two different rationales. This would mean duplication and uncertainty. It was quite a mess. Passing Bill C-11 would have diminished, in Quebec at least, the legal clarity that is needed to ensure that personal information is protected.

Here is what Daniel Therrien, the then privacy commissioner, told the Standing Committee on Access to Information, Privacy and Ethics, of which I am honoured to be a member. He said, and I quote, “I believe that C-11 represents a step back overall from our current law and needs significant changes if confidence in the digital economy is to be restored.”

He proposed a series of amendments that would make major changes to the bill. I want to commend the government here. It listened to the criticism. It is rare for this government to listen, but it did so in this case. It buried Bill C-11. We never debated it again in the House and it died on the Order Paper. It reappeared only after being improved.

Bill C-27 shows more respect for the various jurisdictions and avoids the legal mess I was talking about earlier.

Our personal information is private and it belongs to us. However, property and civil rights fall exclusively under provincial jurisdiction under subsection 92(13) of the Constitution of 1867.

What is more, privacy basically falls under provincial jurisdiction. That is particularly important in the case of Quebec, where our civil law tradition leads us to pass laws that are much more prescriptive.

Last spring, Quebec's National Assembly passed Bill 25, an in-depth reform of Quebec's privacy legislation. Our law, largely inspired by European laws, given that we share a legal tradition, is the most advanced in North America. As we speak, it is clear that Quebec has exceeded the European requirements and that our companies are protected from any hiccups in data circulation.

Our principles are clear: Our personal information belongs to us. It does not belong to the party who collected it or the party who stores it. The implication is clear. No one can dispose of, use, disclose or resell our personal information without our free, informed and express consent. Bill C-11 challenged this legal clarity but Bill C-27, at the very least, corrects that.

Under clause 122(2) of Bill C‑27, the government may, by order, “if satisfied that legislation of a province that is substantially similar to this Act applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of this Act in respect of the collection, use or disclosure of personal information that occurs within that province;”.

In other words, if Quebec's legislation is superior, then Quebec's legislation will apply in Quebec.

When I met with the minister's office earlier this week, I asked for some clarification just in case. Will a Quebec business be fully exempt from Bill C‑27, even if the information leaves Quebec? The answer is yes. Will it be exempt for all of its activities? The answer is yes.

There is still some grey area, though. I am thinking about businesses outside Quebec that collect personal information in Quebec. In Europe, it is clear. It is the citizen's place of residence that determines the applicable legislation. The same is true under Quebec's legislation.

It is not as clear in Bill C‑27. Since the bill relies on the general regulation powers for trade and commerce as granted by the Constitution, it focuses more on overseeing the industry than on protecting citizens. That is the sort of thing we will have to examine and fix in committee. I look forward to Bill C‑27 being studied in committee so we can debate the substance of the bill.

I have to say that I sense the openness and good faith of the government. In that regard, I would like to tell the member for Kingston and the Islands to take note that, for once, I feel he is working in good faith.

Bill C‑27 will have a much greater impact outside Quebec than within it, because it is better drafted than Bill C-11. That is not the only aspect that was improved. The fundamental principles of the bill are clearer. Consent is more clearly stated. The more sensitive data must be handled in a more rigorous manner, no matter the size of the entity holding them. That is also more clear.

If the principles are clear, the act will better stand the test of time and adjust to the evolving technologies without becoming meaningless.

We will support it at second reading after a serious debate, but without unnecessary delays. However, we believe and insist that the real work must be done in committee. Bill C-27 is complex. Good principles do not necessarily make good laws. Before we can judge whether Bill C-27 is indeed a good law, we will need to hear from witnesses from all walks of life.

When it comes to privacy, it only takes one tiny flaw to bring down the whole structure. This requires attention to detail and surgical precision. The stakes are high and involve the most intimate part of our lives: our privacy.

For a long time, all we had to do to maintain our privacy was buy curtains. That is how it used to be. It kept us safe from swindlers. Then organizations started collecting data for their records. Bankers collected financial information, the government collected tax information and doctors collected medical records. This sensitive information had to be protected, but it was fairly simple, since it was written on paper.

Today, we live in a different world. Whereas personal information used to be a prerequisite for another activity, such as caring for a patient or getting a loan from a bank, it has become the core business of many companies. Information has become the core business of many companies, which are also large companies.

Computerization enables the storage and processing of astronomical volumes of data, also known as big data. Networking that data on the Internet increases the amount of available data exponentially and circulates it around the globe constantly, sometimes in perpetuity, unfortunately.

For many corporations, including web giants, personal data is crucial to the business model. Citizen-consumers are now the product they are marketing. To quote Daniel Therrien once again, we are now in the era of surveillance capitalism. Speaking of which, The Great Hack on Netflix is worth seeing. This is troubling.

Furthermore, for our youngest citizens, the virtual world and the real world have merged. Their lives are an open book on Instagram, Facebook and TikTok. They think they are communicating with the people who matter to them, but they are in fact feeding the databases that transform them into a marketable, marketed product. We absolutely have to protect them. We need to give them back control over their personal information, which is why it is so important to amend and modernize our laws.

I would like to close my speech with an appeal to the government. Bill C‑27 does a lot, but there are also many things it does not do, or does not do properly. Consent is all well and good, but what happens when our data is compromised, when it has been stolen, when it is in the hands of criminals? These people operate outside the law and therefore are not governed by the law. All the consent-related protocols we can think of go out the window. To avoid fraud and identity theft, we will have to clarify the measures to be taken to ensure that anyone requesting a transaction is who they say they are. This really is a new dynamic. In that respect, we are somewhat in the dark, even though, curiously, this is a growing problem.

