Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

[Marilyn Gladu, Conservative, Sarnia—Lambton, ON]

Thank you, Chair. Yes, I would.

Just by way of background, this is revisiting the discussion we had when the member who brought the bill forward was here. We spent the last parliamentary session trying to modernize a lot of the legislation to make sure we captured the digital changes that have happened.

We updated Bill C-11, Bill C-18 and Bill C-27 to all reflect the digital age. We want to make sure that “digital creations” are included. Then, when we had the language discussion, we agreed that English and French were important but, as has been pointed out, there are indigenous languages that people do creative activities in and there may also be ethnic-specific ones. In order to reflect that diversity and the digital creations, this amendment is to add the following:

filmmaking and digital creations that reflect the diversity of Canada, including with respect to the languages in use and its ethnocultural composition.

That's brought to you by the legislative people who know the legalese terms.

Thank you.

Criminal Code

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Mr. Speaker, Western University's brief has a pretty good outline of what some of the definitions of these are, and I would go back to it, as it has been thought about. I think there are two dozen references of other literature in there that I would draw my colleague's attention to.

I would ask colleagues on the justice committee to intersect with some of the work that is being done on the industry committee regarding Bill C-27, the artificial intelligence and data act, to ensure that our laws are harmonized as we move forward and make sure that is done in a way so women, others, people in public life and children are not victimized.

[The Chair, Liberal, Joël Lightbound]

I call the meeting back to order.

We were on Mr. Perkins' subamendment to Mr. Turnbull's proposal.

However, I would like to start by thanking Mr. Dufresne, Ms. Ives and Mr. Maguire for being here. I apologize for the turn of events. These things happen in parliamentary life. I'm sure we'll have an opportunity to invite you back. Anyway, our study of Bill C‑27 has a long way to go, as you can see. Thank you very much. You're free to go, if you wish.

We can now resume debate on Mr. Perkins' subamendment.

To remind members, it was to modify what has been circulated by Mr. Turnbull and add a deadline that conforms with the original motion that Mr. Vis proposed.

Go ahead, Mr. Perkins.

[Francis Drouin, Liberal, Glengarry—Prescott—Russell, ON]

If members want to proceed to clause-by-clause consideration of the bill, we will of course pass a motion to that effect. We're ready to do the clause-by-clause study, but we know full well that we won't have heard the necessary testimony.

The usual practice for all House of Commons committees is to receive evidence and use that to inform amendments. The chair has confirmed that no date has yet been set to proceed with clause-by-clause consideration and submit our Bill C‑27 amendments or clauses. When the committee decides to proceed with clause-by-clause consideration, the amendments will be moved. I'm sure the Conservatives will have comments to make and amendments to propose. They've said as much. Mr. Masse, for one, said he was ready to put amendments forward, too. I'm sure the Bloc Québécois will also have amendments to propose to Bill C‑27. It's standard practice for a committee to set a date for submitting amendments.

I don't see what's going on here, other than not wanting to hear from Mr. Dufresne. What's happening here is not contempt of Parliament. It's perfectly normal for a minister to say he's open to amendments and prepared to accept them. Regardless of which parties put them forward, we'll debate them once the committee has decided on a date.

That's all I wanted to say. I'm not a regular member of this committee, but I sit on other committees and I know how things work.

[The Chair, Liberal, Joël Lightbound]

Just to make sure we're all on the same page, we're now debating the subamendment that Mr. Perkins has submitted. I would, however, volunteer a small comment. Based on the text of the motion, it asks for the production of certain documents “within five business days”. We have the PBO on Tuesday, so for the next five business days we're not studying Bill C-27. To me, then, it seems moot to add this subamendment.

If you want to maintain it, we can, but—

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Our parliamentary system is obviously based on trust and respect between parliamentarians, particularly in the context of a minority government. However, I can't consider last Tuesday's exercise to be a model of trust and respect, particularly with regard to these aspects, especially in a context where we're being told about the urgency of passing Bill C‑27 and bringing ourselves in line with European law, specifically with regard to data protection.

This is a bill that was tabled in June 2022, I remind you, that the government only addressed three or four times in the House over one year, last year. We can't claim it's because the legislative agenda was particularly heavy last year.

So I find it worrying that the government is pressuring us and, on top of that, pulling these amendments out of its hat as though they were a done deal upon which we were to rely. If only that were all. We learned through the media—and not through parliamentary collegiality, since the minister was not transparent with his fellow MPs—that there would be a voluntary code of conduct pending legislation. In my opinion, a voluntary code of conduct, given what we are to debate, is the opposite of the highest industry standards. By not announcing this news to his colleagues before it reached the media, the minister has not been transparent.

