Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Sponsor

Status

In committee (House), as of April 24, 2023

Subscribe to a feed (what's a feed?) of speeches and votes in the House related to Bill C-27.

Summary

This is from the published bill. The Library of Parliament has also written a full legislative summary of the bill.

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Elsewhere

All sorts of information on this bill is available at LEGISinfo, an excellent resource from Parliament. You can also read the full text of the bill.

Bill numbers are reused for different bills each new session. Perhaps you were looking for one of these other C-27s:

C-27 (2021) Law Appropriation Act No. 1, 2021-22
C-27 (2016) An Act to amend the Pension Benefits Standards Act, 1985
C-27 (2014) Law Veterans Hiring Act
C-27 (2011) Law First Nations Financial Transparency Act

Votes

April 24, 2023 Passed 2nd reading of Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts
April 24, 2023 Passed 2nd reading of Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Debate Summary

line drawing of robot

This is a computer-generated summary of the speeches below. Usually it’s accurate, but every now and then it’ll contain inaccuracies or total fabrications.

Bill C-27 aims to modernize Canadian privacy laws by enacting the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act. The bill seeks to provide individuals with greater control over their personal data, strengthen privacy enforcement, and establish a framework for the responsible development and deployment of artificial intelligence systems. While proponents argue the bill balances innovation with robust protections, critics express concerns about loopholes, government overreach, and the lack of recognition for privacy as a fundamental right.

Liberal

  • Supports Bill C-27: Liberal members expressed strong support for Bill C-27, emphasizing its role in protecting children in the digital age and updating Canada's privacy framework to align with current technologies and business practices.
  • Modernizing Privacy Laws: Members highlighted the urgent need to modernize privacy laws to address the exponential growth of data and the emergence of new technologies like social media and AI. The goal is to give Canadians more control over their data and ensure responsible innovation.
  • Balancing Innovation: Liberals stressed the importance of balancing strong privacy protections with responsible innovation, allowing businesses to innovate while ensuring they use data responsibly. They mentioned a new exception to consent for activities in which an organization has a legitimate interest, with safeguards to prevent abuse.
  • Protecting Minors' Data: A key focus was on enhancing the protection of minors' personal information, defining it as sensitive and requiring higher standards of protection. The bill aims to give parents and minors more power over this information, including the ability to have it deleted.
  • Regulating Artificial Intelligence: The Liberals emphasized the need to regulate AI to mitigate potential harms, including bias and discrimination, while supporting responsible AI development. The bill seeks to establish clear expectations and regulations for high-impact AI technologies.
  • Global Interoperability: Members noted the importance of maintaining Canada's adequacy status with the European Union's GDPR and ensuring interoperability with international partners. The bill aims to align with international best practices and facilitate cross-border data flows.
  • Enforcement and Accountability: The legislation would strengthen privacy protection by granting the Privacy Commissioner more powers and establishing tougher penalties for non-compliant organizations. A new tribunal would be created to hear appeals and impose penalties.

Conservative

  • Privacy not a right: Conservatives argue that the bill fails to recognize privacy as a fundamental human right. They assert that this omission weakens the bill, making it easier for industry players to be irresponsible with personal data and failing to align with international declarations on human rights.
  • Consent is too vague: The Conservatives claim the bill relies on a flawed 'notice and consent' model, and that the exceptions, particularly 'legitimate interest,' are too broad and undefined. They worry that businesses will determine what constitutes a legitimate interest, trivializing privacy, and that implied consent is not sufficient.
  • Tribunal is unnecessary: The Conservatives criticize the bill for creating a bureaucratic tribunal instead of empowering the Privacy Commissioner. They believe the tribunal will cause delays and that the Privacy Commissioner should have the authority to levy fines directly, aligning with practices in other countries.
  • AI portion inadequate: Conservatives contend that the AI portion of the bill requires a complete rewrite and should be split into its own bill. They argue it lacks independent oversight and gives excessive power to the Minister of Innovation, Science and Economic Development to make political decisions on privacy.

NDP

  • Supports sending to committee: The NDP supports sending Bill C-27 to committee for further study and amendments. They believe it is important to modernize Canada's privacy laws and establish rules around data governance.
  • Splitting the bill: The NDP have asked for separate votes on the artificial intelligence and data act, arguing that it deals with distinct issues from the rest of the bill, and should be considered separately.
  • Falls short of standards: The NDP believes that Bill C-27 does not meet the standards set by GDPR and other privacy legislation around the world, and that numerous amendments are required to strengthen consumer protections and ensure accountability.
  • Need for stronger rights: The NDP is concerned that the bill is lopsided towards the business sector and does not adequately protect individual rights, they will propose amendments to ensure informed consent and better protection for individuals.

