Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

The House resumed consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

Digital Charter Implementation Act, 2022

[The Assistant Deputy Speaker, NDP, Carol Hughes]

The Minister of Innovation, Science and Industry has eight minutes to finish his speech.

[François-Philippe Champagne, Liberal, Minister of Innovation]

Madam Speaker, it is a pleasure to be here with my colleagues this morning.

Let me start where I left it before we paused for question period on a Friday.

Another important component is knowing that companies are committed to the responsible development and deployment of artificial intelligence systems. This is why we have developed the artificial intelligence and data act. Ensuring strong legal protection so that organizations remain accountable for the use of AI systems will help us to build trust.

Indeed, the proposed artificial intelligence and data act seeks to build on the already positive work of industry and academics to further promote and support responsible AI development. Specifically, much of the act will focus on regulating the development and deployment of high impact AI technologies.

More importantly, this law is designed in a way that it can grow and evolve over time. It will set expectations and create clear, bright lines right now around the most egregious and harmful conduct, while allowing space for our regulations to evolve to a collaboration with civil society and industry, and I think that is what my friends on the other side of the floor will want.

This part of the act would require that organizations consider the impacts of the system they use and put in place measures to identify, assess and mitigate harms to the health, safety and well-being of Canadians, which is something I hope everyone in this House will support. It would also require organizations to actively mitigate discrimination and bias as they design and develop artificial intelligence systems.

Furthermore, specific requirements would be laid out in regulations regarding how companies must assess and mitigate risk and monitor the effectiveness of those measures. To support compliance and enforcement, the Minister of Innovation, Science and Industry would be empowered to request information, order third party audits or additional mitigation measures, and share information with other federal regulators.

Finally, this new proposed act would set out clear criminal prohibitions and penalties regarding the use of data obtained unlawfully for AI development, where there is reckless deployment of AI, or where there is intent to cause serious harm. The act is a solid foundation, not only for today but also for our future.

The economists among us know full well that Canada is an integral part of the global economy.

That is why we developed legislation that promotes interoperability, but also our leadership in this very important domain. It will give us the necessary tools to work on a coherent national approach with our provincial and territorial counterparts, since that is a critically important issue that was raised.

In recent years, many businesses and privacy experts have highlighted the importance of maintaining Canada's adequacy status with the European Union's General Data Protection Regulation, also known as GDPR. Without GDPR, we are at risk of falling behind globally.

That is why I am asking members that we act today. That is why I am asking my friends and colleagues in this House to send the bill to committee. It is incumbent on the 338 people who sit in this House to bring our privacy laws into the 21st century. What we are suggesting with this bill is to give more power and more control to people over their data online. It is about protecting our children and making sure they are better protected in the digital age. It is also about making sure there is responsible use of AI.

Let us seize the moment, let us be ambitious and let us bring our data privacy law into the 21st century. Let us have all members contribute to that in committee. The country, our nation and our children would be well served. It could be the best gift we give them for Christmas, that this House act to protect them.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Speaker, I thank the minister for his speech. There was not a lot in the speech that I could disagree with or that we could disagree with. Our challenge is that we do not think the speech actually delivers what is said in this bill. We know perfection can be the enemy of the good, but I think, in this case, that “good” is not good enough.

Privacy is a basic human right. We have seen in past iterations of this bill that the Liberal government cannot put that in the bill, which I think is a bit of nonsense. Parliament has the right to deal with economic issues under the Constitution. The personal privacy element is the basis of freedom, the freedom of movement and the freedom of speech. Privacy is critical to that. Privacy is a fundamental human right. It should be recognized in this bill, but it is not.

Why do the Liberals not believe that privacy is a fundamental human right?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, I would like to thank my hon. colleague for his question and also for his work. I expect him to be working with us, and there is a simple answer to his question. He will see, when it goes to committee, that the bill recognizes the right to privacy of individuals and their personal information.

In a sense, the bill achieves the same goal. I think we are on the same page, and that is why we put it in the preamble. I know my colleague, who is an experienced member of this House, is someone who wants to make sure we move into the 21st century. He is right. Let us not have perfection be the enemy of the good. We want to bring our laws into the 21st century.

I would like to take this opportunity to say that today is the birthday of the member for South Shore—St. Margarets, and the best gift he could give to children across Canada is to make sure we vote for this bill and send it to committee. I know he is a man with a big heart; give a gift to our children in Canada. Let us protect them against harm in the digital world.

[Rachel Blaney, NDP, North Island—Powell River, BC]

Mr. Speaker, this is a very broad and complex bill. It is important that we recognize that. It can lead to some serious concerns that we may want to talk about later.

Part of this bill creates the new personal information and data protection tribunal, which can overrule the new enforcement actions and fines imposed by the Privacy Commissioner. I am concerned about the vagueness of the membership of the tribunal, with many appointed by the government.

Would this not be either a political tool or perceived as a political tool for the government to turn over rulings it does not like?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, I would like to thank my hon. colleague for her thoughtfulness in this regard, because she understands, like I do, how important it is for society to move and to have modern privacy laws that would protect Canadians. This legislation is about giving more power and control to people over their data.

With respect to the tribunal, in terms of procedural fairness, we have heard a lot. The point I would make to my hon. colleague is that we listened to a lot of people on that. The fact that we would have a specialized tribunal is something that is quite common in our country, where we often have a commissioner who has regulatory power and power to demand action from companies that do not comply with the act. In terms of procedural fairness, we always have this check and balance with a tribunal.

I can assure the member that the thinking behind the bill is to have people who are specialized in the area in order to make sure we have the best possible rulings on that, so that we can make sure the enforcement of the act is enshrined in the law, and also that we have judicial review in a way that would be done by people who are well versed in the field. As she well knows, obviously these decisions could be appealed to the Federal Court of Appeal, so there are a lot of safeguards, and it is really meant to make sure we have the best possible people, who understand privacy law and the digital world and can make rulings that would serve Canadians.

[Sylvie Bérubé, Bloc, Abitibi—Baie-James—Nunavik—Eeyou, QC]

Mr. Speaker, I thank my colleague for his speech.

We know that, in many ways, Bill C‑27 seeks to protect individuals' anonymity. With digital services omnipresent in our lives, we know that transactions and information exchanges are happening faster and faster. Bill C‑27 was designed to give back the personal dignity that organizations have violated for far too long.

Can the minister tell me if Bill C‑27 will go to committee so we can hear from experts who can identify the flaws in this bill?

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, it is a pleasure to see you in the big chair.

The answer to my hon. colleague's question is absolutely.

There are parents listening to us at home today. The greatest gift we could give children is to refer Bill C-27 to a committee so that the questions my colleague raised can be properly studied. What she said in her introduction is correct. There are three simple things behind Bill C‑27. First, we want to give individuals more control and power over their online information. Next, as a parent, I feel it is fundamental that there be better protection for our children in the digital age. Finally, it will regulate artificial intelligence so that it is used responsibly and serves the public.

I believe it is time to bring our 20-year-old legislation into the 21st century. That is a good thing, and it is what Canadians want. It may reassure my colleague to know that during the study of Bill C‑11, we listened to many experts and collected comments to ensure not only that we have a good law, but that we are among the best in the world and that we set an example on the international stage.

I am pleased to hear that, like me, my colleague thinks that the best gift we can give our young people before Christmas is to send Bill C‑27 to committee to get it passed as quickly as possible.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Mr. Speaker, I thank the minister for introducing this bill. I think it is very important to Canadians to protect their privacy.

I have heard a lot about these issues in my work with the committee on access to information, privacy and ethics, and one thing we have heard in some of these committee meetings is that the privacy rules in Europe are stronger. I am wondering if the minister could explain to us how this legislation would bring Canada on par with Europe in terms of privacy.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, I will answer quickly.

First, I want to thank my colleague for all of the work she has done on this file. I also want to thank my parliamentary secretary, who does an outstanding job in committee. I strongly believe in the role of committees.

My colleague is absolutely right. This legislation is the equivalent of the EU's General Data Protection Regulation, or GDPR, which is very well known here.

What the member is saying is fundamental. What we want to do with this law is to make sure that we maintain adequacy with the GDPR, which is the law that they have in Europe to protect privacy. I think that is very important. It is important for Canadians, but it is also important for businesses. I think my colleagues on the other side of the aisle will really understand that passing this is fundamental for small and medium-sized businesses across our nation who need to share information with colleagues in Europe to be able to do so. This is the best way we can do that.

I hope we can send the bill to committee, so that work can start and we can give a big a gift to Canadians as we approach Christmas.

[Mike Morrice, Green, Kitchener Centre, ON]

Mr. Speaker, as it stands today, federal political parties do not have to follow the same privacy laws that apply to others across the country.

I wonder if the minister could speak to why this is not addressed in Bill C-27 and if he would be open to addressing this in the future.

[François-Philippe Champagne, Liberal, Saint-Maurice—Champlain, QC]

Mr. Speaker, I am always willing to listen. We have listened to a lot of people. This is about Canadians. It is not about us. It is about making sure that we have the best privacy laws that are fit for purpose in the 21st century. I invite my colleague and all members to send this to committee as quickly as we can, so that the real work can start.

Parents are watching us as we speak this morning. They want the House and every member to help protect their children. That is what we are trying to achieve.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, 34 years ago, the Supreme Court said that “privacy is at the heart of liberty in a modern state”. In the words of Justice Gérard La Forest of the Supreme Court of Canada in 1988, it is worthy of an individual and “it is worthy of constitutional protection”. All Canadians are worthy of having their privacy respected.

It is our duty as parliamentarians to do our best to protect Canadians' privacy rights, especially as we struggle so much for it today.

Bill C-27, formerly Bill C-11, is designed to update Canada’s federal private sector privacy law, the Personal Information Protection and Electronics Documents Act, or PIPEDA, to create a new tribunal and to propose new rules for artificial intelligence systems. It is a reworking of Bill C-11, and it has three components: the consumer privacy protection act; the personal information and data protection tribunal act, creating a new tribunal; and the artificial intelligence and data act.

The bill applies to Canadians' private rights. It does not apply to CSIS, RCMP or CSE. That and other government-held data is governed by the Privacy Act. Privacy laws for Canadians have not been updated in 22 years, and Europe updated the General Data Protection Regulation in 2016.

When we last updated this act, 22 years ago, the member for South Shore—St. Margarets was turning 21 years old, and society was going through big changes. The world had just gotten past the Y2K scare. We were looking at what was going to happen to computers when the clock changed from 1999 to 2000. In certain areas, we did not know if the power would go out or what would happen.

People listened to music on CD Walkmans. Apple was over a year away from launching a cutting-edge new technology called the iPod. Less than 30% of Canadians actually owned a cellphone. The most popular cellphones were the Motorola Razr, which was a flip phone, and the Nokia brick phone, with texting that used the number pad and almost no web browsing capabilities. The most sophisticated app was called Snake. A fledgling Canadian telecommunications company was just starting, and it was called BlackBerry.

That is how long it has been since we updated our laws. Today, 22 years later, data collection is getting more sophisticated, and surveillance is more of the norm than the exception.

Apple Watch announced a few weeks ago that it can track and tell when a woman is ovulating. What is concerning, and we are going to talk a lot about data for good and data for wrong, is that this technology can tell if a woman skips a cycle, and then can identify if there has been a miscarriage or an abortion. This is very concerning.

Our Fitbits, our web history and our Apple phones can tell us how many steps we did in a day. Sometimes when we are in Parliament it is about 10, and if we are door knocking it is about 25,000. That does not sound important, but that information is also letting those regulators know where we have been, where we are going and where we live.

Facial recognition technology can identify a face like a fingerprint. Sometimes that is good. We have heard from law enforcement that it can be used for human trafficking. Sometimes that is wrong, when people are identified in a street and when people are identified with their names, their data and where they have been. Let us think of Minority Report, where everywhere someone goes, they are identified. It did not matter where they where going or where they had been. That is something that could happen with facial recognition technology.

Google and Amazon listen and collect our data in our bathrooms, living rooms, kitchens and cars. How many times have we been in conversations and Siri asks, “What was that?” Siri is always listening. Amazon is always listening. Speaking of cars, they are cellphones on wheels. When we connect to a rental car, and a lot of us rent cars, we see five or six other phones in the history. That car has downloaded all the data from our phone into that car. A lot of times, if we see that in the rental car, that car holds our information. It is very concerning.

There are many examples where it has hurt Canadians in the last several years. Two summers ago, Tim Hortons had a data breach, where every time someone rolled up the rim, it told Tim Hortons where they went afterwards, if they went home or where they were staying. It collected all that data, and it was a big problem.

In the ethics committee, we studied facial recognition technology. There was a company called Clearview AI, which took two billion images off the Internet, including a lot of ours, and just gave them to the police. There was no consent. The information just went and ended up in the hands of law enforcement.

There is Telus's “data for good”. During the pandemic, Telus collected our data. It knew where we went and if we went to the grocery store or the pharmacy, or if we stayed home. It just gave that to the government. It was called “data for good”. They called it de-identification. I am going to talk about how that hurt everyone later.

Lastly is doxing or using personal information to try to out people. GiveSendGo is a big one. It gave a U.S. company the information of people who donated to different causes or events. At one point, Google identified all those donors on a website showing exactly where they lived. Everyone's information, when they donated to a company, was identified and outed. That was terrible.

Surveillance has not just resulted in a wholesale destruction of privacy but a mental health crisis in children and youth as well. I am glad to hear the minister speak about children and youth because data has certainly affected them and continues to.

Canada’s federal government has repeatedly failed to take privacy seriously and construct a legal framework that protects the rights of Canadians in the digital age. This bill normalizes surveillance and treats privacy not as a fundamental human right and not even as a right to consumer protection. To make this point very clear, nowhere in the document for Bill C-27 does it state that privacy is a fundamental human right. However, this should be the crux of new legislation to update privacy laws, if not the outward premise, with the statement hammered from the preface until the end of Bill C-27 and following through the entire document. However, it is not there. It is nowhere and, therefore, holds no value.

This bill does not use that statement from the onset. It should be the pillar by which the bill is designed and led. Only a strong bill will ensure that Canadians' privacy rights are protected. Because of its omission, the bill is very weak, making it easier for industry players to be irresponsible with people's personal data. This is ironic as Canada has signed on to the UN Declaration of Human Rights and the International Covenant on Civil and Political Rights. That is where the bill starts and ends, with its failure to properly address privacy for Canadians.

Conservatives believe that Canadians’ digital privacy and data need to be properly protected. This protection must be a balance that ensures Canadians’ digital data is safe and that their information is properly protected and used only with their consent, while not being too onerous to be detrimental to private sector business. It is a balance.

Let us be clear. We need new privacy laws. In fact, it is essential to Canadians in this new digital era and to a growing digital future, but Bill C-27 needs massive rewrites and amendments to properly protect privacy, which should be a fundamental right of Canadians. The bill needs to be a balance between the fundamental right to privacy and privacy protection and the ability of business to responsibly collect and use data.

It also needs more nuance, but parts of this bill are far too vague. The definition of tyranny is the deliberate removal of nuance, so to create more equality or fairness on those privacy rights and to ensure businesses and AI use data for good, we need more nuance with more detail and more explanation, not less. There was a saying I used to love that my grandfather would say: “If you're going to do something, make sure you do it right or don't do it at all.”

Besides the omission of privacy rights as a fundamental right, the bill needs a massive rewrite. First, the bill doubles down on a flawed approach to privacy using a notice and consent model as its legal framework. The legal framework of Bill C-27 remains designed around a requirement that consent be obtained for the collection, use and disclosure of personal information, unless one of the listed exceptions to consent applies. Those exceptions are called “legitimate interest”.

What is scary about legitimate interest is that the businesses themselves will determine what legitimate interest means and what will be exempt. A quote on this from Canada’s leading privacy and data-governing expert, Teresa Scassa, says that this provision alone in the bill “trivializes the human and social value of privacy.” The legitimate interest provision allows Facebook, for instance, to build shadow profiles of individuals from information gathered from their contacts, even those with no Facebook access or accounts, without asking for their permission.

Have colleagues ever seen the “people you may know” feature on Facebook? Sometimes people turn up there, although one might not know where they had ever met and even though neither party is actually on Facebook. That is because Facebook builds profiles and shadow profiles from other members' contacts. Facebook has a feature that will suggest that one share their contacts: It will be great. People will give all their friends' information to Facebook: their emails, addresses and sometimes their private phone numbers. The U.S. found that information was turning up in Facebook. Here are a couple of examples. An attorney had a man recommended as a friend he might know who was a defence counsel on one of his cases, when they had only communicated though a work email. Another time, a man who donated sperm to a couple, secretly, had Facebook recommend their child as a person he should know, despite not having the couple, whom he once knew, on Facebook.

Legitimate interests needs more nuance. It needs to be more defined, or it is useless. Legitimate interests allow for too much interpretation. In other words, it allows something to be something unless it is not. It is far too broad.

Additionally, consent is listed as having to be “in plain language that an individual to whom the organization’s activities are directed would reasonably be expected to understand.” Bill C-27 makes it hard to determine what legitimate interests are, and that goes back to privacy as a Human Rights Commission complaint.

If we compare this section to the European Union's privacy law, the GDPR, which is, as the minister stated, the gold standard, the legitimate interest exemption is available unless there is an adverse effect on the individual that is not outweighed by the organization's legitimate interest, as opposed to the interest or fundamental freedom to the individual under the GDPR. If adverse effects on the individual can be data breaches, which are shocking and distressing to those impacted, and some courts have found that the ordinary stress and inconvenience of a data breach is not a compensable harm since it has been a routine part of life, probably for the last two years at least, then the legitimate interest exemption will be far too broad.

However, Bill C-27 would take something that was meant to be quite exceptional for consent in the European Union's privacy laws and make it a potentially more mainstream basis for the use of data without acknowledging consent. Why would it do this? It is because Bill C-27 places privacy on par with commercial interests in using personal data, something that would not happen if privacy was noted in the bill as a fundamental right for Canadians.

Additionally, we need to be wary of consent. As a mandatory, consent should be made easier. Has anyone ever looked at their iPhone when agreeing to consent and scrolled down? Has anyone actually read all that? Has anyone read Google's 38 pages of consent every time they sign up or use Google?

Consent is not easy. It is not simple, and certainly this proposed law would not make it any simpler. We need to be wary of consent, and we need to ensure that consent is consensual, both in language and intent, and that we all know exactly what we are signing up to do, to give and to receive.

There is another term I want to explain as well called “de-identification”. The bill talks a lot about de-identification, and its definition is that it “means to modify personal information so that an individual cannot be directly identified from it,” and then goes on to say “a risk of the individual being identified remains.” Therefore, an individual would lose all their information, but a risk of identifying an individual would remain.

Members will remember my Telus data for good example. Telus gave this information to the government during COVID, even though a risk of the individual being identified remained. It should be scrapped, and instead we should be using the word “anonymize”, which is also in the bill. This is what the GDPR does. In the bill, it “means to irreversibly and permanently modify personal information, in accordance with generally accepted best practices, to ensure that no individual can be identified from the information, whether directly or indirectly, by any means.”

I would ask members which one they would prefer. Would they like to be re-identified, as there is a possibility, or would they like no identification by any means?

Another major flaw in Bill C-27 is the creation of a bureaucratic tribunal instead of giving the Privacy Commissioner more bite. The creation of a tribunal is a time-waster, and the Privacy Commissioner should be allowed to levy fines. The Privacy Commissioner should be given more power and more bite. This is unclear because the EU, the U.K., New Zealand and Australia do not have tribunals that mediate their fines for privacy violations. Furthermore, it would no doubt cause those who have had their privacy violated to have to wait for years for the right of action.

I will put this straight. First we would have the Office of the Privacy Commissioner, or OPC, make a ruling. Then the government said that it would have a tribunal, which could then reverse the ruling of the Privacy Commissioner, and then we would have the Supreme Court, which would be allowed to rule on the tribunal's ruling. We would have a decision, another decision and a third decision, and each one of them could be countered.

Let me guess how long it would take. What do members think it would take? Would it take 48 hours or six months? Right now, the average is one year for the Privacy Commissioner, and we could add another year for the tribunal plus another year for appeals.

I ask this: Is it fair to have the average Canadian who has had their data breached, with their limited resources, have to go up against Facebook and Amazon and then spend three years in court? Does this protect fundamental privacy rights? Is this not just adding another layer of government that we certainly do not need?

The absence of rights-based language in the bill might tip the scale away from people in Canada, and the OPC and the tribunal weigh the privacy interest of people against the commercial interests of companies. Again, what does this come back to? Privacy was not listed as a fundamental right of Canadians.

Lastly, the AI portion of this bill is a complete rewrite. It needs to be split into its own bill.

I want to commend the minister for bringing this forward. He wants to be the first one in the land to bring this part of the bill forward, but to be honest, consultations only started in June. We have met with many individuals who certainly have not had any input into this deal, and although AI is there, there are many parts missing.

First of all, its findings conclude that there will be no independent and expert regulator for automated decision systems, nor does it have a shell of a framework for responsive artificial intelligence regulation and oversight. Instead, it says that the regulations will be determined at some future date and decisions will come from the Minister of Innovation, Science and Economic Development or a designated official.

Again, part of this includes a new tribunal and puts decisions where they should not be, onto the government, with enforcement and decision-making by the minister or the minister's designated ISED official. This would be political decisions on privacy. Does everyone feel comfortable that we are now shifting from a tribunal to the government?

This part of the bill will shift all of that to the government, to the minister or his designate. It reminds me of the proclamation, “I'm from the government, and I'm here to help.”

There is no mention of facial recognition technology, also, in this part of the bill, despite reports that have come from the ethics committee, the examples I gave from before on FRT. Certainly, that is worth more study.

There are some parts of the bill that have good aspects and certainly ones we can get behind, including the protection of children's privacy. As a father, I know it is so very important. Our children now have access to all kinds of different applications on their phones, iPads and Amazon Fires.

Our children are being listened to and they are being surveilled. There is no question that businesses are taking advantage of those children and that is something that we definitely need to talk about.

The attempt to regulate AI, though, as I have stated, needs major revisions. Without a proper privacy statement, it does not have a balanced purpose statement establishing that the purpose of the CPPA is to establish rules for governing the protection of personal information in a manner that balances the right to privacy and the need for organizations to collect, use or disclose personal information.

We should be shooting beyond the European Union's privacy act, shooting to be the world leader in the balance of ensuring privacy protection and that businesses and industries use data for good. In doing so, they would attract investment and technology, all the while protecting Canadians' fundamental right to privacy.

Canada needs privacy protection that builds trust in the digital economy, where Canadians can use new technologies for good while protecting them from the bad, profiling, surveillance and discrimination. The minister said that he wants to seize the moment, that we need leadership in a constantly changing world. Most importantly, the minister said that trust has never been more important.

If we do not get this right, and if we do not make sure that privacy is a fundamental human right, and declare that in the document and build the document around that right, we are doing two things: We are not prioritizing Canadians' privacy, as we are certainly not putting privacy at the forefront of the bill, and we are certainly not showing leadership in an ever-changing world.

As I noted at the onset, the technologies of 22 years ago have changed so significantly. The technologies now are changing more significantly. In the next 22 years, we are going to have technologies that are more embedded, not less, in our lives. We will have AI that do good.

One of the stakeholders that we met with actually talked about AI for good. They talked about embedding AI into the government's system of passports. That might actually mean that we could get passports within 48 hours. Could we imagine that? Could we imagine imbedding technology for good into a system that would allow Canadians to get the things that they need more often?

We love technology. We want to embrace it. We just want to make sure that, number one, privacy is protected. We want to make sure that we do the hard work of building frameworks alongside Canadians' fundamental human right to privacy and being protected in equal balance with the economy, democracy and the rule of law. This bill does not do that, not yet.

Let us work to make sure we come back with a bill that does that.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Mr. Speaker,I found the hon. member's intervention to be quite fascinating. He spent a lot of time talking about fundamental human rights and using rights-based language, yet today the Conservatives' provincial cousins in Ontario are literally trampling all over those rights by using the notwithstanding clause in legislation to force people to work before even allowing a court to weigh in on whether it is appropriate or if the law that they created was appropriate.

I am wondering, with all of this talk about fundamental rights, would the member agree that these should be rights that are not subject to a notwithstanding clause or should not be able to be trampled all over, like their provincial cousins are doing in Ontario right now.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, I am disappointed in that question. We are talking about privacy rights for Canadians. We are talking about protecting children's privacy rights, which are being absolutely discriminated against. They are surveilled every single day by big data. We want to protect their privacy rights.

The member across from me is my neighbour, and I know he is also a father. Just how much of our children's information is out in the world, how much is being data mined and sold to other countries and companies, concerns me.

I would love to hear questions about how we are going to better this bill and, therefore, better our children's futures in a digital age.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Mr. Speaker, I know there was some discussion about rights, and I heard my Liberal colleague across the way questioning the Conservatives on why they are staying silent while Doug Ford takes away the rights of workers. I found it peculiar that my Liberal colleague asked that considering the government forced postal workers back to work.

The member for Carleton has stayed silent, and I am wondering if the Conservatives support their buddy Doug Ford taking workers' rights away?

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, once again, I am disappointed. I guess the Liberals and NDP do not really care about privacy rights for children, which we are talking about today. This is fundamental to the bill.

The minister did a lot of hard work putting this bill together and there have been a lot of consultations. This is the second iteration. Bill C-11 died only because there was an election called. Now we have Bill C-27, which is very serious. It talks about the rights of our children and Canadians that have been trampled on. I gave a lot of different examples where we just have not gotten it right in protecting children.

