At this point my office does need more resources. We've made a request for more resources already and we're awaiting the response on that. We are evaluating what we will need for Bill C-27 and beyond.
François-Philippe Champagne Liberal
In committee (House), as of April 24, 2023
Subscribe to a feed (what's a feed?) of speeches and votes in the House related to Bill C-27.
This is from the published bill. The Library of Parliament has also written a full legislative summary of the bill.
Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.
All sorts of information on this bill is available at LEGISinfo, an excellent resource from the Library of Parliament. You can also read the full text of the bill.
At this point my office does need more resources. We've made a request for more resources already and we're awaiting the response on that. We are evaluating what we will need for Bill C-27 and beyond.
We need to make sure, whoever the decision-maker is, whether it's the judiciary, my office or departments, that they have the necessary understanding of the technology that's at play. We need to understand the privacy impacts. We need to understand the information at play, and we need to understand what the capabilities are and if those change the nature of the discussion of metadata.
We have privacy legislation in the public sector that's 40 years old. We have the private sector. We have Bill C-27 that's going to be considered to modernize the private sector, so it's important that the legislation keeps up, but also, as you rightly point out, that the decision-makers are properly equipped with that knowledge. In this case, it's technological knowledge.
We're certainly looking at the resources situation very carefully. We have had the Privacy Act extension order that extended the ambit of the Privacy Act. We've made a request for more resources based on that. We're waiting for the answer to that request.
We're also looking at Bill C-27. We're looking at potential modernization of the Privacy Act itself. All of these are raising questions of resources. Not everything requires more resources, but I'm certainly looking at this very carefully as one of my focuses to see if we have what we need and what we will need so that we can be as efficient as we need to be to face these new challenges and realities.
Iqra Khalid Liberal Mississauga—Erin Mills, ON
Thank you.
You just mentioned the use of such surveilling technologies by private organizations. I know that in the news we heard recently about the Awz group, which former prime minister Stephen Harper has been deeply involved with. There's technology such as Corsight, which uses facial recognition software, or viisights and their behaviour recognition software.
Are you concerned about how those technologies being developed are being used by private companies, and whether we should be doing more? You just mentioned Bill C-27 as well. Perhaps you could expand on that.
I think Canada has a number of safeguards. The role of my office is to ensure that we can make them stronger and to promote making them stronger. We've called for law reform for the Privacy Act to modernize it so that it catches up to new technology. There is Bill C-27, which is currently before the House in terms of private sector privacy.
We value privacy as Canadians, and I think it's something that has to be top of mind. That's why I say that privacy is a fundamental right. It has to be so. It has to be seen as such. It is not an obstacle to the public interest. It has to be there. It has to work with the public interest, but it has to be something that we communicate and we address to build trust for Canadians.
I think we have a strong system. I think it could be stronger. I think it's important that it be world class and that it be the best system in privacy. It's a fundamental right, and it's fundamentally important for Canadians.
I would second what Ms. Bhandari is saying. It's not too late to act.
I would just also add really quickly that we have a very big enforcement problem in Canada. Obviously we had rulings against Clearview here as well. Clearview is currently challenging those rulings against it from the B.C. privacy commissioner, the Alberta privacy commissioner and the Quebec commissioner.
Federally though, it did not challenge the federal Privacy Commissioner's ruling because that ruling is not binding, so it's essentially, “take it as a recommendation and move on.” I think the enforcement mechanisms that will come through in the private right of action that is coming through Bill C-27—which I imagine may come before you shortly—is something that you would also like to take a look at very closely when you're considering how to make sure that whatever laws you put in place are respected by Clearview and all the other companies that follow its model.
René Villemure Bloc Trois-Rivières, QC
Thank you, Mr. Chair.
Ms. Bhandari, this morning, the Government of Canada introduced Bill C‑27, which, among other things, implements the Digital Charter. Part 3 of the bill is entitled “Artificial Intelligence and Data Act.”
The bill therefore deals with artificial intelligence and facial recognition. It will be sent to committee for study so that we can discuss it and make suggestions for improvement.
From what you know of the Biometric Information Privacy Act, or BIPA, what should we look to in that legislation to enrich our digital charter that will eventually be implemented?
Tamir Israel Staff Lawyer, Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic
Good afternoon, Mr. Chair and members of the committee.
My name is Tamir Israel and I'm a lawyer with the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic at the University of Ottawa, which sits on the traditional unceded territory of the Algonquin Anishinabe people.
I want to thank you for inviting me to participate in this important study into facial recognition systems.
