Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Digital Charter Implementation Act, 2022

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, I do not see the connection to the first portion of my hon. colleague's question. I do understand that this bill absolutely needs significant improvement.

I am certainly supportive of it, in principle, to go to committee to have the amendments ironed out and improved upon so the legislation could address some of the concerns raised by my friend, as well as the concerns identified by people across the country. This includes some of the experts who say we need to strike the right balance, and it is about time privacy legislation takes into account all those issues.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, I am thankful for this opportunity to speak to Bill C-27, the digital charter implementation act, 2022. While there are many important components of Bill C-27 to debate, my speech today will focus on just two aspects. The first is privacy, and the second is identity.

The protection of both the privacy and the identities of Canadians is essential. We need to ensure that strong legal mechanisms are in place to guarantee that protection. Connected with that is the need to protect from the commercial interests of private companies, as well as protection from the government and its potential overreach into the private lives of Canadian citizens. Consequently, I believe a national digital charter is urgently needed. To protect Canadians, it is important that we have a piece of legislation that acts as an umbrella to protect Canadians from government, and to uphold the privacy of Canadians' data and their digital identities.

The second part of my speech will highlight some of the breaches that have occurred over the past three years. These breaches drive home the urgent need for more stringent protection for Canadians when it comes to privacy and protecting their private information.

Privacy rights are at the heart of any democracy. They are necessary for reinforcing the limits and boundaries between private citizens, their government and the private sector. In Canada, individual liberties are guaranteed by section 7 of the Canadian Charter of Rights and Freedoms. Our Chief Justice of the Supreme Court has made comments on this. She stated, “liberty...depends on and mandates respect for the individual and his or her right to be free from government restraint, except as authorized by law.”

Justice McLachlin further explains why it is important for government to keep the people informed and to answer questions, stating, “People who possess power, even small administrative powers, may use information they should not have improperly. And even if they don’t, the individual’s fear that they may use it, often leads to unwilling compliance.”

Just as we have fundamental freedoms entrenched in the highest law of our land to protect us from government encroachment of our freedoms, I also believe that it is necessary to have digital data privacy legislation. That is a fundamental right that urgently requires the strengthening of our legislative protections and enforcement.

That is why we need a federal digital charter, which would act as an overarching piece of legislation. However, Bill C-27, the digital charter implementation act, falls short of this very important objective. The Office of the Privacy Commissioner, for years, has made several calls for reform. Privacy watchdogs have repeatedly lamented that our federal privacy laws are outdated, that they fail to provide the needed legal protections in an increasingly digital world.

Canadians also have serious concerns about privacy. First, they have concerns about how their private information is being used, and what large corporations and governments are doing with it. Second, these concerns have turned into a fear because of the misuse and abuse of private information in the recent years.

This leads me to the second point of my speech. I will speak about the bigger problem in the privacy landscape in this country, which is that the Liberal government is failing to update its own legal boundaries and parameters in this area. The reality is that this bill does not touch on the Privacy Act, the act that governs the government, and this digital charter does not cover how the government handles the information it collects from Canadians.

Essentially, this bill is saying, “Do as I say, not as I do.” With this bill, the government is telling businesses, even sole proprietorships, that they should add additional layers of red tape under the threat of financial penalties. Business owners are still struggling to recover from COVID setbacks, lockdowns and government red tape.

My fear is that many of these small businesses, subject to these new requirements, would not be able to survive or have the capacity to implement some of these new requirements. These demands come even though government itself has failed to lay down the rules and regulations as to what is needed in the form of a regulatory infrastructural framework to secure our digital future.

A digital charter is needed to protect Canadians, but the federal government should be leading by example by outlining a digital charter that would protect the personal data and privacy of its own citizens first, before it asks businesses to do so. Let us be honest that the number one privacy concern Canadians have right now is how their government is using their information. These fears were exacerbated during the trucker convoy when Canadians’ bank accounts were frozen and property was confiscated through the abuse of the Emergencies Act.