I am surprised that the NDP also does not seem to think that privacy is a fundamental right and something that we should protect. The Conservatives will certainly protect it. We are the only ones speaking about it today.

[René Villemure, Bloc, Trois-Rivières, QC]

Mr. Speaker, I would like to thank my colleague from Bay of Quinte, who was also my colleague at the Standing Committee on Access to Information, Privacy and Ethics. We all miss him a lot.

He raised what I consider to be a very important point. He said that the bill in question does not treat privacy as a fundamental right. That really resonated with me because the Privacy Commissioner of Canada identified it as a prerequisite for moving forward.

I would like my colleague to comment on that.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, it is absolutely essential. If we lose privacy as a fundamental right, or even, as in this bill, we put it in Parliament's business, and when we get to the courts and people who have had their rights trampled on, who have had their homes addresses on the Internet for everyone to see because they donated to something, we lose what we value as individuals, as Canadians and as a Canadian society. We lose the protection for all of us to have the right to live a great life, volunteer, do the things we want to do, pursue that which motivates us the most, not because man or God says it is the right thing to do but because it is our natural right as Canadians. It is what we tout to the world as our freedom. Protecting that is paramount.

We have laws to protect that and give us the ability to look after that, but we do not mention that in any part of the bill. The bill is missing that. The biggest problem with the bill is that, if it becomes law and this is still not in the bill, then the courts and businesses are left to their own definitions of what that means. I talked about legitimate interest. It has to be in this bill from the outset. It is in the European Union's bill, and it is in Quebec's privacy bill, so why is it not in the Canadian bill being presented to Parliament?

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Mr. Speaker, some of this goes to the general approach of the government. We have a bill that purports to have noble objectives, which we might agree to as objectives, but there are all kinds of problems with the bill. The member talked about how much of this bill is left to future regulation. We have seen before where bills lack details or give the minister future powers, and we do not know what the final system is going to look like.

The member was on the ethics committee when we studied artificial intelligence and facial recognition. There was a great report that had unanimous support from all parties, including the Liberal members of that committee, but this bill was already tabled, and it seemed we were really just beginning to scratch the surface.

Could the member maybe comment on some of the recommendations that came out of the ethics committee report and the problem with just leaving so much to this vague future regulation?

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, we had a great study at the ethics committee, and we have just started to scratch the surface, as my hon. colleague mentioned, by looking at what has happened because of this technology and where it is going. Regarding facial recognition technology, Clearview AI was a company that scraped images off the Internet and just gave them to law enforcement.

One of the most concerning parts of the report we had was that when facial recognition technology was used, it misidentified Black women 38% of the time. That is very concerning. When we asked law enforcement whether traditional technologies like fingerprinting did the same, we heard they do not.

This technology is not perfect, and we therefore need a lot of study on it and a lot of consultation. We certainly have not had that. Our recommendation is to make sure we have tremendous consultation on the AI portion and perhaps scrap that until we are ready to present it.

[Mike Morrice, Green, Kitchener Centre, ON]

Mr. Speaker, I want to start by recognizing that tensions are high today with respect to workers' rights. I appreciate that colleagues of mine have brought up the importance of being mindful that a province has invoked the notwithstanding clause to trample on workers' rights and that the federal government has the power of disallowance in the Constitution to override that.

I understand the member for Bay of Quinte does not want to speak about that, so I would like to ask a question related to Bill C-27 with respect to political parties not being required to protect consumers' private data and this gap not being addressed in the current version of Bill C-27. I would like to know if the member for Bay of Quinte is as concerned about this as he is about a number of other items in Bill C-27, and if so, if he would like to speak about that.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, I want to thank the member for bringing the subject back to the matter at hand.

I have heard of this and read about it, and it is concerning to look at it.

There are two parts we are looking at for privacy. Number one is Bill C-27, which would protect Canadians' privacy rights when it comes to business. The second side is the Privacy Act. We have not looked at that, and that needs to come back to Parliament as well. The Privacy Act pertains to everything the government holds and controls, and how much information the government gets to keep on Canadians as well. Those two are very important, and to the member's point, certainly political parties are as well.

I think we all have to be responsible with private data. We all have the right as good citizens to collect it when it is going to be good, but not when it is bad. The point I brought up before is that using personal information for political gain to identify where people live because we do not like what they donated to is absolutely irresponsible, and I hope the member agrees with that as well.

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Mr. Speaker, my previous question was not about privacy, because I agree with the member on that. My question to the member was how he is going ensure that the rights he wants so badly are not trampled on, like what we are seeing today.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Mr. Speaker, the first thing to do with the bill is ensure that we get it right and include fundamental privacy rights. If the member is so concerned about that, I am hoping he is going to join our side with amendments to ensure that this is absolutely the starting place for the bill. If we are doing this in this Parliament here in this place, we should do everything we can to ensure that fundamental privacy rights are included in the bill and that going forward we accept nothing else.

[René Villemure, Bloc, Trois-Rivières, QC]

Mr. Speaker, I would like to begin by giving a shout out to my constituents in Trois-Rivières, whom I will be visiting all next week in my riding.

When I talk to people on the street, privacy is a topic that comes up a lot. They know that I sit on the Standing Committee on Access to Information, Privacy and Ethics, and privacy comes up often. People tell me that it is important, that we must do our best to rise to the challenge. Today, we have the opportunity to debate that very subject.

Society is a human construct. It is a reflection of how we organize our lives together. It reflects our vision of the world, the role of a citizen, the role of the state. In a democratic society where elected officials are chosen by the people to represent them, our laws must reflect our desires and the desires of our fellow citizens, as well as the way in which their visions can be realized. In other words, a society and its laws are eminently cultural constructs.

When we compare the legislation passed in the House of Commons with that of the Quebec National Assembly, the difference is striking. Ottawa tends to emphasize the enforcement mechanism, whereas in Quebec, the emphasis is on the legislator's intent. Ottawa wants to arbitrate, while Quebec wants to prescribe and guide.

When it comes to privacy, this is especially true in the digital age: the difference is dramatic.

At one end of the spectrum, so to speak, is the United States. In the United States, laws are primarily intended to arbitrate disputes rather than to shape how the digital economy operates. Laws are based on the good faith of the players and on voluntary codes. As one might imagine, this has its limits. Ultimately, if someone is wronged, they can get redress through the common law.

At the other end of the spectrum is the European Union. The legislation there prescribes clear obligations. I am referring to the General Data Protection Regulation, better known by the acronym GDPR.

In between is Canada, a hybrid creature whose intentions on privacy oscillate between the European and American extremes. This may seem like an academic debate, but there are practical implications that bring us to Bill C-27.

When it comes to privacy, European law is the most prescriptive in the world. It is based on a clear principle, namely that our personal information belongs to us and us alone, and no one can use it or benefit from it without our free, informed and explicit consent.

Once the government set out that principle or objective, it then provided a mechanism for achieving it. That mechanism is the GDPR. The GDPR is becoming the standard to follow when it comes to privacy, because it is the legal standard with the clearest objectives and the most binding application. Simply put, the GDPR does a good job of protecting privacy. That is one reason why it is the standard we should be emulating; the other is that the EU is projecting its standard-making power beyond its borders.

In order to protect the personal information of European citizens, the European Union will soon prohibit European businesses from sharing this information with foreign businesses that do not offer comparable protection. This does not affect us yet, but next year, the EU will be reviewing Canada's laws to see if they offer sufficient protection.

The existing legislation on personal electronic information protection dates back to 2000. That was 22 years ago. We were in the dinosaur era, the pre-digital era, an era we barely remember now. Also, it is far from clear whether Canada passes the comparable protection test required under the GDPR.

Information exchanges between Canadian businesses and their European partners could become more complicated. This is particularly true in areas that deal with more sensitive information, such as the financial sector. It is therefore absolutely necessary to redraft the Personal Information Protection and Electronic Documents Act, which is completely outdated. It has not kept pace with technological change and the data economy, where we are both the consumer and the product. It has not kept pace with the legal environment, where Canada is a dinosaur compared to Europe, as I was just saying.

Nevertheless, my colleagues will have figured out that the Bloc Québécois is in favour of the principle of Bill C‑27. Nevertheless, I would like to make a general comment about Bill C‑27. For some reason, the government has put into one bill two laws with completely different objectives. The bill would enact the consumer privacy protection act and also the artificial intelligence and data act. Although there is a logical link between these two acts, they could be stand-alone bills. Their objectives are different, their logic is different and they could be studied separately.

I have a suggestion for the government. It should split Bill C‑27 into two bills. We could create what I would call the traditional Bill C‑27, which would deal with personal information and the tribunal. Then, what I would call Bill C‑27 B would address artificial intelligence. As I was saying, there are logical reasons for that, but there are also practical reasons. Let me be frank and say that the artificial intelligence act being proposed is more of a draft than a law. The government has a clear idea about the mechanism for applying it, but, clearly, it has not yet wrapped its head around the objectives to be achieved and the requirements to be codified.

The mechanism is there, the bureaucratic framework is there, but the requirements to be complied with are not. Apart from a few generalities, the law relies essentially on self-regulation and the good faith of the industry. I have often faced these situations, and I can say that the industry's good faith is not the first thing I would count on.

Apart from a few generalities, this relies on good faith, but that is not a good way to protect rights. I am not convinced that this bill should be passed as written; I think it needs to be amended. Bill C‑27 probably deserves the same fate that Bill C‑11, its predecessor, encountered in the last Parliament. The government introduced it, debate got under way, criticism was fierce, and the government let it die on the Order Paper so it could keep working on it and come back with a better version. I think that is exactly what should happen to the artificial intelligence act.

The government has launched a healthy discussion, but this is not a finished product. If we decide that the government needs to keep working on it and come back with a new version, we will also be delaying the modernization of privacy and personal information legislation. Given the European legislation, which I talked about earlier, that is not what the government wants to do. That is why I would cordially advise the government to split Bill C‑27.

I am going to focus primarily on personal information protection because that is the part of Bill C‑27 that is ready to go and has the most practical applications. As I said before, Bill C‑27 is an improved version of Bill C‑11, which was introduced in the fall of 2020.

However, Bill C-27 still does not establish privacy as a fundamental right. Bill C-11 was strong on mechanics, but weak on protection. The principles were also weak and consent was unclear. It was tough on large corporations and much less so on small businesses. When it comes to privacy, however, it is the sensitivity of the data that should dictate the level of protection, not the size of the company.

A new start-up that develops an app that aggregates all of our banking data, for example, may have only two employees, but it still possesses and handles extraordinarily sensitive information that must be protected as much as possible. I cannot help but think of the ArriveCAN app, which was developed by just a few people but has a large impact on the data that is stored.

Finally, Bill C-11 did not provide for any harmonization with provincial legislation, such as Quebec's privacy legislation. The Bloc Québécois was quite insistent on that. A Quebec company subject to Quebec law would also have been subject to federal law as soon as the data left Quebec. It would have been subject to two laws that do not say the same thing and have two different rationales. This would mean duplication and uncertainty. It was quite a mess. Passing Bill C-11 would have diminished, in Quebec at least, the legal clarity that is needed to ensure that personal information is protected.

Here is what Daniel Therrien, the then privacy commissioner, told the Standing Committee on Access to Information, Privacy and Ethics, of which I am honoured to be a member. He said, and I quote, “I believe that C-11 represents a step back overall from our current law and needs significant changes if confidence in the digital economy is to be restored.”

He proposed a series of amendments that would make major changes to the bill. I want to commend the government here. It listened to the criticism. It is rare for this government to listen, but it did so in this case. It buried Bill C-11. We never debated it again in the House and it died on the Order Paper. It reappeared only after being improved.

Bill C-27 shows more respect for the various jurisdictions and avoids the legal mess I was talking about earlier.

Our personal information is private and it belongs to us. However, property and civil rights fall exclusively under provincial jurisdiction under subsection 92(13) of the Constitution of 1867.

What is more, privacy basically falls under provincial jurisdiction. That is particularly important in the case of Quebec, where our civil law tradition leads us to pass laws that are much more prescriptive.

Last spring, Quebec's National Assembly passed Bill 25, an in-depth reform of Quebec's privacy legislation. Our law, largely inspired by European laws, given that we share a legal tradition, is the most advanced in North America. As we speak, it is clear that Quebec has exceeded the European requirements and that our companies are protected from any hiccups in data circulation.

Our principles are clear: Our personal information belongs to us. It does not belong to the party who collected it or the party who stores it. The implication is clear. No one can dispose of, use, disclose or resell our personal information without our free, informed and express consent. Bill C-11 challenged this legal clarity but Bill C-27, at the very least, corrects that.

Under clause 122(2) of Bill C‑27, the government may, by order, “if satisfied that legislation of a province that is substantially similar to this Act applies to an organization, a class of organizations, an activity or a class of activities, exempt the organization, activity or class from the application of this Act in respect of the collection, use or disclosure of personal information that occurs within that province;”.

In other words, if Quebec's legislation is superior, then Quebec's legislation will apply in Quebec.

When I met with the minister's office earlier this week, I asked for some clarification just in case. Will a Quebec business be fully exempt from Bill C‑27, even if the information leaves Quebec? The answer is yes. Will it be exempt for all of its activities? The answer is yes.

There is still some grey area, though. I am thinking about businesses outside Quebec that collect personal information in Quebec. In Europe, it is clear. It is the citizen's place of residence that determines the applicable legislation. The same is true under Quebec's legislation.

It is not as clear in Bill C‑27. Since the bill relies on the general regulation powers for trade and commerce as granted by the Constitution, it focuses more on overseeing the industry than on protecting citizens. That is the sort of thing we will have to examine and fix in committee. I look forward to Bill C‑27 being studied in committee so we can debate the substance of the bill.

I have to say that I sense the openness and good faith of the government. In that regard, I would like to tell the member for Kingston and the Islands to take note that, for once, I feel he is working in good faith.

Bill C‑27 will have a much greater impact outside Quebec than within it, because it is better drafted than Bill C-11. That is not the only aspect that was improved. The fundamental principles of the bill are clearer. Consent is more clearly stated. The more sensitive data must be handled in a more rigorous manner, no matter the size of the entity holding them. That is also more clear.

If the principles are clear, the act will better stand the test of time and adjust to the evolving technologies without becoming meaningless.

We will support it at second reading after a serious debate, but without unnecessary delays. However, we believe and insist that the real work must be done in committee. Bill C-27 is complex. Good principles do not necessarily make good laws. Before we can judge whether Bill C-27 is indeed a good law, we will need to hear from witnesses from all walks of life.

When it comes to privacy, it only takes one tiny flaw to bring down the whole structure. This requires attention to detail and surgical precision. The stakes are high and involve the most intimate part of our lives: our privacy.

For a long time, all we had to do to maintain our privacy was buy curtains. That is how it used to be. It kept us safe from swindlers. Then organizations started collecting data for their records. Bankers collected financial information, the government collected tax information and doctors collected medical records. This sensitive information had to be protected, but it was fairly simple, since it was written on paper.

Today, we live in a different world. Whereas personal information used to be a prerequisite for another activity, such as caring for a patient or getting a loan from a bank, it has become the core business of many companies. Information has become the core business of many companies, which are also large companies.

Computerization enables the storage and processing of astronomical volumes of data, also known as big data. Networking that data on the Internet increases the amount of available data exponentially and circulates it around the globe constantly, sometimes in perpetuity, unfortunately.

For many corporations, including web giants, personal data is crucial to the business model. Citizen-consumers are now the product they are marketing. To quote Daniel Therrien once again, we are now in the era of surveillance capitalism. Speaking of which, The Great Hack on Netflix is worth seeing. This is troubling.

Furthermore, for our youngest citizens, the virtual world and the real world have merged. Their lives are an open book on Instagram, Facebook and TikTok. They think they are communicating with the people who matter to them, but they are in fact feeding the databases that transform them into a marketable, marketed product. We absolutely have to protect them. We need to give them back control over their personal information, which is why it is so important to amend and modernize our laws.

I would like to close my speech with an appeal to the government. Bill C‑27 does a lot, but there are also many things it does not do, or does not do properly. Consent is all well and good, but what happens when our data is compromised, when it has been stolen, when it is in the hands of criminals? These people operate outside the law and therefore are not governed by the law. All the consent-related protocols we can think of go out the window. To avoid fraud and identity theft, we will have to clarify the measures to be taken to ensure that anyone requesting a transaction is who they say they are. This really is a new dynamic. In that respect, we are somewhat in the dark, even though, curiously, this is a growing problem.

There is another gap to fill. Bill C‑27 provides a framework for the handling of personal information in the private sector, but not in the public sector. The government is still governed by the same old legislation, which dates back to the pre-digital era. The legislation is outdated, as we saw with the fraud related to the Canada emergency response benefit. The controls are also outdated. I therefore call on the government to get to work and to do so quickly. We will collaborate.

Finally, there is another thing the government needs to work on and fast. We addressed this issue in committee when we were looking at the geolocation of data. Bill C‑27 indicates what we need to do with personal data, nominative data. However, with artificial intelligence and cross-tabulation of data, it is possible to recreate an individual based on anonymous information. As no personal information was collected at the outset, Bill C‑27 is ineffective in these cases. However, we started by recreating the profile of a person with all their personal information. It is not science fiction. It is already happening. Nevertheless, this is missing from Bill C‑27, both in the part on information and the part on artificial intelligence.

I am not bringing this up as a way of opposing Bill C‑27. As I said, we will support it. However, we have to be aware of the fact that it is incomplete. As legislators, we still have some work to do. The time has come to treat privacy as a fundamental right.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, I have spent a lot of time on the ethics committee with the member for Trois-Rivières, and we have dealt with a lot of this material. It has been fantastic.

He spoke about Quebec being a model for Canada, as Quebec has some of the strongest privacy laws in place at the moment. I am wondering if he could expand on two things. One, what does Quebec have that we could implement through Bill C-27 that works really well? Two, does Quebec mention privacy as a fundamental human right for Canadians?

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, to reassure my colleague, Quebec does indeed mention that the right to privacy is a fundamental right.

What is most important is that the Quebec act protects the data, no matter where it is used. It is protected based on the location of the individual. The laws apply in that place. At the same time, we do not only consider the size of the entity, but also the source of the data.

These are minor differences, but they are important at a time when data is shared around the world.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, it is good to hear that the Bloc is willing to support this bill. I share the same concerns about the provisions for protecting minors, and the bill right now as it is does not provide very good guidance on sensitive information.

I wonder if the member agrees that this bill could be enhanced by providing more guidance on how to handle sensitive information in relation to protecting minors.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I completely agree with my colleague's comments.

Bill C‑27 is a good bill, but it is incomplete. We need to go further with respect to protecting the rights of minors, in particular. Today, minors are vulnerable, but they are the ones sharing the most data without it being protected. They will have to live with that for their entire lives. Therefore, I completely agree.

I hope that in committee we will be able to propose amendments that are accepted by the government in order to protect minors.

[Christine Normandin, Bloc, Saint-Jean, QC]

Madam Speaker, I thank my eloquent colleague for his speech. We always learn a lot when we listen to him. It is always enjoyable.

I would like to hear what he has to say about what will happen in committee. I understand that there is a massive amount of work to do to make this bill acceptable since it currently contains many flaws. Often, the contributions of expert witnesses are what support us in committee.

I would like to know what kind of experts he thinks it would be useful to hear from. Perhaps computer scientists, ethicists or legal experts? Generally speaking, who would he like to see testify in committee?

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, for a bill like this one that will have such a major impact on society, I think that we need to invite a rather broad range of witnesses, whether it be anthropologists, philosophers, ethicists, demographers or futurists. We will invite a computer scientist to appear at the end. The idea is that we need to think about the world of tomorrow and beyond.

I think that we should invite witnesses from all backgrounds and that we need to have the legislative maturity to listen, even when what we are hearing may be unpleasant. When exploring every angle of an issue, we need to hear all points of view and I am willing to do that.

[Rachel Blaney, NDP, North Island—Powell River, BC]

Madam Speaker, one thing that is a bit concerning for me in this bill is how broad and complex it is. It brings a lot of things into one place, and that can sometimes be a lot. It is important for us to have a process to look through that very closely to make sure that nothing is left out, and that does concern me.

One thing in particular that I have reviewed is the personal information and data protection tribunal. I asked a question of the minister earlier today and the minister was very clear: He felt this is a normal process and no one should worry. However, I am concerned, because this tribunal would have the ability to overrule the new enforcement actions and fines imposed by the Privacy Commissioner. Unfortunately, the vagueness of the membership of the tribunal is a concern, with many of its members appointed by the government. Today, we know it is very important that we not have any conflict or any perception of conflict. Both of those things are important.

I am wondering if the member could talk about whether this could be perceived or actually implemented in such a way that it allowed the government to use it as a political tool for the government to overrule decisions that it simply does not like.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my hon. colleague for that excellent question. At this point, we do need some parameters we can use to define the tribunal's role and the Privacy Commissioner's role. I think the commissioner should have a little more power.

I am usually on the Standing Committee on Access to Information, Privacy and Ethics, but this time around, I will be on the Standing Committee on Industry and Technology because I want to make sure this work gets done. I will make sure that we do this work rigorously, that we take a non-partisan approach to assessing this bill and that we get everyone on board with the bill.

Let me reiterate that this bill will have an impact on people's lives in the future. That is why we cannot let it become a political tool. I do not think it is one at this point, but I want to make sure it never becomes one. We will have to clearly define the roles of the tribunal and the Conflict of Interest and Ethics Commissioner, as well as those of the higher courts, which may want to rule on these matters. There is some confusion about these roles that needs to be cleared up.

[Randall Garrison, NDP, Esquimalt—Saanich—Sooke, BC]

Madam Speaker, I thank the hon. member for his very perceptive speech on this act. I wonder if he shares the concern I have, which is that whatever good provisions are here, a lot of my constituents do things every day online that put their privacy at risk. They do not understand the implications of the things that have become routine. When I read through the bill and I look at this, I wonder how we are going to deal with that problem in the future, because this is very complex material. Ordinary consumers are giving up their privacy rights, not willingly, but because of the complexity of the issues they do not really understand the implications of with respect to their privacy.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague for his question.

When we reviewed the geolocation project at the Standing Committee on Access to Information, Privacy and Ethics, we realized that someone with a Telus phone had not consented to their data being shared. It is very clear.

There is already an education component in the Privacy Commissioner's mandate, but I think it needs to be exercised more, because right now, when people click on “I agree”, most of them do not know what they are agreeing to.

As part of a recent committee mandate, we recommended that it should be possible to continue without accepting. I think there needs to be good privacy education in schools and at home. However, I also think that the Privacy Commissioner should be doing more on the prevention side of things. Right now, we are basically left to our own devices. Once we click “I agree”, it is too late.

[Gabriel Ste-Marie, Bloc, Joliette, QC]

Madam Speaker, I thank my hon. colleague from Trois-Rivières for his interesting speech.

The French magazine L'Express ran a story this week in connection with what the member was referring to. It said that it can take five, six or nearly seven hours to read the terms of service on Internet sites. That is what we are asked to do before clicking “I agree”.

Does the member believe we should set limits for this type of practice?

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, yes, I do. I believe that even the legal team who wrote the conditions we have to read before we agree to use Apple, for example, has not read all the conditions because it is too complex. Obviously, this needs to be put in layman's terms and simplified. When we sign a contract, it is advantageous to the drafter of the contract. When we are required to sign the contract, as in the case of an Apple iPhone, it is a problem.

In past meetings of the Standing Committee on Access to Information, Privacy and Ethics, we voiced our desire to simplify this and draw inspiration from Europe's General Data Protection Regulation to determine if it is possible to move forward without accepting the conditions.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, since we are talking about the rights of citizens, I would like to ask a question that is timely and urgent.

Does my colleague agree that a government should use the notwithstanding clause to take away workers' right to strike?

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank the hon. member for his question.

I was speaking on Bill C-27 this morning. I am not an expert on the notwithstanding clause. Unfortunately, I will not be able to answer his question because I do not have the legal background to do so.

The House resumed from November 4 consideration that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I am happy to start this week by speaking to Bill C-27. It is quite an extensive bill at over 140 pages in length. It would amend several acts and the most consequential are three of them in particular, as it is an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts.

I should start by saying that this is really three pieces of legislation that have been bundled up into one. As New Democrats, we have called for different voting for the third and final part of this act.

The first two parts of the act, concerning the consumer privacy protection act and the personal information and data protection tribunal act, do have enough common themes running through them to be put together into one piece of legislation. I still think, for these issues, that they would have been better as two separate pieces of legislation because one of them is brand new and the first one, the consumer privacy protection act, is the former Bill C-11, which was highly controversial in the previous Parliament.

When we had an unnecessary election called by the Prime Minister, that bill died, along with all of the work from Parliament, which was not concluded, despite extensive lobbying and consultation going, particularly, through the ethics committee at that time. This has now been bundled with some other legislation to go through the industry committee, which is fine.

The personal information and data protection tribunal act is a new component of this legislation. I have some concerns about that element of it, but it does have a common theme, which is worthwhile, and at least it has the potential to be put together and bundled. Although, again, it is extensive, it is a bundling that we can accept.

We have called for a Speaker's ruling with regard to the artificial intelligence and data act, as this is brand new legislation as well, but it does not have the same connections as the previous two pieces, which are bundled together, in the way that one could could argue for them. We want a separate vote on the second part of this because the legislation would be studied at committee together.

