Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Digital Charter Implementation Act, 2022

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I think this government takes privacy very seriously. That is why we have been working on this legislation since the last government and why we have improved this legislation, bringing it before the government a second time to include things like artificial intelligence and improve security for the privacy of young people on the Internet.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is a pleasure for me to speak to Bill C-27 in the House today, a bill that deals with issues related to privacy, as well as the way that the government interacts with large corporations to protect, or not, the privacy of Canadians.

I want to say at the outset that I am deeply concerned by the fact that the government has clearly been captured by certain corporate interests. It is important to distinguish in this discussion between corporate interests and the idea of a free market. As Conservatives, we believe very much in the importance and value of a free market and a competitive market, a market that is legitimately a challenging and competitive place for businesses that have to compete with each other to have the best products, where some businesses come in to challenge and steal market share away from other businesses and so forth, where there are not gatekeepers preventing new entrants coming into business. We celebrate free markets and the competitive aspect of free markets rather than a situation in which a small group of large corporations is able to dominate and exercise undue and inappropriate power.

In this House, different parties have different dispositions when it comes to corporations. We have the NDP that generally takes kind of an anti-business approach in general, we have my party that champions the free competitive market and we have a government that is, sadly, captured by specific corporate interests, often at the expense of the free market, as well as at the expense of individual well-being. Paradoxically, the NDP, while it criticizes the government for that, is fundamentally complicit with the government in, on the one hand, criticizing its agenda as it relates to defending corporate interests, but, on the other hand, supporting the government and providing it with the supply it needs to continue in its misguided approach.

What we see in terms of the government's relationship with large corporate interests at the expense of the free market and individual well-being is clear across a broad range of cases. We could talk, for instance, about the government's fondness for specific companies in terms of outsourcing and procurement, how it has repeatedly gone back to McKinsey to do work that in fact could have and should have been done within the public service, despite McKinsey's track record in so many different areas. We can talk about the fact that while the public service has grown, outsourcing under the government has expanded dramatically. We can talk about how it has pushed companies to implement forms of political discrimination, such as freezing people's bank accounts. We can talk about a number of the violations of individual privacy and liberty that happen through the government's close relationship with corporations.

I will say, in general, there is this emerging concept of woke capitalism or stakeholder capitalism that I think we need to be thoughtfully critical of, this idea that large corporations should be making definitive determinations and forcing those implementations on the country using their power and that governments can push corporations to push woke ideas or particular views of the common good that arise not through free democratic deliberation, but that come about because of pressure from corporate interests. We see the government's fondness for this kind of woke corporatism approach, where it tries to pressure companies to align with and push its views on various issues.

Again, Conservatives are very supportive of competitive marketplaces where businesses are doing business, not assuming a preferential position in social values debates, where businesses have to compete to survive, where new businesses are able to compete with old businesses and where we support the development of new small businesses so that we do not have a concentration of corporate power, but, rather, a well-functioning, effective market economy. That is the vision that Conservatives are defending.

Let me talk specifically about the issue of privacy and how we see the working out of the government's kind of approach to and relationship with big corporations in terms of their approach to privacy.

I am very pleased the Conservative Party uses and has a member-driven policy document. On issues like this, if one would like to know where Conservatives stand, it is not just a matter of Conservative caucus discussion but it is also a matter of drawing from the work that hundreds of thousands of Conservative Party members do, deliberating at the riding level, having discussions, proposing ideas and bringing those to a convention that then leads to a standing policy document that helps to define and frame the values that Conservatives stand for. I know our Conservative Party is deeply committed to the idea of grassroots democracy and the role our members play in all aspects of decision-making.

That is very important, and in this particular context, we see that playing out in the area of the policy declaration. Our policy declaration recognizes the fundamental right people have to privacy. As a Conservative caucus, we are supportive in advancing and bringing to the House that view about fundamental rights, a fundamental right to data privacy that has come to us through the involvement of our members but that also reflects the widely held perspectives of Canadians beyond our membership, a fundamental right around the protection of data.

This bill, Bill C-27, could have mirrored the language from the Conservative Party policy declaration. It does not. It does not recognize the fundamental nature of rights around data privacy. Rather, it talks about kind of striking a balance between people wanting to have their privacy protected but also the fact there are certain corporate interests. There are interests of corporations the government is close to that might be negatively affected if we recognize the fundamental right to privacy of Canadians, so it effectively seeks to say there should be some balance between the idea of protecting people's rights and the fact there may be certain large corporations whose interests would be negatively affected by recognizing the privacy rights of Canadians.