Canadians still remember how the government quietly spied on their movements during the pandemic without their consent. A year ago, it was discovered that the Public Health Agency of Canada was tracking Canadians' movement during the pandemic. This was done without their knowledge, and PHAC wanted to keep doing it quietly for years into the future, but it was the Conservative opposition that discovered this breach and stood up for Canadians. We demanded answers from the Public Health Agency on the way the data was collected, how it was defined, what third parties were privy to the data and whether any data was reidentified. It is important that the government answer these questions and sets standards because it is falling short of its own requirements.

Canadians have not forgotten even the ArriveCAN debacle, the privacy questions around its mandatory use, and the terms and conditions associated with it. In other words, exactly what personal data and identifying information has been shared outside the app? Under what circumstances, and with which domestic or international organizations, was it shared? The app’s privacy notice even stipulated that the government had the right to share our information contained in the app with international organizations and institutions.

Canadians have a right to know with whom their data is being shared. This matter, it is no surprise, was referred to the Privacy Commissioner for an investigation. We are still waiting for an answer on the ArriveCAN privacy breaches.

Let us not forget that Canadians were fined thousands of dollars and threatened at their own borders for not submitting their own private medical information. This was, in my view, a massive overreach of government powers, but the reality is that this overreach happened because Canada has insufficient legal safeguards in place to prevent such abuses, and this creates a profound distrust in government.

It concerns me that the government is moving toward integrating a digital proof of identity framework that would massively expand the centralization of government access to the private information and data of Canadians. There are numerous ethical abuses that relate to this data collection.

The biggest concern is having all of one's private information in one place. Imagine our health information, driving information and banking information all in one portal. This would give information handlers a great deal of power over our data. This power urgently needs to be kept in check, and we need public experts in consultation on the ethics behind this centralized data collection power to uncover what we need to do to protect Canadians.

In conclusion, Canada’s digital privacy framework has long been in dire need of modernization. I want to thank the Standing Committee on Access to Information, Privacy and Ethics, which worked hard on this issue for years. Canadians must have the right to access and control the collection, use, monitoring and retention of their personal data. However, in Canada, the Liberal government is failing Canadians by not prioritizing its own accountability when it comes to protecting privacy rights. The bill sadly fails to put forward a rigorous and comprehensive legislative framework that would defend Canadians’ data, privacy and digital identities, now and in the future.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Mr. Speaker, we heard some fairly outlandish claims about the government illegally monitoring Canadians, which is extremely bold, to say the least. I am curious as to whether the member has any actual facts to back up that claim or if that is just another conspiracy theory being led by Conservatives and the alt-right wing of the party.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, this is a part of the problem with why Canadians do not trust government. When Canadians raise concerns, the Liberals label them, degrade them, make fun of them and call them conspiracy theorists instead of dealing with the real issues and fears that Canadians have. The news report indicated that the privacy of Canadians was breached during COVID, and that is factual.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I am known for my perspicacity, so I decided to ask ChatGPT another question.

I asked it to come up with a question for my Conservative colleague from Haldimand—Norfolk about the importance of enhancing data and privacy protection in Bill C-27. That was what her speech was about.

ChatGPT replied: “Sure, here is a question for the Conservative member. The question is as follows: As a Conservative member, how does she think that Bill C‑27, which aims to modernize the Privacy Act”—already this is a step up from the other question—“will offer better protection for Canadians' data and privacy? Also, what are the key points she would like to see in the bill to ensure the adequate protection of personal information?”

I am very impressed by artificial intelligence because it touches on the role of the official opposition, which is not just to complain, but also to make suggestions.

I would be very curious to hear my colleague's thoughts on the subject, because I did not hear many constructive remarks in her speech.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, I beg to disagree. There were largely areas of constructive discussion in my speech, and I will highlight some of them for my friend.

The government needs to have an infrastructure framework that will protect the privacy of Canadians before it can demand that of businesses. Businesses, which are already saddled with red tape, do not even have the mechanism to put this in place. Nor does the federal government have the structure to put this in place, but it demands that the business sector do that, with sweeping loopholes that could violate the privacy of Canadians.