Of course, in front of industry, it might be a fine show and elicit applause, but the minister is accountable to parliamentarians. I cannot understand why he didn't tell us the day before, on Tuesday. It's another element that adds to the context in which we feel that the bill we will be debating is now obsolete, for obvious reasons. ChatGPT didn't previously exist. Technology has evolved. They talk about fundamental principles, saying that the law they want to replace is over 25 years old, and that Facebook and the iPhone didn't exist back then. Where is Facebook, or Meta, now? These are the people who have taken control of our democracy, who prevent our local media from functioning and who laugh at Canada's Parliament and parliamentarians. They boast about legislation that lasted so long, when it has actually caused major setbacks.

So it seems rather irresponsible to allow things to continue in this manner. We began this study on the wrong footing, and I think there needs to be more transparency and collegiality. Not only will we be asking people for about fifteen meetings to react and draw on their expertise to tell us about the repercussions, but companies also need predictability, and we don't know what we'll be debating.

I therefore urge that we obtain these documents as quickly as possible, and even make them public, because we need to be able to do our job. Right now, however, we're not equipped to do so.

Thank you.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair. I appreciate it. I just want to make sure, because when you're attending virtually, sometimes you don't get seen. I know you're diligent on that.

I support this motion. It's been pretty interesting, what's taken place over the last number of hours. The minister has been actively lobbying me to move this bill as quickly as possible, and I do support that, but I also support a proper process. Mr. Dufresne and his team are very valuable pieces of what needs to be done even outside of Bill C-27, which is updating the Privacy Act in several different ways, and it's the same with the Competition Bureau.

I find it hard to accept that the minister sat across the table from us.... He talked about amendments. Government members even referred to them as amendments. I actually did a point of order, if you remember, Mr. Chair, with regard to whether they were ideas or amendments. We know that right now they're just ideas that were presented in front of the committee, despite having over a year. I'm glad that we had the context of them, and some of the stuff that was floated about is important, but I don't know how it's reasonable to expect people to come in front of us in this speculative process that we have, when the minister says he is actually going to fix his bill, which he already acknowledged is flawed and has errors. We discussed that in the House of Commons and now we have come here. This committee also passed a request to the witnesses coming forward on whether they could bring amendments to us as well so that we could properly vet them and also share them with other presenters so that people could look at those things.

How do you start something so important and so critical with only a speculative process? I know that right now I would have a motion to bring back the Privacy Commissioner's team after we know exactly what is there.

There's also the process of respect that Mr. Perkins mentioned. The minister sat right there, and then the next day went out to the public and provided new information that he didn't provide to us as members of Parliament. He went to basically a public event and disclosed new information that he wasn't willing to provide to his own committee the day before. It's pretty hard to accept that and also to be responsible for one of the most important pieces of legislation.

I would point out that some of the groups coming forth will be from the not-for-profit sector or the private sector. They actually have to use time, resources and in some cases money to draft their amendments into a legal form and context to present them to us. They also sit there, in front of the world, with their reputations on the line over what they present to us, and it's a mockery to them when they don't even know exactly what they're presenting to.

I can't believe that we're proceeding in such a way and that the government doesn't have the amendments to table in front of us so that we can also make sure that they'll be in a context that will be accepted within the bill. I spoke at the last meeting about how the government had amendments to my legislation. The government brought them forth, theminister himself, and then the Liberals not only did that but also ruled them out of order themselves.

We don't know exactly where this is going, but I'd like to have the proper context of how we're going to analyze the bill. I think it's bad, when we have our guests in front of us, that we have to go on the fly about what the minister may or may not have and whether he's serious on all the points that were raised. Are they actually going to be ones that will be collectively put together? I don't know. What's the point of our spending resources, time and energy and then treating our guests so poorly? They have to come here and wing it in terms of what theminister and the government have as legislation.

To wrap up, we know two things. One, there's a high degree of interest in this bill. It's very technical. Part of it is new. The second thing we know is that when we invite people to come in front of us, we know that the bill right now is critically flawed. It's had one debate in the House already, and it's our job to fix it. The minister has indicated that it needs fixing, but we don't know what parts they're supportive of or not supportive of. That's unfortunate. Again, I've been open to trying to move this legislation along as quickly as possible, but I'm not going to be part of a broken process from the very beginning.

That's just unfortunate, because I think we all want to move on this.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you, Mr. Chair.

I'd like to thank the witnesses for being here today.

Mr. Dufresne, I want to thank you for your excellent work, including the 15 key recommendations that you put forward with respect to Bill C-27. For what I am about to do today, I apologize. I know your time is very valuable, but I am about to move a motion with respect to the testimony that was given by the minister at the last meeting. I am doing so because the minister indicated that he would be making amendments to the bill, but he wouldn't provide the committee with those specific amendments.