There will be a high degree of interest in this legislation, since Bill C-11 had that in the past. The new bill changes position from Bill C-11 significantly, and I expect that this in itself will garner a lot of chatter, as well as review and interest, from a number of organizations, many of whom we have already heard from as of now.

The other part, with the tribunal, would be another important aspect, because it is a divergence from our traditional way of enforcement and creates another bureaucratic arm. Again, I would like to see more on this, and I am open to considering the idea, but it is certainly different from our traditional private right of law for dispute settlements about data breaches and other types of corporate malfeasance, that actually have to deal with the types of laws that are necessary to bring compliance among people.

This goes to the heart of, really, where a political party resides in their expectations of companies and their use of data, information and algorithms. For New Democrats, we fall very much in line with something I have tabled before, several years ago, which is a digital bill of rights, so that one's personal rights online are consistent with that of our physical rights, where one is expected to be properly treated in a physical world and in the digital format world. That includes one's right to privacy, right to the expectation of proper behaviour conducted toward oneself and right to not be abused. It also includes significant penalties to those who do those abuses, especially when we are looking at the corporate world.

Where this legislation really becomes highly complicated is the emergence of artificial intelligence, which has taken place over the last decade and will be significantly ramped up in the years to come. That is why the European Union and others have advanced on this, as well as the United States.

Our concern is that this bill tries to split both worlds. We all know that the industries of Google and other web giants have conducted significant lobbying efforts over the last number of years. In fact, they have tripled their efforts since this administration has come into place and have had a direct line of correspondence about their lobbying, which is fine to some degree, but the expectation among people that it would be balanced does not seem to be being met.

I want to bring into the discussion the impact on people before I get into the technical aspects of the bill, as well as the data breaches that remind us of the need for protection among our citizens and other companies as well. One of the things that is often forgotten is other SMEs, and others can be compromised quite significantly from this, so protecting people individually is just as important for our economy, especially when we have the emergence of new industries. If they are behaviours that are hampered, manipulated or streamed, they can become significant issues.

I want to remind people that some of the data breaches we have had with Yahoo, Marriott, the Desjardins group and Facebook, among others, have demonstrated significant differences in the regulatory system between Canada and the United States and how they treat their victims. A good example is a settlement in the U.S. from 2009 with the Equifax data breach, where Equifax agreed to pay $700 million to settle lawsuits over the breach in agreement with the U.S. authorities, and that included $425 million in monetary relief to consumers. We have not had the same type of treatment here in Canada.

This is similar to the work I have done in the past with the auto industry and the fact that our Competition Bureau and our reimbursement systems are not up to date. We have been treated basically as a colony by many of the industries when it comes to consumer and retail accountability.

We can look at the example of Toyota and the data software issue, where the car pedal was blamed for the cars going out of control. It turned out this was not the case. It was actually a data issue. In the U.S., this resulted in hundreds of millions of dollars of investment into safety procedures. We received zero for that. Also, consumers received better treatment, where their vehicles were towed back to different dealerships to be fixed. In Canada, consumers did not receive any of that.

The same could be said with Volkswagen, another situation that took place with emissions. Not only did we not receive compensation similar to that of the United States, we actually imported a lot of the used Volkswagen vehicles from Europe. However, that was of our own accord and time frame when those vehicles were being sunsetted in those countries because of emissions.

In the case of Facebook, the U.S. Federal Trade Commission was able to impose a $5-billion fine for the company's violation, while the Privacy Commissioner's office was forced to take the company to federal court here in Canada. One of the things I would like to point out is that our Privacy Commissioner has stood up for the needs of Canadians, and one of the concerns with this bill would be the erosion of the Privacy Commissioner's capabilities in dealing with these bills and legislation.

The Privacy Commissioner has made some significant points on how to amend the bill and actually balance it, but they have not all been taken into account. One of the strong points we will be looking to is to see whether there are necessary amendments from our Privacy Commissioner on this.

One of the big distinctions between Canada and the United States, which is to our benefit and to Canada's credit, is the office of the Privacy Commissioner. Where we do not have some of the teeth necessary for dealing with these companies, we do have the independent Privacy Commissioner, who is able to investigate and follow through at least with bringing things to a formal process in the legal system. It is very labourious and difficult, but at the same time, it is independent, which is one of the strengths of the system we have.

If the government proceeds, we will see the bill go to committee, which we are agreeing to do. However, we do want to see separate voting. Before I get into more of the bill, I will explain that we want to see separate voting because we really distinguish that this is inappropriate. The artificial intelligence act is the first time we have even dealt with this topic in the House of Commons, and it should be done differently.

We will be looking for amendments for this, and big corporate data privacy breaches are becoming quite an issue. Some of these privacy breaches get highly complicated to deal with. There have been cases with cybersecurity and even extortion. The University of Calgary is one that was well noted, and there have been others.

We need some of these things brought together. The bill does include some important fixes that we have been calling for, such as stronger enforcement of privacy rights, tough new fines, transparency in corporate decisions made by algorithms.

I have pointed out a lot of the concerns that we have about the bill going forward because of its serious nature. However, we are glad this is happening, albeit with the caveat that we feel the bill should be separate legislation. The minister does deserve credit for bringing the bill forward for debate in the House of Commons.

Bill C-11 should have been passed in the last Parliament, but here we are again dealing with it. The new tribunal is the concern that we have. It could actually weaken existing content rules, and we will study and look at the new tribunal.

The tribunal itself is going to be interesting because it would be an appointment process. There is always a concern when we have a government appointment process. There is a concern that there could be complications setting up the tribunal, such as who gets to go there, what their background is, what their profession is and whether there will be enough support.

One of the things that gives me trouble is that the CRTC, for example, takes so long to make a decision. It is so labourious to go through and it has not always acted, most recently, in the best interest of Canadians when it comes to consumer protection and individual rights. It gives me concern that having another tribunal to act as a referee instead of the court system could delay things.

Some testimony has been provided already, some analysis, that suggests the tribunal might end up with lawsuits anyway, so we could potentially be back to square one after that. The time duration, funding, the ability to investigate and all these different things are very good issues to look at to find out whether we will have the proper supports for a new measure being brought in.

Another government resource for this is key. At the end of the day, if it is a tribunal system that is not supportive of protecting Canadians' privacy and rights, then we will weaken the entire legislation. That is a big concern because that would be outside Parliament. The way that some of the amendments are written, it could be coming through more regulatory means and less parliamentary oversight.

Who is going to be on the tribunal? How will it be consistent? How will it be regulated? I would point to the minister providing the CRTC with a mandate letter, which is supposed to emphasize the public policy direction it should be going. In my assessment, the CRTC, over the last number of years, has not taken the consumer protection steps that New Democrats would like to see.

When it comes to modernizing this law, we do know that this will be important to address because there are issues regarding the data ownership, which is really at the heart of some of the challenges we face. There is algorithmic abuse and also areas related to compensation, enforcement, data ownership and control, and a number of things that are necessary to ensure the protection of people.

We can look at an area where I have done a fair amount of work related to my riding, which is automobile production. There has been the production of the car and the value there, but there will also be the data collection. The use of that data collection can actually influence not only one's individual behaviour, but also that of society. That is a significant economic resource for some of these companies.

It is one of the reasons I have tabled an update to my bill on the right to repair. The right to repair is a person's ability to have their vehicle fixed at an auto shop of their choice in the aftermarket. The OEMs, the original manufacturers, have at times resisted this. There have been examples. Tesla, for example, is not even part of what is called the voluntary agreement, but we still do not have an update with regard to the use of data and how one actually goes about the process of fixing the vehicle.

It also creates issues related to ownership of the vehicle, as well as insurance and liability. These could become highly complicated issues related to the use of data and the rules around it. If these types of things are not clear with regard to the process of rights for people, expectations by those who are using the data, and protection for people, then it could create a real, significant issue, not only for individuals but for our economy.

Therefore, dealing with this issue in the bill is paramount. A lot of this has come about by looking at what the GDPR, the general data protection regulation, did in European law. Europe was one of the first jurisdictions to bring forth this type of an issue, and it has provided an adequate level of protection, which is one of the things Europe stands by with regard to protection of privacy. There have been some on the side over here in North America who have pushed back against the GDPR, and even though this landmark legislation has created a path forward, there still is a need for transparency and to understand what the monetary penalties for abuse are going to be, which are also very important in terms of what we expect in the legislation.

Erosion of content rights is one of the things we are worried about in this bill. Under Bill C-27 individuals would have significantly diminished control over the collection, use and disclosure of their personal data, even less than in Bill C-11. The new consent provisions ask the public to install an exemplary amount of trust to businesses to keep them accountable, as the bill's exceptions to content allow organizations to conduct many types of activities without any knowledge of the individuals. The flexibility under Bill C-27 allows organizations to state the scope not only of legitimate interests but also of what is reasonable, necessary and socially beneficial, thus modelling their practices in a way that maximizes the value derived from the personal information.

What we have there is that the actors are setting some of the rules. That is one of the clearer things that we need through the discussion that would take place at committee, but also from the testimony that we will hear, because if we are letting those who use and manage the data make the decision about what consent is and how it is used, then it is going to create a system that could really lead to abuse.

There is also the issue or danger of de-identification. Witnesses, artificial intelligence and people being able to scrub much of their data when they want and how they want is one of the things we are concerned about. There is not enough acknowledgement of the risk that is available in this. That includes for young people. We believe this bill is a bit lopsided towards the business sector at the moment, and we want to propose amendments that would lead to better protection of individual rights and ensure informed consent as to what people want to do with their data and how they want it to be exercised as a benefit to them and their family, versus people being accidentally or wilfully brought into exposure they have not consented to.

As I wrap up, I just want to say that we have a number of different issues with this bill. Again, we believe there should be a separate vote for the second part of this bill, being the third piece of it. It is very ambitious legislation. It is as large as the budget bill. That should say enough with regard to the type of content we have. I thank the members who have debated this bill already. It is going to be interesting to get all perspectives. I look forward to the work that comes at committee. It will be one that requires extensive consultation with Canadians.

[Dan Mazier, Conservative, Dauphin—Swan River—Neepawa, MB]

Madam Speaker, the member touched a little on children's personal rights and protection. I wonder if he could comment on seniors and what kind of an impact it would have on them if they were exposed to this legislation. How could the legislation in fact harm seniors, especially if it was made more bureaucratic?

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I did not touch on the issue of seniors, and I really appreciate the member's raising it.

We do not even have consistency right now in the decision-making process about privacy. People currently agree to a number of different things by clicking boxes, and there is no standardization. For seniors, we have seen, for example with the ArriveCAN app, the confusion as they have complex technology thrust at them during times of stress and times of highly important decisions.

As we move toward this, the member raises a good point in the sense that seniors and other people will need some type of support, education and coaching that go along with this, and shown in plain language. We are dealing with a highly technical bill here that we have had to scrub through the system several times, and the complications it has are unbelievable.

We know we have a very good, educated population, but this is a big change, and I hope that there will be a program of education as part of this. It is a good point that seniors have been left out of this debate, and I am glad the member raised that.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I appreciate the speech from the member for Windsor West, especially around the issue of artificial intelligence. This is a brand new area. How does the member feel about the importance of this, and does he feel we are ready to legislate in this area? I know it is an area of concern for my constituents, and I would like to hear the member's thoughts on that.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I applaud the minister for bringing the issue forward to Parliament. Again, I want to exercise some caution that the first two pieces of the legislation are much easier to deal with, because at least there was some discussion on those with Bill C-11. It is a bit different in this one, and the tribunal is an issue, but I am open to looking at it. I just have concerns about that. However, the artificial intelligence part of it is critical. I am glad it is in front of us, but it is going to require much more extensive debate and care, and that is why it should be entirely separate.

We in the NDP have proposed a fairly reasonable compromise, and the Speaker will rule on it. The proposed compromise is that there would be a separate vote for that particular part of the bill. The reason is that perhaps the first two parts could lead to a decision that might be different from the decision on the last part, just to ensure that we get enough testimony and time in committee for it.

I am looking forward to all perspectives in the House on this. It is time for us to look at that. It is a reasonable position, and I am glad it is in front of us. I do not like the way it is in front of us, but we will deal with that.

[Yves Perron, Bloc, Berthier—Maskinongé, QC]

Madam Speaker, I thank my hon. colleague for his speech.

This is a very important moment in time. The subject before us is sensitive and extremely complex. As has been mentioned several times, we are wading into areas that have not been regulated until now. It is very important to take the time to get it right. Certain conditions are obviously needed. For example, all legislation must be adapted to legislation that already exists in the provinces and in Quebec. As we know, orders in council issued during the previous Parliament guaranteed that there would be no encroachment on provincial jurisdictions if equivalent legislation exists in those provinces.

I wonder if my colleague could confirm whether his party is committed to not encroaching on provincial jurisdictions. Unfortunately, his party usually has a hard time respecting what happens in the provinces and wants to centralize everything at the federal level. I want him to understand that things might be more efficient if we can avoid duplicate structures. That is the first part of my question, which is fundamental. Furthermore, his political party has a tendency to pass legislation very quickly using gag orders, which are supported by the party. It concerns me that such an important piece of legislation is being voted on after limited debate.

Will the member commit to respecting the time allotted for debate on this bill and to respecting Quebec's jurisdictions?

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I have extensive notes here, more than I could even go through, with regard to this bill being the number of pages that it is.

My party has an exemplary record of respecting Quebec and using, including in this bill, some of the practices in Quebec that are solid for all of us. Therefore, I disagree with the member on that.

Also, I have also seen the member's party close debate many times during the years I have been here. I have been here just over 20 years, and the Bloc has limited debate on different bills at different times for different circumstances and so forth. I want to have a robust discussion about this, and we are committed to it. I have expressed that to the minister and to other parties, including anyone who wants to talk about this bill to try to make sure it gets its due course. Those are the things that are quite strong.

I will conclude by saying again that we have shown that some of the best practices from Quebec are part of our strategy. That is flattery, and it is not at odds with Quebec.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, I appreciate the complexity with which the bill has been introduced and that it presents to my hon. colleague, and the work involved in going through it. He mentioned the problems in terms of the tribunal process. I know the Privacy Commissioner has raised a lot of concerns.

Could the member perhaps go into a little more detail about the insistence, which our party certainly has, that the Privacy Commissioner has raised, in terms of ensuring that consumers have far more access to fairness within the legislation than organizations typically would have, because they have more monetary resources to pursue things under legal precedence?

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, the member for London—Fanshawe's question is something I did not touch on. Again, there is so much in the bill. She is quite right with regard to the fact that if an individual wants to take a legal right of action against an abuse, it is going to be more cumbersome for them, and a company would have a better chance at that.

The tribunal and the division of power with the Privacy Commissioner are going to be very interesting. What I do not want to do is anything that would undermine the Privacy Commissioner. I suppose I am biased in the sense that from my experience, the Privacy Commission has been an excellent model, has done some excellent work and needs more support. That is the other thing we have to do. If we are going to give it more responsibilities, it will need more support. What is worrisome to me is that the tribunal would be a bit disenfranchised from that consistency, and that is one of the reasons we want to see this legislation debated thoroughly.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Madam Speaker, we know that businesses and companies find data to be very useful for many purposes, including offering consumers the goods and services they prefer.

However, data can also be used to reduce competition, charge certain selected individuals higher prices for a good, or increase delivery charges for food in locations where there is less competition. Data can therefore be used to stifle competition. It seems to me that Canada's regime is very outdated.

I would like my colleague to comment on whether this bill will provide some sort of justice for Quebec and Canadian consumers, who are presently likely to be taken advantage of by companies that use their personal data without their knowledge and against their own interests.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, that is going to be where we really want to steer, as New Democrats, toward more empowerment for consumers and watching that abuse be eroded. The problem we have is that some of the companies and the lack of competition we have in Canada right now could even lead to greater abuse, potentially, because the information and sharing of data can be done behind closed doors and behind the system of accountability. That will be one of the things to watch for, and that really is the objective of parliamentarians.

I am glad the member has raised that, because I think it is one of the things we do not want to lose sight of. A good example is that we see outright abuse of competition right now. When we had the Loblaws bread scandal, those involved were also putting their money offshore, and on top of that they all ended their pandemic hero pay at the same time, so these are good questions.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I will be sharing my time with the member for York Centre.

I am pleased to rise in the House today to speak to the digital charter implementation act, 2022, in particular the aspect on the consumer privacy protection act. If I have time, I will also discuss the artificial intelligence and data act.

I am very proud to speak to these two pieces of legislation that introduce a regime that seeks to not only support the technological transformation, but also help Canadians safely navigate this new digital world with confidence. These past few years, Canadians have witnessed these technological shifts take place. They have taken advantage of new technologies like never before. In 2021, more than 72.5% of Canadians used e-commerce services, a trend that is expected to grow to 77.6% by 2025.

According to TECHNATION, a 10% increase in digitalization can create close to a 1% drop in the unemployment rate. What is more, every 1% increase in digitalization can add $8.7 billion to Canada's GDP. In order to take advantage of those major benefits for our economy, we must ensure that consumers continue to have confidence in the digital marketplace.

Technology is clearly an intrinsic part of our lives, and Canadians have growing expectations regarding the digital economy. It is absolutely essential that the Government of Canada be able to meet those expectations.

With this bill, the government is putting forward a regime that gives Canadians the protection they deserve. First, as stated in the preamble of the digital charter implementation act, 2022, Canada recognizes the importance of protecting Canadians' privacy rights. Similarly, the 2022 consumer privacy protection act also provides important protections for Canadians.

That said, our government has listened to the input of various stakeholders, and we have made changes to improve this bill. I was on the committee in the last Parliament, and there was a lot of discussion about the previous bill, Bill C‑11. I am very pleased to be able to speak to Bill C-27, so that we can get all that work done in this Parliament.

One of the most important changes we have made is enhancing protection for minors. Some stakeholders felt that the previous legislation did not go far enough to protect children's privacy. I agree. Consequently, the bill was amended to define minors' information as sensitive by default. This means that organizations subject to the law will have to adhere to higher standards of protection for that information. The legislation also provides minors with a more direct route to delete their personal information. This will make it easier for them to manage their online reputation. I think this is a really important change, because we know that young people are very aware and very capable of using all types of digital platforms, but at the same time, we need to make sure that they are able to protect their reputation.

In addition to protections for minors, we also made changes to the concept of de-identification of personal information. According to many stakeholders, the definitions in the old bill were confusing. We recognize that having well-defined terms helps ensure compliance with the act and provides more effective protection of consumers' information. In that regard, I understand that, because we are talking about new technologies and an evolving industry, it is important for all members to share their expertise, since that will help us develop a better piece of legislation.

The difference, then, between anonymous information and de-identified information needs to be clarified because, clearly, if information is de-identified but an organization or company is able to reidentify it, that does not serve the purpose of having anonymous information.

Data-based innovation offers many benefits for Canadians. These changes contribute to appropriate safeguards to prevent unauthorized reidentification of this information, while offering greater flexibility in the use of de-identified information.

The new law also maintains the emphasis on controlling the use of their personal information by individuals. That remains a foundation of the law, namely that individuals must be able to fully understand the purpose for which information will be used and consent to that purpose in the most important circumstances.

However, the modern economy must also have flexible tools to accommodate situations that are beneficial but that may not require consent if the organization respects certain limits and takes steps to protect individuals.

The approach advocated here continues to be based on the concept of individual control, but proposes a new exception to consent to resolve these gaps as a tool for safeguarding privacy. The new provisions propose a general exception to cover situations in which organizations could use personal information without obtaining consent, provided that they can justify their legitimate interest in its use for circumstances in which the individual expects the information to be used.

In addition, to prevent abuse, the exception is subject to a requirement that the organization mitigate the risk. For example, digital mapping applications that take photos of every street and that we use to view them, particularly to help with navigation, are widely accepted as being beneficial. However, obtaining individual consent from every resident of the city is impossible.

I believe that everyone in the House will agree that it is hard to imagine how we managed before we had access to those navigation applications. Last evening, I had a visit with a family member in Ottawa and was very happy to have my mapping application to find my destination.

The presence of an exception, combined with a mitigation requirement, therefore allows individuals to take advantage of a beneficial service while safeguarding personal information. The example shows another key aspect for building trust and transparency. Digital mapping technology presents a certain level of transparency. The vehicles equipped with cameras can be seen on our streets and the results can also be seen posted and available online.

However, there are some technologies or aspects thereof that are more difficult to see and understand. That is why the bill continues granting individuals the right to ask organizations for an explanation regarding any prediction, recommendation or decision made in their regard by an automated decision-making system.

What is more, these explanations must be provided in plain language that the individual can understand. These provisions also support the proposed new artificial intelligence act. However, I do not think that I have time to get into that, so I will end there.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, the member spoke about the protection of minors. I have a simple question. I cannot find anywhere in the bill where it defines a minor or a reference to “sensitive information”. Could the hon. member please inform the House how the bill defines a minor and sensitive information?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I appreciate the concern the member brings with that question.

We have many definitions of “minor”, but it is generally understood that it is the different provinces that would legally establish who a minor is. We can understand it being youth using the Internet, and we need to make the extra effort to protect them and ensure they have the tools to protect themselves.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, I commend my colleague. I sat with her on the Standing Committee on Access to Information, Privacy and Ethics for a few months.

We had concerns about privacy. Several recommendations were made, and that is why Bill C‑11 became Bill C‑27. I acknowledge that the bill has been improved. That being said, I wonder about two things.

First, in 2022, I do not think it is right that banking institutions are taking the lead on showing us how important it is to protect privacy. Second, this bill is important, but I would like to know if we should refer it to a committee to study it properly because it is really two bills in one. The first is on artificial intelligence, and the second is on privacy protection. What does the member think?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I know that my colleague opposite is very interested in this matter because our personal information was leaked by a Quebec financial institution. That was very worrisome.

I believe that it is in the business interests of financial institutions to protect their customers and not to lose them. They have really taken the lead in this area. The provinces have followed suit, but I believe it is also the federal government's role to enhance these protections and ensure that standards exist across the country.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Madam Speaker, it is notable that Bill C-27 does not explicitly apply to political parties. Given the potential for privacy breaches and other issues to exist in the political arena, I wonder if my colleague across the way could comment on the potential for amending it to explicitly reference and include political parties in the scope of the bill.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, that is a very interesting question, which I believe has come up at different times in this Parliament and previous Parliaments. It is an area, I am sorry to say, that I do not have a lot of insight into, but the overriding principle of safeguarding the information of Canadians has to be first and foremost, especially for any political party that hopes to earn their votes.

[Ya'ara Saks, Liberal, Parliamentary Secretary to the Minister of Families]

Madam Speaker and hon. colleagues, I rise today to speak about the digital charter implementation act, 2022, also known as Bill C-27.

I thank the member for Châteauguay—Lacolle for sharing her time with me today.

It is an important discussion that is happening among Canadians about what our digital environment looks like. As we know, over the past few years, we have witnessed the constant evolution of our digital environment. Canadians have been successfully navigating through this changing environment, but they have also made it clear to us that they want better protection of their privacy. They want to be able to benefit from the latest emerging technologies with the confidence that they can be used safely. Canadians also believe that organizations need to be fully accountable for how they manage personal information and how they go about developing powerful technologies, such as artificial intelligence, or AI.

From the beginning of our consultations on digital and data, stakeholders have stressed the importance of maintaining flexibility to innovate responsibly and maintain access to markets at home and abroad. I am proud to say that the digital charter implementation act, 2022, which would enact the consumer privacy protection act, or CPPA, and the artificial intelligence and data act, or AIDA, would do just that.

The CPPA represents a complete transformation of Canada's private sector privacy regime, the Personal Information Protection and Electronic Documents Act, or PIPEDA, which came into force in 2001. That was 20 or so years ago. CPPA would introduce significant changes to better protect Canadians' personal information, including strong fiscal and financial consequences for those who seek to benefit from curtailing their legal obligations. This new framework would also ensure that all Canadians could enjoy the same privacy protections as individuals have in other countries.

The AIDA, for its part, is being proposed to build confidence in a key part of the data-driven economy. This part of the bill would introduce common standards for responsible design, development and deployment of AI systems. It would also provide businesses with much-needed guardrails for AI innovation and would ensure that Canadians can trust the AI systems that underpin the data economy.

PIPEDA was passed at the start of the century when other countries and some provinces were moving forward with privacy laws governing the private sector. Recognizing the potential for a patchwork of provincial privacy laws to emerge and the need to align internationally, Canada put in place PIPEDA as a national privacy standard. It drew on best practices to provide robust privacy protections for increased consumer confidence and a consistent and flexible regulatory environment for businesses that allowed for legitimate use of personal information.

The key element for alignment was the recognition of provincial private sector privacy laws as substantially similar. This meant that, where such a law is given that designation, PIPEDA did not apply to an organization's activities within that province. PIPEDA would continue, however, to apply to the federally regulated sector in that province and to any personal information collected, used or disclosed in the course of commercial activities across borders. This has provided a stable regulatory environment and flexibility for provinces, and it has supported Canada's trade interests well for many years.

Today, history is repeating itself, but the stakes are much higher. The role of the digital economy is far more central to our lives than it was 20 years ago. To harness all that the modern digital world has to offer, we clearly need to modernize our federal private sector privacy law. The provinces are moving in that direction and, again, the risk of fragmentation looms.

Quebec has amended its private sector privacy law, and B.C. and Alberta are examining their private sector privacy laws as well. Ontario too is considering introducing a new private sector privacy law. Therefore, the federal government must act now to ensure that all Canadians benefit from a substantially equivalent degree of protection and facilitate compliance for organizations that do business across the country.

