Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I appreciate that, but we are studying Bill C-27 now. That is the discussion we're having. We can ask any question we want of witnesses on Bill C-27, a very large bill. This is about the relationship of two studies and Bill C-27. I could point you to the procedures book—“the big green book”, as we all call it—and page 1061. The reference there allows us to reference the topic at hand that we're discussing. It would be in order.

Perhaps the clerk could take a look at that page. I know she knows this book inside out, because I've talked to her a lot about it in the past. She's very knowledgeable about it.

If you'd like, I could take a minute, or I could read it in. I don't think that's necessary, probably, since the clerk has it. It's on page 1061.

[The Chair, Liberal, Joël Lightbound]

Procedurally, Mr. Perkins, I understand you're giving notice of the motion. You're not tabling it, because, if notice was not given, to table-drop a motion, it has to be on the topic discussed. We're on Bill C-27.

I understand there's one sentence at the end that would pause Bill C-27. It's not precisely on the topic. I'm tempted to say this cannot be discussed right now, because notice was not given, but I'll hear you out, Mr. Perkins, on that.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Dr. Guilmain.

Mr. Chair, I'd like to propose a motion, because I was poked by the bear. I wasn't going to do this, but I'll do it now, anyway.

I move that, pursuant to the request for documents passed by the committee on November 21, 2023, the committee order the Minister of Innovation, Science and Economic Development to produce unredacted copies of the Stellantis-LGES battery plant contracts to members of the committee in both official languages—in other words, get it translated—by Tuesday, November 28; further, that the committee pause the study of Bill C-27 until the contracts have been circulated.

The reason, Mr. Chair, for doing so is that we all know the government has hired, over the last few years, another hundred thousand officials. Surely, they can get it translated if the contracts weren't presented in both official languages. It surprises me that the government would not have contracts in both official languages before signing them.

I request that all efforts be made on this critical issue, where such a large government subsidy is involved and where there are such conflicting public reports about what's going on, so that we get access, as committee members, to the terms outlined—as MP Turnbull amended and as the Liberals voted for, ultimately—in the motion at our last meeting. Get the French quickly. It should not take some undefined period of time for the government to present it. We can't get on with the urgent nature of what we passed at the last meeting without, justifiably, a French version and an English version of the contracts.

I think the government should treat this with the most expediency and put all the resources it can into addressing the needs of this committee. I'm asking that they produce the translated documents very quickly. Once we get them, we'll pause for the day or two we need to look at the contracts. This isn't an indefinite pause. It's to give us the opportunity. Let's say we had them by Thursday. Instead of Thursday's meeting, we would have the day on Thursday to take a look at the contracts, if that's the way it works out.

Thank you, Mr. Chair.

[Antoine Guilmain]

If I may, I'll answer in three parts.

First, there is Bill C‑27 in and of itself. I grant you, in my humble opinion, that part 3 and parts 1 and 2 are probably unrelated. That's a real problem. I won't hide the fact that, when I talk about the aspect of Bill C‑27 that I like—it's always like that in a relationship, we like or we like less—I'm talking about parts 1 and 2, to be quite honest with you. That's the first thing. I think part 1 is a very good start. There are gaps. As I told you, it's not perfect in terms of compensation and the flexibility of consent, among other things. However, in my opinion, the bill is a very good foundation.

Second—and I go back to my earlier comment—I think there's a common sense rule with respect to this piece of legislation. It's just a matter of looking at the obligations in a very cold way. We have to ask ourselves some questions. I would like to come back to the example of the famous La Tuque convenience store, which, by the way, is being well advertised. I don't know if there are two, though. In any case, if I were the owner of this famous convenience store and I saw this text, I would wonder if it would help me in how I operate. Is this piece of legislation really going to change the way I do things? That is the objective. We really have to show businesses that we don't want to create problems for them for the sake of creating problems for them. We have to tell them that we want to help them focus their attention on the right things.

I gave you the example of the privacy officer. I don't personally believe that our convenience store needs a privacy officer. I think it's that kind of analysis that could really help small and medium-sized businesses. We have to put ourselves in their shoes and ask ourselves whether, based on what we see, based on non-sensitive data…. Again, I think this is an important element, because small and medium-sized businesses have a voice that is heard, obviously, but it will depend on the data. Data is really the key. However, I think you have to look at some of those things, and obviously that has been taken into account in some provisions and not in others.

Perhaps we need to make an effort to be consistent and to ensure that this aspect is truly taken into account. That could help, I think.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you, Mr. Chair.

I'd like to thank all the witnesses. Their comments are really very interesting.

