Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

[Dr. Emily Laidlaw]

I fully support the recommendations for amendments by Commissioner Dufresne regarding Bill C-27. I think it needs to be amended. I think it only solves part of the problem, because it's still a consent paradigm. Also, as long as it relies on consent, it doesn't dive into some of the more problematic aspects of social media and their influence, which, really, nobody can consent to.

Therefore, unless we wholly change Bill C-27, which I don't think we'll do, we need online harms legislation. I do think the AI act is problematic and needs to be pulled out of Bill C-27 and reworked. It absolutely should not be set up under ISED as a commissioner within that body.

[René Villemure, Bloc, Trois-Rivières, QC]

In 30 seconds, can you tell me whether you support Bill C‑27 as it currently stands?

[Brett Caraway]

That's supposed to be part of Bill C-27, the formulations of some sort of protections for minors. If you listen to representatives from TikTok, they will tell you that they have self-regulation and that they are the vanguard of that. They would say that people 18 and under can't livestream, or the privacy settings are by default for people 16 and under, or people 16 and under are limited to 60 minutes. However, these are settings that can just be changed.

It is important for the government to step in and help parents out, because they are literally overwhelmed by all the different social media platforms, and, of course, teens are on these platforms, depending on whom you ask, four to five hours a day.

[Alexandre Plourde]

I think that you want to understand how the personal information and data protection tribunal affects consumer rights.

As I said earlier, we have mixed feelings about the personal information and data protection tribunal. We would rather the Office of the Privacy Commissioner of Canada have the power to impose administrative monetary penalties.

However, in our view, the personal information and data protection tribunal isn't the biggest issue. Our main concern isn't the tribunal. It's all the other common law courts where a consumer could bring proceedings against a company on the basis of the new federal privacy legislation. There's a major problem. The current bill contains a significant restriction that could undermine consumers when they want to use this legislation before the courts.

The issue isn't the personal information and data protection tribunal. The issue lies outside the criminal process, including the Office of the Privacy Commissioner of Canada and the new data protection tribunal. In our view, Bill C‑27 seriously impedes, or at least threatens to impede, the civil process.

I'll talk about Quebec. It's the only area that we know well, obviously. Quebec has its own privacy legislation, which has more teeth than the legislation on the table today. Quebec also provides for civil remedies. If a company fails to meet its obligations under federal legislation, I can turn to the civil courts in Quebec to assert my rights.

We think that the current bill carries risks. We can't predict what the courts will say about the scope of section 107. We're worried that it could lead to long legal debates. We would like MPs to ensure that this bill doesn't interfere with civil remedies. We're very concerned about this issue. We urge you to take action to protect consumer rights in Quebec, in order to ensure that consumers can pursue remedies under this legislation, should the need arise.

[Alexandre Plourde]

The problem we have with clause 107 of Bill C‑27 is that it threatens Quebeckers' right to pursue civil remedies, an issue that seems to have fallen off the radar in this bill, but that really worries us.

Based on this clause's current wording, the private right of action—the right to sue a company in a civil court under federal legislation—can only be exercised under very strict conditions: if the Office of the Privacy Commissioner of Canada has found that a company has failed to meet its obligations; if a compliance agreement has not made it possible to compensate the consumer; or if a fine has been imposed in one of the very specific cases set out in the bill.

Otherwise, the consumer cannot sue the company in a civil court, cannot sue for compensation, and cannot assert their rights in court. They could find themselves in a situation where the office of the commissioner, for example, did not accept the complaint they filed against the company or did not make a finding, thereby failing to meet the requirements set out in clause 107. The consumer would then be deprived of recourse in court and would not be able to sue the company in a civil court.

Option consommateurs is an organization that files class action lawsuits and pursues civil remedies before the courts. In many situations, it has launched class action lawsuits against tech giants. For example, it filed a lawsuit against Google. However, that class action lawsuit is not the result of a complaint handled by the office of the commissioner. If we had to interpret clause 107 of the bill strictly, such a class action lawsuit may not be able to take place.

As a result, in order to avoid endless constitutional debates before the courts, we ask that the legislator's intent be clarified, since it is not, I am sure, to limit remedies available to Quebeckers. To that end, we are asking that a subclause be added to clause 107 of Bill C‑27 indicating that it does not exclude provincial civil law remedies. The provincial remedies, the civil remedies, would then be in addition to the remedies set out in clause 107. That would solve a lot of problems and legal debates for us and would give consumers a great deal of access to justice.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you.