Like PIPEDA, the CPPA is grounded in the federal trade and commerce powers. It builds on the best practices developed internationally and by Canadian provinces, and it foregrounds the importance of the ease of doing business across boundaries. The CPPA replicates the approach under PIPEDA, and it updates the mechanism in regulations for recognizing provincial laws as substantially similar. The regulations will set out the criteria and process for such recognition and will continue to provide the flexibility that has been important to PIPEDA's success.

CPPA, like its predecessor, would also maintain the Privacy Commissioner's ability to collaborate and co-operate with his or her provincial counterparts. This is an important tool to ensure consistency, guidance and enforcement, and one that has enabled our commissioners to lead the world in privacy collaboration and co-operation.

Canada also needs to move proactively to regulate in the AI space, given that the operation of these systems transcends national and provincial borders in the digital environment. AIDA would create a common standard that all organizations involved in international and inter-provincial trade and commerce would have to meet. AIDA would place Canada at the forefront of international regulation in the AI space and would provide clear rules across the country. This would spur innovation and build confidence in the safety of AI systems used or developed in Canada.

We live in an interconnected world. Data is constantly flowing across borders. In 2001, the European Commission recognized PIPEDA as providing adequate protection relative to EU law, allowing for the free flow of personal information between Canadian and European businesses.

In 2018, a new EU regulation came into effect that was known as the general data protection regulation. It updated many of the existing requirements and added strong financial penalties for contraventions. The EU is currently reviewing its existing adequacy decisions, including the one that applies to Canada. We expect to hear more on the outcome of this review soon.

The CPPA would make a positive contribution to maintaining Canada's adequacy with the EU privacy regime. It would enable personal data from EU businesses to continue to flow to Canada without additional protections. Beyond the EU, the changes proposed in the CPPA would represent important updates that would bring us in line with other international jurisdictions that have updated their laws. It would ensure interoperability with consistent rules, rights and consequences.

Other jurisdictions internationally are also moving ahead on their AI regulation, and strong action is needed to maintain Canada's leadership position internationally. Interoperability with international partners remains a key priority. The EU in particular has advanced a framework for regulating AI that would set standards for any AI systems being deployed in the EU market.

AIDA would propose a risk-based approach that would ensure interoperability with the EU while keeping in mind that Canadian context is unique. For example, AIDA would include flexible compliance options in order to ensure that our many small to medium-sized businesses would not be left behind. The proposed AIDA would represent an opportunity for Canada to lead internationally, would ensure market access for Canadian companies and would uphold Canadian values.

The government launched Canada's digital charter in 2019. Its 10 guiding principles offer a foundation on which to build an innovative and inclusive digital and data-driven economy. Ensuring interoperability, a level playing field, strong enforcement and real accountability are clearly reflected in the digital charter implementation act, 2022.

I can assure colleagues that our approach is pragmatic, principled and meets our trading needs. The bill would provide a consistent, coherent framework that Canadians and stakeholders could rely on. With Bill C-27 we would continue to encourage trade and investment and to grow an economy that would extend across provincial and international borders alike.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, one of the important concepts of this legislation is clause 18, which introduces the concept into law of legitimate interests of the business. It says that when there is a legitimate interest of the business, it can choose to use a person's data for something that it did not intend, if it is of more importance to the business and it does not think it would cause too much harm to the individual.

I wonder if the member could tell us why the government believes that a company has a right to use an individual's data without their permission.

[Ya'ara Saks, Liberal, York Centre, ON]

Madam Speaker, this legislation is important right now so that we can weed out what is not legitimate. We all have these phones. I have one. It tells us when we have been to the grocery store, it tells us when our flights are on time and it tells us where we are in the world. We acquiesce to that every day and that data is used. In the same mind, we want to make sure that when businesses, large or small, have access to that information, because we have agreed to it in theory, that it is guard-railed and it is protected.

That was a great question, and I think that is exactly why we are moving on this legislation.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I want to remind the hon. member that she is not to use her phone as a prop in the House.

Questions and comments, the hon. member for Laurentides—Labelle.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, it is a beautiful Monday morning, particularly since we are talking about a bill that will likely make things easier for people who, unfortunately, did not give their consent or whose personal information was compromised.

I will repeat my question, which I unfortunately did not get an answer to. Does the government intend to thoroughly analyze this bill and invite enough witnesses to ensure that it is clear for all legislators?

[Ya'ara Saks, Liberal, York Centre, ON]

Madam Speaker, as part of the ethics committee team, I have already begun these deep-dive discussions on the impact of AI on privacy. We have looked at the mobility data of movement as it pertained to the pandemic. I can rest assured that I have an interest in this at committee, whether it is at ethics, at justice or wherever this lands, to make sure that we get those answers. Consumers and Canadians have a right to know how their data is used and to understand when it is used and the purpose for it.

I am deeply encouraged by our work at committee and what we have done, and I look forward to the discussions that will be ahead.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, privacy rights are so critical. When they are violated, consumers deserve to be compensated. There have been numerous examples in the United States where consumers have been compensated in the realm of hundreds of millions of dollars. For the same breach here in Canada, consumers have not been compensated.

I am wondering if the member would support amendments that would ensure that, in Bill C-27, there is parity, and for the same breach, Canadians and Americans would be getting fair compensation.

[Ya'ara Saks, Liberal, York Centre, ON]

Madam Speaker, as I mentioned in my speech, part of the act and its contemplation is financial consequences for misuse of the act, in terms of privacy and data breaches, so it is certainly something that would come up.

I heed warning. The member and I have talked about this in terms of the Volkswagen case in the U.S. and Canada. We need to compare apples to apples. It is a bit of apples to oranges when it comes to the litigious nature of the United States in terms of compensation and the guardrails that are here in Canada. We should always be mindful of that. While in principle we want to make sure that there is accountability and transparency in the use of this, and that with accountability comes financial penalties, I would like to make sure that it is a made-in-Canada approach.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, data is used for good and data is used for evil. Data is money, data is power and data is knowledge. Data can improve our lives. Data can also harm our lives. Data tells the story of our lives, and our personal data flows globally. The amount of data in the world has doubled since 2020 and is expected to triple by 2025 according to Statista, 2022.

To understand why we need modern privacy rights in the digital world, it is important to understand that businesses have evolved from providing a specific service, like a social network such as Facebook and Twitter or a search engines such as Google or Microsoft to find things, to using data to gather information on individuals and groups, to manage and deploy people's data and to sell their information to others and sell them goods and services.

We have evolved from businesses providing these services for interest to businesses using these services for surveillance on us and making enormous amounts of money on our personal information. As legislators, we must balance the uses of data collection with an individual's right to privacy. It is a delicate balance that Bill C-27 aims to address by modernizing our privacy laws.

At the heart of this long overdue revision to our privacy laws must be the rights of the individual. In my view, commercial usage of data under privacy law should be secondary to personal privacy, and should only be focused on how business interests enhance personal needs and how commercial entities protect individual privacy rights. My remarks today will focus on why this legislation falls far short of what individuals, groups and businesses need for a clear legislative framework of data collection and management of personal information in this digital age.

First, Bill C-27 is really three bills in one omnibus bill. The first bill would update privacy law. The second bill contains a new semi-judicial body and would potentially duplicate what the Privacy Commissioner could do while removing the right to go to the courts. The third is a rushed bolt-on bill on artificial intelligence that does not, in my mind, have much intelligence in it. The Liberal legislation manages to weaken privacy and put up barriers to innovation at the same time.

Bill C-27 fails Canadians right up front in its preamble. Despite demands from privacy advocates over the last few years, the government has failed to recognize privacy as a fundamental right in the preamble. The bill states that individuals' personal information should have the “full enjoyment of fundamental rights”. This is clever language that avoids giving personal privacy the recognition that it is a fundamental right or a fundamental human right.

The wording “full enjoyment of fundamental rights” in the preamble needs to be amended from “of fundamental rights” to “as a fundamental right”. Furthermore, leaving this strictly in the preamble reduces if not eliminates any real legal impact. If privacy is a fundamental right, for it to have true force in this bill it needs to be included as well in clause 5, which notes the purpose of the bill.

Why is privacy a fundamental right? Freedom of thought, freedom of speech and freedom to be left alone are derived from privacy. The legal protections of privacy limit government's intrusion into our lives. In free and democratic societies, we consider these freedoms as essential rights. The rights to think what I want, to say what I want and to be free to choose what I do, what I am interested in and whom I interact with and where I do that in our digital world are data points. To me they are personal information and therefore are part of a fundamental right to privacy.

What does this mean? It means privacy rights under law are prioritized over commercial rights. A rights-based approach serves as an effective check on technology's potential dangers while ensuring businesses can function and thrive.

Government officials have told me this cannot be recognized in the bill the way it needs to be to have true meaning under law and force because it would intrude on provincial jurisdiction. I do not agree, and neither does the Privacy Commissioner of Canada. Both levels of government can regulate privacy and do. The federal government's role is to regulate aspects under its control, including the fact that commerce does not follow provincial boundaries and therefore requires federal oversight.

I believe that most Canadians accept and expect their data to be used to enhance their experiences and needs in our modern society. I also believe that for organizations to obtain the data of Canadians, Canadians must first consent to it, and that if these same organizations find new uses of our data, they need to get express consent as well. Canadians want their data safely protected and not used for things they did not give permission for, and if they choose to end a relationship with a service provider, they want their personal data to be destroyed.

I do not believe Canadians want their personal data sold to other entities without their express consent, and how does Bill C-27 deal with these expectations of Canadians? I think poorly. The legislation, in the summary section, states that the dual purpose of the bill is to “govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.” What it would not do is place personal privacy rights above commercial interests.

The bill would require express consent in clause 15, and that is true, but a great deal of the bill goes on to describe the many ways in which consent would not be required and how it would be left up to the discretion of the organization that has collected the data if it needs consent for its usage. The bill is also weak in terms of making sure individuals understand consent when given. For consent to be meaningful, the usages proposed must be understood. The lack of definition and the placement of burden of interpretation on businesses expose those same businesses to legal action and penalties if they get it wrong. This lack of clarity may stifle innovation in Canada as a result. The bill needs to ensure that individuals understand the nature, purpose and consequences of the collection, use and disclosure of the information to which they are consenting.

In addition, the bill would give organizations the right to use information in new ways and would require businesses to get an update to consent for this information. That is good and necessary, but the bill would also enable organizations to use the implied consent in subclause 15(5). When combined with paragraph 18(2)(d), this would give businesses carte blanche to use implied consent rather than express consent.

An organization can decide on its own that the original consent implies consent for a new purpose, and they do not need to seek the individual's views. This is a version of the old negative option marketing that was outlawed in the 1990s. Either someone gives consent, or they do not. There is no such thing as implied consent, in my view, and this needs to be removed from the bill.

Additionally, the bill uses the term “sensitive information”, which companies and organizations must determine to protect data, but it does not anywhere in the more than 100 pages define what “sensitive information” is. It needs to be defined in the bill to include information revealing racial and ethnic origin, gender identity, sexual orientation and religious and other affiliations. These are just a few examples.

However, that is not the worst of it. Bill C-27 would introduce a concept called “legitimate interest”. This is a new rule that would rank an individual's interests and fundamental rights below those of the organization that gathered the information, the exact opposite of what a personal privacy bill should do. To do this, subclause 18(3) would allow an organization or business to use information if it has a legitimate interest in doing so. However, here is where it really gets goofy: To try to reduce businesses using our data under the legitimate interest clause for their own needs over ours, the Liberals have decided to limit the power under paragraph 18(3)(b). This clause could prohibit the business or organization from using our information for the purpose of influencing behaviour.

For more than 20 years, since the invention of loyalty and rewards programs, retailers have used people's data to offer products they might enjoy based on their purchasing patterns. Have members ever bought wine online or in store because it said, “If you like this, you might enjoy this alternative”? Have members ever watched a show on Netflix because it was recommended? Have members ever listened to a song on Spotify because it was recommended based on what else they had listened to? Well, guess what. Paragraph 18(3)(b) could now make this service illegal.

The Liberals cannot get express consent right, and they are allowing companies to use people's data with implied consent or no consent at all. The Liberals are also putting the business use of people's personal data above their privacy rights. That is why it is really the no privacy bill. At the same time, the Liberals are making illegal the good parts of what businesses do in enhancing the customer experience by removing the ability to study purchasing patterns and offering products that we might enjoy because of paragraph 18(3)(b). This bill makes influencing people's decisions illegal.

The minister said to me and mentioned in the House in his opening speech on the bill, as have other members today, that he is proud to be protecting children from harm in this digital bill. This 100-page legislation has only one clause related to children. Subclause 2(2), under “Definitions”, states that “information of minors is considered to be sensitive”, but the bill does not define “sensitive” nor does it define what a minor is. Officials tell me that the definition of a minor is determined by provincial law, so each province would have different rules, and companies would have to comply with the different rules in every province.

If the protection of children were really a major purpose, this legislation would devote some space to defining both what a minor is and what sensitive information is. During COVID, minors used many online apps and programs to continue their formal education. There were then and still are no protections under law as to what is done with their data. This technology would be a new normal for our education system. The online surveillance of children resulting from the COVID experience is huge and protections are zero, even with this bill.

This bill needs to define in law, not regulation, age-appropriate consent for minors, and comprehensive rules to prevent the collection, manipulation and use of any minor's data. This bill leaves it up to businesses to decide what is sensitive and appropriate for minors. It is a colossal failure on the minister's main selling point for this no privacy bill.

The bill is silent on the selling of personal data. It needs provisions on the limits and obligations of data brokers. The bill is silent on the use of facial recognition technology. The bill also prohibits using data in a way that produces significant harm and defines it inadequately. For example, psychological harm caused by a data breach and embarrassment caused by privacy loss are not included. The damages role needs to be expanded to include moral damages, since most contraventions of privacy do not involve provable, quantifiable damages.

Creating more government bureaucracy and growth is the true legacy of the Liberals in government. This bill is no exception, with the creation of a body to appeal the Privacy Commissioner's rulings to. The appointed new body of non-lawyers is called the personal protection and data tribunal, and it is the second part of the bill. Frankly, these powers, if they really are important, should be given to the Privacy Commissioner to eliminate the middle man of bureaucracy. There is no need for this tribunal.

Finally, let us turn to the ill-conceived, poorly structured and ill-defined artificial intelligence part of Bill C-27. It really needs to be removed from this legislation and puts this bill's passage into question. AI is a valid area to legislate, but only with a bill that has a legislative goal. That is why I am hopeful that the Speaker will rule in favour of the NDP's point of order, reiterated by our Conservative House leader, which would ensure that part 3 of the bill is voted on separately from part 1 and part 2.

Essentially, this part of Bill C-27 would drive all work on AI out of Canada to countries with clearer government legislation. It tells me the government has not done its homework, does not really know what AI is or will become, and has no idea how it will impact people in our country.

The bill asks parliamentarians to pass a law that defines no goals or oversight and would give all future law-making power to the minister through regulation, not even to the Governor in Council but to the minister. The minister can make law, investigate violations, determine guilt and impose penalties without ever going to Parliament, cabinet or any third party.

It is a massive overreach and is anti-democratic in an area critical to Canada's innovation agenda. Promises of consultation in the process of crafting regulations is too little, too late. It puts too much power in the hands of unelected officials and the minister.

The definition in the bill of what AI is, and therefore what it wants total regulatory power over, is a system that autonomously processes date related to human activities using a genetic algorithm, a neural network, machine learning or other networks to make recommendations or predictions. If we think this is futuristic, it is not. It is already happening in warfare to determine and execute bombings.

Without parliamentary oversight, the bill introduces the concept of “high-impact systems”. It does not define what that is, but it will be defined in regulation and managed in regulation. No regulatory power should ever be given to the minister or the Governor in Council for anything that is not defined in law.

The only thing the bill defines is the unprecedented power to rule all over this industry and the fines to those who breach the unwritten regulations. The massive financial and jail penalties that extend down to the developers and the university researchers for undefined breaches of law as part of the statute are huge.

Unless this portion of the bill is separated when members vote, this AI section is reason alone that the bill should be defeated. AI is a significant need, but it needs a proper legislative framework, one that is actually developed with consultation.

I urge all members to read the bill carefully. Current privacy laws need amendment, but the current law is preferable to this ill-defined proposal. The AI bill would drive innovation and business out of Canada's economy, making us less competitive.

It is hard to believe anyone could get this legislation so wrong, especially since this is the second time the Liberals have proposed updating our privacy laws. Without splitting the bill, without having separate votes and without considerable amendments in committee in the first two parts, the bill should be defeated.

I urge all members to consider this seriously in their deliberations as we go on to the many speeches that we will hear. While this is a critical point of updating our personal privacy, the bill, in its current state, does not do it and it gives equal if not greater rights to businesses and organizations than it does to individuals.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, I have heard the Conservatives talk a couple times, as did the member, about the definition of a “minor”. For a lot of people, that is self-explanatory. I think we can assume what is intended by the definition of “minor”. Would the member support this going to committee so questions like that could be answered? If it is a matter of defining that, and the member and others feel so passionately that it should be in there, would it not be beneficial to get it to committee so that discussion could be had?

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, I suspect the bill will go to committee given the costly coalition of the NDP and Liberals.

Specifically on that question on defining “minors”, it is not clear in the bill because it does not set an age. We are allowed to drive at 16 and vote at 18. The age of majority can be 19 for consuming alcohol. In the United States, the law for the purpose of the digital economy, I think, defines it as low as 13. That is where some of the confusion will lie.

If people are running businesses and we have all these different definitions in Canada of what a minor is, how are they supposed to determine, for the purpose of managing that database and whether that information should stay there or not, what the cut-off age is? It is too vague.

I am hopeful that is one of the areas, presuming the bill will reach committee with the coalition, that we will study in depth and perhaps be able to come up with a more precise definition.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Madam Speaker, I thank my colleague from South Shore—St. Margarets for her speech.

Here are my takeaways from my colleague's speech: Not everything in this bill is black and white, and it could be improved. Also, the Conservatives want to vote against the bill just to prevent it from going to committee. In contrast, I think we can find common ground and amend it.

I have to say that this unwillingness to send the bill to committee does suggest, kind of like what we saw with the bill to amend the Broadcasting Act, that the Conservatives may be under the influence of big corporations that would be happier with no regulatory framework whatsoever rather than an imperfect one that is a work in progress.

I think this kind of approach which consists of arguing against sending the bill to committee could undermine Quebeckers' and Canadians' confidence in our institutions.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, the member for Mirabel and I have some spirited discussions as seatmates.

With respect to the first point, if there is not a separate vote, as has been requested in the point of order, for the artificial intelligence in the third part of the bill, then, yes, we agree that this needs to be defeated because it would really hurt our economy.

In terms of the issue of personal privacy versus companies, in my remarks I made it very clear that the bill is inadequate in dealing with the personal protection of privacy and data of the individual and it places the interest of business over that. We are opposed to this.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Madam Speaker, I share my colleague's concern about the lack of due diligence on the artificial intelligence aspect of the bill. I wonder if the member wants to elaborate on that point a bit more, because artificial intelligence could be anywhere from national defence all the way to something as simple as products people have in their homes. I wonder if the member wants to talk a bit more about the importance of separating that part of the bill.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, it is an enormous area. Artificial intelligence is already here in aspects of our lives of which we are not aware. Machine learning has evolved into this neural net.

There was a conflict in Azerbaijan where all the targets were chosen by artificial intelligence and the actual bombing and execution of that were all done by artificial intelligence without any human intervention. Obviously that is a worrisome thing from our perspective, though maybe not from some perspectives of other countries with different ethical backgrounds or approaches to these issues.

There is the need to do a proper consultation beforehand. We are at the early stages of trying to figure out the balance of how to do that in a way that still enhances our lives, like those things that we get now through machine learning about better purchasing options, right through to the issue of the point of which the machines are doing the decision-making process. It is an important area to put some regulatory and law structure around, as other countries have. However, we need to have much more detail in the bill rather than just give the minister carte blanche of regulatory power in the future to define it, execute it and investigate it.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, one of the concerns I have with the bill is again with respect to companies having too many rights and too much power within this. One of them is around the disposal of information. Could the member talk about his party's concern with that as well, when companies say that they are disposing of it and yet that information is truly not disposable?

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, that is a great question regarding the ability of individuals to request the destruction, for example, of their data if they leave. I heard about a case in the news this morning and I got an email from somebody yesterday, who has been having this ongoing battle with Telus. The person is leaving the company and wants that information destroyed, but cannot even get a response from Telus.

That is one of the areas, if the bill gets to committee, that we need to explore the issue of providing amendments to the bill that would give individuals more control over the decision to destroy their data if they leave.

There is a worrying provision, as I mentioned already, about minors. A member of the government side said that minors could request the destruction of their data. I do not think minors should have to request it, personally. Minors' data should not be kept in anyway in storage in the system we have today.

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, on that point, when we think about data that is collected, quite often a lot of that data, especially by AI, is collected in a manner that is not identifiable with who the data came from. The whole point to AI is to develop the systems by pouring massive amounts of data into them so the technology can become intelligence, so to speak.

How does the member square the comment he made with respect to demanding data be deleted from Telus, for example, when it might not be identifiable and, ultimately, one would not want it to necessarily be identifiable in many situations? Would he exclude that from those comments?

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, all information is identifiable because it involves, and should involve, expressed consent up front and is trackable under all systems now, even under AI. It can be, theoretically, and at times the identity is removed to put it together in a larger context of data.

I am looking forward to hearing testimony on this. It is my understanding that there are technologies that allow people, through a back end, to figure out and get at that data. I am not sure the legislation is strong enough to deal with the issue of the itemized data, the stuff that had people's individual identification taken off, and that it cannot be reconstituted. I know there are penalties in the bill for doing that if it is done without permission, but there are questions around the technology's ability to truly hide one's data at this point.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Madam Speaker, it is an honour today to rise to speak to Bill C-27, the digital charter implementation act.

I think it is important to reflect on how long it has been since we last had an update to legislation regarding the privacy laws that exist around data. The last time was over 20 years ago. Twenty years might not seem like a long time, but when we think about it, 20 years ago Facebook was probably just a program Mark Zuckerberg was working on in his dorm room.

If we think of iPhones, they were pretty much non-existent 20 years ago. Smart phones were out, but they certainly did not have anywhere near the capabilities they do today. So many other technologies we have come to rely on now have been getting smarter over the years. They are acting in different manners and are able to do the work they do because of the data being collected from individual users.

Another great example would be Google. Twenty years ago it was nothing more than literally a search engine. One had to type into the Google form what one was looking for. Sometimes one had to put weird characters or a plus symbol between words in the search terms. It literally was just a table of contents accessing information for people. However, now it is so much more than that. How many of us have, at some point, said to somebody that we would love to get a new air fryer, and then suddenly, the next day or later that day, we see in Google, on Facebook, or whatever it might be, advertisements for air fryers that keep popping up. I am sure that sometimes it is a coincidence, but I know in my experience it seems it happens way too often to be a coincidence.

These are the results of new technologies that are coming along, and in particular AI, that are able to work algorithms and build new ones based on the information being fed into the system. Of course the more information that gets fed in, the smarter the technologies get and the more they are looking to feed off new data that can give them even further precision with respect to advertising and targeting tools at people.

This is not just about selling advertising. AI can also lead to incredible advancements in technology that we otherwise would not have been able to get to, such as advancements in health and the automotive industry. If we think of our vehicles, the big thing now in new cars is the lane-assist feature, which uses technology such as lidar to read signals in the road.

There is technology that, when we enter our passwords to confirm we are human beings, sometimes requires us to pick different things from pictures. When we do that, we are feeding information back into helping those images be properly placed. We are not just confirming that we are human beings; there is an incredible amount of data being used to give better evaluations to various different formulas and equations based on the things we do.

When we think of things like intelligent and autonomous vehicles, which basically drive themselves, 20 years ago would we ever have thought a car could actually drive itself? We are pretty much halfway there. We are at a point where vehicles are able to see and identify roads and know where they need to be, what the hazards are, and what the possible threats are that exist with respect to that drive.

What is more important is that, when I get into my vehicle, drive it around and engage with other vehicles, it is analyzing all of this data and sending that information back to help develop that AI system for intelligent vehicles to make it even better and more predictive. It is not just the data that goes into the AI, but also the data that it can generate and then further feed to the algorithms to make it even better.

It is very obvious that things have changed quite a bit in 20 years. We are nowhere near where we were 20 years ago. We are so much further ahead, but we have to be conscious of what is happening to that data we are submitting. Sometimes, as I mentioned in a previous question, it can be data that is submitted anonymously for the purposes of being used to help algorithms around lidar and self-driving vehicles, for example. At other times it can be data that can be used for commercial, marketing and advertising purposes.

I think of my children. My six-year-old, who is in grade one, is developing his reading quite quickly. Two years ago, even at the age of four, when he would be playing a video game and would not be able to figure out how to get past a certain level, he would walk up to my wife's iPad and basically say, “Hey, Siri, how do I do this?”

Just saying that, I probably set off a bunch of phones to listen to what I am saying, but the point is that we have children who, already at such a young age, are using this technology. I did not grow up being able to say, “Hey, Siri, how do I do this or that?”

What we have to be really concerned about is the development of children and the development of minors, what they are doing and how that can impact them and their privacy. I am very relieved to see there is a big component of this that, in my opinion, aims to ensure the privacy of minors is maintained, even though I have heard the concern or the criticism from some members today that the definition of “minor” needs to be better reflected in the legislation.