Mr. Guilmain, I'll turn to you.

I'll go back to the example you gave, the convenience store in La Tuque. We all understand that you chose that location, since the convenience store is in Minister François-Philippe Champagne's riding. Up until now, he probably thought he had a little private life, but with the convenience store story, his life has now become public.

I'm using your example to talk about small businesses across Canada. We know that 95% of businesses in Canada are the backbone of our economy. With this bill, we are addressing both individuals and businesses and entrepreneurs who will have to adapt to this legislation.

Earlier, you referred to a survey you conducted on Quebec's Bill 25. Nearly 70% of respondents needed more information or clarification on the act.

Do you think the process will possibly be the same for Bill C‑27?

We're talking about consultations. You think this is a good bill, from what I understand. However, I must say that this isn't exactly what we've heard since the beginning of the consultations.

A number of people have told us that they weren't consulted. Representatives of organizations, who have appeared before our committee so far, have said that they weren't consulted. Some have told us that it would be preferable for them to be consulted. I think one of the witnesses said so earlier. He said that it would be good if there were more consultations.

Do you think it would be a good idea to hold more consultations?

We've been told on a number of occasions that we should normally, at the outset, separate the whole issue of artificial intelligence from that of privacy, because they are two completely different things.

What are the real or possible consequences of the elements that will, in a way, bury SMEs in bureaucracy?

[Antoine Guilmain]

Yes. I think there are two sub-aspects from my perspective.

The first aspect is the transition period. I think we should not undermine the fact that, even though there are already processes in place with PIPEDA and potentially with law 25, it does take time to have something that is meaningful.

I'm a lawyer, so I wish I could tell you that it's only a question of the papering aspect and just giving some policies and moving on. The fact is that privacy is much more than only legal professionals. I think there's an understanding internally in any organization to understand what is going on in terms of data flows and what we do to protect the information we have.

That's the reason why I tend to think that 36 months is the bare minimum. As a matter of fact, when we look around the world, that's what we are seeing. We saw with law 25 that 24 months was not sufficient. At the moment, companies are struggling very much to comply even with law 25, most of which came into force.

On the second aspect of your question, regarding what we can change, I will give you a simple example. If we go to proposed section 8 of the CPPA, it says, “An organization must designate one or more individuals to be responsible for matters related to its obligations under this Act.” I'll go back to my example of the convenience store in La Tuque. They have very little personal information. Their first question when they come to me would be, “Whom do I appoint? Who is my privacy officer?”

I think this is where it is problematic. It's not based on the size of the company; it's more a question of the volume and sensitivity of the information, the good news being that this threshold is present in Bill C-27 in some disposition. In particular, when I look at the privacy management program in proposed section 9, there is a caveat: depending on the “volume and sensitivity” of the information. I think the key aspect would be just to look at those absolute requirements and say, do we have a threshold based on the volume and sensitivity of the information? I think this could be a good exercise in the full version of the CPPA at least.

[Michelle Gordon]

That's a really good question.

I generally support the new exceptions to consent in Bill C-27 , which are similar—slightly different—to the GDPR. I agree that the application of the legitimate interest exception, whether as a stand-alone right or as an exception to applied consent, will help a contextual analysis and will help nurture innovation and allow for a difference between...how organizations look at their programs and at accountability and transparency.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

I want to stay in the same vein. I think this is a great discussion.

We obviously believe in privacy as a fundamental right, but at the same time, businesses have to be able to collect and use data. We're in a unique situation right now with Bill C-27 because the GDPR has just come into place with some of their.... I hate to call it red tape, but it's the processes in which businesses, small and otherwise, have to follow those rules.

We're trying to look for good amendments in this bill that obviously make sure that privacy is held as a fundamental human right, but also protect businesses from the overburden and the policies and procedures that are going to weigh on businesses' ability to do business as well as collect and use data for good.

I'm going to start with Ms. Gordon.

What can we do in this bill to ensure that this collection and the consent models are easy for businesses while also protecting privacy? What have we learned from the GDPR?

[Antoine Guilmain]

In terms of aligning with the European Union, I must say that it will require an analysis that may take years. Japan recently received a suitability decision and is considered a good country for the transfer of personal information. This is the result of years of work by the European Commission.

I think Bill C‑27 is a very good bill in terms of complying with European standards, in this case the European Union's General Data Protection Regulation. There are a lot of “Canadianized” concepts, if I may say so. It's worded a little differently, particularly when it comes to sensitive data. I still think that Bill C‑27 is a good bill in that regard, apart from certain aspects on anonymization and the legal basis for handling personal information, as I mentioned.