As such, I am going to move a motion right now, Mr. Chair. I move “That pursuant to Standing Order 108(1), the committee order the Minister of Innovation, Science and Industry and his department to produce the amendments, briefing notes and memos referencing the amendments discussed by the minister in his opening remarks to the committee on September 26, 2023, provided that these documents be provided to the clerk of the committee within five business days.” I believe that was just sent to the clerk to be sent around.

I am tabling that because I believe the minister came forward in good faith with those changes, largely based on the recommendations from our witness here today, and I believe it is in the interest of Canada and all members of this committee to have that information before we proceed accordingly.

Thank you, Mr. Chair.

[Philippe Dufresne, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Good afternoon, Mr. Chair, members of the committee, I am pleased to be here today to assist the committee in its study of Bill C‑27, the Digital Charter Implementation Act, which would enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act.

I am accompanied by Michael Maguire, Director of PIPEDA Investigations, and Lara Ives, Executive Director, Policy, Research & Parliamentary Affairs.

I would like to begin by saying that I welcome the introduction of this bill. I view its introduction as an encouraging sign, as the act must be modernized to face challenges and to seize the opportunities presented by major technological advances, including artificial intelligence.

My office has long advocated for a modernization of both the Personal Information Protection and Electronic Documents Act and the Privacy Act, which applies to the public sector. Canadians expect modern privacy laws that will protect their fundamental right to privacy while supporting the public interest and innovation.

The bill addresses a number of concerns that were previously raised by my office and by others. For example, it requires that information used to obtain consent be in understandable language, it provides my office with order-making powers and it includes an expanded list of contraventions to which administrative monetary penalties may apply in cases of violations.

The introduction of the AIDA, the artificial intelligence and data act, could make Canada one of the first countries to regulate AI, which is important, given the technology's potential risks. Although the AIDA does not specifically address privacy risks, the CPPA, the consumer privacy protection act, would apply to the processing of personal information within AI systems.

Bill C-27 is a step in the right direction, but it can and must go further to protect the fundamental privacy rights of Canadians while supporting the public interest and innovation. I've tabled with the committee our written submission, setting out 15 key recommendations with the changes needed to improve and strengthen Bill C-27.

These are based on the three themes of my vision for privacy, which are, one, that privacy is a fundamental right; two, that privacy supports the public interest and innovation; and three, that privacy is an accelerator of Canadians' trust in their institutions and in their participation as digital citizens.

I will now highlight a few of our recommendations, but would invite committee members to also consult the full submission as well as our 15 recommendations.

Under the theme of privacy as a fundamental right, I recommend strengthening the preamble and purpose clause to explicitly recognize privacy as a fundamental right, and highlight the need to protect children's privacy and the best interest of the child, so that these important principles inform the interpretation of all aspects of the legislation. I understood from the minister's testimony earlier this week that the government agrees with this recommendation, and I'm delighted to hear it.

We also recommend that an organization's purposes for collecting, using or disclosing personal information be specific and explicit, and that penalties be available in cases where the personal information of Canadians is collected, used or disclosed for inappropriate purposes. Given the importance of the rules concerning appropriate purposes, effective remedies should be available to ensure compliance.

Under the theme of privacy in support of the public interest, we recommend that organizations be required to implement privacy by design and that privacy impact assessments be prepared in high-risk cases. This would be an important and necessary protection that would apply to high-impact AI systems. We also recommend that the definition of “de-identified information” be modified to include the risk of re-identification and that the government’s authority to issue certain regulations be more narrowly defined. On this last point, I would note that the bill currently gives the government the unduly broad ability to completely remove activities from the scope of the act and to allow new exceptions to the consent requirement for business activities without having to show that those activities are necessary.

We also recommend that Canadians be given the right to request an explanation when an AI system makes a prediction, recommendation, decision or profiling about them.

Under the theme of privacy as an accelerator of Canadians’ trust, and in order to ensure that most cases can be resolved quickly and without the need for lengthy legal processes, we recommend that my office have more flexibility in negotiating and enforcing compliance agreements and in co-operating and communicating with other regulators. Here again, the minister's testimony earlier this week suggests agreement with these points. It will be important to see the details of those proposals. This is important in many areas, but it will be crucial when dealing with AI and generative AI.

We also recommend that challenges to decisions of the proposed new data protection tribunal be brought directly to the Federal Court of Appeal in order to ensure timely and cost-effective resolutions for all parties. We note that as an alternative solution to achieve these goals, reviews of my office’s decisions could be done by the Federal Court instead of the tribunal.