I feel as though if it is not known what a minor is, in terms of how it relates to this legislation, then I believe this is something that can be worked out in committee. It is something to which the governing members would be more than welcome, in terms of listening to the discussion around that and why or why not further clarifying the definition is important.

I would like to just back up a second and talk more specifically about the three parts of this bill and what they would do. The summary reads as follows:

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.

A consequence of this first part would be to repeal other older pieces of legislation. I think this is absolutely critical, because this goes back to what I have been talking about in terms of how things have changed over the last 20 years. We are now at a place where we really do not know what information we are giving or is being used from us. I realize, as some other colleagues have indicated, 99.9% of the time, we always click that “yes, I accept the terms” without reading the terms and conditions, not knowing exactly how our information is being used and what is actually being linked directly back to us.

Through the consumer privacy protection act, there would be protections in place for the personal information of individuals while, at the same time, really respecting the need to ensure companies can still innovate, because it is important to innovate. It is important to see these technologies do better.

Quite frankly, it is important for me personally, and this will be very selfish of me, that, when I am watching on Netflix a show that I really like, I get recommendations of other shows I might really like. As the member for South Shore—St. Margarets mentioned earlier, when it comes to Spotify, it is important to me also that, when I start listening to certain music, other music gets suggested to me based on what other people who share similar interests to mine have liked, and how these algorithms end up generating that content for me.

It is important to ensure that companies, if we want them to continue to innovate on these incredible technologies we have, can have access to data. However, it is even more important that they be responsible with respect to that innovation. There has to be the proper balance between privacy and innovation, how people are innovating and how that data is being used.

We have seen examples in recent years, whether in the United States or in Canada, where data that has been collected has been used in a manner not in keeping with how that data was supposed to be used. There has to be a comprehensive act in place that properly identifies how that data is going to be used, because, quite frankly, the last time this legislation was updated, 20 years ago, we had no idea how that data would be used today.

By encouraging responsible innovation and ensuring we have the proper terminology in the legislation, companies would know exactly what they should and should not be doing, how they should be engaging with that data, what they need to do with that data at various times, how to keep it secure and safe and, most importantly, how to maintain the privacy of individuals. It is to the benefit not just of individuals in 2022, or 2023 almost, to have data that is being properly secured. It is also very important and to the benefit of the businesses, so that they know what the rules are and what the playing field is like when it comes to accessing that data.

The second part of this bill, as has been mentioned:

...enacts the Personal Information and Data Protection Tribunal Act, which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act.

This is absolutely critical, because there has to be somewhere people can go to ensure that, if they have a concern from a consumer perspective over the way their data is used and they are not happy with the result from the commissioner, they have an avenue to appeal those decisions. If we do not do that, and we put too much power in the hands of a few individuals, or in this case the Privacy Commissioner under the consumer protection act, if we give all that power and do not have the ability for an appeal mechanism, then we will certainly run into problems down the road. This legislation would help ensure that the commissioner is kept in check, and it would also help consumers have the faith they need to have in terms of accountability when it comes to their data and whether it is being used and maintained in a safe way.

The third part of the bill is the more controversial in terms of whether or not it should be part of this particular legislation or in a separate vote. The summary reads:

Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate the risks of harm and biased output related to high-impact artificial intelligence systems.

That act would provide for public reporting and authorizes the minister to order the production of records related to artificial intelligence systems. The act also would establish prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system in an intentional or reckless way that causes material harm to individuals.

One of the consequences of artificial intelligence, quite frankly, is that if we allow all of this biased information to be fed into the artificial intelligence systems and be used to create and produce results for important algorithms, then we run the risk of those results being biased as well if the inputs are going to be that way. Therefore, ensuring that there are proper measures in place to ensure individuals are not going to be treated in a biased manner is going to require true accountability.

The reality is that artificial intelligence, even in its current form, is very hard to predict. It is very hard to understand exactly when a person is being impacted by something being generated from an artificially intelligent form. Quite often, a lot of the interactions we already have on a day-to-day basis are based on these artificial intelligence features that are using various different inputs in order to determine what we should be doing or how we should be engaging with something.

The reality is that if this is done in a biased manner or in a manner that is intentionally reckless, people might not be aware of that until it is well past the point, so it is important to ensure that we have all of the proper measures in place to protect individuals against those who would try to use artificial intelligence in a manner that would intentionally harm them.

As I come to the conclusion of my remarks, I will go back to what I talked about in the beginning, that artificial intelligence, quite frankly, has a lot of benefits to it. It is going to transform just about everything in our lives: how we interact with individuals, how we interact with technologies, how we are cared for, how we move around by transportation, how we make decisions, as we already know, on what to listen to or what to watch.

It is incredibly important that as this technology develops and artificial intelligence becomes more and more common, we ensure that we are in the driver's seat in terms of understanding what is going into that and making sure we are fully aware of anybody who might be breaking rules as they relate to the use of artificial intelligence. It will become more difficult, quite frankly, as the artificial intelligence forms take on new responsibilities and meanings to create new decisions and outputs, and we must ensure that we are in a position to always be in the driver's seat and have the proper oversight that is required.

I recognize that some concerns have been brought forward today by different members. At first glance, when the member for South Shore—St. Margarets and others brought forward the concern around the definition of a “minor”, which is not something I thought of when I originally looked at this bill, I can appreciate, especially after hearing his response to my question, why it is necessary to put a proper definition in there. I hope the bill gets to committee and the committee can study some of those important questions so we can keep moving this along.

I certainly do not feel as though we should just be abandoning this bill altogether because we might have concerns about one thing or another. The reality, and what we know for certain, is that things have changed quite a bit in the last 20 years since the legislation was last updated. We need to start working on this now. We need to get it to committee, and the proper studies need to occur at this point so we can properly ensure that individuals' privacy and protection are taken care of as they relate to the three particular parts I talked about today.

[Dan Mazier, Conservative, Dauphin—Swan River—Neepawa, MB]

Madam Speaker, the member mentioned some of the things that are missing in the bill and that it will hopefully get to committee, but there was no mention, as he said, about minors and defining “minor”. My other colleague mentioned today that in the U.S. it is defined as 13 years old, which I found quite surprising. Here in North America we have so many definitions of “minor” that we still do not know what they meant here in Canada when they wrote the laws. There was no mention of seniors, which I mentioned already this morning.

Overall, why did the government pick such an ambiguous or bureaucratic way of approaching this legislation and offering clarity versus having the rules and doing it right the first time?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, when I first looked at the word “minor” I just assumed what a minor would be. I think my natural assumption was that it meant anybody under the age of 18. That was an assumption I probably should not have made.

I have been listening to the discussion today, and when I asked that question of the member for South Shore—St. Margarets, he gave a really good answer that made me pause and reflect on the fact that even in Canada, we have various terms for minors.

I am looking forward to seeing this go to committee so that it can be studied and then we can hear the pros and cons of defining it. Maybe there is no con to it and only pros, in which case I look forward to hearing what the committee puts forward on that. Maybe there is another reason it should not be defined that I am unaware of at this point. Again, that is something I would like to hear the answers to.

However, the debate today has certainly opened my eyes to that perspective.

[Mario Beaulieu, Bloc, La Pointe-de-l'Île, QC]

Madam Speaker, personal information is a shared jurisdiction. The Government of Quebec already has Law 25 on personal information.

Are there any guarantees that the new legislation will not infringe on Quebec's jurisdiction? Has the member already considered that? Does he have any examples?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, my understanding, based on the information that I have received, is that the bill aligns itself very closely with the approaches of other jurisdictions, such as where the member is from in Quebec. I think that the two bills can work together and this does not necessarily supersede the other.

Again, that is a good question for the committee to study and report back on. At least, my understanding at this point is that it works very closely with other laws that exist. That may be part of the reason the information was not conclusive in relation to defining a minor. Perhaps that is a decision that has to be made with the provinces and other jurisdictions. I do not know, but I think it is a good question and I too would like to hear the answer to it when this returns from committee.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, one of the things that concern me in this bill is the proposed personal information and data protection tribunal. The way it is formulated and the vagueness of the membership, especially since many members will be appointed by the government, gives rise to a concern that it might be used as a political tool by the government of the day to overturn rulings it does not like. No other jurisdiction in the world has a tribunal like this. No other privacy regime has a tribunal like this.

I am curious as to whether the member thinks it might be better just to empower the Privacy Commissioner.

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, I do not understand exactly what the member means by just empowering the Privacy Commissioner. My understanding was that the intent of the tribunal was to oversee decisions that were made by the commissioner. That being the case, I think it is important that there be a body in place to bring complaints about the commissioner to.

Having said that, again, if the concern is not about the structure of the bodies but more about the composition and how that is determined, then I think this is a great conversation that can be had at committee, and the committee can bring forward its suggestions on this.

The government that introduced the bill certainly is not in a majority, as we know, and the NDP have been there to work with the government quite a bit. If these are suggestions that need to be brought forward, in a minority Parliament there is going to have to be at least a majority of the members on the committee that make recommendations back. I guess we will see what comes back from the committee.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, I appreciated hearing the thoughts of the member for Kingston and the Islands, but one proposed section that is a concern to me is proposed section 18(3), which states:

An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use

I wonder if the member could comment on the possibility of tightening up the language of what a legitimate interest is and if, in his view, this is something the committee could look at improving when the bill gets there.

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Mr. Speaker, given the fact that the governing party does not have a majority, if a majority of the House feels a concern over that, there will have to be some kind of a compromise or resolution in committee with respect to this.

My only caution would be to ask, what does it actually mean? When we hear stuff like this and we read it, we might intuitively say, “Hold on, there is a problem with this,” without actually getting all the feedback. Committee is a great place to ask these questions specifically and to get examples of when that might happen and when it might not. That would then better inform the committee to make a recommendation, like the member is suggesting.

[Ken McDonald, Liberal, Avalon, NL]

Madam Speaker, I want to compliment my colleague on his wonderful speech.

He did mention that it has been 20 years since this matter was reviewed and looked at. Could the member describe why now, and how important it is to get it right at this time?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, as I said at the beginning of my remarks, 20 years ago none of us were on Facebook. I think it was just Mark Zuckerberg and some of his college friends, and look where we are now and not only the way Facebook, Instagram and all those other social media services impact our daily lives in the sense that we are using them, but also how they are selling stuff to us, collecting information from us and feeding stuff back to us. The same could be said about Google and the iPhone. All these things have come a tremendous way in the last 20 years.

Having the proper measures in place now is critically important, because these technologies are not going to slow down. They are just going to speed up, getting better and more efficient. We need to make sure the proper accountability and rules are in place at this stage of the game, so we are not trying to play catch-up even more later on.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, the member talked about being in the driver's seat, about AI and privacy.

The bill is really a balance between business interests and privacy, but one thing that we have seen is missing from the bill is its failure to mention privacy as a fundamental human right. That is not included in the purpose clause. We look at other provinces, like Quebec, and Quebec has privacy listed as a fundamental human right in its privacy legislation.

To be in control, to be in the driver's seat, to protect our minors, to ensure that businesses do not have something like legitimate interests that take control of this bill, does the member agree that having privacy listed as a fundamental human right is imperative to this bill going forward in the purpose statement?

[Mark Gerretsen, Liberal, Kingston and the Islands, ON]

Madam Speaker, the member indicated that it is not in the preamble. Could it be in the preamble? Maybe it should be. I am not sure.

What I did learn very quickly from my days on municipal council is that the preamble really does not matter; it is the resolve clauses in the motion, or in this case the bill, that really matter. Do I believe that privacy is of the utmost importance? Absolutely. It is talked about throughout this bill. Should that be in the preamble? I am sure that is another matter that could be discussed at committee to determine if it is appropriate.

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, for the average citizen in the digital age, we have entered uncertain times. To almost everyone, at face value, the convenience of our time is remarkable. Access to any piece of information is available at our fingertips. Any item imaginable can seamlessly be ordered and delivered to our doors. Many government services can be processed online instead of in person. Canadians have taken these conveniences for granted for many years now.

The pandemic accelerated our ascent, or descent, depending on who you ask, into the digital age. The inability to leave our homes and the necessity to maintain some rhythm of everyday life played a significant part in that, but around the world, we saw governments taking advantage of the plight of their citizens. Public health was used as a catalyst for implementing methods of tracking and control, and social media platforms, which have been putting a friendly face on exploiting our likes, dislikes and movements for years, continue to develop and implement that technology with little input or say from their millions of users.

Canadians no longer can be sure that their personal information will not be outed, or doxed, to the public if doing so would achieve some certain political objective. We saw that unfold earlier this year with the users of the GiveSendGo platform.

The long-term ramifications of our relationship with the digital economy is something Canadians are beginning to understand. They are now alert to the fact that organizations, companies and government departments operating in Canada today do not face notable consequences for breaking our privacy laws. As lawmakers, it is our responsibility to ensure that Canadians’ privacy is protected and that this protection continues to evolve as threats to our information and anonymity as consumers unrelentingly expands both within and beyond our borders.

That brings me to the bill we are discussing today, Bill C-27. It is another attempt to introduce a digital charter after the previous iteration of the bill, Bill C-11, died on the Order Paper in the last Parliament. My colleagues and I believe that striking the right balance is at the core of the debate on this bill. On the one hand, it seeks to update privacy laws and regulations that have not been modernized since the year 2000 and implemented in 2005. It would be hard to describe the scale of expansion in the digital world over the last 22-year period in a mere 20-minute speech. It is therefore appropriate that a bill in any form, particularly one as long-awaited as Bill C-27, is considered by Parliament to fill the privacy gaps we see in Canada’s modern-day digital economy.

Parliament must also balance the need for modernization of privacy protection with the imperative that our small and medium-sized businesses remain competitive. Many of these businesses sustain themselves through the hard work of two or three employees, or perhaps even just a sole proprietor. We must be sensitive to their concerns, as Canada improves its image as a friendly destination for technology, data and innovation. This is especially true as our economic growth continues to recover from the damaging impact of pandemic lockdowns, crippling taxes that continue to rise and ever-increasing red tape.

That extra layer of red tape may very well be the catalyst for many small businesses to close their operations. No one in the House would like to see a further consolidation of Canadians’ purchasing power in big players such as Amazon and Walmart, which have the infrastructure already in place for these new privacy requirements.

In a digital age, Canadians expect businesses to operate online and invest a certain amount of trust in the receiving end of a transaction to protect their personal information. They expect that it will be used only in ways that are necessary for a transaction to be completed, and nothing more.

In exchange for convenience and expediency, consumers have been willing to compromise their anonymity to a degree, but they expect their government and businesses to match this free flow of information with appropriate safeguards. This is why Bill C-27, and every other bill similar to it, must be carefully scrutinized.

As many of my colleagues have already indicated, this is a large and complex bill, and we believe that its individual components are too important for them to be considered as one part of an omnibus bill.

There are three—

[The Speaker, Liberal, Anthony Rota]

I am sorry, but I am going to cut in to interrupt the hon. member. She will have 15 minutes and 45 seconds to complete her speech when we return to this. We will now go to Statements by Members.

The House resumed consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Mr. Speaker, as many of my colleagues already indicated, this is a large and complex bill, and we believe that its individual components are too important for them to be considered as one part of an omnibus bill. I am pleased with the ruling of the Speaker.

There are three separate pieces of legislation to this bill. In part 1, the consumer privacy protection act would repeal and replace decades-old measures concerning personal information protection. In part 2, the personal information and data protection tribunal act would strike a tribunal to administer penalties for violations of the CPPA. In part 3, the artificial intelligence and data act is brand new to the bill and sets up a framework for design and use of AI in Canada, which is almost entirely unregulated.

Long before the widespread use of the Internet, our Supreme Court was clear that privacy is at the heart of liberty in a modern state. The government should be taking every opportunity possible to enshrine privacy in our laws as essential to the exercise of our rights and freedoms in Canada. As Daniel Therrien stated in the Toronto Star earlier this month, “democracies must adopt robust solutions anchored in values, not laws that pretend to protect citizens but preserve the conditions that created the digital Wild West.”

The value of privacy should anchor the bill. Instead, the bill fails right out of the gate. The preamble states:

the protection of the privacy interests of individuals with respect to their personal information is essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms in Canada

Placing this value in the preamble of the bill where it has no teeth raises distrust rather than confidence that the government truly respects Canadians' privacy rights. The CPPA would require organizations, companies or government departments affected by the bill to develop their own codes of practice for the protection of personal information. While these codes must be approved and certified by the Privacy Commissioner, one can only imagine the variation of protection that would result. This requirement would add significant red tape and would be yet another onerous task borne on the backs of small and medium-sized businesses, which employ most Canadians. It would also create more work for the Privacy Commissioner in parsing through complicated codes created by larger, wealthier, powerful corporations, companies or government departments that have legal teams whose sole purpose is to find creative ways to perhaps game the system.

Although it would take more time and investment up front, the better option, in my mind, would be to create a standard code of practice that all entities have to follow. This could certainly be taken on as one of the first responsibilities of the expanded Office of the Privacy Commissioner in defining the universal code of practices, where confidence in the process would be greatest and where the greatest level of concern for individual privacy actually exists.

This bill states that personal information can be transferred without Canadians' consent for purposes ranging from research to analysis to business purposes, but it must be de-identified before this can take place. At first glance, this is a positive measure until it is compared with anonymization as an alternative. According to the bill, de-identify means “to modify personal information so that an individual cannot be directly identified from it, though a risk of the individual being identified remains.” That leaves much to be desired when compared to the anonymization of personal information. In the bill, anonymize means “to irreversibly and permanently modify personal information, in accordance with generally accepted best practices, to ensure that no individual can be identified from the information, whether directly or indirectly, by any means.”

Any attempt to identify individuals from de-identified information is prohibited, except in approved circumstances. While many of these approved circumstances relate to the ability of an entity to test the effectiveness of its de-identification system, the potential for abuse still exists. This bill would be improved by eliminating those chances for abuse. We should examine replacing de-identification with anonymization wherever possible.

In comparing Bill C-27 to the EU regulations, we see there are several ways in which the CPPA does not live up to what is widely considered to be the international gold standard of privacy protection, which is the European Union's 2016 General Data Protection Regulation, or GDPR. There is a glaring example of Bill C-27's inferior protections: The GDPR processes personal data in such a manner that it can no longer be attributed to a specific individual without the use of additional information kept separately, subject to technical and organizational measures. This is a security and privacy-by-design measure of the GDPR.

Regarding what Bill C-27 considers to be sensitive information, there is nothing to indicate what sensitive information actually entails. It is also limited in its application. Only the personal information of minors is considered to be sensitive. All information Canadians surrender to any entity should be considered sensitive. On the other hand, the GDPR possesses a particular regime for special categories of personal data, including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data and data concerning health, sex life and sexual orientation.

We are happy to see that consent is better defined in Bill C-27. However, exceptions for activities not requiring consent would remain in place. Some of them are so broad that an entity could interpret them as never requiring consent. These are loopholes that Canadians should not have to endure when they are required to check the box that they have read and accept terms before they are able to interact with a digital site.

For example, legitimate interests in a given situation may be used by companies to disregard consent. There is a danger that these interests will outweigh potential adverse effects on the individual. Attempting to define legitimate interests allows for too much interpretation, and interpretation is not something that lends itself to privacy laws. The use of personal information could also be exempt from consent if a reasonable person would expect the use of their information for business activities. There is no definition as to what a reasonable person is.

The bottom line is that there are far too many loopholes and vague terms. For the savvy, wealthy or well-lawyered, the potential for abuse exists. The GDPR, conversely, is unequivocal on consent. It must be freely given, specific, informed, unambiguous and in an intelligible and accessible form, and is only valid for specific purposes. Canada should have followed that example. Canadians cannot help but wonder why Bill C-27 does not.

Under the proposed CPPA, there is no minimum age for minor consent, nor is “minor” defined. In the EU, the GDPR sets out a minimum age for a minor's consent at 16 years of age. Member states also have the flexibility to allow for a lower age, provided the age is not below 13 years.

If a breach of personal information does take place, Bill C-27 would make Canada slower to respond than its international counterparts. This bill mandates that a notification be made to the Privacy Commissioner of any breach that creates a real risk of significant harm as soon as it is feasible. The individual affected would also need to be informed, but, again, as soon as feasible.

The GDPR sets out that a mandatory notification must be made to the supervisory authority without undue delay, or 72 hours after having become aware of the incident in certain circumstances. Prior to the introduction of this bill, Canada was lagging behind internationally, and it still is, even after. The GDPR is already six years old. That is six years of extra time during which the Liberals have failed to develop this legislation to meet the robust international standard.

In Bill C-27, the Privacy Commissioner would be empowered to investigate any certified organization for contravening the act. The commissioner has been rightly asking for increased powers and responsibilities for some time, and this goes beyond a mere recommendation to violators to stop their actions. The commissioner would be able to recommend greater penalties of no more than $20 million or 4% gross global revenue for a summary offence, and no more than $25 million or 5% gross global revenue for an indictable offence.

These penalties should add more bite to what the Privacy Commissioner can do and impact how Canadians’ personal information will ultimately be treated. The penalties would also apply to a greater number of provisions, such as actions that contravene the establishment and implementation of a privacy management program and failure to ensure equivalent protection for personal information transferred to a service provider.

However, these new powers for the Privacy Commissioner hit a dead end when taken in context with the second part of this bill, which establishes a tribunal. The personal information and data protection tribunal would consist of no more than six members, and only half of those members must have experience in information and privacy law. The Privacy Commissioner would have order-making authority and the ability to make recommendations to this tribunal regarding penalties. However, the tribunal would have the power to apply its own decision instead, which would be final and binding. Except for judicial review under the Federal Courts Act, the tribunal's decisions would not be subject to appeal or to review by any court. These are powers equivalent to a superior court of record.

The existence of this tribunal would dull the new teeth given to the Privacy Commissioner. While the commissioner could recommend that a penalty be levied for violations of the CPPA, it is the tribunal that would have the power to set the amount owed by these organizations.

The cost associated with striking this tribunal is also a concern. Despite the fact that its work would likely be limited to a handful of times per year to determine penalties, it would apparently require a full-time and permanent staff of 20. I am deeply concerned as the government also has a bad habit of striking advisory councils, or so-called arm's-length regulatory bodies, in advance of bills being debated and passed in the House, long before the ink on the legislation is dry.

My memory is drawn to when a bill was being debated in the House, and I inquired about the details of the proposed environmental council. I was told with great zeal that it had already been established, and the members had been appointed before the bill was even debated in the House.

Can the current Prime Minister tell us if this tribunal would be struck only after Parliament has dealt fully with this bill? Will the Liberals be transparent with Canadians on how the appointment process would be undertaken? Can they assure Canadians that a full-time and permanent staff of 20 has not already been determined? After seven years of Liberal power, the level of patronage in this place run deep.

Part 2, which is the personal information and data protection tribunal act, should be removed as it is a bureaucratic middleman with power that would conflict and create redundancy with the Privacy Commissioner's new powers. The new powers would mean little if they were not coupled with quick and effective consequences for violators. It would prolong decisions on fines and harm Canada's reputation of holding violators accountable.

It would also not align with our friends in the EU, U.K., New Zealand and Australia that do not use a tribunal system for issuing fines. It goes to show Canadians that when it comes to making big government needlessly bigger, the Liberals do it well.

The third and final part of this bill is the only entirely new component. The artificial intelligence and data act seeks to regulate an entity, artificial intelligence, that has not been regulated before in this country.

It would set standards for the creation and use of AI systems in Canada by both domestic and international entities. More specifically, international and interprovincial trade and commerce in artificial intelligence systems would be regulated through common requirements for the design and use of those systems.

It would prohibit certain conduct pertaining to AI systems that could lead to harmful results for individuals and their personal data. There is that mention of personal data. This is a massive undertaking, attempting to regulate something that, up to this point, has been almost entirely unregulated.

I also understand that consultations on this were only initiated in June. Logic would dictate that such a bill requires careful scrutiny and time to get it right.

Requiring record keeping and human oversight are positive developments. What we find difficulty with is getting a clear picture of what the final framework would look like, as the minister alone would be empowered to establish these regulations. The minister would be able to act independently of Parliament in making rulings and imposing fines. In an age of uncertainty and new horizons for our relationship with AI, this is unacceptable. Parliament, at the very least, and independent experts and watchdogs should be central to the creation and enforcement of these rules.

It appears that once again the government has chosen to simply tack on a crucial area of concern to Canadians to an already complicated bill, and it wishes to again entrust sweeping powers to a minister to act independently of parliamentary oversight.

My final thoughts today on Bill C-27 are as follows. The Conservatives are considering this bill through a reasoned approach, and appreciate that stakeholders who have been calling for this legislation for years are watching today's debate closely.

It is absolutely clear that modern-day protection for the personal information of Canadians is required. They must have the ability to access and control its collection, use, monitoring and disclosure, and the right to delete it or the right to vanish.

How can we ensure that data is protected through watertight regulations and strict fines for abuse while also realizing that not every business affected by this bill would have the resources of Walmart or Amazon? Small and medium-sized businesses should be shielded from onerous regulation that stifles their growth. This is not to say that business interests should weigh equally with personal privacy, but there is a balance to be had, and I believe the Liberals do not have it right here.

Furthermore, in a cynical attempt to move their legislative agenda forward, the Liberals have bundled changes to privacy laws with a first-of-its-kind framework for artificial intelligence that once again intends to govern through top-down regulation and not through legislation.