As the committee has heard, facial recognition technology is versatile and poses an insidious threat to privacy and anonymity, while undermining substantive equality. It demands a societal response that's different and more proactive than that to other forms of surveillance technology.
Face recognition is currently distinguished by its ability to operate surreptitiously and at a distance. Preauthenticated image databases can also be compiled without participation by individuals, and this has made facial recognition the biometric of choice for achieving a range of tasks. In its current state of development, the technology is accurate enough to inspire confidence in its users but sufficiently error prone that mistakes will continue to occur with potentially devastating consequences.
We have long recognized, for example, that photo lineups can lead police to fixate erroneously on particular suspects. Automation bias compounds this problem exponentially. When officers using an application such as Clearview AI or searching a mug shot database are presented with an algorithmically generated gallery of 25 potential suspects matching a grainy image taken from a CCTV camera, the tendency is to defer to the technology and to presume the right person has been found. Simply including human supervision will, therefore, never be sufficient to fully mitigate the harms of this technology.
Of course, racial bias remains a significant problem for facial recognition systems as well. Even for top-rated algorithms, false matches can be 20 times higher for Black women, 50 times higher for native American men, and 120 times higher for native American women than they are for white men.
This persistent racial bias can render even mundane uses of facial recognition deeply problematic. For example, a United Kingdom government website relies on face detection to vet passport image quality, providing an efficient mechanism for online passport renewals. However, the face detection algorithm often fails for people of colour and this circumstance alienates individuals who are already marginalized by locking them out of conveniences available to others.
As my friend Ms. Bhandari mentioned, even when facial recognition is cured of its biases and errors, the technology remains deeply problematic. Facial recognition systems use deeply sensitive biometric information and provide a powerful identification capability that we know from other investigative tools such as street checks will be used disproportionately against indigenous, Black and other marginalized communities.
So far, facial recognition systems can be and have been used by Canadian police on an arrested suspect's mobile device, on a device's photo album, on CCTV footage in the general vicinity of crimes and on surveillance photos taken by police in public spaces.
At our borders, facial recognition is at the heart of an effort to build sophisticated digital identities. “Your face will be your passport” is becoming an all-too-common refrain. Technology also provides a means of linking these sophisticated identities and other digital profiles to individuals, driving an unprecedented level of automation.
At all stages, transparency is an issue, as government agencies in particular are able to adopt and repurpose facial recognition systems surreptitiously, relying on dubious lawful authorities and without any advance public licence.
We join many of our colleagues in calling for a moratorium on public safety and national security related uses of facial recognition and on new uses at our borders. Absent a moratorium, we would recommend amending the Criminal Code to limit law enforcement use to investigations of serious crimes and in the absence of reasonable grounds to believe. A permanent ban on the use of automated, live biometric recognition by police in public spaces would also be beneficial, and we would also recommend exploring a broader prohibition on the adoption of new facial recognition capabilities by federal bodies absent some sort of explicit legislative or regulatory approval.
Substantial reform of our two core federal privacy laws is also required. Bill C-27 was tabled this morning and it would enact the artificial intelligence and data act, as well as reform our private sector law, our federal law PIPEDA. Those reforms are pending and will be discussed, but beyond the amendments in Bill C-27, both PIPEDA and the Privacy Act need to be amended so that biometric information is explicitly encoded as sensitive, requires greater protection in all contexts and, under PIPEDA, requires express consent in all contexts.
Both PIPEDA and the Privacy Act should also be amended to legally require companies and government agencies to file impact assessments with the Privacy Commissioner prior to adopting intrusive technologies. Finally, the commissioner should be empowered to interrogate intrusive technologies through a public regulatory process and to put in place usage limitations or even moratoria where necessary.
Those are my opening remarks. I thank the committee for its time. I look forward to your questions.
François-Philippe Champagne LiberalMinister of Innovation
Mr. Speaker, I thank my colleague for her question, for her excellent work and for her leadership.
As my colleagues will attest, there is a lot of enthusiasm for what we did today. Earlier, I introduced the Digital Charter Implementation Act, 2022, which will give people more power to protect their personal information and their children. This is how we are ensuring that Canadians can take advantage of the latest technologies and be confident that their personal information is protected and secure and that companies are acting responsibly. Security and trust are key words in the digital age.
Digital Charter Implementation Act, 2022Routine Proceedings
Saint-Maurice—Champlain Québec
Liberal
François-Philippe Champagne LiberalMinister of Innovation
moved for leave to introduce Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.
(Motions deemed adopted, bill read the first time and printed)