There is another gap to fill. Bill C‑27 provides a framework for the handling of personal information in the private sector, but not in the public sector. The government is still governed by the same old legislation, which dates back to the pre-digital era. The legislation is outdated, as we saw with the fraud related to the Canada emergency response benefit. The controls are also outdated. I therefore call on the government to get to work and to do so quickly. We will collaborate.

Finally, there is another thing the government needs to work on and fast. We addressed this issue in committee when we were looking at the geolocation of data. Bill C‑27 indicates what we need to do with personal data, nominative data. However, with artificial intelligence and cross-tabulation of data, it is possible to recreate an individual based on anonymous information. As no personal information was collected at the outset, Bill C‑27 is ineffective in these cases. However, we started by recreating the profile of a person with all their personal information. It is not science fiction. It is already happening. Nevertheless, this is missing from Bill C‑27, both in the part on information and the part on artificial intelligence.

I am not bringing this up as a way of opposing Bill C‑27. As I said, we will support it. However, we have to be aware of the fact that it is incomplete. As legislators, we still have some work to do. The time has come to treat privacy as a fundamental right.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, I want to thank the member for bringing the subject back to the matter at hand.

I have heard of this and read about it, and it is concerning to look at it.

There are two parts we are looking at for privacy. Number one is Bill C-27, which would protect Canadians' privacy rights when it comes to business. The second side is the Privacy Act. We have not looked at that, and that needs to come back to Parliament as well. The Privacy Act pertains to everything the government holds and controls, and how much information the government gets to keep on Canadians as well. Those two are very important, and to the member's point, certainly political parties are as well.

I think we all have to be responsible with private data. We all have the right as good citizens to collect it when it is going to be good, but not when it is bad. The point I brought up before is that using personal information for political gain to identify where people live because we do not like what they donated to is absolutely irresponsible, and I hope the member agrees with that as well.

[Mike Morrice, Green, Kitchener Centre, ON]

Mr. Speaker, I want to start by recognizing that tensions are high today with respect to workers' rights. I appreciate that colleagues of mine have brought up the importance of being mindful that a province has invoked the notwithstanding clause to trample on workers' rights and that the federal government has the power of disallowance in the Constitution to override that.

I understand the member for Bay of Quinte does not want to speak about that, so I would like to ask a question related to Bill C-27 with respect to political parties not being required to protect consumers' private data and this gap not being addressed in the current version of Bill C-27. I would like to know if the member for Bay of Quinte is as concerned about this as he is about a number of other items in Bill C-27, and if so, if he would like to speak about that.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, once again, I am disappointed. I guess the Liberals and NDP do not really care about privacy rights for children, which we are talking about today. This is fundamental to the bill.

The minister did a lot of hard work putting this bill together and there have been a lot of consultations. This is the second iteration. Bill C-11 died only because there was an election called. Now we have Bill C-27, which is very serious. It talks about the rights of our children and Canadians that have been trampled on. I gave a lot of different examples where we just have not gotten it right in protecting children.

I am surprised that the NDP also does not seem to think that privacy is a fundamental right and something that we should protect. The Conservatives will certainly protect it. We are the only ones speaking about it today.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, 34 years ago, the Supreme Court said that “privacy is at the heart of liberty in a modern state”. In the words of Justice Gérard La Forest of the Supreme Court of Canada in 1988, it is worthy of an individual and “it is worthy of constitutional protection”. All Canadians are worthy of having their privacy respected.

It is our duty as parliamentarians to do our best to protect Canadians' privacy rights, especially as we struggle so much for it today.

Bill C-27, formerly Bill C-11, is designed to update Canada’s federal private sector privacy law, the Personal Information Protection and Electronics Documents Act, or PIPEDA, to create a new tribunal and to propose new rules for artificial intelligence systems. It is a reworking of Bill C-11, and it has three components: the consumer privacy protection act; the personal information and data protection tribunal act, creating a new tribunal; and the artificial intelligence and data act.

The bill applies to Canadians' private rights. It does not apply to CSIS, RCMP or CSE. That and other government-held data is governed by the Privacy Act. Privacy laws for Canadians have not been updated in 22 years, and Europe updated the General Data Protection Regulation in 2016.

When we last updated this act, 22 years ago, the member for South Shore—St. Margarets was turning 21 years old, and society was going through big changes. The world had just gotten past the Y2K scare. We were looking at what was going to happen to computers when the clock changed from 1999 to 2000. In certain areas, we did not know if the power would go out or what would happen.

People listened to music on CD Walkmans. Apple was over a year away from launching a cutting-edge new technology called the iPod. Less than 30% of Canadians actually owned a cellphone. The most popular cellphones were the Motorola Razr, which was a flip phone, and the Nokia brick phone, with texting that used the number pad and almost no web browsing capabilities. The most sophisticated app was called Snake. A fledgling Canadian telecommunications company was just starting, and it was called BlackBerry.

That is how long it has been since we updated our laws. Today, 22 years later, data collection is getting more sophisticated, and surveillance is more of the norm than the exception.

Apple Watch announced a few weeks ago that it can track and tell when a woman is ovulating. What is concerning, and we are going to talk a lot about data for good and data for wrong, is that this technology can tell if a woman skips a cycle, and then can identify if there has been a miscarriage or an abortion. This is very concerning.

Our Fitbits, our web history and our Apple phones can tell us how many steps we did in a day. Sometimes when we are in Parliament it is about 10, and if we are door knocking it is about 25,000. That does not sound important, but that information is also letting those regulators know where we have been, where we are going and where we live.

Facial recognition technology can identify a face like a fingerprint. Sometimes that is good. We have heard from law enforcement that it can be used for human trafficking. Sometimes that is wrong, when people are identified in a street and when people are identified with their names, their data and where they have been. Let us think of Minority Report, where everywhere someone goes, they are identified. It did not matter where they where going or where they had been. That is something that could happen with facial recognition technology.