The Liberals should commit today to splitting this bill up to allow Canadians a clear view of its intended impact. With that commitment, the Conservatives will be looking to do the hard work at committee to improve the long-awaited but flawed elements of this legislation. Even in an age of convenience, the world in which we live grows even more complicated by the day. Canadians deserve privacy protection worthy of 2022 realities and beyond.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, this is very progressive legislation that deals with an area of concern that Canadians have, and it is something the government is concerned about. That is why we have the legislation. It is for safety and privacy, which are of critical importance.

We are moving into a significant digital economy with databases. The issue is there, and I am interested in knowing where the Conservatives are going to fall on this legislation. When I listened to the member, she seemed to express concerns about this area, but there was no indication of whether the Conservative Party would be supporting the legislation. We just heard from the Speaker in terms of voting on the three parts.

Does the member have any suggested amendments that she is thinking about? I believe that Canadians need this legislation. Would it not be nice to have legislation of this nature pass second reading before the end of the year?

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, I do not know if, throughout my speech, members heard my concerns around the fact that this falls short of what our international colleagues have created. It is so much stronger in the European Union's 2016 general data protection regulation, or GDPR.

Obviously, we have indicated on this side of the House that we have a lot of concerns, especially with the lack of definition of so many terms that are included in this legislation. They need to be clarified. Otherwise, it is going to create all kinds of additional problems. What we need more than anything is clarity so that Canadians can have confidence that their privacy is being protected.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Madam Speaker, I was fascinated by the part of the bill dealing with artificial intelligence. Personally, I thought that it proposed a general framework and the beginnings of a legal structure that were very interesting. The objective is to regulate pan-Canadian, interprovincial and other trade, as well as to prohibit certain practices.

Does my colleague agree with me on that, at least? It is an important step forward in a sector like artificial intelligence, which is so murky and so amazing at the same time.

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, I agree that this is an area in which Canada is way behind. It is absolutely crucial that we get started on creating that framework. However, what disturbs me is the fact that it was tossed into this bill that also deals with other issues, which are significant on their own. Consultation on this did not even begin until June. It is very rash of us to consider it in this legislation. I am thankful that it is going to be voted on separately.

[Lisa Marie Barron, NDP, Nanaimo—Ladysmith, BC]

Madam Speaker, this follows on the question that was just asked by my colleague. We recently saw that 19,000 Canadians were affected by the recent Equifax breach, for example. The Office of the Privacy Commissioner concluded that Equifax did not fulfill its obligations to Canadians. It entered into a compliance agreement with no fines, no penalties and no compensation for Canadian victims. We are seeing very different fines and penalties for Canadians and Americans, and Canadians are getting the short end of the deal.

Does the member feel it is important that we have parity and equivalency for citizens on both sides of the border?

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, there are many areas where Canada is on the short end of the stick. I think of our ability to have Wi-Fi and cellphones at a reasonable price compared with other countries. In this case, it is really important that we do the due diligence needed. Canadians need to have the same level of ability to have their privacy protected that any other nation has. I would encourage members to look at the EU version of this and do a far better job of incorporating in this what is needed to function internationally with our allies.

[Dan Albas, Conservative, Central Okanagan—Similkameen—Nicola, BC]

Madam Speaker, I too share concerns with Bill C-27, particularly around the artificial intelligence and data act. Specifically, I agree with her. Having one minister solely delegated the responsibility for a wide variety of different regulations that might affect private as well as public data is too much. As Parliament, we should be looking into this and setting out the parameters.

The government has basically told the private sector that it can hold it accountable for serious harm, something it does not even define in the law, in Bill C-27, while at the same time giving itself the ultimate loophole. It says it can exempt itself. Not only that, but some of the organizations are trustworthy, as it says in the bill. The minister can say that any provincial or federal commission or body he or she wants can be exempted, allowed to use artificial intelligence and held to a different standard than the private sector is.

Does the member agree that this particular section, more than anything, needs to be looked at? I believe it is too much government overreach. It has essentially given itself the ultimate loophole.

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, that is my deepest concern as well. We have seen the government, in other pieces of legislation, give itself the authority to create a situation that is out of the hands of Parliament and into the hands of a minister as to how things will be developed or implemented.

I certainly agree with the member. We need to do a lot more work and make sure that Canadians are truly protected, and not by just one individual at a certain point in time who has a great deal of power. In some cases in that situation, I would say too much power. We need to ensure that it is done properly with Canadians in mind.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, I fully understand the stress the Canadian financial sector is feeling.

Unless we tighten the rules, Canada will not meet the European Union's expectations, which means Canada's financial sector could lose all or part of very important European markets. There is less pressure in Quebec because, thanks to its own legislation, it is already compliant.

Despite the pressure, the bill must be properly drafted. Is my colleague concerned that pressure from the financial sector could lead to a situation in committee where words and time are more limited?

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, this is an example of circumstances where Canadians are having trouble trusting the government to do the right thing and to truly have their backs in this area. We have already seen circumstances in the past year or two where the banks have had an unbelievable impact on Canadians' lives by having the powers entrusted to them to do things that are out of line and out of step with truly protecting the privacy of Canadians.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, my colleague talked about the tribunal aspect. It is very important that, in this bill, when it comes to privacy protection, besides the Privacy Commissioner, we would have another element of a tribunal. Most importantly, out of that process, there would still be the Federal Court. When it comes to citizens having their data breached, and the whole premise of this bill is to protect that of citizens, children and adults alike, there is still going be a tribunal added.

Is there any other jurisdiction that is using a tribunal? If not, why does the member think it is included in this bill?

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, it is deeply disturbing to me when I see that, among the European Union, U.K., New Zealand and Australia, none of our allies has chosen to use a tribunal. The power is there for their commissioners to make sure that the various entities are being held accountable with regard to an individual's privacy.

Their rules are far more specific than ours are in this bill thus far, and it just shows that we are weaker in truly protecting Canadians' privacy rights compared to our allies. It is a sign that we are doing things with an ulterior motive. That disturbs me, because it would again give power to a different organization within the system, which the government is creating to basically give different organizations, perhaps government departments, an out—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Resuming debate, the hon. member for Richmond Hill.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, I will be splitting my time with my colleague, the member for Vaughan—Woodbridge.

I am pleased to rise today in support of Bill C-27, the digital charter implementation act.

Privacy is a long-standing, fundamental right for Canadians, and we have never been more reliant on the digital economy. Even though we are living in this complex technological era, the current privacy law was last updated over 20 years ago, before smart phones or any social media platforms even existed. This brings us to the cardinal step our government is taking today.

We know Canadians need to have confidence not only that their is data safe and their privacy fully respected, but also that their government is striving to enhance the protection of their privacy through the implementation of timely safeguards in an era when the digital economy is driving transformative change. These objectives are exactly what the privacy protection framework of Bill C-27 would aim to accomplish.

We are introducing new legislation to ensure our country has critical protection in place to safeguard the security of Canadians. This legislation proposes not only to increase the confidence of Canadians in emerging technologies but also to strengthen privacy protection for consumers while supporting economic development that results from the responsible use of data and artificial intelligence. It would also pave the path for governing trade and commerce in the private sector, as it relates to regulating how private organizations handle personal information and develop AI systems.

Upon enactment into law, Bill C-27 would be one of the most substantial improvements to Canadian privacy laws in decades, but it would go further by establishing a legal framework to regulate high-impact AI systems to better protect consumers. In essence, this legislation proposes the following key enactments: the consumer privacy protection act; the personal information and data protection tribunal act; and finally, the artificial intelligence and data act, or AIDA. I will expand on each one of these major enactments in detail.

The enactment of the consumer privacy protection act proposes to achieve the following: first, to enhance Canadians' control over personal information by empowering them to request its deletion, and adding new transparency requirements for organizations when obtaining consent from individuals for their information; second, to create new data mobility rights that promote consumer choice and innovation; and third, to bolster our privacy enforcement and oversight by granting the Privacy Commissioner of Canada order-making powers to compel organizations to stop the use of personal information, through administrative monitoring penalties for serious breaches of law.

This aspect of the bill is of the utmost importance to nearly 200 of my constituents in the riding of Richmond Hill who have voiced their pertinent concerns regarding privacy protection and have spoken to me personally in relation to this legislation and what it seeks to achieve for Canadians. Through the mentioned key facets, my constituents, and in fact all Canadians, can rest assured that their government's sole intention is to ensure Canadians' first-class privacy and data protection.

By enacting the personal information and data protection tribunal act, our government seeks to strengthen protection for minors' personal information, introduce greater flexibility for the Privacy Commissioner and explicitly foster more privacy expertise among key decision-makers. This would be achieved through the establishment of a new administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner.

The third and most crucial aspect of this legislation, in my point of view, would establish a new law on artificial intelligence.

According to a recent study by Nanos Research on behalf of Innovation, Science and Economic Development Canada, key industry stakeholders have expressed a range of concerns regarding artificial intelligence. As technologies have matured, risks associated with AI systems have also come to light, including with respect to health, safety and bias. These concerns speak to the need to ensure the responsible development of AI. Moreover, as companies invest in increasingly complex AI systems, Canadians need to have confidence in AI systems they use every day.

It is therefore essential that the use and collection of data follow best practices to protect the rights and freedoms of Canadians. This brings me to the very reason why I personally identify this enactment as the most crucial aspect of this legislation.

It is in response to these legitimate concerns that our government proposes to introduce a new law to promote a unique approach to AI. It is an approach that would protect Canadians from discrimination, loss of autonomy and serious harm to their health, safety and economic well-being. The newly proposed AI law contains central provisions that would protect commercially sensitive information while ensuring that AI systems do not cause adverse effects on Canadians. Consequently, this approach would establish rules aimed at promoting good data-governance practices and respect for Canadian standards and values.

This new law would support responsible innovation by giving companies a clear framework for developing AI systems; compel organizations responsible for AI systems to mitigate potential harm to Canadians, including bias; establish an AI and data commissioner to support the Minister of Innovation, Science and Industry in the administration of the act to encourage innovation in the marketplace; and, finally, impose serious penalties for all use of illegally obtained personal information.

It is also notable to mention that it would serve as a build-up on our government's previous investments and commitment to expanding the pan-Canadian AI strategy first launched in 2017 to enhance growth in Canada's digital economy.

Each of these acts would work to provide Canadians with more autonomy over their privacy and increase accountability of personal information handled by organizations, while also giving Canadians the freedom to move their information from one organization to another in a secure manner.

In quick summary, by introducing this groundbreaking piece of legislation, our government is working to strengthen and modernize our privacy laws and to protect Canadian consumers by limiting private companies' abilities to access private information in the digital sector. Most importantly, we would be creating new rules for the responsible development of Al alongside the continuation of the advancement of its implementation across Canada.

The digital charter implementation act would ensure Canadians have strong privacy protections and clear rules of the road for businesses, as well as guardrails to govern the responsible use of artificial intelligence. As I stand here today in support of this important piece of legislation, I am confident that, given our country's highly skilled workforce, with this vital step, Canada would be well positioned not only to play an important global role in the field of AI, but also to create an environment where Canadian companies could be world leaders in responsible innovations.

Most importantly, through this cardinal legislation, Canadians would be reassured that we would never compromise on trust and safety for their privacy, and that their government is wholeheartedly committed to advancing Canadian privacy protection laws while unlocking innovation that promotes a strong economy that works for everyone.

I would like to close this intervention by encouraging all my colleagues in the House to support this valuable piece of legislation. We can work together to move beyond traditional privacy protection to ensure data control for all Canadians and modernize our laws to adapt to the realities of a complex digital economy. This is the only way to advance Canadian digital technology and Canadian values across the world.

[Eric Melillo, Conservative, Kenora, ON]

Madam Speaker, I just wanted to pick up on something my hon. colleague talked about around the tribunal. Given the fact that the EU and the United States do not have tribunals and given the fact that the Federal Court has the ability, presently, to appeal the Privacy Commissioner, I have a simple question for my colleague from the Liberal Party.

Does he feels that having that tribunal included is a necessity and, if so, why would he feel that way?

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, it is not a matter of whether it is a necessity. I think it is complementary and it strengthens the existing laws that we have. It also further ensures the protection of the data and provides a venue for the minister, as well as Canadians, to ensure that, if it comes to a point of contention, there are many venues to get the support they need.

[Andréanne Larouche, Bloc, Shefford, QC]

Madam Speaker, I thank my hon. colleague for his speech.

I would like to come back to the topic of adopting this motion and particularly the importance of sending Bill C-27 to committee, to make sure all the details are in place. It is important that the committee do its work properly. This is very technical.

Quebec has Bill 25. How can we ensure that there is no interference between Bill 25 and Bill C-27? How can we combine the work of both levels of government? This is a shared jurisdiction. Could my colleague comment on that?

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, first of all, I would like to acknowledge the leadership that the Quebec province has shown in developing legislation around privacy. I want to ensure the member that this legislation is very much a complement and a partner with that legislation. There are two other provinces that are faced with the same situation, B.C. and Alberta, as well as Quebec. The key thing is that we are taking a lot of best practices from the Province of Quebec in this, and we look forward to hearing more about that when the bill is unanimously approved at second reading and is sent to committee for further review.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I have enjoyed working with my hon. colleague on committee for several years. I would like to ask him about the delicate balance that we have here between the interests of businesses and that of the individual with regard to privacy, ownership of data and algorithms. I fall more to the individual and the person being protected, as to the strength of where we should go. I just wonder if he has determined where he is at right now.

The bill seems to be a little too slanted toward business organizations at the moment and their use of data. I wonder how he feels about that.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, it is good to respond to my hon. colleague. We have had the pleasure of serving together at the Standing Committee on Industry and Technology. When the bill has passed second reading, it will be sent to that committee.

I actually think it is a very balanced bill between privacy and ensuring that small businesses and organizations who use data have the guidelines to do the work they need to do to serve Canadians. I believe, through the de-identification or the anonymization of the data, the data of individuals is protected, while giving businesses the data that is needed to ensure they foster innovation while also being able to effectively run their businesses and compete not only locally but also internationally.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Madam Speaker, my comments are similar to the member for Windsor West's, in terms of the balancing of the interests of business with the interests of the individual. To some degree, the bill fails to do both of those things. Businesses are looking for clarity and businesses are looking for a clear set of rules for how they can operate. I would note that, from clause 17 to clause 50, there are all of these exemptions. Exemptions do not allow for clarity.

I just wonder if the hon. member thinks there are enough exemptions in the bill.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, can we have the support of the hon. member across the aisle to ensure that the bill can go to the committee, so that we can have the opportunity to have conversations such as the one he is tabling?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I am pleased to rise before hon. members today to speak to the digital charter implementation act, 2022. More specifically, I would like to discuss the new artificial intelligence and data act.

This legislation seeks to not only enhance Canadians' confidence in emerging technologies, but also support economic development stemming from the responsible use of AI systems and data.

As many have noted, Canada is well placed to play an important global role in AI. Thanks to Canada's highly skilled and diverse workforce and experts at research centres across the country, we have a unique opportunity to create an environment where Canadian companies can be world leaders in responsible innovation, taking full advantage of the digital economy.

Pan-Canadian institutes such as the Quebec Artificial Intelligence Institute, or Mila, the Vector Institute in Toronto, and the Alberta Machine Intelligence Institute in Edmonton reflect the abundance of Canadian talent and resources. What is more, according to Global Advantage, in January 2020, the number of AI companies in Canada, in other words, companies with a product or service that implements AI, has doubled over the past five years to 660.

The responsible use of data and AI systems has the potential to drive improvements in all sectors of the economy, leading to groundbreaking discoveries with significant economic, health, environmental and social benefits, including streamlining processes and decision-making, eliminating inefficiencies and enabling better resource allocation.

AI is already augmenting processes and skills in every industry. As noted in the March 2021 report, “Artificial Intelligence Policy and Funding in Canada”, by McGill University's Centre for Interdisciplinary Research on Montreal, the Government of Canada is making massive investments in AI, with $1 billion in government contributions provided across Canada as of August 2020.

In addition, in budget 2021 the Government of Canada committed to expanding the pan-Canadian AI strategy that was first launched in 2017 with an initial investment of $125 million through the Canadian Institute for Advanced Research. Budget 2021 proposes additional funding of $443.8 million over 10 years, starting in 2021–22. It is clear that the government recognizes the potential of this industry and that the development of artificial intelligence technologies will play a fundamental role in the growth of the digital economy.

Canadians are also optimistic about the future benefits of AI. For example, a recent study by Nanos Research on behalf of ISED shows that Canadians are almost seven times more likely to say that the impact of AI will be very positive rather than very unfavourable. However, stakeholders have also expressed a range of concerns regarding AI and automated decision-making systems.

As some of these technologies have matured, risks associated with AI systems have also come to light, including with respect to health, safety and bias. The same Nanos survey I mentioned earlier noted that Canadians are most concerned about job loss, AI replacing humans, privacy and security, AI malfunction, and biased decision-making and ethics considerations.

These concerns speak to the need to ensure the responsible development of AI. The proposed consumer privacy protection act will address protections related to privacy and related security elements, but what about health, safety and bias? As machines learn from datasets they are fed, they may replicate many of the past failings that resulted in systematic disparate treatment of minorities and other marginalized consumers in vital sectors such as banking, housing and health care.

In order to increase Canadians' confidence in the use of AI technology, our laws need to be adapted to the realities of the digital economy. Some issues were identified through our consultations on digital media and the feedback we received following the publication of the consultation document on the modernization of the Personal Information Protection and Electronic Documents Act.

Many stakeholders expressed concern regarding individuals' potential loss of control over the use of their personal information in the application of AI, the lack of transparency regarding the resulting decisions, and the impacts on individuals and groups.

While businesses are investing in increasingly complex AI systems and algorithmic technologies, Canadians need to have confidence in the AI systems they use every day. They also need to have recourse when automated systems make important decisions that can impact their lives.

The advancement of AI systems requires data, a lot of data. Personal information is particularly sought after to help develop algorithms and customize services. It is therefore vital that the collection and use of this data follow international standards and best practices in order to protect Canadians' rights and freedoms.

The artificial intelligence and data act is needed to address these types of concerns by establishing rules to promote a human-centred approach to artificial intelligence, good data governance practices and respect for Canadian standards and values. This approach will protect Canadians from a range of potential harms including discrimination, loss of dignity and autonomy, and serious harm to their health, safety, and economic and social well-being.

The artificial intelligence and data act will support responsible innovation by giving businesses a clear framework to guide the design, development and deployment of artificial intelligence systems.

The AIDA will ensure that entities responsible for AI systems that have a high impact on Canadians identify and mitigate potential harms, including bias. By aligning with internationally recognized standards, this will ensure market access for Canadian innovations. The proposed AI law contains provisions that protect commercially sensitive information while ensuring that AI systems do not have adverse or negative effects on Canadians.

More precisely, the AIDA contains obligations for organizations that design, develop or deploy high-impact AI systems to conduct assessments to determine the level of impact of their systems; adopt reasonable administrative, policy and technical measures to mitigate risks and assess compliance; maintain records about their artificial intelligence systems, and report harm or risk of imminent harm.

The AIDA will also give the Minister of Innovation, Science and Industry the necessary tools to engage with organizations and to ensure compliance with the law. While voluntary co-operation will always be the first course of action, the AIDA provides that the minister may order an organization to provide documentation relevant to assessing compliance with the act. Under the AIDA, the minister may also refer questions to the other relevant regulatory bodies, such as the Privacy Commissioner or the Competition Bureau.

Also, in cases in which there are reasonable grounds to believe that the AI system may cause serious harms, the minister may order suspension of its use or operations. The minister will also be able to communicate compliance issues to the public as a means of further raising awareness about the requirements of the act.

The artificial intelligence and data act also creates a position of artificial intelligence and data commissioner to assist the minister in administering the act and to help businesses understand their responsibilities and how to comply. The commissioner will have a dedicated structure and budget for that purpose. These measures will help increase consumer confidence and their understanding of these technologies, support the ecosystem and maintain a flexible legislative framework that is responsive to international technological and regulatory developments.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, I would like to take 15 seconds to congratulate my colleague on delivering half his speech in French. He has improved by leaps and bounds in less than a year.

Now, the moment we have all been waiting for, my question. Quebec has a law that protects its citizens' privacy, law 25. We talked about it earlier. In the early 2000s, PIPEDA's paragraph 26(2)(b) stated that the Governor in Council would, by order, respect Quebec's legislation. Essentially, the federal act would not apply with respect to personal information about individuals' property or their civil rights. In other words, the act would leave matters under Quebec's jurisdiction alone. Even though Quebec's law 25 already complies with EU expectations, Bill C‑27 contains no clause guaranteeing that the federal government will respect the application of Quebec's law.

My question is simple. Will my colleague work to ensure that the federal government respects Quebec's law 25 and that there will be an order to that effect?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I thank my colleague for her question and her comment about my French. I practice a lot, but not all the time.

I am going to answer her question about Quebec's law in English.

It is interesting that we are again following the Province of Quebec, much as we did with the child care plan we introduced in Canada. This piece of privacy legislation is really modelled and follows the Quebec law that was put into place. My understanding, from reading over the notes on the bill, is that where there is provincial jurisdiction that is deemed to be similar to the law we introduce, we will obviously hand it over or defer to the provincial legislation.

There is nothing that infringes on the law that is currently in place in Quebec. I applaud the Quebec provincial authorities for bringing forward legislation over the years that the federal government has looked to and modelled.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Madam Speaker, I would note that from point 17 to point 50 there is a whole raft of exemptions for this bill. It is interesting to me that we are trying to build something that is predictable for the business community and protects the interests of the individual.

Does the member not think that several pages of exemptions does neither? It does not give definition to business and also does not protect the rights of individuals.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, once the bill arrives at committee stage there will be plenty of time to bring forth ideas and to strengthen legislation. That is the job of all members of Parliament here. We are sent here to improve legislation, so I encourage my colleague to do so.

All MPs know, from studying PIPEDA and other pieces of legislation that we have examined while sitting on committees, that because of technology, be it Facebook, Instagram or the use of AI, we need to revise our privacy laws. This is a good, solid step in that direction.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, the issue of the tribunal is an interesting one. Does the member know what the cost of the tribunal will be?

We are taking away a potential resource from the Privacy Commissioner and/or the court system, and we will have to create an entirely new organization. I am curious to know what the cost of the tribunal will be.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I thank the member for Windsor West, who I have travelled and worked with on the Canada-U.S. interparliamentary association. From my understanding of the bill, the tribunal will provide for access to justice and contribute to the further development of privacy expertise. That is very important in this day and age, when we are dealing with artificial intelligence and with a lot of data. We need to ensure that individuals' data is not misused, that we can move forward and that people can have confidence that their data is being protected.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, it is indeed a pleasure to rise to discuss Bill C-27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act. There is a lot happening in Bill C-27. I have a lot of concerns about this bill, and that is why I will be voting against Bill C-27. It would not do the things we need to do to protect the privacy of Canadians.

I would first flag, in looking at this legislation, that the first act it would create is the consumer privacy protection act. Why is it not the Canadians' privacy protection act? Why are we talking about consumers and giving more ability to corporations to collect the privacy data of Canadians? That, to me, is very disconcerting and one of the things I want to talk about during my presentation.

The Personal Information Protection and Electronic Documents Act, PIPEDA, was the very first piece of legislation we had back in 2000, so it has been 22 years since we have updated legislation related to the issue of the privacy protection of data that has been shared online. Of course, technology has evolved significantly over the last 20 years. If we look at PIPEDA, it all rolls back to 34 years ago when the Supreme Court of Canada said, “that privacy is...the heart of liberty in a modern state”.

It said “privacy is...the heart of liberty”, and that completely falls back on the Charter of Rights and Freedoms. Concerning fundamental freedoms, subsection 2(b) of the charter says, “freedom of thought, belief, opinion and expression, including freedom of the press and other media of communication” while subsection 2(d) refers to, “freedom of association.”

We know very well that people's privacy has to be protected on anything they do online, what they do through mobile apps, what they do in their email communications and the collection of that data by service providers because, ultimately, anything we do online goes through a service provider on the Internet, and we have to ensure that our charter freedoms are protected to ensure our liberty.

We already know that under freedom of association, a lot of people who gather in Facebook groups and other fora on the Internet have already been violated by the Emergencies Act. We know that during the “freedom convoy” in the city, the government was harvesting data and that data was then shared by some means. With GiveSendGo, the data was mined off of it, shared on Google Maps and distributed across the country. People's individual financial information, the ultimate piece of privacy that should be protected, went across this country and the government failed to intervene.

Bill C-27 falls short on what needs to happen to protect privacy, recognizing how people are using the Internet and modern technologies, especially with mobile apps and everything that is happening on our phones. However, the protection of individuals is worth it and the privacy rights are worthy of constitutional protection, which Bill C-27 fails to recognize. We do not have a definition of privacy rights or a guarantee of privacy rights in Bill C-27, and that is why it fails.

I am the shadow minister of national defence, but earlier this year I served for a number of months as the shadow minister of ethics and digital information. I can say that, during my time serving on the ethics committee, it dealt with a number of issues. One of them, of course, was the use of Clearview AI, the facial recognition software that the RCMP and other police agencies use across this country. The ethics committee dug in deep and provided a report.

The Liberals let the RCMP make use of this technology under their tenure and did not say anything until it became public. Clearview AI, an American company, was scraping images off of Facebook and other social media such as Instagram to populate its database.