The first thing we need to do is ensure that the Liberals put in place a legislative framework that will set the foundation for digital privacy in Canada.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, privacy rights are fundamental. Small businesses are important. I wonder if the member agrees that it is important to empower the Privacy Commissioner to enforce the protection of both those groups of people.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, I am impressed that Bill C-27 would give the Privacy Commissioner some teeth to enforce penalties. That I acknowledge. I also see it as a positive that there is some attempt to create some sort of regulatory framework, but it does not go far enough. This framework has to start from the federal government and work its way down so we have an umbrella legislation to protect the digital privacy of Canadians.

[Jennifer O'Connell, Liberal, Parliamentary Secretary to the Minister of Intergovernmental Affairs]

Mr. Speaker, I appreciate the opportunity to ask the hon. member a question.

I am curious as to whether the member thinks there should be consequences or reprimands for members of the House who meet with known Nazis who spread misinformation and disinformation, who glorify the Holocaust and who speak against anti-Muslim rhetoric. If the member is talking about online hate, privacy of Canadians and regulation, does she condemn her actions by meeting with a known Nazi who spouts anti-Muslim rhetoric?

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, the Prime Minister has met with far worse individuals than I have ever met with. I can tell the member this. As a member of Parliament, it is my duty to have meetings—

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I rise on a point of order. All members are honourable members. The member just said that the Prime Minister had met with worse people than she had. I would like her to name them.

[The Deputy Speaker, Conservative, Chris d'Entremont]

That is getting into debate.

The hon. member for —Norfolk, from the top.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, the Prime Minister has put on blackface so many times that he has degraded Black people. He literally put a banana in his pants, and the member has the audacity to stand and look at me, as a Black woman, and ask about my meeting with another member of the European Parliament. That is within my job description. I do not have to approve of everything in which another member believes in order to have the decency to have meetings with other individuals.

The Prime Minister denigrated Black men by putting a banana in his pants. Shame on every member over there who does not chastise him. If this were any other country, he would not be leading. He would not have the moral authority to lead.

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, to bring it back to the topic of this debate, Bill C-27, the intention of the bill is to modernize the protection of digital privacy rights in Canada. The previous iteration of the bill was roundly panned by stakeholders when it was introduced in the previous Parliament. However, in this new version, Bill C-27, the government has added a few new elements, for example, regulating artificial intelligence.

Unfortunately, there are so many different elements within the bill that nobody can actually address all the issues within a 10-minute speech, so I will focus on the privacy issues that are sorely lacking within the legislation.

The bottom line is that the new bill, Bill C-27, remains fundamentally flawed and is, simply put, a redux of the former bill. Essentially, what it would do is put lipstick on a pig.

The dramatic and rapid evolution in how we gather, use and disseminate digital information in the 21st century has presented the global community with not only a lot of opportunities but significant challenges as we try to protect society and individuals against the unauthorized use of their data and information. This directly implicates the issue of privacy and the various Canadian pieces of legislation that address the issue of privacy.

This is not the first time the Liberal government has tried to “fix” a problem, and I use that term advisedly. It tries to fix things, but just makes things worse. In the 21st century, we are faced with immense challenges in how we protect individuals, our Canadian citizens, against those who might misuse their data and information. Any suggestion that this digital charter is actually an articulation of new rights is simply wrong. This is a digital charter, but it is not a digital charter of rights.

I will turn to the most significant and substantive part of the bill, the privacy elements. Very little of this legislation has been changed from the original Bill C-11, and the government has not measurably responded to the criticism it received from the stakeholders when the previous version of the bill was reviewed at committee.

There are five key additions and alterations to Canada's existing privacy protection laws.

First, the bill expressly defines the consent that Canadians must give in order for their data and information to be collected and used, and there are guidelines attached to that. We commend the government for doing that clear definition of consent.

Second, Bill C-27 addresses the de-identification, the anonymization of data that is collected by private companies. Again, that is important. We want to ensure when private businesses collect information from consumers that this information is not attached to a specific individual or citizen.

Just to be clear, the bill contains numerous broad exemptions, which we could probably drive a truck through, and will likely create the loopholes that will allow corporations to avoid asking Canadians for permission.

