Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Digital Charter Implementation Act, 2022

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, we have, for example, the ruling of Justice La Forest on it 34 years ago. We have section 8 of the charter, which has been interpreted by the courts as protecting privacy rights.

Privacy is what this bill should be all about. It is because of concerns over people's personal, private information that this attempt to legislate the issue is in front of us. However, the fact of the matter is that there are so many exceptions to the rule that it really would not at all do what it is supposed to do. In fact, it would really make matters worse.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, there were a lot of good issues that my colleague raised in this context, but I am concerned about where the Conservatives are at this moment, and maybe he can outline the alternative.

Right now, if we do not send the bill to committee, we then trust it to go back to the government and basically assume that it might do more consultation, that it might look at other legislation, that it will even bring the bill back and that the House could actually stand around for that process. If we do nothing on it, we then exclude all the commentary and information we should be getting from hundreds of witnesses who want to actually participate in a public debate on this right now.

Perhaps the member can lay out his party's vision on how long it will take AI to actually be raised in a responsible manner outside of the controls of the government alone, if the bill does not go to committee and we shut everything down now.

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, the problem with this legislation is that it is just so fundamentally flawed. We just could not deal with all the changes that need to be made in the context of a committee. As just one example, when it comes to protecting the privacy rights of children, there is only one mention in the entire bill. It does not define “minor”. It does not define “sensitive information”. If this were a serious attempt at legislation, we would have, at the very minimum, hard and fast protections for the privacy rights of children, but the bill just does not do it. That is only one thing out of dozens of things.

The bill needs to go back to the drawing board. It needs to be more like what they have done in the European Union and it needs to protect Canadians' privacy.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Mr. Speaker, I rise to speak to Bill C-27, the digital charter implementation act. This legislation is the first update of federal private sector privacy laws in more than two decades.

Contained within this bill are three distinct pieces of legislation, each of which is flawed in its own way. The first piece of legislation within this bill would establish the consumer privacy protection act, legislation that completely fails to protect personal and sensitive information of individual Canadians in the digital era. The second piece of legislation within this bill would establish a tribunal system with respect to complaints around potential privacy rights violations. I submit that this tribunal system is duplicative, cumbersome and political, and that it would slow down the process of adjudicating and determining privacy complaints, to the detriment of individual Canadians and often to the benefit of powerful corporations.

The third piece of legislation within this bill seeks to establish a legal framework with respect to artificial intelligence systems. Let me say that it is important that the regulatory void that presently exists, with respect to the AI sector, be filled, but the substance of the bill, as it pertains to AI, is fundamentally flawed. It contains vague language. More concerningly, it puts a significant amount of legislative power in the hands of the Minister of Industry by way of regulation, absent parliamentary scrutiny.

The government is essentially asking, with respect to AI, for Parliament to adopt a bill without knowing the details and without understanding the impact of the bill on AI. It is saying, “Trust us. Trust the minister to fill in the blanks and come up with the rules after the fact.” I do not trust the government on anything, after it has gotten just about everything wrong over these past eight years. In any event, it is an overreach. It is a power grab of sorts. It is inherently undemocratic and it undermines investor confidence in the AI sector when we need investor confidence because of the uncertainty the bill creates in giving the minister the power to essentially come up with and change the rules on a whim.

When it comes to the AI component of the bill, the government needs to go back to the drawing board and engage in meaningful consultation, consultation that simply did not take place.

This is a complex bill. It is more than 100 pages long. It includes many complex and technical matters and so, in the very limited time that I have to contribute to this debate, I want to focus on how this bill fails to adequately protect the privacy rights of individual Canadians.

Privacy has long been recognized as a fundamental right of Canadians. That is because it goes to the core of who we are as individuals and is essential to the enjoyment of fundamental freedoms. As the Supreme Court declared in a 1988 decision, “Privacy is at the heart of liberty in a modern state” and privacy “is worthy of constitutional protection”.

Unfortunately, Bill C-27 fails to put the privacy rights of Canadians first. Instead, it puts the interests of big corporations, big tech and data brokers ahead of the rights of individual Canadians, and that, without war, is unacceptable.