Google and Amazon listen and collect our data in our bathrooms, living rooms, kitchens and cars. How many times have we been in conversations and Siri asks, “What was that?” Siri is always listening. Amazon is always listening. Speaking of cars, they are cellphones on wheels. When we connect to a rental car, and a lot of us rent cars, we see five or six other phones in the history. That car has downloaded all the data from our phone into that car. A lot of times, if we see that in the rental car, that car holds our information. It is very concerning.

There are many examples where it has hurt Canadians in the last several years. Two summers ago, Tim Hortons had a data breach, where every time someone rolled up the rim, it told Tim Hortons where they went afterwards, if they went home or where they were staying. It collected all that data, and it was a big problem.

In the ethics committee, we studied facial recognition technology. There was a company called Clearview AI, which took two billion images off the Internet, including a lot of ours, and just gave them to the police. There was no consent. The information just went and ended up in the hands of law enforcement.

There is Telus's “data for good”. During the pandemic, Telus collected our data. It knew where we went and if we went to the grocery store or the pharmacy, or if we stayed home. It just gave that to the government. It was called “data for good”. They called it de-identification. I am going to talk about how that hurt everyone later.

Lastly is doxing or using personal information to try to out people. GiveSendGo is a big one. It gave a U.S. company the information of people who donated to different causes or events. At one point, Google identified all those donors on a website showing exactly where they lived. Everyone's information, when they donated to a company, was identified and outed. That was terrible.

Surveillance has not just resulted in a wholesale destruction of privacy but a mental health crisis in children and youth as well. I am glad to hear the minister speak about children and youth because data has certainly affected them and continues to.

Canada’s federal government has repeatedly failed to take privacy seriously and construct a legal framework that protects the rights of Canadians in the digital age. This bill normalizes surveillance and treats privacy not as a fundamental human right and not even as a right to consumer protection. To make this point very clear, nowhere in the document for Bill C-27 does it state that privacy is a fundamental human right. However, this should be the crux of new legislation to update privacy laws, if not the outward premise, with the statement hammered from the preface until the end of Bill C-27 and following through the entire document. However, it is not there. It is nowhere and, therefore, holds no value.

This bill does not use that statement from the onset. It should be the pillar by which the bill is designed and led. Only a strong bill will ensure that Canadians' privacy rights are protected. Because of its omission, the bill is very weak, making it easier for industry players to be irresponsible with people's personal data. This is ironic as Canada has signed on to the UN Declaration of Human Rights and the International Covenant on Civil and Political Rights. That is where the bill starts and ends, with its failure to properly address privacy for Canadians.

Conservatives believe that Canadians’ digital privacy and data need to be properly protected. This protection must be a balance that ensures Canadians’ digital data is safe and that their information is properly protected and used only with their consent, while not being too onerous to be detrimental to private sector business. It is a balance.

Let us be clear. We need new privacy laws. In fact, it is essential to Canadians in this new digital era and to a growing digital future, but Bill C-27 needs massive rewrites and amendments to properly protect privacy, which should be a fundamental right of Canadians. The bill needs to be a balance between the fundamental right to privacy and privacy protection and the ability of business to responsibly collect and use data.

It also needs more nuance, but parts of this bill are far too vague. The definition of tyranny is the deliberate removal of nuance, so to create more equality or fairness on those privacy rights and to ensure businesses and AI use data for good, we need more nuance with more detail and more explanation, not less. There was a saying I used to love that my grandfather would say: “If you're going to do something, make sure you do it right or don't do it at all.”

Besides the omission of privacy rights as a fundamental right, the bill needs a massive rewrite. First, the bill doubles down on a flawed approach to privacy using a notice and consent model as its legal framework. The legal framework of Bill C-27 remains designed around a requirement that consent be obtained for the collection, use and disclosure of personal information, unless one of the listed exceptions to consent applies. Those exceptions are called “legitimate interest”.

What is scary about legitimate interest is that the businesses themselves will determine what legitimate interest means and what will be exempt. A quote on this from Canada’s leading privacy and data-governing expert, Teresa Scassa, says that this provision alone in the bill “trivializes the human and social value of privacy.” The legitimate interest provision allows Facebook, for instance, to build shadow profiles of individuals from information gathered from their contacts, even those with no Facebook access or accounts, without asking for their permission.

Have colleagues ever seen the “people you may know” feature on Facebook? Sometimes people turn up there, although one might not know where they had ever met and even though neither party is actually on Facebook. That is because Facebook builds profiles and shadow profiles from other members' contacts. Facebook has a feature that will suggest that one share their contacts: It will be great. People will give all their friends' information to Facebook: their emails, addresses and sometimes their private phone numbers. The U.S. found that information was turning up in Facebook. Here are a couple of examples. An attorney had a man recommended as a friend he might know who was a defence counsel on one of his cases, when they had only communicated though a work email. Another time, a man who donated sperm to a couple, secretly, had Facebook recommend their child as a person he should know, despite not having the couple, whom he once knew, on Facebook.

Legitimate interests needs more nuance. It needs to be more defined, or it is useless. Legitimate interests allow for too much interpretation. In other words, it allows something to be something unless it is not. It is far too broad.

Additionally, consent is listed as having to be “in plain language that an individual to whom the organization’s activities are directed would reasonably be expected to understand.” Bill C-27 makes it hard to determine what legitimate interests are, and that goes back to privacy as a Human Rights Commission complaint.

If we compare this section to the European Union's privacy law, the GDPR, which is, as the minister stated, the gold standard, the legitimate interest exemption is available unless there is an adverse effect on the individual that is not outweighed by the organization's legitimate interest, as opposed to the interest or fundamental freedom to the individual under the GDPR. If adverse effects on the individual can be data breaches, which are shocking and distressing to those impacted, and some courts have found that the ordinary stress and inconvenience of a data breach is not a compensable harm since it has been a routine part of life, probably for the last two years at least, then the legitimate interest exemption will be far too broad.