Third, the bill provides that all organizations and companies that undertake activities that impact the privacy of Canadians must develop codes of practice for the protection of the information they collect.

Finally, the act would create harsher financial penalties, up to $25 million, for a violation of Canadian privacy rights. We, again, commend the government for doing that.

However, let me say for the record that what we do not support is the unnecessary creation of a new personal information and data protection tribunal, which is another level of bureaucracy that would add more layers of complexity, delays and confusion to the commissioner's efforts to enforce privacy laws.

Canada is not alone in expressing concern over the risks that digital information and data flows represent to the well-being of Canadians and our privacy rights. Many other countries are grappling with the same issue and are responding to these threats, and none more so than the European Union. The EU has adopted its general data protection regulation, the GDPR, which has now become the world's gold standard when it comes to privacy protection in the digital environment.

The challenge for Canada is that the EU, which is a market of over half a billion well-heeled consumers, measures its willingness to mutually allow sharing of information with other countries against the GDPR, the standard it has set. Those who fall short of the rigour of that privacy regime will find it difficult to conduct business with the EU.

Do our current regime and this legislation measure up to the GDPR from the EU? No, probably not. In fact, for years Canada's digital data privacy framework has been lagging behind those of our international counterparts. The problem is that if we do not meet the standard, we will not be able to do the kind of business with the EU we expect to. As someone who played a part in negotiating our free trade agreement with the European Union, I know it would be an absolute travesty to see that work go to waste because our country was not willing to adopt robust privacy and data protections.

I note that, as is the custom with our Liberal friends, the bill creates more costs for taxpayers to bear. There is a creation of new responsibilities and powers for the commissioner, which we support, but this legislation calls for the creation of a separate tribunal, a new layer of bureaucracy and red tape that small and medium-sized enterprises will have to grapple with.

There are other unanswered questions. Why does this legislation not formally recognize privacy as a fundamental right? Regrettably, as presented, Bill C-27 misses the opportunity to produce a path-breaking statute that addresses the enormous risks and asymmetries posed by today's surveillance business model. Our key trading partners, especially the EU, have set the bar very high, and the adequacy of our own privacy legislation could very well be rescinded by the EU under its privacy regime.

Thirty-five years ago, our Supreme Court affirmed that privacy is “at the heart of liberty in a modern state”, yet nowhere in this bill is that right formally recognized. Any 21st-century privacy regime should recognize privacy as a fundamental human right that is inextricably linked to other fundamental rights and freedoms. By the way, I share the belief that as a fundamental right, it is not appropriate to balance off the right to privacy against the rights of corporations and commercial interests. Personal privacy must remain sacrosanct. When measured against that standard, Bill C-27 fails miserably.

I have much more to say, but I will wind down by saying that this bill is another missed opportunity to get Canada's privacy legislation right by consulting widely and learning from best practices from around the world. There is a lot riding on this bill, including the willingness of some our largest trading partners to allow reciprocal data flows. This bill is not consistent with contemporary global standards.

The Centre for Digital Rights notes that this legislation “fails to address the reality that dominant data-driven enterprises have shifted away from a service-oriented business model towards one that relies on monetizing [personal information] through the mass surveillance of individuals and groups.” That should be a wake-up call to all of us. Sadly, this bill fails to listen to that call. Let me repeat that there is a move toward monetizing personal information through mass surveillance of individuals and groups, and the government has not yet recognized that.

For those reasons, I expect the Conservatives will be opposing this bill and voting against it.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I switched from ChatGPT to Bing, since I also wanted to test that platform. I asked Bing, in connection to what my colleague from Abbotsford was saying, what the consequences of not legislating on the content of Bill C-27 would be.

It gave me an interesting answer, namely that, essentially, it could have an impact on the protection of data provided by companies.

Not legislating and not acting right now will therefore lead to more data losses unless we establish a framework, which is one of the aims of Bill C‑27.

By playing all these games in the House to waste time and stop us from passing Bill C‑27, are the Conservatives not putting Quebeckers' and Canadians' personal information at risk?