It is true that the preamble of the bill refers to privacy interests, and I emphasize the word “interests”, as being integral to individual autonomy, dignity and the enjoyment of fundamental freedoms. It is of significance that missing in the bill is any mention of rights, but instead privacy is referred to as an “interest” and not the right that it is.

The absence of rights-based language in the bill tips the scale against individual Canadians in favour of commercial interests. As a consequence, the tribunal, as well as the Privacy Commissioner, would face significant challenges in weighing the privacy rights of Canadians against commercial interests, more likely than not, unfortunately, to the detriment of individual Canadians.

Members do not have to take my word for it. They can take the word of the former privacy commissioner of Canada, Daniel Therrien, who, in a November 13, 2022, op-ed in the Toronto Star said that the absence of rights-based language in this legislation “will likely reduce the weight of privacy in assessing the legality of intrusive commercial practices.” That was from the former privacy commissioner of Canada.

While the absence of rights-based language is a significant shortcoming in the bill, it is far from the only shortcoming in the bill when it comes to protecting the privacy rights of Canadians.

The bill contains many exceptions and loopholes with respect to obtaining the consent of Canadians for the collection, use and retention of data and private or personal information. So wide are the exceptions, so wide are the loopholes that the purported protections provided for in the bill are all but meaningless. The bill provides no clarity with respect to sensitive information. There are no broad categories around sensitive information, information worthy of additional protections, unlike legislation in other jurisdictions.

The bill is completely silent with respect to the selling of data. It provides no limitations or rules around data brokers. It provides nothing in the way of protections for Canadians around other areas. It does not provide a remedy, for example, for moral damages in the case of data breaches.

In so many respects, this bill falls short, and that is why it has been widely criticized by leading privacy experts. Canadians deserve better. That is why Conservatives will be voting against this bill. The Liberal government needs to go back to the drawing board.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, the member started off by talking about the sense of urgency that is there, because of the timing. It has been many years since we have seen the modernization of legislation to deal, in a substantial way, with the issue of privacy on the Internet. There are all forms of data banks and other things that are out there. People want to have the assurance that the national government is in fact acting on the issue.

My concern is that the Conservative Party seems to be determined not to see privacy legislation. Even if it disagrees with it, the principles of the legislation are very positive. Why would the Conservative Party not want to see this legislation at least get to the committee stage, where it could be further discussed?

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Madam Speaker, to answer the parliamentary secretary to the government House leader, the bill is fundamentally flawed. It is unsupportable on that basis. If it were a matter of a few amendments, it would make sense to send the bill to committee on the basis that the bill was supportable on principle, but that is not the case with the bill. Indeed, with respect to the consent provisions of the bill, the bill arguably would take a step back from the completely inadequate measures that were provided in PIPEDA.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, the section of the legislation on artificial intelligence, or AI, suggests self‑regulation. I would like to know whether my colleague supports self‑regulation or if, on the contrary, the state should further regulate the use of AI.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Madam Speaker, what we need with respect to the AI component of the bill is clarity, and we need certainty. What we do not need is the power grab the government has afforded itself, whereby the minister would be afforded enormous powers by way of regulations that would create significant uncertainty.

There was a complete lack of consultation. I believe the consultation only began in June, and that underscores why the bill needs to be scrapped and needs to be defeated. The government needs to go back, do its homework, engage in consultation and get this right.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, we have been talking a lot today about, as I have certainly heard clearly from the Conservatives, how the bill is without redemption and cannot be fixed as it is just too flawed. One of the previous speakers for the Conservatives mentioned that maybe it could be split into two because it is so large, and certainly I agree. There are so many things that are the matter with the bill, and this is not the first time we have seen Liberal legislation that is highly flawed and that we must try to spend a great deal of time fixing. However, the parliamentary secretary and my own colleague noted the timing, and going back and taking our time knowing the industry is moving so quickly and the technology is moving so quickly.

Are there any recommendations the member could make for when it goes to committee? Maybe splitting the bill into two would be potentially helpful so we can take our time. The bill is out there, so what can we do to make it better?