However, Bill C-27 would take something that was meant to be quite exceptional for consent in the European Union's privacy laws and make it a potentially more mainstream basis for the use of data without acknowledging consent. Why would it do this? It is because Bill C-27 places privacy on par with commercial interests in using personal data, something that would not happen if privacy was noted in the bill as a fundamental right for Canadians.

Additionally, we need to be wary of consent. As a mandatory, consent should be made easier. Has anyone ever looked at their iPhone when agreeing to consent and scrolled down? Has anyone actually read all that? Has anyone read Google's 38 pages of consent every time they sign up or use Google?

Consent is not easy. It is not simple, and certainly this proposed law would not make it any simpler. We need to be wary of consent, and we need to ensure that consent is consensual, both in language and intent, and that we all know exactly what we are signing up to do, to give and to receive.

There is another term I want to explain as well called “de-identification”. The bill talks a lot about de-identification, and its definition is that it “means to modify personal information so that an individual cannot be directly identified from it,” and then goes on to say “a risk of the individual being identified remains.” Therefore, an individual would lose all their information, but a risk of identifying an individual would remain.

Members will remember my Telus data for good example. Telus gave this information to the government during COVID, even though a risk of the individual being identified remained. It should be scrapped, and instead we should be using the word “anonymize”, which is also in the bill. This is what the GDPR does. In the bill, it “means to irreversibly and permanently modify personal information, in accordance with generally accepted best practices, to ensure that no individual can be identified from the information, whether directly or indirectly, by any means.”

I would ask members which one they would prefer. Would they like to be re-identified, as there is a possibility, or would they like no identification by any means?

Another major flaw in Bill C-27 is the creation of a bureaucratic tribunal instead of giving the Privacy Commissioner more bite. The creation of a tribunal is a time-waster, and the Privacy Commissioner should be allowed to levy fines. The Privacy Commissioner should be given more power and more bite. This is unclear because the EU, the U.K., New Zealand and Australia do not have tribunals that mediate their fines for privacy violations. Furthermore, it would no doubt cause those who have had their privacy violated to have to wait for years for the right of action.

I will put this straight. First we would have the Office of the Privacy Commissioner, or OPC, make a ruling. Then the government said that it would have a tribunal, which could then reverse the ruling of the Privacy Commissioner, and then we would have the Supreme Court, which would be allowed to rule on the tribunal's ruling. We would have a decision, another decision and a third decision, and each one of them could be countered.

Let me guess how long it would take. What do members think it would take? Would it take 48 hours or six months? Right now, the average is one year for the Privacy Commissioner, and we could add another year for the tribunal plus another year for appeals.

I ask this: Is it fair to have the average Canadian who has had their data breached, with their limited resources, have to go up against Facebook and Amazon and then spend three years in court? Does this protect fundamental privacy rights? Is this not just adding another layer of government that we certainly do not need?

The absence of rights-based language in the bill might tip the scale away from people in Canada, and the OPC and the tribunal weigh the privacy interest of people against the commercial interests of companies. Again, what does this come back to? Privacy was not listed as a fundamental right of Canadians.

Lastly, the AI portion of this bill is a complete rewrite. It needs to be split into its own bill.

I want to commend the minister for bringing this forward. He wants to be the first one in the land to bring this part of the bill forward, but to be honest, consultations only started in June. We have met with many individuals who certainly have not had any input into this deal, and although AI is there, there are many parts missing.

First of all, its findings conclude that there will be no independent and expert regulator for automated decision systems, nor does it have a shell of a framework for responsive artificial intelligence regulation and oversight. Instead, it says that the regulations will be determined at some future date and decisions will come from the Minister of Innovation, Science and Economic Development or a designated official.

Again, part of this includes a new tribunal and puts decisions where they should not be, onto the government, with enforcement and decision-making by the minister or the minister's designated ISED official. This would be political decisions on privacy. Does everyone feel comfortable that we are now shifting from a tribunal to the government?

This part of the bill will shift all of that to the government, to the minister or his designate. It reminds me of the proclamation, “I'm from the government, and I'm here to help.”

There is no mention of facial recognition technology, also, in this part of the bill, despite reports that have come from the ethics committee, the examples I gave from before on FRT. Certainly, that is worth more study.

There are some parts of the bill that have good aspects and certainly ones we can get behind, including the protection of children's privacy. As a father, I know it is so very important. Our children now have access to all kinds of different applications on their phones, iPads and Amazon Fires.

Our children are being listened to and they are being surveilled. There is no question that businesses are taking advantage of those children and that is something that we definitely need to talk about.

The attempt to regulate AI, though, as I have stated, needs major revisions. Without a proper privacy statement, it does not have a balanced purpose statement establishing that the purpose of the CPPA is to establish rules for governing the protection of personal information in a manner that balances the right to privacy and the need for organizations to collect, use or disclose personal information.

We should be shooting beyond the European Union's privacy act, shooting to be the world leader in the balance of ensuring privacy protection and that businesses and industries use data for good. In doing so, they would attract investment and technology, all the while protecting Canadians' fundamental right to privacy.

Canada needs privacy protection that builds trust in the digital economy, where Canadians can use new technologies for good while protecting them from the bad, profiling, surveillance and discrimination. The minister said that he wants to seize the moment, that we need leadership in a constantly changing world. Most importantly, the minister said that trust has never been more important.

If we do not get this right, and if we do not make sure that privacy is a fundamental human right, and declare that in the document and build the document around that right, we are doing two things: We are not prioritizing Canadians' privacy, as we are certainly not putting privacy at the forefront of the bill, and we are certainly not showing leadership in an ever-changing world.