That information was then used, using artificial intelligence, to profile and identify people using mass surveillance techniques. We found through testimony that, not only was this done illegally, and the Privacy Commissioner ruled that Clearview AI had broken the law and that the RCMP had used it illegally, but also it was racially discriminatory as well, and it was a huge problem that people of colour and women were unfairly treated by this AI.

Bill C-27 would not regulate the use of facial recognition technology such as Clearview AI. Right now, we know the RCMP disagrees with the ruling of the Privacy Commissioner, so the question is whether CSIS, the Department of National Defence or the Communications Security Establishment are making use of similar types of technology. I will get into some of the recommendations from that report if I have time later on, but we did call as a committee, and it was adopted by the majority of members on our committee, for a federal moratorium on the use of facial recognition technology. We called for new laws, guardrails and safeguards to be built into legislation through PIPEDA and through the Privacy Act.

Bill C-27 would not provide that protection to Canadians. It would not ban or install a moratorium on the use of FRT, so that is absent.

Also, we asked that all companies be prohibited from scraping the images of Canadians off the Internet, whether it be through Facebook, Instagram, TikTok or whatever the app might be. We know that this causes potential harm to Canadians, yet Bill C-27 fails again to recognize this harm. The Liberals failed to incorporate recommendations coming from a standing committee of the House into this legislation.

One of the other things we heard about was that Tim Hortons was caught mass tracking Canadians who were using their app. If anyone who had the Tim Hortons app went to a Tim Hortons location and bought a coffee and a donut, that app was then used to track the behaviours of consumers of Tim Hortons as they were travelling for the next 30 minutes.

Again, this shows how the sharing of personal information and the mass data violation with the tracking of individual Canadians violated their privacy rights. Although Tim Hortons assures us they are not doing it now, we are not sure what happened with that data. Was it shared or sold to other corporations? Again, Bill C-27 would give companies, under clause 55 of the bill, a litany of exceptions to consent to sharing that personal information they collected through the use of their app. That would violate our privacy rights.

Although the Liberals have built in here words about consent and the ability for individuals to write in with consent or get removed, when it comes to terms and conditions, most Canadians, when they download an app and check the box to say “yes”, they have not read those terms and conditions. They do not know that some of these apps, as Tim Hortons was doing, were actually undermining their own privacy rights as they apply to the use of mobility data information, and because those terms and conditions are long, legalistic and cumbersome, people refuse to actually take the time to read it. Just because someone checks the box to say “Yes, I consent to using this app”, does not give those companies the right to violate the privacy of those individuals' outside of the commercial transaction that takes place between them and, in this situation, Tim Hortons.

The exemptions that are allowed under the bill for corporations need to be changed in the bill. There is no we can support it as Conservatives because they would be huge violation of privacy and of mobility, which are all things that are provided under our charter rights.

Under the government, we also saw the Liberal Minister of Health stand up and defend the Public Health Agency of Canada, which was caught red-handed having companies such as TELUS track the movement of Canadians via their cellphones. It said that it de-identified all the data it collected, but it wanted to know how Canadians were moving around the country underneath the auspices of the COVID pandemic and how transmission was occurring. That was a violation of privacy.

At committee, we made a bunch of recommendations, which the government has failed to implement in Bill C-27. Bill C-27 gives companies, such as TELUS and other mobile service providers, the ability to track the movement of Canadians across this country. It may want to call it “meta data” or say it has been de-identified, but we also know from testimony at committee that it can re-identify the meta data that has been turned over to the government. We have to make sure that it is done in the public interest and under the auspices of national security, public health and national defence. If that type of data is being collected, then there has to be a way to dump that data and ensure it disappears forever.

One of the other studies we undertook was of the Pegasus software system, which is very insidious. It is being used for national security. A similar type of technology is being used right now by the RCMP, CSIS and others. It has the ability to turn people's cellphones into video cameras and listening devices. It is a very cryptic, insidious spyware, or malware, that people can get on their phones by accidentally clicking on a piece of information, like opening up an email, and it will download. Then they can listen to the individuals in that place.

They do not have to bug people's houses anymore. They do not have to use high-grade technology to listen to the interests of individuals because it gives them the ability to turn cameras on to watch what they are doing, and turn microphones on to hear what they are discussing without them ever knowing it.

We want to make sure charter rights are protected. There are times we have to use this in the collection of data. There was definitely the admission by members of the RCMP that they have used it over a dozen times. They have their own system, not Pegasus, but one similar to it. We know that to use that type of technology, to protect the rights of Canadians, there should be a warrant issued to ensure there is judicial oversight, even if it is being used by the Department of National Defence and CSE, we have to make sure it is not being used against Canadians and only deals with those national threats they refer to as threats that are foreign entities. That is something that Bill C-27 fails to recognize.

I should say this as well. We heard at committee that this type of technology is being used against politicians, that there is foreign interference out there. As we have come to learn on different occasions, there are countries out there and other agencies that are interested in what we are saying as politicians, not just here in the House, but the private conversations we have in caucus, among colleagues, when we get together at committees, at pre–committee meetings, and the discussions we have in our offices. Our phones have become listening devices, so we have to be aware of that.

One of the things we have always talked about is what the gold level standard is to protect individuals, the citizens of our country, and to ensure their privacy rights are paramount in all the discussions we have. At the same time, we know there are going to be advances in technology, and the need at times to have police agencies, the Department of National Defence and the military use technology that could violate the rights of some people, but always with that judicial oversight that is provided underneath the charter. That gold standard is the European Union’s General Data Protection Regulation. We see that the gold standard goes well above and beyond what Bill C-27 is trying to do.

Bill C-27 falls way short. We heard at committee that with the data collection taking place on apps, online surveillance measures have to provide the right for data to be forgotten, or the right to data disposal or erasure, another terminology that is used. It is about making sure that data collected, even if it is for the public good or even if it is metadata, is disposed of at the end of the day.

It should not be that I consent to have my data removed from a database by checking something off or having to write in an app being used to buy coffee at the neighbourhood store, for example. It should be that it is our right to be forgotten and that after a certain time frame, data is erased forever from the database where it is being held and is not used again for commercial purposes, nor used, sold or traded among commercial entities.

The gold standard that the European Union has is not included in Bill C-27. Again, that is why we have so many concerns.

When we look at clause 55, which has already been mentioned by a number of my colleagues, it has a boatload of exemptions built in for corporations to get around the removal of privacy data. These exemptions allow them to write in, make changes and share data. We have to make sure the onus is not on Canadians to get their privacy information back or to get their privacy information removed. The onus should be on corporations to prove why they need it. The onus also has to be on the government. This is about transparency and accountability. There needs to be a realization that Canadians deserve an explanation as to why some of their data may be used, even if it is de-identified, and why it would be used for the buildup of public policy or to deal with issues like a pandemic.

Just to move forward a bit, I note that given some of things we saw at committee when we were looking at facial recognition technology, the power of artificial intelligence and the growing power of AI, we made a number of recommendations. They included that whenever the government looks at using artificial intelligence or FRT for military, defence or public safety, it needs to be referred to the National Security and Intelligence Committee of Parliamentarians for study, review and recommendation, and it needs to be reported publicly. There also needs to be a public artificial intelligence registry for the algorithmic tools being used. However, we do not see that registry for artificial intelligence companies in Bill C-27.

I have already talked about the right to be forgotten and said there needs to be a set period of time. I have talked about the prohibition on the practice of capturing images of Canadians from public platforms such as Facebook, Instagram and Twitter. We also need to make sure there is a federal moratorium on using FRT until we have proven it is needed by police agencies, the justice system has proven that it works and we are sure it is not racializing Canadians in its use. Ultimately, the Privacy Commissioner and judicial authorization have to override that.

As Daniel Therrien, the Privacy Commissioner, said about the RCMP:

[It] did not take measures to verify the legality of Clearview’s collection of personal information, and lacked any system to ensure that new technologies were deployed lawfully. Ultimately, we determined the RCMP’s use of Clearview to be unlawful, since it relied on the illegal collection and use of facial images by its business partner.

Its business partner was Clearview AI.

There is an ongoing need to ensure that charter rights and international human rights are brought together in a collaborative way in how we all form our opinions on Bill C-27. I hope the bill is taken back and redrafted, and if not, I hope there is an opportunity to make massive amendments to it so that it actually takes into consideration the privacy rights of all Canadians.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Before we proceed to questions and comments, it is my duty pursuant to Standing Order 38 to inform the House that the questions to be raised tonight at the time of adjournment are as follows: the hon. member for Leeds—Grenville—Thousand Islands and Rideau Lakes, Public Safety; the hon. member for Saanich—Gulf Islands, Climate Change; and the hon. member for Nanaimo—Ladysmith, Fisheries and Oceans.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I note that the last time we had any real changes to the privacy legislation of this magnitude was a couple of decades ago. We did not even have iPhones 20 years ago, so I would ultimately argue that there is a need for change.

Tim Hortons aside, I believe the legislation we are talking about provides a good balance between consumer rights, the issue of privacy and the whole digital market out there. No doubt, it would be nice to see the legislation go before committee and, ideally, for that to take place sometime before the end of the year.

Given the urgency of the issue itself and the fact that we have not seen anything for 20 years, would the member agree that it would be nice to see the legislation pass before the end of this year?

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, the Liberals have been in government for the last seven years, and they have not brought forward this legislation with any urgency, it seems. It has been on the docket and off the docket a number of times.

The member talks about consumers rather than Canadians. Let us stop looking at people as commodities. Let us look at them as individuals and their rights.

One thing the Liberals could put into the bill, as recommended by the Standing Committee on Access to Information, Privacy and Ethics, is details on how Canadians can opt out of being surveilled and on how their data is collected. Why is that not in here? We have a national do not call list, and we can sign up for it so we are not getting bothered all the time by telemarketers. Why would we not have a national opt-out clause for Canadians' data collection, whether for government interests or commercial interests, so they have the ability to say no because they want their privacy rights to be respected?

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, my colleague from Selkirk—Interlake—Eastman mentioned some things that are not covered by Bill C-27. The law they have in Europe right now requires businesses to have two ways to identify individuals, but the trend is moving toward having three.

Does my colleague think that Bill C-27 should also legislate on the number of methods of identification that businesses should be required to use? It does not do so right now, which is why we need to carefully study it in committee.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I do not believe that the bill lives up to the gold standard of European Union law. The European Parliament has been very good at having general data protection regulation. That is the gold standard. The bill does not provide the types of safeguards that protect the interests of Canadians.

We need an ongoing discussion on how the personal information of Canadians is protected. Bill C-27 does not provide all the guardrails required for the protection of individual Canadians. A task should be given to the industry committee or the ethics committee to dive deeper to make sure we have an opportunity to hear from more witnesses and to provide the amendments that are so desperately needed to the bill. I think it actually needs to go back to be redrafted.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, I want to the thank the hon. member for Selkirk—Interlake—Eastman for a very thoughtful speech. As a member of Parliament grappling with Bill C-27, I have to say that I am grateful that his party assigned him to this area of work sometime in the past, because this is enormously complicated.

The bill is three acts in one, and I would ask the member what we should do at this point. The Speaker has now given a ruling that says we will be able to vote separately on the AI piece of the bill, but I do not think that is good enough. I do not know if the committee will be able to set aside witnesses and only look at the AI piece in a concentrated fashion.

I would support anything we could do as opposition members of Parliament to make sure the bill is not rushed and to make sure that the artificial intelligence pieces are treated as separately as possible so that we have a good amount of time for amendments and understanding while not rushing it through.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I agree with the member. We want to get this right. This should not be rushed. It is not about getting this done by Christmas because we have a legislative agenda to hammer through, as the member for Winnipeg North continues to cheerlead. What we need is to take our time.

We can split the bill into three ways and assign them to committees other than the industry committee. We can give the bill over to public safety to look at the use of the legislation from the standpoint of policing. We can shuffle off the piece on artificial intelligence to the ethics committee, making sure that it has the time to dive deep into it and hear from witnesses about how we can improve upon the bill.

Ultimately, what we could do is defeat the bill at second reading, send the government back to the drawing board and have it do a broader consultation on how this bill should be written so that it addresses the needs of the industry but protects the rights of Canadians.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Madam Speaker, I would bring to the member's attention the studies we undertook at the ethics committee, where it was reported that agencies of the federal government, including the RCMP and PHAC, did not follow the existing Treasury Board guidelines on the adoption of new technology. I think all parties agree that we need updated legislation, but the government is not even following the rules that it already has.

Does there need to be more than just new regulation and protection for Canadians' privacy? Is it not also important that the government actually follow the rules that it creates, which it has not done with respect to Canadians' privacy?

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I want to thank the member for his time as chair of the ethics committee and for the great job he did.

We heard from a lot of experts, and the committee found over and over again that the government was not following its own rules, including those in the Privacy Act and PIPEDA, which is antiquated, as the member for Winnipeg North pointed out. It does not even follow the guidelines that the Treasury Board has.

If the government cannot even follow the rules as they are currently, it leaves us feeling hopeless that it is going to follow the rules of any new legislation we bring in. However, I would hope that a future Conservative government would make sure legislation provides that privacy rights and the charter's freedom of expression and freedom of speech are solely protected in legislation for Internet use. That has to be the guiding light in all documentation and legislation we provide.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, given the issues of the bill and the complexity of it, I was really grateful for the intervention by the member for New Westminster—Burnaby about the NDP request to separate the votes. We cannot actually separate the bill so that it goes to different committees. We are stuck with having a separate vote on artificial intelligence.

I know the parliamentary secretary wants to rush the bill through by Christmas, so would it not have made more sense to have three separate bills because there are three extensive pieces of legislation? If the Liberals want to move the bill quicker, perhaps they would be willing to actually separate the bill for separate studies in the House of Commons. It requires them to do this, unfortunately, not the opposition.

[James Bezan, Conservative, Selkirk—Interlake—Eastman, MB]

Madam Speaker, I agree that we should be dealing with this in a more focused way. Instead of having one big omnibus bill, this should be split into smaller bills so we can have a more fruitful debate and have a chance for more expert input. Then we would have more parliamentarians engaged in drafting any potential amendments to any legislation. As it is right now, the bill will be referred to only a couple of committees, and we have a timeline, which seems to be pushed by the government, that does not work.

The Privacy Commissioner, Daniel Therrien, notes that “most Canadians whose data was used did not know their data was used. The parties, both the government and the private sector, could have done more to inform users that their data was used for these purposes.” That was the data collection done through PHAC. He also said, “the second issue is whether it is good legislative policy that de-identified information falls outside the reach of privacy laws.”

The Liberals are trying to correct that through legislation. However, as David Lyon said, “high-level studies from various places, one from Imperial College London and the university in Leuven, show that 99.8% of Americans could be reidentified in a dataset that used 15 demographic attributes.” That is disconcerting, and that is why this legislation falls short.

[Andy Fillmore, Liberal, Parliamentary Secretary to the Minister of Innovation]

Mr. Speaker, I will be splitting my time with the member for Saanich—Gulf Islands.

I am very pleased to be here to discuss Bill C-27, the digital charter implementation act of 2022. The bill would implement a new world-class regime for the protection of consumers and to ensure that Canadians have confidence that businesses are handling their personal data responsibly and are developing and deploying new technologies in a responsible and ethical way.

The bill also includes important changes that would support responsible innovation in an increasingly digital and data-driven marketplace. It would modernize Canada's regulatory framework for privacy protection in the private sector in a manner that supports innovation and is interoperable with the data protection laws of Canada's major trading partners.

The bill would also reinforce Canada's commitment to responsible artificial intelligence development, or AI development. As parliamentary secretary to the Minister of Innovation, Science and Industry, and indeed as the MP for Halifax, with its burgeoning tech sector, I can tell members from first-hand experience that Canada is a world leader in AI, with top talent and innovative companies.

In a world that is increasingly reliant on digital technologies, the bill would build on Canada's advantage by creating a foundation of trust and ensuring that companies meet the highest standards of responsibility when developing and deploying AI. We need to ensure that Canadians’ personal information is protected, but there is also a need to support Canadian businesses so that they can grow, prosper and innovate in this increasingly digital world.

We recognize that technology is growing rapidly and providing companies with large amounts of personal information. This information fuels business decisions. It informs the creation of new products and services for customers. This innovation is critical, but we absolutely have to ensure that this innovation happens in a responsible way.

Therefore, in my limited time today, I am going to focus my comments on the first and third parts of the act, with a focus on enabling and supporting responsible innovation.

I will begin with the first part.

The proposed new Consumer Privacy Protection Act, or CPPA, retains the principles-based approach of our current private sector privacy law in order to continue harnessing the success of a flexible and adaptable privacy law.

We know circumstances are changing all the time. To better reflect advances in digital technologies, the emergence of AI and other new technologies, the CPPA contains a number of provisions to support industry innovation without compromising the protections Canadians depend on.

First, the CPPA includes a new exception to consent, to cover specified business activities, and it introduces the concept of legitimate interests into Canada’s privacy framework, with updates that take into consideration what we have heard from stakeholders on the previous proposal that came before Parliament in 2020, back when I was parliamentary secretary to the then minister of heritage and we were considering this.

The objective is to help reduce the administrative burden on businesses and on individuals in situations in which seeking consent is not meaningful, for example, the use of personal information for the shipping of goods that have been requested by the individual.

In these situations, the customer clearly anticipates receiving a shipment, and the company should be able to undertake this shipment without the law adding an extra burden to provide this service. Importantly, this exception may not be used in situations in which the organization intends to influence the individual’s behaviour or decisions.

Moreover, given the need to consider interests and potential impacts on individuals, the organization will be required to assess the potential impacts on individuals, implement measures to eliminate or mitigate such impacts, and comply with any prescribed requirements. The Privacy Commissioner may review such assessments on request.

All in all, the inclusion of a targeted legitimate interest exception aligns the CPPA with international best practices, including those of the EU.

Second, the CPPA defines and clarifies how businesses should handle de-identified personal information, in other words, personal information that has been modified to reduce the risk that an individual could be recognized or identified.

This framework takes into account the feedback we heard from the previous proposal. The bill also defines anonymized information and confirms that information that has no risk of identifying an individual falls outside the scope of the act.

The bill before us today would incentivize organizations to de-identify personal information before using it for research, development and analysis purposes, further protecting Canadians’ privacy.

We know businesses need to invest in R and D to improve their products, which benefits customers by providing them with new and innovative products and services. This provision would allow businesses the flexibility to use de-identified data for R and D, adding value for both customers and firms. However, the CPPA confirms that this information would still stay within the protection of the act and under the oversight of the Privacy Commissioner of Canada, as one would expect.

Recent years have also shown the critical role data plays in developing evidence-based policies and responding to public crises. Whether it is to respond to public health needs or the now-present challenges from climate change, or even planning a city, data is needed to help us rise to these challenges, but it must be used responsibly and in keeping with our values.

That is why the CPPA introduces a framework that would allow for the use of data in ways that would benefit the public good. It would do this by allowing companies to disclose de-identified data to specified public entities, such as hospitals, universities and libraries. These disclosures would be permitted only where specific criteria are satisfied. That is, the personal information must not identify an individual, and there must be a socially beneficial purpose, like those related to health, public infrastructure or environmental protections. This would ensure that the privacy of individuals is protected, while making sure we would be using everything at our disposal to respond to increasingly challenging global issues.

Third, the CPPA introduces a new framework for codes of practice and certification systems that would enable businesses to proactively demonstrate their compliance with the law. For example, companies that are engaged in a particular business activity could collaborate on the development of a code of practice that outlines how they comply with the specific provisions of the law. With the approval of that code by the Privacy Commissioner, organizations would have greater certainty that they are meeting their obligations.

Similarly, the bill provides a scheme for recognizing certification systems that demonstrate compliance with the law. Organizations that choose to participate in approved certification schemes would benefit from a reduced risk of enforcement actions under the act. This would be especially helpful for small- and medium-sized entities that do not necessarily have extensive legal resources at their fingertips. These new frameworks for recognized codes and certifications would make it easier for businesses to demonstrate their compliance with the law to customers, to business partners and to the Privacy Commissioner of Canada.

I would like to move now to the third part of the legislation, the proposed artificial intelligence and data act, or AIDA, which would support responsible innovation by giving businesses a clear framework to guide the design, development and deployment of artificial intelligence systems, or AI systems. AI systems have many benefits and operate across national and provincial boundaries.

As I mentioned, Canada has become a global leader in artificial intelligence through the pan-Canadian AI strategy. However, as the technology has matured, risks associated with AI systems have also come to light, including with respect to health, safety and bias. In order for Canadian innovators to maintain this status, common standards are needed for international and interprovincial trade in AI systems.

The bill would guide innovation by building confidence in the technology and protecting Canadians against the harms such systems can cause. Specifically, AIDA would ensure that entities responsible for high-impact AI systems identify and mitigate potential harms, including bias. By aligning with internationally recognized standards, this would ensure market access for Canadian innovations.

Lastly, an artificial intelligence and data commissioner would be created, with the dual role of support the minister in administering the act and playing a supportive role in helping businesses understand their responsibilities and how to comply. We believe the government is paving the way for Canada to be a world leader in innovation by providing Canadians with clear rules on how it may be developed and used.

I believe it is imperative the House move to pass this bill. The digital charter implementation act would not only protect the personal information of Canadians and lay the ground rules for the responsible design, development, deployment and operation of AI systems in Canada, but also enable the responsible innovation that will promote a strong Canadian economy. With this bill, the government is sending a clear message that responsible innovation is critical for Canada’s future economic success and competitiveness.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, former Liberal bagman David MacNaughton, who was subsequently appointed to be the ambassador for Canada to the United States, went on to become the president of Palantir. It is the Dyson of data scooping and meta tag recombination.

His first order of business was to attempt to secure a contract with the Canadian federal government, but he had violated the cooling-off period for being a public servant. What assurances do Canadians have that this will be secure enough and that we will be protected from this legislation's being used as political weaponry on the taxpayer's dollar?

[Andy Fillmore, Liberal, Halifax, NS]

Madam Speaker, I begin by pointing out that Canadians have never been more reliant on digital data. In fact, a previous hon. member of this House, Scott Brison, famously quipped that we have Blockbuster legislation. We have Blockbuster law in a Netflix world. It is clear we need to update this.

To the member's question about enforcement and making sure there are repercussions for the misuse of data or for violating the proposed act, the act would create the data commissioner. It would give the commissioner powers to impose administrative monetary penalties. In contrast to today's legislative landscape, I think the proposed act would address the member's concerns.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, I would like to thank my colleague from Halifax for his speech. I am sure he will work hard in committee to defend the integrity of this bill. He can count on the Bloc Québécois's support for the principle of the bill.

The Chair delivered a ruling earlier this afternoon about how Bill C-27 should be divided into two parts. I would like to hear his comments on that. What impact will that have on the bill? Does he think that will jeopardize certain aspects of Bill C-27? What will be the consequences?

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

For clarification, I would point out that Bill C-27 has not been divided and only the vote will be done separately.

The hon. parliamentary secretary.

[Andy Fillmore, Liberal, Halifax, NS]

Madam Speaker, I want to thank my colleague for his excellent work on the industry committee. We accomplish good things there together, and there are many more to come.

This ruling was handed down today by the Speaker. We are going to figure out what it means. In terms of process, there may be some implications. Whatever the process implications are, I do not think it impacts the content and the imperative that we move ahead with updating our digital privacy laws in Canada.

I look forward to working with him and all members of the industry committee to get this across the finish line.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Madam Speaker, Bill C-27 does not explicitly apply to political parties, and in the past we have seen the possibility of privacy breaches and misuse in the political arena.

Should the bill be amended to specifically include political parties?

[Andy Fillmore, Liberal, Halifax, NS]

Madam Speaker, as I mentioned in my remarks, the content of the bill has been driven by past consultations on its previous iteration in 2020. It has been driven by discussions with industry partners and with social and civil society groups.

We are very confident that the contents of the bill, as it stands now, will address the gaps and how out of date it is. I believe the concerns around political parties are covered under the Elections Modernization Act, which we passed in the previous Parliament.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, I know it is very important, when we look at different aspects of the bill, for it to be balanced, as the member has mentioned, between business, ethics and consumer protection. We believe in privacy as a fundamental human right.

One of the definitions he talked about was de-identification versus anonymization. De-identification was used in ethics. We studied the Telus data for good program, whereby data was just given from Telus to consumers to the government during COVID. De-identification means that the risk of the individual being identified remains, whereas anonymization means that information is scrapped.

Can the member comment on whether he sees anonymization being used more than de-identification?

[Andy Fillmore, Liberal, Halifax, NS]

Madam Speaker, my view on this is that we need to give Canadian creators and innovators every advantage we can to innovate and keep Canada in a competitive position, while at the same time protecting the privacy of Canadians and individuals. There is absolutely a balance there, and we have to find where that line is. I look forward to the good work ahead on the industry committee, where we can help to find that balance.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, I acknowledge that I am standing today, as any day that I am on Parliament Hill, on the Algonquin land of the Anishinabe peoples. I say a large meegwetch to them.

I am speaking today, as we all are, to Bill C-27, which is really three bills in one. My other parliamentary colleagues have already canvassed the bare outline of this, in that we are looking at three bills: an act to create a consumer privacy protection act; a personal information and data protection tribunal act, which largely replaces some of what there was already in PIPEDA in the past; and a brand new artificial intelligence and data act.

I want to start with the artificial intelligence and data act because it is the part with which all of us are least familiar. Much of what we see in this bill was previously before Parliament in last session's Bill C-11. There is a lot to dig into and understand here.