Bloc

  • Supports Bill C-27 principle: The Bloc supports the principles of Bill C-27. However, members suggest that the Bill, which combines the consumer privacy protection act and the artificial intelligence and data act, should be split into two separate bills.
  • Privacy as a fundamental right: Bloc members believe that the time has come to treat privacy as a fundamental right. While Bill C-27 is an improvement, it still does not establish privacy as a fundamental right.
  • Harmonization with Quebec law: Since privacy protection is a shared jurisdiction, it is vital that Bill C‑27 not take precedence over Quebec law. Clause 122(2) of Bill C‑27 allows for exemptions where provincial legislation is substantially similar and applies within that province, such as Quebec's Bill 25.
  • Need for further study: The Bloc will support the bill at second reading but believe the real work must be done in committee. Good principles do not necessarily make good laws, and the committee needs to hear from witnesses from all walks of life. When it comes to privacy, it only takes one tiny flaw to bring down the whole structure.

Green

  • Concerns with AI regulation: The Green Party acknowledges the complexity of regulating artificial intelligence and data, emphasizing the need for thorough study and consideration of potential unintended consequences. They suggest that the AI and data act (part 3 of the bill) may warrant separate committee study to ensure comprehensive review and understanding.
  • Privacy for political parties: The Green Party believes that privacy legislation should apply to political parties, which are currently exempt. They advocate for adding political parties to the list of organizations obligated to protect the privacy of Canadians.
  • Potential privacy issues: The Green Party raises concerns that the legislation could weaken some privacy protections, referencing an assessment that gives the bill a low passing grade. They intend to propose amendments to address these concerns during the committee stage.
  • Clarify privacy exemptions: The Green Party agrees with concerns raised about overly broad exemptions within the bill, specifically referencing subclause 18(3). They emphasize the need for further clarification regarding what constitutes a "legitimate" reason for invading people's privacy.
Was this summary helpful and accurate?

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:20 p.m.

Conservative

Ryan Williams Conservative Bay of Quinte, ON

Madam Speaker, I have spent a lot of time on the ethics committee with the member for Trois-Rivières, and we have dealt with a lot of this material. It has been fantastic.

He spoke about Quebec being a model for Canada, as Quebec has some of the strongest privacy laws in place at the moment. I am wondering if he could expand on two things. One, what does Quebec have that we could implement through Bill C-27 that works really well? Two, does Quebec mention privacy as a fundamental human right for Canadians?

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:20 p.m.

Bloc

René Villemure Bloc Trois-Rivières, QC

Madam Speaker, to reassure my colleague, Quebec does indeed mention that the right to privacy is a fundamental right.

What is most important is that the Quebec act protects the data, no matter where it is used. It is protected based on the location of the individual. The laws apply in that place. At the same time, we do not only consider the size of the entity, but also the source of the data.

These are minor differences, but they are important at a time when data is shared around the world.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:20 p.m.

NDP

Lori Idlout NDP Nunavut, NU

Uqaqtittiji, it is good to hear that the Bloc is willing to support this bill. I share the same concerns about the provisions for protecting minors, and the bill right now as it is does not provide very good guidance on sensitive information.

I wonder if the member agrees that this bill could be enhanced by providing more guidance on how to handle sensitive information in relation to protecting minors.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:20 p.m.

Bloc

René Villemure Bloc Trois-Rivières, QC

Madam Speaker, I completely agree with my colleague's comments.

Bill C‑27 is a good bill, but it is incomplete. We need to go further with respect to protecting the rights of minors, in particular. Today, minors are vulnerable, but they are the ones sharing the most data without it being protected. They will have to live with that for their entire lives. Therefore, I completely agree.

I hope that in committee we will be able to propose amendments that are accepted by the government in order to protect minors.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:20 p.m.

Bloc

Christine Normandin Bloc Saint-Jean, QC

Madam Speaker, I thank my eloquent colleague for his speech. We always learn a lot when we listen to him. It is always enjoyable.

I would like to hear what he has to say about what will happen in committee. I understand that there is a massive amount of work to do to make this bill acceptable since it currently contains many flaws. Often, the contributions of expert witnesses are what support us in committee.

I would like to know what kind of experts he thinks it would be useful to hear from. Perhaps computer scientists, ethicists or legal experts? Generally speaking, who would he like to see testify in committee?

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:20 p.m.

Bloc

René Villemure Bloc Trois-Rivières, QC

Madam Speaker, for a bill like this one that will have such a major impact on society, I think that we need to invite a rather broad range of witnesses, whether it be anthropologists, philosophers, ethicists, demographers or futurists. We will invite a computer scientist to appear at the end. The idea is that we need to think about the world of tomorrow and beyond.

I think that we should invite witnesses from all backgrounds and that we need to have the legislative maturity to listen, even when what we are hearing may be unpleasant. When exploring every angle of an issue, we need to hear all points of view and I am willing to do that.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:25 p.m.