In particular, although the bill speaks about a balance at a general level, it is so, to borrow a word from the member opposite, “flexible” that it creates space one could effectively drive a truck through, with so many different exceptions and exemptions that it is not really effectively protecting the privacy rights of Canadians.

A member opposite, in a speech just given, said that this is a flexible framework, that the bill is flexible. Well, flexibility is not always a virtue. In particular, it is flexible for who? Who is doing the flexing? Who is the one who is able to bend the bill back and forth to their own will and interests? I would suggest the flexing is not being done by the individual who is supposed to own their own data, the flexing is being done by these corporate interests the government is close to.

Even if one believes this should be a balanced approach, it is not a balanced approach. It is a highly “flexible” approach in which the bending and twisting is done by the particular interests the government has been and always I suspect will be close to until we are able to have a new government in this country that respects fundamental rights, respects privacy and believes in a free competitive market in which businesses compete instead of where particular corporate friends of the government are protected.

I want to draw the attention of members to specific sections in here that identify broad exceptions in the legislation. Subclause 18(3) would allow the organization or business to use a person's information if they have a legitimate reason for doing so. That is pretty flexible. If one wants flexible, we are going to say this data cannot be used in a certain way unless there is a reason to do so. I would submit most people who do things think they have a legitimate reason for them. Others might not think they have a legitimate reason, but to say people's data can be used as an exception if there is a legitimate reason, there likely could be no broader conceivable exception than that one.

However, there are more exceptions even, if that one were not enough. The legislation, for instance, in subclause 15(5), refers to “implied consent”, so apparently in the case of privacy legislation, consent is not so sacrosanct, because companies can interpret an implied consent in this context.

There are clear problems with this legislation in terms of the particulars, but we can understand broader than the particulars the motivation or the value set that is behind this bill, which is that the government is once again trying to defend corporate interests instead of defending privacy and a genuinely competitive free market.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is disappointing listening to Conservative after Conservative stand and say they do not like this. Now that member referred to some sort of concern of policy platform. We do not know, really, because we often question the lack of any sort of plan coming from the Conservative Party. What we know is that we have substantial legislation that would set the framework, protect the privacy of Canadians and enable penalties and fines to ensure there is a consequence when a company breaks its trust with Canadians. What do the Conservatives say? They say they do not care about this type of legislation because they have their own ideas.

Will the member and the Conservative Party acknowledge that it is okay to allow the legislation to go to committee where the member can continue to rant on the different ideas and maybe even do something positive, like suggest an amendment he feels would make the legislation better?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is quite a thing to be accused of ranting by the member for Winnipeg North. I am so sorry to have disappointed him with my speech. I recall in an earlier exchange he referred to me as a “mischievous little guy”. I framed that and put it on my wall. That is truly having a ride. The goal I set out from the beginning was to be thus recognized by the member.

He asks what changes to the bill I would like. I suggest he support changes that reflect what Conservative members, in their wisdom, have put forward through our policy declaration, which we, as a caucus, are strongly supporting. This is the idea that there is a right to digital privacy that comes before the corporate friends of that member and the government.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, I am looking at Bill C-27 and wondering what we make of the fact, and I know he commented on this, that we have three different bills that are all put together and only one is really new. We have seen the privacy pieces and the repeal of PIPEDA in the former Parliament's Bill C-11. The bill before us relating to artificial intelligence and high-impact AI and regulating that is essentially an entirely different scheme of legislation. Would the Conservatives agree that they should be split so we can examine them separately? I think that is already their position. What does the hon. member say to that?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, some members will recall that way back in 2015, eight long years ago, in the lead-up to that election, the Liberal platform spoke about how the Liberals would end omnibus bills. That went the way of the dodo bird, as did many of their other election commitments.

It was such a sunny time, in the rhetoric of the Liberal caucus, and we see the government's management of its legislative calendar. It puts forward bills, then it prorogues Parliament; it puts forward bills again and calls an early election. Now it is putting forward bills again.

In contrast, my constituents are certainly hoping for an opportunity to weigh in on the government at some point soon, but I think the member's point is quite correct. We have seen immense hypocrisy from the government around omnibus bills, and I wonder if we are getting to a point where it will just try to put all aspects of its legislative agenda together at once. I think that is probably the direction some of the members want to go.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, to respond to the member across the way from Alberta, he, the Prime Minister and the Liberal Party say to just trust them on this. Does the member who just spoke think we should trust the government and the Prime Minister?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, my short answer would be that, no, we should not trust the government.

