Bill C-27 (Historical)

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

This bill is from the 44th Parliament, 1st session, which ended in January 2025.

Sponsor

François-Philippe Champagne Liberal

Status

In committee (House), as of April 24, 2023
(This bill did not become law.)

Summary

This is from the published bill. The Library of Parliament has also written a full legislative summary of the bill.

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Elsewhere

All sorts of information on this bill is available at LEGISinfo, an excellent resource from Parliament. You can also read the full text of the bill.

Bill numbers are reused for different bills each new session. Perhaps you were looking for one of these other C-27s:

C-27 (2021) Law Appropriation Act No. 1, 2021-22

C-27 (2016) An Act to amend the Pension Benefits Standards Act, 1985

C-27 (2014) Law Veterans Hiring Act

C-27 (2011) Law First Nations Financial Transparency Act

Votes

April 24, 2023 Passed 2nd reading of Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Debate Summary

This is a computer-generated summary of the speeches below. Usually it’s accurate, but every now and then it’ll contain inaccuracies or total fabrications.

Bill C-27 aims to modernize Canadian privacy laws by enacting the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act. The bill seeks to provide individuals with greater control over their personal data, strengthen privacy enforcement, and establish a framework for the responsible development and deployment of artificial intelligence systems. While proponents argue the bill balances innovation with robust protections, critics express concerns about loopholes, government overreach, and the lack of recognition for privacy as a fundamental right.

Liberal

Supports Bill C-27: Liberal members expressed strong support for Bill C-27, emphasizing its role in protecting children in the digital age and updating Canada's privacy framework to align with current technologies and business practices.
Modernizing Privacy Laws: Members highlighted the urgent need to modernize privacy laws to address the exponential growth of data and the emergence of new technologies like social media and AI. The goal is to give Canadians more control over their data and ensure responsible innovation.
Balancing Innovation: Liberals stressed the importance of balancing strong privacy protections with responsible innovation, allowing businesses to innovate while ensuring they use data responsibly. They mentioned a new exception to consent for activities in which an organization has a legitimate interest, with safeguards to prevent abuse.
Protecting Minors' Data: A key focus was on enhancing the protection of minors' personal information, defining it as sensitive and requiring higher standards of protection. The bill aims to give parents and minors more power over this information, including the ability to have it deleted.
Regulating Artificial Intelligence: The Liberals emphasized the need to regulate AI to mitigate potential harms, including bias and discrimination, while supporting responsible AI development. The bill seeks to establish clear expectations and regulations for high-impact AI technologies.
Global Interoperability: Members noted the importance of maintaining Canada's adequacy status with the European Union's GDPR and ensuring interoperability with international partners. The bill aims to align with international best practices and facilitate cross-border data flows.
Enforcement and Accountability: The legislation would strengthen privacy protection by granting the Privacy Commissioner more powers and establishing tougher penalties for non-compliant organizations. A new tribunal would be created to hear appeals and impose penalties.

Conservative

Privacy not a right: Conservatives argue that the bill fails to recognize privacy as a fundamental human right. They assert that this omission weakens the bill, making it easier for industry players to be irresponsible with personal data and failing to align with international declarations on human rights.
Consent is too vague: The Conservatives claim the bill relies on a flawed 'notice and consent' model, and that the exceptions, particularly 'legitimate interest,' are too broad and undefined. They worry that businesses will determine what constitutes a legitimate interest, trivializing privacy, and that implied consent is not sufficient.
Tribunal is unnecessary: The Conservatives criticize the bill for creating a bureaucratic tribunal instead of empowering the Privacy Commissioner. They believe the tribunal will cause delays and that the Privacy Commissioner should have the authority to levy fines directly, aligning with practices in other countries.
AI portion inadequate: Conservatives contend that the AI portion of the bill requires a complete rewrite and should be split into its own bill. They argue it lacks independent oversight and gives excessive power to the Minister of Innovation, Science and Economic Development to make political decisions on privacy.

NDP

Supports sending to committee: The NDP supports sending Bill C-27 to committee for further study and amendments. They believe it is important to modernize Canada's privacy laws and establish rules around data governance.
Splitting the bill: The NDP have asked for separate votes on the artificial intelligence and data act, arguing that it deals with distinct issues from the rest of the bill, and should be considered separately.
Falls short of standards: The NDP believes that Bill C-27 does not meet the standards set by GDPR and other privacy legislation around the world, and that numerous amendments are required to strengthen consumer protections and ensure accountability.
Need for stronger rights: The NDP is concerned that the bill is lopsided towards the business sector and does not adequately protect individual rights, they will propose amendments to ensure informed consent and better protection for individuals.

Bloc

Supports Bill C-27 principle: The Bloc supports the principles of Bill C-27. However, members suggest that the Bill, which combines the consumer privacy protection act and the artificial intelligence and data act, should be split into two separate bills.
Privacy as a fundamental right: Bloc members believe that the time has come to treat privacy as a fundamental right. While Bill C-27 is an improvement, it still does not establish privacy as a fundamental right.
Harmonization with Quebec law: Since privacy protection is a shared jurisdiction, it is vital that Bill C‑27 not take precedence over Quebec law. Clause 122(2) of Bill C‑27 allows for exemptions where provincial legislation is substantially similar and applies within that province, such as Quebec's Bill 25.
Need for further study: The Bloc will support the bill at second reading but believe the real work must be done in committee. Good principles do not necessarily make good laws, and the committee needs to hear from witnesses from all walks of life. When it comes to privacy, it only takes one tiny flaw to bring down the whole structure.

Green

Concerns with AI regulation: The Green Party acknowledges the complexity of regulating artificial intelligence and data, emphasizing the need for thorough study and consideration of potential unintended consequences. They suggest that the AI and data act (part 3 of the bill) may warrant separate committee study to ensure comprehensive review and understanding.
Privacy for political parties: The Green Party believes that privacy legislation should apply to political parties, which are currently exempt. They advocate for adding political parties to the list of organizations obligated to protect the privacy of Canadians.
Potential privacy issues: The Green Party raises concerns that the legislation could weaken some privacy protections, referencing an assessment that gives the bill a low passing grade. They intend to propose amendments to address these concerns during the committee stage.
Clarify privacy exemptions: The Green Party agrees with concerns raised about overly broad exemptions within the bill, specifically referencing subclause 18(3). They emphasize the need for further clarification regarding what constitutes a "legitimate" reason for invading people's privacy.

Was this summary helpful and accurate?

(The House divided on the motion on part 3, which was agreed to on the following division:)

Vote #301

Digital Charter Implementation Act, 2022Government Orders

April 24th, 2023 / 3:40 p.m.

The Speaker Anthony Rota

I declare part 3 of the bill carried.

The House has agreed to the entirety of Bill C-27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts, at the second stage reading.

Accordingly, the bill stands referred to the Standing Committee on Industry and Technology.

(Bill read the second time and referred to a committee)

Digital Charter Implementation Act, 2022Government Orders

April 24th, 2023 / 3:40 p.m.

The Speaker Anthony Rota

I wish to inform the House that, because of the deferred recorded divisions, Government Orders will be extended by 25 minutes.