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Madam Speaker, if the bill is passed, given the trend with respect to data practices, the bill will be, for all intents and purposes, already out of date, and that is a problem. However, I would submit that if it is studied at committee, which I expect it will be, it would require significant amendments around protecting the individual privacy rights of Canadians. There are major gaps missing from the legislation that I outlined, including with respect to sensitive information. There is a lack of broad categories, and the fact that this is not defined needs to be worked on. There are a whole lot of other provisions. There are many, in fact, which is why we cannot support the bill.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, I am proud to rise on behalf of my privacy-loving constituents in Renfrew—Nipissing—Pembroke.

Bill C-27 is another piece of legislation that had to be resurrected after the Prime Minister called his superspreader pandemic election. Originally, this was supposed to be a long overdue update to the Privacy Act, and it has since morphed into Bill C-27, the data-grab act.

Everything about Bill C-27 should leave the Liberals feeling embarrassed. A Canadian's right to privacy is fundamental. Sadly, Canadians' privacy rights are not a priority for the government.

This bill has languished for years. It was first introduced immediately after the original online streaming censorship act was introduced. However, when the Prime Minister called his pandemic election and reset all legislation, what did the Liberals make a priority? Was it the privacy rights of Canadians? No. Was it securing Canadians' ownership over their data? No. Instead, what the Liberals prioritized was a bailout for big telecom and a bailout for the legacy media.

Not only does the government care more about padding the bottom line of Postmedia, but it also adopted Rupert Murdoch's false narrative about tech profiting off the content produced by the news media. Social media companies and search engines do not profit off the news media. They profit off us. These companies profit off our data, and the Liberals know the truth. Unfortunately, this legislation seeks to make it easier for companies to profit off our privacy.

If Bill C-27 is not significantly improved at committee, then together with Bill C-11 and Bill C-18, the government will have entrenched the surveillance economy in Canadians' lives. By combining the updates to the Privacy Act with the creation of a new artificial intelligence act, the Liberals have actually illustrated the brave new world we live in.

The Privacy Act and the way we talk about privacy even today are holdovers from the industrial era. We do not live in that world anymore. In the industrial economy, privacy rights were concerned with the ability to control what information could be shared. The goal was to prevent harm that could come from our personal information being used against us.

In effect, information was personal and an economic liability. We spent money on shredders to destroy personal information. The careless use of our personal information could only have a negative value, but then the world changed. Our personal information stopped being a liability and became an asset.

It started out slowly. Early examples were Amazon recommending a new book based on previous purchases and Netflix recommending what DVD rental we should next receive by mail. Google then began displaying ads next to search results. That was the eureka moment: Targeted ads were very profitable.

However, the targeting was pretty basic. If someone searched for shoe stores near them, Google returned search results alongside ads for shoes. Then it became ads for shoes on sale nearby. Then came Facebook and millions of people signed up. In exchange for an easy way to connect with friends and family, all someone had to do was share all their personal information, like who their friends were, how many friends they had and their geographical proximity to friends.

With the addition of the “like” button, the data harvesting exploded. If someone liked a news story about camping, they would start seeing ads for tents and sleeping bags. Every action Canadians took online, every single bit of their data, was commodified. Our privacy was turned into property and we lost both.

Not only does this bill not secure privacy rights, but it effectively enshrines the loss of our property rights with just two words: legitimate interest. Proposed subsection 18(3), entitled “Legitimate interest”, has this to say:

(3) An organization may collect or use an individual's personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use

Is “legitimate interest” defined anywhere in the legislation? No. It is just another example of the vagueness found throughout the legislation.

Even if we accept the plain-language definition and that private business really somehow does have a genuine, legitimate reason to collect private information without consent, it is weighed against the adverse effect. However, this is industrial-era thinking. It views personal information only as a potential liability. Businesses have a legitimate interest in making money. With the Internet and mobile phones, much of our private information can be collected without any adverse effect. This legislation turns the private information of Canadians into the property of corporations and calls it legitimate.