My slightly longer answer would be that over the last few years, we have seen various actions through COVID and various other actions contemplated by the government. In all of these actions, there is a great deal of concern about people's privacy. Because of the way the government has acted in the past, there is concern and distrust any time the government says not to worry, that it is going to protect our information and that it will not use systems in such a way. The current government has undermined trust in government and institutions because it has not been worthy of that trust.

The House resumed from March 7 consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, it is, again, an honour to rise and speak in this place on behalf of my constituents of Medicine Hat—Cardston—Warner in relation to Bill C-27. It is dubbed the digital charter implementation act.

It is really frustrating to continually see legislation from the Liberal government that is sloppy, lazy and really incomplete, to be honest, and this bill is no exception.

Canadians have seen most of this legislation before in a failed attempt back in 2020. That legislation died on the Order Paper when the Prime Minister took his costly, ill-timed and overly optimistic opportunity to call an election. Since then, we have had three years of inaction on this file, and now the government has tabled this piece of legislation, Bill C-27, which should have been more focused on giving the people of Canada the privacy rights they deserve.

Instead, this legislation is literally the least that they could have possibly done in this regard. The bill is a flawed attempt to start the long overdue process of overhauling Canada's digital data privacy framework. Conservatives will be looking at putting forward some common-sense amendments at the committee stage to protect both individuals and small businesses alike and to ensure that it is the best possible legislation moving forward.

The Conservative Party believes that digital data privacy is a fundamental right that urgently requires strengthened legislation, protections and enforcement. Canadians must have the right to access and control collection, use, monitoring, retention and disclosure of their personal data.

It is unfortunate that we could not rely on the Liberals to get it right the first time, but maybe they will have the modesty, humility and common sense to accept the amendments that will be coming, instead of once again using their NDP coalition to control and steamroll at committee stage.

It is also a shame because Canada's digital data privacy framework has been in dire need of modernization for years. This government has been dragging its feet as well for years on this critically important legislation.

It appears that there is no good reason as to why there has not been advancement on this legislation. Clearly, they did not spend their extra time making the legislation any better than when it was first proposed in 2020.

Conservatives will be looking to see how this bill can be improved. However, when looking at how to improve something, we need to look at why it is even in front of us to begin with.

The Liberals brought it forward today because they were finally exposed for being flat-footed on Canadians' data protection and how they were exposed. Let us think about TikTok.

Michael Geist, Canadian research chair in Internet and e-commerce law at the University of Ottawa, said that he found it “pretty stunning” that the Liberals had to block TikTok on government devices as a precaution because, again, “part of what [the Liberals] were attributing the TikTok ban to was essentially Canada's weak privacy laws.”

The expert continued to say that, when it comes to Bill C-27, the government “sat on it. It barely moves in the House.”

He is not alone in his criticism either. Former privacy commissioner of Canada Daniel Therrien shared similar concerns to those of Michael Geist and those we as Conservatives have.

The former commissioner, Mr. Therrien, argued that the solutions in proposed Bill C-27 are not strong enough to rein in technology companies from pursuing “profit over respect for democratic values”.

He also said that Bill C-27 “will not provide effective protection to individuals, in part due to weak enforcement provisions.”

Former commissioner Therrien's most notable criticism, however, is in his retort to the Liberals' claim that the bill “will create the most important penalties among G7 countries”, which is called “simply marketing”.

This is just a gentlemanly way of a former public official saying that it is not really the case. There are those of us who would call it by some other name.

At best, Bill C-27 is a first step. It is better than the nothing that the Liberals have done for the last three years. That is where the catch-22 is with this bill as proposed.

Doing something will be better than staying in our current technological stone age, with respect to data privacy.

Specific items like the bill's requirements for all businesses to have a privacy watchdog and maintain the public data storage code of conduct are positive measures. However, it does cause worry about the burden this new layer of red tape will have on small business and especially for sole proprietors. Again, on a catch-22 of this lazy Liberal legislation, the law does not go far enough to protect children's privacy for example.

While the information of minors is finally included in the legislation, the definition of what is sensitive, what a minor is or who a minor is are not set out, and the sensitive information of adults for example is not given the same special provisions. This means that businesses are left to decide what is sensitive and appropriate for minors. It also means that the courts, when interpreting the legislation, will understand that if not amended, the sensitive information of adults was specifically left out of the legislation.