As I noted at the onset, the technologies of 22 years ago have changed so significantly. The technologies now are changing more significantly. In the next 22 years, we are going to have technologies that are more embedded, not less, in our lives. We will have AI that do good.

One of the stakeholders that we met with actually talked about AI for good. They talked about embedding AI into the government's system of passports. That might actually mean that we could get passports within 48 hours. Could we imagine that? Could we imagine imbedding technology for good into a system that would allow Canadians to get the things that they need more often?

We love technology. We want to embrace it. We just want to make sure that, number one, privacy is protected. We want to make sure that we do the hard work of building frameworks alongside Canadians' fundamental human right to privacy and being protected in equal balance with the economy, democracy and the rule of law. This bill does not do that, not yet.

Let us work to make sure we come back with a bill that does that.

[Mike Morrice, Green, Kitchener Centre, ON]

Mr. Speaker, as it stands today, federal political parties do not have to follow the same privacy laws that apply to others across the country.

I wonder if the minister could speak to why this is not addressed in Bill C-27 and if he would be open to addressing this in the future.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, it is a pleasure to see you in the big chair.

The answer to my hon. colleague's question is absolutely.

There are parents listening to us at home today. The greatest gift we could give children is to refer Bill C-27 to a committee so that the questions my colleague raised can be properly studied. What she said in her introduction is correct. There are three simple things behind Bill C‑27. First, we want to give individuals more control and power over their online information. Next, as a parent, I feel it is fundamental that there be better protection for our children in the digital age. Finally, it will regulate artificial intelligence so that it is used responsibly and serves the public.

I believe it is time to bring our 20-year-old legislation into the 21st century. That is a good thing, and it is what Canadians want. It may reassure my colleague to know that during the study of Bill C‑11, we listened to many experts and collected comments to ensure not only that we have a good law, but that we are among the best in the world and that we set an example on the international stage.

I am pleased to hear that, like me, my colleague thinks that the best gift we can give our young people before Christmas is to send Bill C‑27 to committee to get it passed as quickly as possible.

[Sylvie Bérubé, Bloc, Abitibi—Baie-James—Nunavik—Eeyou, QC]

Mr. Speaker, I thank my colleague for his speech.

We know that, in many ways, Bill C‑27 seeks to protect individuals' anonymity. With digital services omnipresent in our lives, we know that transactions and information exchanges are happening faster and faster. Bill C‑27 was designed to give back the personal dignity that organizations have violated for far too long.

Can the minister tell me if Bill C‑27 will go to committee so we can hear from experts who can identify the flaws in this bill?

The House resumed consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

Digital Charter Implementation Act, 2022.

[François-Philippe Champagne, Liberal, Minister of Innovation]

moved that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts be read the second time and referred to a committee.

Madam Speaker, I thank my colleagues on the other side of the House for their enthusiasm this morning. I am extremely proud to speak today to Bill C-27, a bill to implement Canada's digital charter 2022. This bill will help us better protect our children in the digital age.

I am also proud because our government continues to show leadership in an ever-changing world. In 2019, we launched Canada's Digital Charter, a set of 10 core principles intended to build trust in a digital world.

Today, we are putting those principles into action by proposing ambitious and comprehensive reforms for Canada's privacy framework, including stronger protections for children.

More importantly, Bill C‑27 recognizes that protecting personal information is not enough. Canadians also deserve to know that they can trust the innovative technologies that shape our economy and our society. With this bill, we will be one of the first countries in the world to create a framework for the responsible use of artificial intelligence.

For Canadians to further prosper from the digital economy, we need to ensure they have confidence and trust in the digital platforms, confidence that our advantage in cutting-edge technology does not come at the price of privacy and safety, confidence that their personal information is protected and confidence that we are taking the extra steps to protect our children.

Children interact with the digital world just like adults do, but our government believes that their privacy deserves special protections. Just as Canadians need to have confidence that new technologies are being developed and deployed responsibly, businesses need clear rules so that they can effectively deliver the products and services Canadians want and need. In today's digital economy, trust has never been more important.

As my hon. colleagues know, Canada is a nation that depends on foreign trade. We live in a world where data are constantly going back and forth across geographical boundaries. Economic activity is increasingly reliant on the analysis and exchange of personal information and data. It also relies on the development of technology, such as artificial intelligence, that can be deployed anywhere in the world.

Although these technologies can improve our quality of life and make our societies and economies smarter and greener, we recognize that Canadians deserve to have their private information properly protected. We recognize that a responsible approach to artificial intelligence is crucial to building a more prosperous Canada.

What is in the digital charter implementation act of 2022? Let me turn to some of the specifics.

The bill introduces three new key pieces of legislation. The first is the consumer privacy protection act. It would replace part 1 of the existing Personal Information Protection and Electronic Documents Act, or what we otherwise know in Canada as PIPEDA. The second is the personal information and data protection tribunal act, which would establish the personal information and data protection tribunal as a key part of Canada's privacy enforcement regime. Third, this bill would introduce the artificial intelligence and data act, a new law that would set a foundation for regulating the design, development, deployment and operations of AI systems. It would also criminalize intentional acts that cause serious harm to individuals.

Our previous privacy legislation, PIPEDA, has served us well. For more than 20 years, businesses have relied on its principles to guide their use of personal information, even as technologies have changed dramatically. Canadians have been secure in the knowledge that their information has been protected. However, we know there is significant room for improvement.

The world now is a very different place than it was 20 years ago. Twenty years ago, iPhones did not exist, and neither did Facebook, TikTok and other social media. Those in this room who are old enough will recognize what I am saying this morning. It is therefore urgent that we update our laws to be in sync with the times.