Ms. Levac or Ms. Plourde, I have a quick question for you. We are talking about amending clause 107 of Bill C‑27 to remove all restrictions on the exercise of consumers' right to pursue civil remedies. In your opinion, to what extent does that clause restrict the exercise of consumers' right to file a class action suit?

I think that's a fairly unique aspect that we haven't heard about at this table yet.

[Philippe Letarte]

I will say from the get-go yes, but I think Bill C-27 is a really good first step into those regulations. It really lays the foundation upon which we can build and it levels the playing field about modernization and privacy in this country, which is greatly overdue.

In terms of my own interests, I hope we're going to get open banking sooner rather than later. I really believe it is kind of an emergency to have open banking at this point in time, for several reasons.

First, we know that the cost of living in Canada is problematic. We know that we need to give more resources to Canadians. We also know that we are losing competitiveness on international ground, so whatever gets it done the fastest is good, but Bill C-27 is a good foundation upon which we can build.

[Ryan Williams, Conservative, Bay of Quinte, ON]

The premise of this is that it seems these are actually in the right stride, parallel to each other. Bill C-27 deals with data. For those listening at home, the whole premise around consumer-led banking is really to make it mandatory that the banks have to share your personal data with other entities who can bank you, which allows.... In the U.K., where we saw it with 4,000 companies, U.K. residents are saving 12 billion pounds a year and businesses eight billion pounds a year. It's really great.

My first question for you as we look at the key to unlocking consumer-led banking is this: Can consumer-led banking, open banking, exist without this legislation right now?

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

Thank you to all our witnesses.

Mr. Letarte, it's nice to have you here today. I introduced a bill about a month ago in Parliament to make sure that consumer-led banking—open banking—gets going. Actually, I'm going to have a bet with my colleague from Abitibi-Témiscamingue—about $50—on whether we'll get third reading of Bill C-27 first or open banking first. I'm not sure. I think I can win some money off him.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

So I understand that you are in favour of including provisions similar to those in Quebec's Bill 25 in Bill C‑27 to strengthen it.

Who could be called upon to challenge an automated decision?

[Sara Eve Levac]

Currently, Bill C-27 would allow someone to obtain on request an explanations of automated decisions. We propose that this should go further, somewhat as you explained with the Quebec example.

First, it may be difficult for consumers to determine whether a decision concerning them was an automated decision. For example, when credit card applications are denied, no explanation is provided to the applicants that would let them know the decision concerning them may have been automated. Consequently, we would recommend that Bill C-27 provide for an obligation to inform consumers that the decision concerning them was an automated decision.

Then we could request that Bill C-27 provide that explanations be provided regarding that decision. An additional step would be to provide as well that a human being may review a decision made by an automated tool, somewhat as is possible in Quebec, so that person can make observations.

There have been media reports of cases in which people were denied credit because the information considered in making the decision included errors. The possibility that such decisions can be reviewed could therefore help avoid situations in which consumers are denied contracts or loans because the decisions concerning them were based on false information.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Ms. Levac or Mr. Plourde, Bill C-27, which will replace the Personal Information Protection and Electronic Documents Act, will give consumers a new right to explanations for the use of automated decision systems to make predictions, provide recommendations and make important decisions concerning them, even when the data used have been depersonalized.

However, unlike Quebec's Bill 25, Bill C-27 makes no provision enabling anyone to oppose the use of an automated decision system or to review a decision made by such a system. What do you think are the potential repercussions for consumers of the absence of any such provisions from the bill?

[Sébastien Gambs]

The quantum field will have an impact on many aspects of communications security, not just on data monitoring tools.

I think that the security standards that are being developed by the National Institute of Standards and Technology in the United States and that will apply to the Internet already reveal a willingness to provide security tools that will help resist quantum attacks.

I don't know whether Bill C-27 mentions anything regarding post-quantum resistance. Apart from data-monitoring tools, that may concern personal data or data security in general.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Is it necessary to extend the provisions of this bill to the private sector to guarantee complete protection for the data of Quebeckers and Canadians? At the same time, how could Bill C-27 be adapted or reinforced to ensure adequate regulation of the use of these kinds of tools in the public sector?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Mr. Gambs, with your permission, I'd like to benefit from your expertise.

Yesterday, Radio-Canada revealed that government departments and agencies were using spying equipment initially associated with the intelligence community to recover and analyze data, including encrypted and password-protected information. Furthermore, the use of those surveillance tools had apparently not been subject to a privacy risk assessment, despite a federal directive requiring it.

In the circumstances, considering that the public sector is included in Bill C-27, what are the main concerns regarding the use of these types of surveillance tools by government entities and, more particularly, the failure to conduct privacy risk assessments?