NDP

Rachel Blaney NDP North Island—Powell River, BC

Madam Speaker, one thing that is a bit concerning for me in this bill is how broad and complex it is. It brings a lot of things into one place, and that can sometimes be a lot. It is important for us to have a process to look through that very closely to make sure that nothing is left out, and that does concern me.

One thing in particular that I have reviewed is the personal information and data protection tribunal. I asked a question of the minister earlier today and the minister was very clear: He felt this is a normal process and no one should worry. However, I am concerned, because this tribunal would have the ability to overrule the new enforcement actions and fines imposed by the Privacy Commissioner. Unfortunately, the vagueness of the membership of the tribunal is a concern, with many of its members appointed by the government. Today, we know it is very important that we not have any conflict or any perception of conflict. Both of those things are important.

I am wondering if the member could talk about whether this could be perceived or actually implemented in such a way that it allowed the government to use it as a political tool for the government to overrule decisions that it simply does not like.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:25 p.m.

Bloc

René Villemure Bloc Trois-Rivières, QC

Madam Speaker, I thank my hon. colleague for that excellent question. At this point, we do need some parameters we can use to define the tribunal's role and the Privacy Commissioner's role. I think the commissioner should have a little more power.

I am usually on the Standing Committee on Access to Information, Privacy and Ethics, but this time around, I will be on the Standing Committee on Industry and Technology because I want to make sure this work gets done. I will make sure that we do this work rigorously, that we take a non-partisan approach to assessing this bill and that we get everyone on board with the bill.

Let me reiterate that this bill will have an impact on people's lives in the future. That is why we cannot let it become a political tool. I do not think it is one at this point, but I want to make sure it never becomes one. We will have to clearly define the roles of the tribunal and the Privacy Commissioner, as well as those of the higher courts, which may want to rule on these matters. There is some confusion about these roles that needs to be cleared up.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:25 p.m.

NDP

Randall Garrison NDP Esquimalt—Saanich—Sooke, BC

Madam Speaker, I thank the hon. member for his very perceptive speech on this act. I wonder if he shares the concern I have, which is that whatever good provisions are here, a lot of my constituents do things every day online that put their privacy at risk. They do not understand the implications of the things that have become routine. When I read through the bill and I look at this, I wonder how we are going to deal with that problem in the future, because this is very complex material. Ordinary consumers are giving up their privacy rights, not willingly, but because of the complexity of the issues they do not really understand the implications of with respect to their privacy.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:25 p.m.

Bloc

René Villemure Bloc Trois-Rivières, QC

Madam Speaker, I thank my colleague for his question.

When we reviewed the geolocation project at the Standing Committee on Access to Information, Privacy and Ethics, we realized that someone with a Telus phone had not consented to their data being shared. It is very clear.

There is already an education component in the Privacy Commissioner's mandate, but I think it needs to be exercised more, because right now, when people click on “I agree”, most of them do not know what they are agreeing to.

As part of a recent committee mandate, we recommended that it should be possible to continue without accepting. I think there needs to be good privacy education in schools and at home. However, I also think that the Privacy Commissioner should be doing more on the prevention side of things. Right now, we are basically left to our own devices. Once we click “I agree”, it is too late.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:25 p.m.

Bloc

Gabriel Ste-Marie Bloc Joliette, QC

Madam Speaker, I thank my hon. colleague from Trois-Rivières for his interesting speech.

The French magazine L'Express ran a story this week in connection with what the member was referring to. It said that it can take five, six or nearly seven hours to read the terms of service on Internet sites. That is what we are asked to do before clicking “I agree”.

Does the member believe we should set limits for this type of practice?

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:25 p.m.

Bloc

René Villemure Bloc Trois-Rivières, QC

Madam Speaker, yes, I do. I believe that even the legal team who wrote the conditions we have to read before we agree to use Apple, for example, has not read all the conditions because it is too complex. Obviously, this needs to be put in layman's terms and simplified. When we sign a contract, it is advantageous to the drafter of the contract. When we are required to sign the contract, as in the case of an Apple iPhone, it is a problem.

In past meetings of the Standing Committee on Access to Information, Privacy and Ethics, we voiced our desire to simplify this and draw inspiration from Europe's General Data Protection Regulation to determine if it is possible to move forward without accepting the conditions.

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:30 p.m.

NDP

Alexandre Boulerice NDP Rosemont—La Petite-Patrie, QC

Madam Speaker, since we are talking about the rights of citizens, I would like to ask a question that is timely and urgent.

Does my colleague agree that a government should use the notwithstanding clause to take away workers' right to strike?

Digital Charter Implementation Act, 2022Government Orders

November 4th, 2022 / 1:30 p.m.

Bloc

René Villemure Bloc Trois-Rivières, QC

Madam Speaker, I thank the hon. member for his question.

I was speaking on Bill C-27 this morning. I am not an expert on the notwithstanding clause. Unfortunately, I will not be able to answer his question because I do not have the legal background to do so.