The amount of data that Canadians create and share every day has grown exponentially. Given that reality, our legislation must adapt to the latest technologies and business practices.

Canadians have told us time and time again that we need more powers to enforce the law, as well as tougher penalties for those who commit the most serious offences. That is exactly what the consumer privacy protection act would do.

The legislation would strengthen privacy protection for Canadians by giving the Privacy Commissioner of Canada significantly more powers, better protecting the data of Canadians, especially minors, and creating a clear set of rules to encourage Canadian organizations to innovate while using data responsibly. Together with the personal information and data protection tribunal act, it would introduce a new enforcement regime to hold organizations accountable for how they handle personal information.

Specifically, it would increase control and transparency when Canadians' personal information is handled by companies. It would give Canadians the freedom to delete their data, as well as move their information from one organization to another in a secure manner. It would provide the Privacy Commissioner with broad powers, including the ability to order a company to stop collecting data or using personal information. It would also establish significant financial consequences for non-compliant organizations, among some of the toughest penalties in the G7.

We heard from many stakeholders on the importance of privacy reform and got specific feedback for the effort we put forward as a government in the last Parliament, including from the Privacy Commissioner. We listened, and our bill is better for it, balancing strong privacy protections with responsible innovation. This bill reflects and builds on the strengths of prior work, but also ensures that we are responding to new realities, as Canadians would expect from the House.

For example, the Privacy Commissioner asked for greater discretion and power to ensure that his office would have the ability to prioritize the most important issues. We agreed. At the same time, we recognized that the needs of smaller organizations for timely guidance and advice are real. For this reason, the CPPA would enable the Privacy Commissioner to prioritize organizations with the greatest needs when it comes to providing them with advice, while also supporting our small and medium-sized businesses so they can comply with this important legislation.

We heard from organizations that said they needed flexibility about data use in order to be innovative and competitive, arguing that the new exceptions to consent proposed in a previous bill were either too narrow or too broad and were potentially susceptible to abuse. For this reason, the proposed new privacy law includes a new limiting exception to consent for activities in which an organization has a legitimate interest. This new limited exception would include a strong backstop to ensure that organizations act responsibly.

Let me be clear. This would be a strongly enforced mechanism to allow for innovation within particular parameters. It is an approach similar to what is found in privacy laws in both the EU and Singapore, which are considered best in class.

We also heard from many stakeholders, including esteemed colleagues here in the House, who urged us to go further when it came to the protection of children. They were right, and this is the section that I am most proud of in the bill. It is why the new privacy protection act would hold organizations to a higher standard when it comes to protecting the personal information of minors.

Specifically, it would define their information as sensitive, requiring a different level of assessment and protection by the companies that use such information. This would help determine whether a company's reason for using personal information is appropriate, what type of consent they must seek, the strengths of safeguards that must be used to protect the information and how long it can be kept. Finally, the bill would also give parents and minors more power over this information, including the ability to have it deleted.

This bill has so much more, and I urge every member in the House to seize this moment.

Business of the House

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Mr. Speaker, indeed, we will all be returning to our ridings next week to pay tribute to those who fought for our freedoms and the values we hold so dear in Canada.

Before that, today we will be hearing the fall economic statement shortly. Tomorrow, the first order of business will be a vote on the ways and means motion regarding the fall economic statement. We will then return to second reading of Bill C-27, the digital charter act.

When we come back after the break, our intention will be to immediately return to the fall economic update. We want to give the Conservatives as many opportunities as possible to speak to it so that hopefully we can vote on it in the fall and not the spring, which we did last year.

[Mark Holland, Liberal, Ajax, ON]

Madam Speaker, there is always a chance. I hear the member opposite saying there is a chance. Although we have many and great differences, there is always hope for us, and I look forward to that hope.

I am very pleased to say that this afternoon, we are going to complete third reading debate of Bill C-31 with respect to dental care and rental housing. Tomorrow, we will finish second reading debate of Bill C-9 concerning the Judges Act. On Monday, we will continue to the fifth day of the second reading debate for Bill S-5, an act to amend the Canadian Environmental Protection Act.

Tuesday, as members will be happy to note, is an allotted day. On Wednesday, we will commence debate on Bill S-4, an act to amend the Criminal Code and the Identification of Criminals Act (COVID-19 response and other measures). On Thursday, we will call Bill C-20, the public complaints and review commission act. For next Friday, our plan is to start second reading debate of Bill C-27, the digital charter implementation act, 2022.

I would also like to inform the House that next Wednesday during Routine Proceedings, under ministerial statements, the Minister of Veterans Affairs will be pleased to deliver a statement for Remembrance Day.

[Randall Baran-Chong]

I'm admittedly not familiar with Bill C-27.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

I have listened to the witnesses and I see the importance of legislating for victims of fraud. The government has introduced Bill C‑27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

What is your opinion of this bill? Does it go far enough?

Do you have any recommendations for us in this regard?

[Sharon Polsky]

Yes. Having it in law is necessary. It has to be clear, not open to interpretation by an organization that wants to use the law to its advantage and not for the sake of clarity. But I caution saying, well, we have new legislation, Bill C-27, the artificial intelligence data act, and that will protect it. It doesn't, because any organization that is deputized, if you will, by CSE or CSIS can do what the government can't.

[Sharon Polsky, President, Privacy and Access Council of Canada]

Thank you, Mr. Chair.

Good morning from here in Calgary.

To you and members of the committee, thank you for inviting me to appear before you today.

In 1964, Ronald Reagan said, “Freedom is never more than one generation away from extinction.”

In 1992, our Supreme Court said, “The very efficacy of electronic surveillance is such that it has the potential, if left unregulated, to annihilate any expectation that our communications will remain private.” The Supreme Court also said that we have a right to know when the state intrudes on our privacy.