In the last budget, the government proposed temporary funding for my office of $6 million over two years to undertake more in-depth investigations of privacy breaches and improve response rates to privacy complaints, as well as $15 million over five years—this would be temporary funding—to operationalize new processes required to implement the proposed Consumer Privacy Protection Act. Should Parliament adopt Bill C‑27, it will be essential that my office be properly resourced to fully and effectively take on important new responsibilities, especially those focusing on prevention. Otherwise, these costs will be borne by Canadians and by businesses themselves.

While our recommendations focus on the CPPA, some of them would also be relevant to AIDA. For instance, I note that AIDA provides significant authority to the government to define key aspects of the law by way of regulation. This would include, for example, determining what does and does not constitute justification to an otherwise discriminatory AI decision for the purposes of the definition of biased output. The government could also establish criteria through regulation for the purposes of defining a high-impact system or determining measures with respect to the way that data is anonymized and how that data can then be used and managed.

Given that all of these could potentially have privacy implications, it will be important to ensure that there is a formal mechanism for my office to be consulted in the drafting of these regulations. Our recommendation to allow for greater coordination and collaboration between my office and other regulators would also be essential in dealing with the privacy impacts of AI.

In conclusion, privacy law reform is overdue and must be achieved. Our recommendations aim to ensure that Canadians have privacy laws that recognize their fundamental right to privacy while allowing them to participate fully in the digital economy, support innovation and position Canada as a leader in this important and evolving area.

I note that many stakeholders are also putting forward submissions and I thank the committee in advance for the critical work that it will do in its review of this important bill and in ensuring the protection and promotion of the privacy of Canadians.

Thank you for your time. I would now be happy to answer any questions that you might have.

[The Chair, Liberal, Joël Lightbound]

I call this meeting to order.

Good afternoon, everyone.

Welcome to meeting No. 87 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C‑27, An Act to Enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts.

I'd like to welcome our witnesses today, who honour us with their presence and who are here to answer our questions.

Joining us from the Office of the Privacy Commissioner of Canada is Mr. Philippe Dufresne, Privacy Commissioner of Canada, whom I now welcome. We are also welcoming Ms. Lara Ives, Executive Director, Policy, Research and Parliamentary Affairs Directorate, as well as Michael Maguire, Director, Personal Information Protection and Electronic Documents Act, Compliance Directorate.

We are pleased to have you with us. Thank you for taking the time to appear before the committee. On behalf of our committee, I apologize for the slight delay today.

Without further ado, Mr. Dufresne, you have the floor for your opening remarks.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

This is a friendly motion. Hearing from witnesses today is extremely important in the context of Bill C-27. I would like to move, and hopefully get unanimous consent, that we invite the officials back as soon as possible—at your discretion, Chair—to provide us the time we need to begin examining this bill.

[The Chair, Liberal, Joël Lightbound]

That is indeed the motion you tabled a week ago. There was agreement to work on it with the parliamentary secretary, Mr. Turnbull, among other people. I think that has been done.

Is it the will of the committee to adopt this motion, knowing that we might not begin that study for some time, given the work involved in considering Bill C‑27?

Is there unanimous consent to adopt the motion presented by Mr. Lemire?

(Motion agreed to)

Thank you, colleagues.

We now have only 10 more minutes with officials. It will depend on the committee's will.

You might be reinvited, though I'm sure that comes as no surprise to you, Mr. Schaan.

We'll use the time we have left. I would suggest we split the time to three minutes, three minutes, one and a half and one and a half.

Go ahead, Mr. Vis.

[Mark Schaan]

Very quickly, the tribunal has two functions. One is, upon the recommendation of the Privacy Commissioner, to issue an administrative monetary penalty in relation to the violation of the consumer privacy protection act. The second is to ensure that there's an appeal mechanism for any decisions of the Privacy Commissioner, and it's on the basis of law that the determination would be made, such that there would be a review or an appeal of the decision. That's also reviewable.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

No one was expecting that Bill C‑27 would be passed in its entirety.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Thank you, Mr. Minister.

The part of Bill C‑27 that pertains to artificial intelligence relies a great deal on self-regulation. The bill has been designed so that companies can create codes of conduct to regulate themselves more independently. The government will therefore have to approve codes of conduct that may not be very strong, which is a concern. What accountability will there be? Will there be audits? If so, how will those audits be monitored? I am referring to governance, protecting innovation, transparency, which is essential, and copyright protection.

That leads me to a fundamental question: If there were an abuse or someone had to be reprimanded for violating a person's privacy, who would be held accountable? That isn't clear. Would it be the developer, the seller or even the user? The private sector needs us to get clarification from you on that because it is creating confusion and preventing us from moving forward.