I mentioned earlier that combining the privacy legislation with the AI legislation actually puts a spotlight on the issue of private data as property. However, as important as it is to highlight the connection, it is more important that these bills be separated. The artificial intelligence and data act has been slapped onto previously introduced privacy legislation.

With the privacy portion of the legislation, the devil is in the details. Overall, however, the bill reflects a general consensus developed over countless committee studies. That is not to mention the contributions to the privacy debate from the federal and provincial privacy commissioners. The issue has been well studied, and the minister has indicated that the government is open to responsible amendments. I am sure that the committee is well equipped to improve the privacy sections of this bill.

The same cannot be said about the artificial intelligence section of the bill. It seems rushed, because it is. It is intentionally vague. The Liberals claim the vagueness is required to provide them with regulatory flexibility and agility. The truth is, they do not know enough to be more precise. I have been trying to get a study on artificial intelligence in the defence committee for years, but there was always a more pressing issue. AI was treated like nuclear fusion technology, something that was always just over the horizon.

Since this bill was introduced 10 months ago, we have gone from ChatGPT to open-source GPT models, which any teenager can apparently run on their personal computer now. AI programs went from producing surrealist art to creating photorealistic images of the Pope in a puffy jacket. We have gone from short clips of deepfake videos impersonating real people to generating fictional people speaking in a real-time video. When we all started to learn Zoom in 2020, how many people thought the other person on the screen they were talking to could just be a fake? Now it is a real possibility.

The speed at which AI is developing is not an argument for delaying AI regulation; it shows that it is imperative to get the regulation right. Would this bill do that? The only honest answer is that we do not know. They do not know. Nobody truly knows. However, we can learn.

We should split this bill and let the stand-alone AI bill be the first legislation considered by one of the permanent standing committees, adding artificial intelligence to its official responsibilities. Artificial intelligence is not going away, and while much of the media attention has focused on chatbots, artistic bots and deepfakes, AI is unlocking the secrets to protein folding. This has the potential to unlock cures to countless different cancers and rare genetic diseases.

A paper was just published describing how an AI trained on data about the mass of the planets and their orbits was able to rediscover Kepler's laws of motion and Einstein's theory of time dilation. If we get this wrong, Canada could be left behind by the next revolution in science and discovery.

Given the government's track record on digital technology, Canadians should be worried about the Liberals rushing vague legislation through to regulate an emerging technology. Rather than modernizing the Broadcasting Act, they are trying to drag the Internet back to the 1980s. With Bill C-18, they claim that linking is a form of stealing.

The Liberals and their costly coalition allies do not even understand how broadcasting technology or the Internet works. They see people's personal data as the legitimate property of corporations, and now they are seeking the power to regulate a revolutionary technology. They did nothing while the world shifted below them, and now they are trying to rush regulations through without understanding the scope and scale of the challenge. Protecting Canadians' privacy and establishing property rights over their personal data should have been prioritized over bailing out Bell and Rogers.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, the legislation the member makes reference to is there, in essence, to modernize the broadcasting industry. This has been pointed out. It is there to ensure a more level playing field. It is there to ensure that some of these big worldwide tech firms are contributing to Canadian content.

This legislation is there to protect the privacy of Canadians. A lot of this legislation, and there is a substantial amount, is there because there is a need for it. It is needed as the Internet and technology continue to grow, whether it is AI or the many other types of data fields people are worried about. Would the member not agree that we need to change with the times and bring in this type of legislation in order to protect the interests and the—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I need to give the hon. member for Renfrew—Nipissing—Pembroke time to answer.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, the member opposite should realize that the Internet is not a form of broadcasting. The Broadcasting Act was brought in to regulate the different bandwidths and the allocations to different stations. We do not need that with the Internet. Instead of regulating technology in the public's interest, they are now regulating speech in the interest of the legacy media. Let us get the privacy bill to committee so that it can be improved and passed.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, my colleague spoke at length about regulating AI. I wonder if she is aware of the European Union bill called the AI Act that was introduced in November 2021 and is currently being studied for adoption by the European Union.

Does she believe we should wait and take guidance from this standard, which is set to become the golden rule internationally anyway?