The need for this study tells us that the court has been ignored.

As we saw with Clearview AI, police sometimes sampled data-oriented policing tools with no procurement paper trail, tools they say are needed for public safety to guard against perceived threats or, as Bill C-27 allows, to provide for societal benefits. Put another way, technology itself is morally neutral. How its use is justified makes all the difference, which is why it is so very important that this study is not hidden behind closed doors shielded from full public view.

We know that the Stasi secretly spied on its citizenry, but we don't expect democratic governments to spy on theirs, yet it's now happening in Canada and around the world with journalists, executives, social activists and elected representatives whose views differ from the ruling party being spied on.

Until recently, though, Dudley Do-Right and Sergeant Preston were what people thought of when they thought of the RCMP, defenders of justice and fair play in their relentless pursuit of lawbreakers, respecting the intent in the letter of the law, the charter and Canadian's privacy, not using an unreported surveillance program to spy on Canadians' social media accounts.

Granted, spyware can help police do their work. More often, though, it's downloaded by the hundreds of thousands and used by human traffickers to control sex slaves and, in domestic conflicts, to terrorize partners.

It's also part of a lucrative new sector that's made our privacy, our freedom and our democracy only a crisis or an election away from extinction. How can any MP or bureaucrat be certain that cabinet confidences, military strategies, election plans or anything can be discussed privately when there's a very real chance that a hidden app is letting someone somewhere in the world listen, watch and record your every text, email and photo, siphon your contacts and your passwords and silently turn on the microphone and camera to watch and listen to you and your surroundings undetected?

As for the question of whether there are any social benefits in spyware, the answer is a perverse but resounding yes. It's the Ford Pinto of technology, a danger hidden to the public in general and to certain people in particular with lots of socially beneficial spinoff jobs, commerce and taxes.

The global cybercrime industry generates more than $1.5 trillion U.S. annually. The global cybersecurity industry is at $1.7 trillion and in Canada, it accounts for $3.5 billion U.S. right now.

Pegasus is just the latest spyware to make the headlines. It reminds us that spyware is a non-partisan, equal opportunity endeavour and that the post-911 tools to combat terrorism have made us all fair game to be targeted and our words used against us. Maybe they already have been.

Disrupting the mercenary surveillance industry will require multi-partisan political will, a coordinated domestic and international effort and a shift in approach to prevent the damage from being done in the first place by regulating the exploitation of privacy. Put the onus where it belongs.

Spyware developers, producers, distributors, investors and the inherently faulty technology make the risk greater than the reward, because regulating Internet content won't stop spyware or child predators, and laws banning hacking-for-hire companies and occasionally catching a criminal haven't made a dent.

Using spyware needs to be made unlawful except in specific exceptional situations and for the shortest possible duration necessary to accomplish a specific investigatory goal with its use approved in advance by a genuinely independent, knowledgeable, apolitical third party so that Canadians can regain trust in government and the public sector and have reason to think of Mounties as Dudley Do-Right, not Snidely Whiplash.

[Philippe Dufresne]

At this point my office does need more resources. We've made a request for more resources already and we're awaiting the response on that. We are evaluating what we will need for Bill C-27 and beyond.

[Philippe Dufresne]

We need to make sure, whoever the decision-maker is, whether it's the judiciary, my office or departments, that they have the necessary understanding of the technology that's at play. We need to understand the privacy impacts. We need to understand the information at play, and we need to understand what the capabilities are and if those change the nature of the discussion of metadata.

We have privacy legislation in the public sector that's 40 years old. We have the private sector. We have Bill C-27 that's going to be considered to modernize the private sector, so it's important that the legislation keeps up, but also, as you rightly point out, that the decision-makers are properly equipped with that knowledge. In this case, it's technological knowledge.

[Philippe Dufresne]

We're certainly looking at the resources situation very carefully. We have had the Privacy Act extension order that extended the ambit of the Privacy Act. We've made a request for more resources based on that. We're waiting for the answer to that request.

We're also looking at Bill C-27. We're looking at potential modernization of the Privacy Act itself. All of these are raising questions of resources. Not everything requires more resources, but I'm certainly looking at this very carefully as one of my focuses to see if we have what we need and what we will need so that we can be as efficient as we need to be to face these new challenges and realities.

[Iqra Khalid, Liberal, Mississauga—Erin Mills, ON]

Thank you.

You just mentioned the use of such surveilling technologies by private organizations. I know that in the news we heard recently about the Awz group, which former prime minister Stephen Harper has been deeply involved with. There's technology such as Corsight, which uses facial recognition software, or viisights and their behaviour recognition software.

Are you concerned about how those technologies being developed are being used by private companies, and whether we should be doing more? You just mentioned Bill C-27 as well. Perhaps you could expand on that.

[Philippe Dufresne]

I think Canada has a number of safeguards. The role of my office is to ensure that we can make them stronger and to promote making them stronger. We've called for law reform for the Privacy Act to modernize it so that it catches up to new technology. There is Bill C-27, which is currently before the House in terms of private sector privacy.

We value privacy as Canadians, and I think it's something that has to be top of mind. That's why I say that privacy is a fundamental right. It has to be so. It has to be seen as such. It is not an obstacle to the public interest. It has to be there. It has to work with the public interest, but it has to be something that we communicate and we address to build trust for Canadians.

I think we have a strong system. I think it could be stronger. I think it's important that it be world class and that it be the best system in privacy. It's a fundamental right, and it's fundamentally important for Canadians.

[Tamir Israel]

I would second what Ms. Bhandari is saying. It's not too late to act.

I would just also add really quickly that we have a very big enforcement problem in Canada. Obviously we had rulings against Clearview here as well. Clearview is currently challenging those rulings against it from the B.C. privacy commissioner, the Alberta privacy commissioner and the Quebec commissioner.