[Antoine Guilmain]

I'd first like to mention that our federal legislation, the Personal Information Protection and Electronic Documents Act, PIPEDA, is a quality piece of legislation. I wouldn't say that there's an urgent need to act, but that's a very personal opinion. There are fairly broad concepts in PIPEDA that already allow companies to do very good things. We aren't in a vacuum at the moment.

That said, Bill C‑27 is very ambitious. I'm talking about the part that deals with the protection of personal information. We shouldn't underestimate the time it will take to adjust the processes. Let's not forget that companies had to grapple with Quebec's Bill 25 a few months ago and complied with it last September. It was a real in-house effort.

I think there's an interest in avoiding a duplication of resources, at the risk of creating a kind of fatigue on the part of companies with regard to requirements. Businesses will no longer understand the message being sent to them. I think it's important to keep in mind the significant transition period.

I don't think there's an urgent need to act, but that's my very personal opinion.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

I'd like to ask you some brief questions about the delays in passing Bill C‑27, since you've opened the door in that regard. Is there an urgency to act? What would the consequences of that be, if we took our time, in a parliamentary context like ours? What do you think about the government's delay in enforcing the act?

[Antoine Guilmain]

There's a fairly fundamental difference. As you know, when it comes to privacy, the notion of consent is central. It's all about consent. We're talking about either express consent implicitly or an exception to consent. That's how Bill C‑27, the current federal act and the Quebec act are built.

Currently, Quebec's approach is very different from the rest of Canada. In fact, it decided to enshrine in law that, when it comes to the collection of personal information, consent isn't always required, provided that the reasons for collecting, using or communicating personal information are disclosed. This was recently confirmed in the guidelines of the Commission d'accès à l'information du Québec.

What does that mean in concrete terms? It's very theoretical, but it's not that theoretical. When you visit a website, you are “attacked” by various methods of consent. That's what we want to impose on children. As adults, our ability to concentrate is very limited. Personally, I have a full-time interest in this, and I don't read everything.

Quebec has decided to take a different approach: we don't force people to give express consent, to click, we just give them the information, and then they can continue with the process. This aspect of transparency is unique to Quebec.

At the moment, the federal legislation, as drafted, seems to indicate that a positive gesture should always be made in certain cases. I think that's a pretty significant difference. Again, not a bad thing. In fact, we're a different approach to the problem. We're providing a little more transparency, a little more control, instead of forcing people to consent in an almost fictitious way.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you for your answer.

In that case, what amendments would it be worthwhile to make to Bill C‑27 to ensure better compatibility?

I'm particularly sensitive to the need to have an environment conducive to innovation and investment. In the current context, is there a risk of establishing standards that could undermine investment and innovation in Quebec?

[Antoine Guilmain]

At the moment, conceptually, Bill C‑27 is quite compatible with Bill 25. I would even say that, in many respects, Bill 25 is stricter than Bill C‑27. I'll go further than that: Bill 25 is one of the strictest laws in the world. That has to be recognized.

In my practice, I work with international clients, whether they are based in the United States, Europe or Latin America, and today, they look at Bill 25 and say that it's really one of the most complicated laws to implement and that it's difficult to comply with it. That's not a good thing.

My position today, quite frankly, is that the two pieces of legislation are compatible. However, I think there are lessons to be learned from Bill 25. I took the liberty of quoting the European Union's General Data Protection Regulation, the GDPR, and I think that's a very interesting model for Bill C‑27 to look at. That's really my position.

There are some very good things in Bill C‑27. It should be noted that, from a legislative standpoint, it makes a very different change. Bill 25 amended existing legislation by patching things up a little. We tried to add an act dating back to 1994. The beauty of Bill C‑27 is that it's unified. There really is a collective understanding.

So my comment on this is to say that looking at Bill 25 as a yardstick may not be the best approach, in my humble opinion.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

My thanks to all the witnesses. I think we're having a very high-quality meeting today, and I'm very grateful to them.

Mr. Guilmain, I'll start with you. I'm going to continue in the same vein as one of my colleague Mr. Sorbara's questions. According to a letter published on the committee's website, although the minister assures that the Quebec legislation will prevail in the province, Jim Balsillie, in particular, expresses concerns that, if Bill C‑27 sets standards that are lower than those of Quebec's Bill 25, it could hinder innovation and jeopardize investments in the Quebec economy.

With that in mind, how do you assess the potential impact of Bill C‑27 on Quebec's economic landscape, particularly on investment and innovation?