Further, businesses will have to navigate varying rules in each province where different definitions of a minor actually apply and that depends on provincial law. This is not good for protecting minors, this is not good for protecting Canadians' sensitive information and this is not good for businesses.

Finally, the fundamental problems in this bill can be summed up in that this bill does not recognize privacy as a fundamental right. Thirty-four years ago, the Supreme Court said that “privacy is at the heart of liberty in a modern state”.

Conservatives believe that individuals are worthy of privacy as a fundamental right, and the concept of privacy as a fundamental right is worthy of legislative protections. Based on that alone, the Liberals have missed the mark on this legislation. Once again, it is up to the Conservatives to fix the Liberals' poorly written legislation.

As I close, I want to offer my thanks for the hard work of the Conservative members of the access to information, privacy and ethics committee. They have done a great job to date. They spent a lot of time on the previous iteration of this legislation, and I have heard a great deal about how Canadians' information and data is used without their consent. With the many identified flaws of the bill, Bill C-27, I think it would be best if this bill were voted down and redrafted, honestly, in order to take these issues into account. However, the NDP-Liberal coalition will surely ignore doing these things right in favour of expediency and send it off to committee.

With that, Canadians and I are leaving the flaws that I have pointed out, and there are many more, along with the additional flaws that I am sure my colleagues will find in their review and will need to be fixed at committee. The Liberals have left the committee a lot of work, but I know that my colleagues there are up for the challenge.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Speaker, I would like to ask my colleague about the overall theme of his speech, which was about the positioning of personal privacy versus business interests. In clause 5 of this bill, it basically says that the purpose of the bill is to balance interests. There has been a lot of discussion about the protection of personal privacy interests. However, clause 18 of the bill says that business interests can trump individual interests by saying that express consent is not needed for a company to do something with the information of an individual if the company thinks it is in the legitimate interests of the company.

I wonder what the member thinks about a government that says this protects personal privacy while giving all the power to the businesses to determine legitimate interest.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, I go back to something my father taught me a long time ago that in all things that one is deliberating, one should have a reasonable and a balanced approach.

With respect to my colleague's question, there needs to be an appropriate balance, legislatively, so that there is no ambiguity and misinterpretation. However, the businesses and individuals, whose information a business has, have the comfort of knowing that it is used appropriately, that there are safeguards in place for its use and that it is not going to be misused. I think that would be an appropriate balance to strike.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Mr. Speaker, I think everybody would agree that for Canadians to prosper and benefit from the improvements of technology, they need to have confidence in the systems. If we look at some of the new apps out there now, it is extremely easy to access information about individuals, whether that is considered to be private information or public.

Could the member expand on why he might see this as critical in making sure Canadians have that confidence to trust the technology? At the end of the day, that is what these businesses will have to rely on if they are going to be successful.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, I appreciate that question from my hon. colleague. When he stands up, I never know what angle he is going to go with. It is nice to have a reasonable question from my friend across the way.

I look at some of the recent examples of privacy and mobility data being used without consent. The member is right. Canadians have to be confident about the information they are using in apps, and they have to have businesses they can trust.

The Tim Hortons app was tracking movements after orders, which caused concern for Canadians. Telus' data for good program was giving location data to PHAC. That was a significant faux pas. One that really stood out was the public doxing of those who donated to the “freedom convoy” through GiveSendGo. Anytime one is revealing their personal information online, there has to be some confidence behind it. Businesses rely on it. Those who use those businesses as consumers need to have confidence that the information is not going to be abused and shared inappropriately.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, given that this is a debate on artificial intelligence, I thought it might be fun to have ChatGPT make up a question for my Conservative colleague from Medicine Hat—Cardston—Warner about passing Bill C-27 and the Liberal government's lack of urgency, since that is one of the things my colleague mentioned.

This is ChatGPT's question: “How does his party view the Liberal government's lack of urgency to pass Bill C‑27, which is designed to protect workers and retirees in defined benefit pension plans in the event of employer bankruptcy? Also, how does he think this inaction could affect affected workers and retirees, as well as the economy as a whole?”

There is room for improvement, but the crux of the question is there. In terms of delays, I understand that the Liberal Party could have introduced a similar bill a long time ago, but my colleague said that he would vote it down all the same.

Are we not at the point where we should approve the principle of the bill quickly and improve the content in committee?