Federally though, it did not challenge the federal Privacy Commissioner's ruling because that ruling is not binding, so it's essentially, “take it as a recommendation and move on.” I think the enforcement mechanisms that will come through in the private right of action that is coming through Bill C-27—which I imagine may come before you shortly—is something that you would also like to take a look at very closely when you're considering how to make sure that whatever laws you put in place are respected by Clearview and all the other companies that follow its model.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Ms. Bhandari, this morning, the Government of Canada introduced Bill C‑27, which, among other things, implements the Digital Charter. Part 3 of the bill is entitled “Artificial Intelligence and Data Act.”

The bill therefore deals with artificial intelligence and facial recognition. It will be sent to committee for study so that we can discuss it and make suggestions for improvement.

From what you know of the Biometric Information Privacy Act, or BIPA, what should we look to in that legislation to enrich our digital charter that will eventually be implemented?

[Tamir Israel, Staff Lawyer, Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic]

Good afternoon, Mr. Chair and members of the committee.

My name is Tamir Israel and I'm a lawyer with the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic at the University of Ottawa, which sits on the traditional unceded territory of the Algonquin Anishinabe people.

I want to thank you for inviting me to participate in this important study into facial recognition systems.

As the committee has heard, facial recognition technology is versatile and poses an insidious threat to privacy and anonymity, while undermining substantive equality. It demands a societal response that's different and more proactive than that to other forms of surveillance technology.

Face recognition is currently distinguished by its ability to operate surreptitiously and at a distance. Preauthenticated image databases can also be compiled without participation by individuals, and this has made facial recognition the biometric of choice for achieving a range of tasks. In its current state of development, the technology is accurate enough to inspire confidence in its users but sufficiently error prone that mistakes will continue to occur with potentially devastating consequences.

We have long recognized, for example, that photo lineups can lead police to fixate erroneously on particular suspects. Automation bias compounds this problem exponentially. When officers using an application such as Clearview AI or searching a mug shot database are presented with an algorithmically generated gallery of 25 potential suspects matching a grainy image taken from a CCTV camera, the tendency is to defer to the technology and to presume the right person has been found. Simply including human supervision will, therefore, never be sufficient to fully mitigate the harms of this technology.

Of course, racial bias remains a significant problem for facial recognition systems as well. Even for top-rated algorithms, false matches can be 20 times higher for Black women, 50 times higher for native American men, and 120 times higher for native American women than they are for white men.

This persistent racial bias can render even mundane uses of facial recognition deeply problematic. For example, a United Kingdom government website relies on face detection to vet passport image quality, providing an efficient mechanism for online passport renewals. However, the face detection algorithm often fails for people of colour and this circumstance alienates individuals who are already marginalized by locking them out of conveniences available to others.

As my friend Ms. Bhandari mentioned, even when facial recognition is cured of its biases and errors, the technology remains deeply problematic. Facial recognition systems use deeply sensitive biometric information and provide a powerful identification capability that we know from other investigative tools such as street checks will be used disproportionately against indigenous, Black and other marginalized communities.

So far, facial recognition systems can be and have been used by Canadian police on an arrested suspect's mobile device, on a device's photo album, on CCTV footage in the general vicinity of crimes and on surveillance photos taken by police in public spaces.

At our borders, facial recognition is at the heart of an effort to build sophisticated digital identities. “Your face will be your passport” is becoming an all-too-common refrain. Technology also provides a means of linking these sophisticated identities and other digital profiles to individuals, driving an unprecedented level of automation.

At all stages, transparency is an issue, as government agencies in particular are able to adopt and repurpose facial recognition systems surreptitiously, relying on dubious lawful authorities and without any advance public licence.

We join many of our colleagues in calling for a moratorium on public safety and national security related uses of facial recognition and on new uses at our borders. Absent a moratorium, we would recommend amending the Criminal Code to limit law enforcement use to investigations of serious crimes and in the absence of reasonable grounds to believe. A permanent ban on the use of automated, live biometric recognition by police in public spaces would also be beneficial, and we would also recommend exploring a broader prohibition on the adoption of new facial recognition capabilities by federal bodies absent some sort of explicit legislative or regulatory approval.

Substantial reform of our two core federal privacy laws is also required. Bill C-27 was tabled this morning and it would enact the artificial intelligence and data act, as well as reform our private sector law, our federal law PIPEDA. Those reforms are pending and will be discussed, but beyond the amendments in Bill C-27, both PIPEDA and the Privacy Act need to be amended so that biometric information is explicitly encoded as sensitive, requires greater protection in all contexts and, under PIPEDA, requires express consent in all contexts.

Both PIPEDA and the Privacy Act should also be amended to legally require companies and government agencies to file impact assessments with the Privacy Commissioner prior to adopting intrusive technologies. Finally, the commissioner should be empowered to interrogate intrusive technologies through a public regulatory process and to put in place usage limitations or even moratoria where necessary.

Those are my opening remarks. I thank the committee for its time. I look forward to your questions.

Privacy

[François-Philippe Champagne, Liberal, Minister of Innovation]

Mr. Speaker, I thank my colleague for her question, for her excellent work and for her leadership.

As my colleagues will attest, there is a lot of enthusiasm for what we did today. Earlier, I introduced the Digital Charter Implementation Act, 2022, which will give people more power to protect their personal information and their children. This is how we are ensuring that Canadians can take advantage of the latest technologies and be confident that their personal information is protected and secure and that companies are acting responsibly. Security and trust are key words in the digital age.

Digital Charter Implementation Act, 2022

[François-Philippe Champagne, Liberal, Minister of Innovation]

moved for leave to introduce Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

(Motions deemed adopted, bill read the first time and printed)