As I was reading through the whole concept of what kinds of harms are done by artificial intelligence, I found myself thinking back to a novel that came out in 1949. The kind of technology described in George Orwell's book, famously called 1984, was unthinkable then. The dystopian visions of great writers like George Orwell or Margaret Atwood are hard to imagine. I will never forget the scene in the opening of The Handmaid's Tale, where a woman goes into a store and her debit card is taken from her. At that moment, we did not have debit cards. Margaret Atwood had to describe this futuristic concept of a piece of plastic that gave us access to our banks without using cash. No one had heard of it then.

There are words from George Orwell, written in 1949, about the ways in which artificial intelligence and new technologies could really cause harm in a dystopian sense. In 1984, he writes, “It was terribly dangerous to let your thoughts wander when you were in any public place or within range of a telescreen. The smallest thing could give you away.”

More recently, there is the song by The Police and written by Sting and others. I will never forget that once I went to a session on rights to privacy being under assault and a British jurist brought with him for his opening of the speech, “Every breath you take, And every move you make, Every bond you break, Every step you take, I'll be watching you.”

We live in a time when artificial intelligence can be enormously invasive of our privacy with things like visual recognition systems, as the hon. member for Selkirk—Interlake—Eastman was just speaking to. These are things that, for someone like me born in 1954, are all rather new, but they are new for people born in 1990 too. It is very new technology and bringing in legislation to control it is equally new and challenging for us as parliamentarians. The whole notion that we are going to be able to spot the ways in which artificial intelligence can affect our democracy is something that will take time.

We talk about harms from this kind of technology, from capturing algorithms, from invading our spaces. We do not have to look any farther than the way Cambridge Analytica was used by the Brexit forces in the U.K. to harness a public outrage against something based on a pile of disinformation, by targeting individuals and collecting their data. That kind of Cambridge Analytica concern also gets into part 1 and part 2 of this bill. We really do need to figure out how to control the digital tech giants harvesting our information.

As an example used earlier today in debate, there is the idea that big digital giants and large corporations can profit from data without the consent of Canadians who may have put a family photo on social media, never knowing that their privacy has been invaded and their personal information and photos have been used for profit without their permission. In this sense, I am going to flag that in the context of the artificial intelligence and data act, I hope we will be taking the time necessary to hear witnesses specifically on this.

We have developed a pattern in recent years, which is to say the last decade or so, of having three or four witnesses appear on panels. All of us in this place know that committees are trying to hear from a lot of people and receive a lot of evidence. It will do us a disservice in our dive into the artificial intelligence and data act if we combine panels of people who are experts on PIPEDA and people who are experts on other aspects of this bill, with panels on artificial intelligence and data.

The committees that study this bill will control their own process. Committees are the masters of their own process, but I would urge the government, the Liberal legislative managers of this piece of legislation, Bill C-27, to follow the lead of the Speaker's ruling earlier today. If we are going to vote on the artificial intelligence act as a separate piece when we come to vote, we could at least make an effort to ensure that the concentrated effort of committee members and hearing witness testimony is not diluted through several different pieces of legislation and panels with three or four witnesses.

Members' questions will inevitably and invariably go to one or two. In this format of panels and pushing witnesses through quickly, we lose a lot of content. Compared with when I worked in government back in the 1980s, which I know seems like the dark ages and no one in this room was on committees in those days, committees would hear from a witness who could speak for 15 minutes and then we would have the rest of an hour to ask that one witness questions. Now that we are into something as complicated as this area, I would urge the committee to give it that kind of attention or to ask the government to send part 3, the artificial intelligence and data act, to a different committee, so that the study can be thorough and we can educate ourselves as to the unintended consequences that will inevitably occur if we go too fast.

Turning to the parts of the bill that deal with privacy, I want to put on the record again a question that was raised just moments ago about whether privacy legislation should apply to political parties in Canada. At the moment, it does not. Political parties are exempted from the kinds of privacy protections that other organizations, NGOs and corporations must use to protect the privacy information of their customers, consumers and citizens.

The Green Party of Canada believes it is essential that political parties be added to the list of organizations that have an obligation to protect the privacy of Canadians.

I will say quickly that I tend to agree with the first analysis of one of the NGOs that are very concerned with privacy information. OpenMedia, in an article by Brian Stewart, says very clearly that this legislation could actually make things worse for some privacy protections. They give the efforts of Bill C-27's consumer privacy protection act and its personal information and data protection tribunal act a grade of D. In other words, it passes but just barely. There will be many witnesses.

I can certainly confirm that, as a Green Party member of Parliament in this place, I will be bringing amendments forward, assuming this bill gets through second reading, which I think we can assume, and ends up at committee.

In the time remaining, I want to emphasize that Canada is aware that privacy is a fundamental human right. It is part of the UN declaration on the rights of individuals. I echo some of the sentiments from the hon. member for Selkirk—Interlake—Eastman in asking why we are looking at consumer privacy. Maybe we should change that word to Canadians' rights and privacy.

I also agree with many members who have spoken today about the problems of subclause 18(3) and the number of exemptions along with the question of what is a “legitimate” reason that people's privacy can be invaded. That should be further clarified. I find “a reasonable person would expect the collection or use for such an activity” to be fine, but the exemptions seem overly broad.

If I dive into anything else I will go over my allotted time.

This is important legislation. We must protect the privacy of Canadians. I think we will call on all parties in this place to set aside partisanship and make an honest effort to review it. That is not to delay it but to make an honest effort to review the bill before it leaves this place.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I believe it was in response to a question by the leader of the Green Party that a member of the Conservative Party responded by implying that the best thing we could do would be to defeat the legislation and send it back to the drawing board. I do not believe that would be the position of the leader of the Green Party, but I do have a question for her.

I can appreciate there is a fear factor. We want to be cautious as we move forward, and what I suggested before in my question is that it seems to me there is a great deal of interest on all sides of the House to get into the nuts and bolts of the legislation. Given the limited time for debate in the House, would it not be better to see the legislation go before a committee because a committee has a lot more time to get into the details of the legislation?

After all, we would still have all of third reading and so forth. That is why I made reference to whether we should be looking at trying to get this legislation through second reading before the end of the year, given the importance of the issue.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, the hon. parliamentary secretary will not be the least bit surprised that I hope his government will not use time allocation again to reduce the time available for debate, and I likewise would urge all parties in this place to ensure everyone who speaks to the legislation has really studied it, knows it well and is prepared to speak to it without notes. I think that would speed along the process of second reading.

There are also concerns with the legislation that I have not referenced yet, but I see an hon. colleague in this place who is certainly as concerned as I am about the rights to children's privacy. We have to be very concerned with the invasive use of images and the right of individuals to be able to get what is now called either erasure or the right to be forgotten.

However, I agree with the hon. member. I would like to see the bill go to committee. I will vote for it, but I have a lot of concerns.

[Ted Falk, Conservative, Provencher, MB]

Mr. Speaker, I want to thank the member for Saanich—Gulf Islands for her engagement. In light of what we have seen in the last two and a half years with the government engaging in serious violations of Canadians' privacy and personal freedom rights, and given the fact it allowed the Public Health Agency of Canada, without judicial authority or approval, to track Canadians on Canadian soil, does the member think the legislation would prevent future episodes of that kind of thing from happening to Canadian citizens?

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I know that my hon. colleague from Provencher and I disagree on some aspects of the facts around the Public Health Agency, but I know there certainly are concerns. I have agreed in this place before that, if an app is tracking personal information, whether it is a Tim Hortons or, worse, the government, we need to pay close attention to that. I think the legislation would make positive steps forward to prevent that, but I do not think we can say with confidence that the legislation absolutely would ensure it never happens again.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I thank my colleague from Saanich—Gulf Islands for her speech. She talked about the importance of data protection.

This bill is aimed at the private sector, but it does not address the public sector, even though the government itself has failed to protect data, as in the case of CERB fraud.

Should the bill also regulate government data to ensure that the public interest is protected?

I would like to hear my colleague's comments on this.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I thank my colleague for his question. As he said so well, recent examples of fraud show that we must address these issues. We must protect the privacy rights of Canadians and Quebeckers. We must do more with this bill.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Mr. Speaker, my hon. colleague spoke about rights, and I agree with her that privacy rights are an important part of the digital age. Like other rights, we must be clear where we stand on them.

I am wondering if the member agrees with me in questioning whether making it easier for the Facebooks and the Googles of the world to use Canadians' personal information in ways that have nothing to do with their services in the guise of helping small business is the right place to stand. That is certainly one of concerns I have.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Mr. Speaker, I think history will look back at the Googles and Facebooks of this world and put them in a category with evil flesh merchants of times gone by. They are appalling, and they get away with murder. They get away with stealing our privacy for their profit.

All of these so-called platforms should be treated as publishers so that common law could deal with them, and they could not be anonymously destroying people's lives. People would know who said what. The publisher would be held to account and could be sued for abuses, which are spread, and for disinformation.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Mr. Speaker, I will be sharing my time with my hon. colleague from Abitibi—Témiscamingue, whom I commend for his hard work.

Today, I am pleased to speak to a bill that is as necessary as it is complex. As written, the bill has some grey areas, some things the Bloc Québécois has reservations about, but we do think it has a lot of potential.

Bill C‑27 enacts the consumer privacy protection act. Sponsored by the Minister of Innovation, Science and Industry, the member for Saint-Maurice—Champlain, the bill is at second reading. It would create three different acts: the consumer privacy protection act, the personal information and data protection tribunal act, and the artificial intelligence and data act. That last one is very interesting.

In essence, Bill C‑27 seeks to strengthen the protection of anonymity and privacy. Now that digital technology is omnipresent in our lives, it is harder than ever to make sure our privacy and personal information are protected.

Until now, organizations of every kind have taken advantage of the absence of a legal consumer protection framework. In Canada, personal information is a commodity without a legal owner.

Just look at the Cambridge Analytica scandal during the 2016 U.S. election. Bill C‑27 aims to change this sorry state of affairs, which is threatening our democracy, our privacy and social peace. The bill not only limits and restricts the excessive freedom enjoyed by organizations that collect and share our data, but it also gives them responsibilities. In short, it puts the individual and the idea of consent back at the centre of reflections on digital exchanges, and that is significant.

The Bloc Québécois supports this bill because it partially fills a legal void in Canada. I say “in Canada” because the Quebec National Assembly passed Law 25 on the protection of personal information way back in September 2021. It is a well-written law. Bill C‑27 is actually largely modelled after it, and we are very proud of that.

Given that the protection of personal information is a shared jurisdiction, it is vital to the Bloc Québécois that Bill C‑27 not take precedence over Quebec law. This does not seem to be the case at this time, but it will be up to the committee to verify this and ensure that it does not.

Speaking of the committee stage, many grey areas still need to be clarified. According to Daniel Therrien, a former privacy commissioner of Canada, Bill C-27 is too timid in its current form.

I myself have thought of something that could be studied at the committee stage, and that is image copyright. Since we are speaking about consent, the protection of anonymity, personal data and the need to adapt our legal framework to the digital era, I believe that it would be highly relevant to address this subject.

Just like the digital world, the world of photography has changed a great deal over the past 20 years. Thanks to smartphones, and the fact that just about everybody owns one, or even two, more and more photos are being taken. According to some estimates, more than three billion photographs are taken every day around the world. An image is a form of personal information. The use and sharing of images are intrinsically linked to the principle of consent. If no consent is obtained, that is a breach of privacy.

I believe that our current interpretation of image copyright is too strict, and this is detrimental to street photography and photojournalism. My father, Antoine Desilets, a photojournalist, was also a street photographer in his own way. Street photography is generally defined as photography done outdoors whose main subjects are people in spontaneous situations and in public places such as streets, parks, beaches and protests.

A good example of this kind of photography is the famous photograph The Kiss by the Hôtel de Ville, taken by the renowned French photographer Robert Doisneau. That shot has actually been the subject of multiple lawsuits, with every Dick and Jane claiming to be one of the two main figures in the picture.

Let me tell a little story from closer to home. In 1987, a Quebec photographer and friend by the name of Gilbert Duclos took a picture of a woman in the street. After the photograph was published in a magazine, the woman decided to sue Gilbert Duclos. She claimed that she was being mocked by her friends and felt that she had been wronged.

After a two-year legal saga that reached the Supreme Court, the woman won. For more than three decades, that decision, known as the Duclos decision, has been a precedent.

The debate was recently reignited by the case of a veiled woman and her husband who were photographed at a flea market in Sainte‑Foy. Since the photograph had been published without their consent, the photographer was forced to pay $3,500 to each of the two people in the photograph, even though the individuals were veiled. There is no doubt that the Duclos decision was used to bolster the plaintiffs' case.

Today, it is very easy to take a photographer to court and win. This means that many photojournalists and street photographers get sued, so unfortunately, they have to practise a form of self-censorship to protect themselves and the newspapers they work for. I believe this self-censorship has grave consequences for the arts, journalism and archive building. As it happens, on October 1, a group of 12 street photographers, led by the esteemed Jean Lauzon, published a book entitled Le droit à l'image as a commentary on this very issue.

The Bloc Québécois believes that the committee that will study Bill C-27 will have to take its time and question all the experts it needs to consult in order to come up with an ironclad law. I have a suggestion. Since we are discussing consent, privacy, the right to anonymity and personal data in the digital age, why not invite experts such as Jean Lauzon to help us understand how to modernize image copyright?

Also, when does an image of an individual taken in a public space become private? Once again, there is the need for oral or written consent on the one hand, and perhaps the definition of the concept of a subject on the other. There is a whole host of factors to consider.

For the rest, I am in favour of Bill C‑27 because it gives hope that we are going to begin to plug the gaping hole that our data is currently circulating in, allowing it to be sold and exploited.

It will be especially important to ensure that the Quebec legislation takes precedence over the Canadian legislation, as is customary in matters of shared jurisdiction.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, the member raises a fascinating issue, which is the capturing of images and how one would protect the privacy of the individual, especially when it is in a public setting. I think that could be applied in many different ways. It would be interesting to see how that sort of a discussion would, in fact, take place at a standing committee.

The member is right in the sense that the legislation is not that far off. I do not know all of the details of it, obviously, but I am led to believe that Quebec has done some fabulous work on this issue. I wonder if he could provide any insights into how the Quebec legislature dealt with the capturing of images and the public versus privacy issue.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Mr. Speaker, that is a very important question.

The Quebec legislation does not go quite that far, but the issue remains. The jurisprudence dates back to 1987, after all.

When my colleague refers to photos taken in public, the definition of the words “public” and “private” is not clear. I might be in the street kissing my mistress. That is my private life, but at a location that, within the meaning of the current federal legislation, is a public place.

There is a host of concepts of the kind that ought to be delineated and more precisely defined in order to bring some much-needed clarity to the whole issue. It is really too bad that Mr. Duclos is still burdened by this jurisprudence.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Mr. Speaker, would the member agree that the creation of two new categories of data exempt from privacy measures is a worrisome gesture by the Liberals and could be a gift to the very technology giants to which they have such close ties?

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Mr. Speaker, our colleague is always full of surprises.

Basically, I think this bill is relevant. Overall, it is relevant. In this day and age and in light of the current context, this bill is pretty much a necessity.

I am concerned about how the bill will be dealt with in committee. When it comes to bills like this one, the committee has an extremely important role to play. Beyond the wording of the bill, it is the work that is done in committee that will be critical for the future.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Mr. Speaker, I would like to call the attention of the House and the member to subclause 15(6) of the bill, which states, “It is not appropriate to rely on an individual’s implied consent if their personal information is collected or used for an activity described in subsection 18(2) or (3).”

If we look at clause 18, it states that one can use a person's implied consent when collecting information. It is fascinating to me that this bill says, on the one hand, that one cannot use implied consent, but then the exemptions part says one can rely on implied consent. What are we trying to do with this bill? It is really muddying the waters for me, and I am wondering if my hon. colleague has a comment about that.

[Luc Desilets, Bloc, Rivière-des-Mille-Îles, QC]

Mr. Speaker, there will be more to come on that.

In the case of photographs, it is not easy to define what implied consent involves. In some situations, implied consent from the subject may be a look that says that they consent. It may also involve asking the subject if they agree to be photographed. In other cases, it may involve written consent.

That is why I think it is extremely important and relevant for the committee to do an exemplary job, and not just with regard to photography, which is part of who I am. In order to do that, the committee needs to invite all kinds of experts.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I am pleased to speak to this bill after my colleague from Rivière‑des‑Mille‑Îles, whom I would like to congratulate. I am also pleased to be following my colleague from Trois‑Rivières, an ethics expert who enlightened us on the potential impact of this bill and the dangers involved.

Unfortunately, very few people are interested in this type of bill, and yet, in the digital age, we cannot afford not to regulate the use of personal information. We cannot deny the fact that the digital shift has exploded in Quebec and elsewhere over the last decade, and it has greatly changed our lifestyles.

It is impressive to see which path companies have chosen during the pandemic, and I think it is a timely discussion to have today. However, I would like to draw attention to the new part of the bill that deals with artificial intelligence. I think it deserves serious consideration.

Part 3 of the bill raises many questions, and opinions from experts in the field of artificial intelligence are mixed. The use of artificial intelligence is a rapidly growing field that risks expanding beyond our control and jurisdiction if we do not begin to regulate the practice and define certain concepts.

Recent developments in AI in general and deep learning in particular have led to the creation of autonomous intelligent agents, which are essentially robots capable of deciding what to do without third-party intervention. These agents' autonomy raises new questions about civil liability, so we have to think about criminal provisions that would apply if someone were put in a dangerous situation, for example.

How should we approach this, and what legal status are we granting them? What legislative framework is the best fit for these autonomous agents?

At this point, we think some important definitions are missing. The law clerks who are examining the bill's provisions from a legal standpoint told us that again today. What is a high-risk intelligence system? What is a high-impact system?

The algorithms produced in applications that use artificial intelligence enable artificial beings to create goods or services or to generate predictions or results. If we compare them to human beings and use the existing framework, how will we interpret the notions of independence and unpredictability attributable to these artificial beings? The experts will help us understand all that.

Quite a few goods already exist that have a layer of artificial intelligence built into them, and 90% of those goods should not pose a problem. Experts at Meta have even said that this technology has reached its limits, because the data to train an algorithm is insufficient in quantity and lacks depth.

Let us get back to the main problem we have with Bill C‑27. Until the department clarifies its thinking on what constitutes a high-impact system, it will be difficult to assess the scope of part 3. Let us assume that everything can be considered high risk. This would mean that many companies would be accountable. If we had greater accountability, the Googles of this world might be the only ones that could risk using artificial intelligence.

The bill does not need to cover everything a machine can do for us or everything software can do once it is developed and generates predictions and results like a calculator.

If we compare it to the European legislation, we note that the latter is currently targeting employment discrimination systems, systems that would determine whether or not a permit to study there can be granted. That is essentially the limit of what the machine can do in our place.

Although the law in this document concerning artificial intelligence is far from being exhaustive, I believe it is important that we start somewhere. By starting here, with a framework, we can lay the groundwork for a more comprehensive law.

My speech this evening will help my colleagues better understand what needs to be clarified as soon as possible so we can have an important discussion about how to regulate the applications that use artificial intelligence and how to process these systems' data.

First, we will have to implement regulations for international and interprovincial exchanges for artificial intelligence systems by establishing Canada-wide requirements for the design, development and use of AI systems. Next, we must prohibit certain uses of AI that may adversely affect individuals.

The legislation is very clear on many other aspects, including on the fact that there would be a requirement to name a person responsible for artificial intelligence within organizations that use this technology. The responsibilities are fairly extensive.

In addition to the artificial intelligence and data act, which is in part 3, Bill C‑27 also includes, in part 1, the consumer privacy protection act, as well as the amendments to the former legislation. Part 2 of the bill enacts the personal information and data protection tribunal act, while part 4 includes the coming into force provisions of the bill.

As my colleagues explained, the other sections of the bill contain a lot of useful elements, such as the creation of a tribunal and penalties. One of the acts enacted by Bill C‑27 establishes a tribunal to process complaints under litigation when it comes to the use of private data. In case of non-compliance, the legislation provides for heavy penalties of up to 3% of a multinational's gross global revenue. There are provisions that are more in favour of citizens when a company misuses digital data.

Yes, this bill does have its weaknesses. I believe those weaknesses can be addressed in committee, but they may require the introduction of new legislative measures. Public services, however, are not covered by this bill. Data in the public sector requires a greater degree of protection; this bill covers only the private sector. Take, for example, CERB fraud and the CRA. In 2020, hackers fraudulently claimed $2,000 monthly payments and altered the direct deposit information for nearly 13,000 accounts.

The government can do more to tackle fraud. Unfortunately, this bill offers no relief or recourse to those whose information has already been compromised. There are digital records of nearly every important detail about our lives—financial, medical and education information, for example—all of which are easy targets for those who want to take advantage. It has been this way for a while, and it is only going to get worse when quantum computers arrive in the very near future.

This means that we must find and develop better means of online identity verification. We must have more rigorous methods, whether we are changing our requirements for passwords, for biometrics or for voice recognition.

Recently, at the sectoral committee, we heard about how easy it is for fraudsters to call telecommunication centres and pass themselves off as someone else to access their information. We must improve identity verification methods, and we must find a way to help those who are already victims of fraud. We must do so by amending Bill C-27 or introducing an additional legislative measure.

Since this is a fairly complex bill, it will be referred to the Standing Committee on Industry and Technology, where we will have the opportunity to hear from experts in the field. At this step, I would like to recognize the leadership of the Minister of Innovation, Science and Industry and his team. We have been reassured by the answers we have received.

Since Quebec already has data protection legislation—Bill 64, which became law 25—we want to understand when the federal act will apply and whether the changes we requested to Bill C-11, introduced in the previous Parliament, were incorporated into this bill. I want to say that we are satisfied with the answers we have received so far.

We will do our due diligence because this bill includes a number of amendments. Obviously, the devil is in the details. During the technical briefings held by the department since Bill C-27 was published, we asked how much time businesses would have to adjust their ways of doing things and comply with the legislation.

We expect that there will be a significant transition period between the time when Bill C-27 is passed and when it comes into force. Since the bill provides for a lot more penalties, the government will likely hold consultations and hearings to get input from stakeholders.

In closing, I would like to say that I have just come back from Tokyo, where I accompanied the Minister of Innovation, Science and Industry to the Global Partnership on Artificial Intelligence Summit, where Quebec and France took the lead. The first summit was held in 2020. I would like to list some important values that were mentioned at this summit that deserve consideration and action: responsible development, ethics, the fight against misinformation and propaganda, trust, education, control, consent, transparency, portability, interoperability, strict enforcement and accountability. These are all values that must accompany open data and ecosystems.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, I would concur with the member and the many others who are, in essence, saying that Bill C-27 is a substantive piece of legislation that is ultimately designed to ensure privacy for Canadians.

As I made reference to earlier, I think we could look at how effective the legislation of the Quebec legislation has been, which was passed just over a year ago, and what the response has been to it. I understand that was what the member was saying. Taking into consideration AI, the tribunal, digital and just how much the digital economy has grown, 20 years ago is the last time we have seen any sort of substantive changes to our privacy legislation.

I am wondering if the member could provide his thoughts in regard to why it is important that we update and modernize. After all, 20 years ago, we did not even have iPhones.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I thank my colleague from Winnipeg North for his remarks.

Indeed, I think such a bill was urgently needed. I commend the government's leadership and congratulate it on having understood the errors in Bill C-11 and making some improvements.

I met with the Minister of Innovation, Science and Industry in January, when it was time to think about developing this bill. I emphasized the importance of the Quebec legislation and of ensuring its primacy. I thank him for listening to me and for the respect evident in Bill C-27.

With respect to the urgent need to take action, Europe is putting a lot of pressure on us. Indeed, Europe has set guidelines and is currently threatening to withdraw its confidence in our artificial intelligence systems in Canada, particularly in the banking sector. It was necessary to act; better late than never.

I hope the principle will be adopted quickly, but more importantly, I hope that the committee work will be thorough and that the experts will be heard. This will be more than welcome.

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Mr. Speaker, I have concerns around the fact that we are expecting the government to do a good job.

The member mentioned CERB, which was, in many ways, abused. We are aware that the government, in an effort to roll it out quickly, removed all the checks and balances on the system. How does that build confidence for him and other Canadians to put their trust in its ability to do this correctly?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, trust is a major issue. Far too often, we are negligent. How many times do we just click “I accept” in an app without reading the consequences of what we are accepting? Our data is being sent all over the world.

Artificial intelligence is something that scares me, truth be told. A guest speaker came to Parliament, to a room in the House of Commons, and this is what he told us. What does AI say is the fastest way to get to Toronto? Just simulate an accident or a speed trap so that people get off the road. That will allow us—

[The Deputy Speaker, Conservative, Chris d'Entremont]

Order. I believe there is no interpretation.

It is working now.

The hon. member for Abitibi—Témiscamingue can restart his answer.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, it is not easy. What I was talking about was trust.

Artificial intelligence is something that scares me, on the whole. A guest speaker came to a meeting held on Parliament Hill, and he told us about the risks.

Say we want to drive to Toronto and there is a lot of traffic. What can we do? We can ask AI to tell us the fastest way to get to Toronto. One option is to simulate an accident, which will ensure that the road is cleared. Another is to say that police have set up a speed trap or something. AI can be used to generate very realistic photos, such as a Parliament building on fire. Fighting disinformation is a major challenge.

Everyone has an individual responsibility. All too often, when using an app, we quickly click “accept” rather than doing our due diligence. That has consequences.

As I was saying earlier, we send a lot of data abroad. With the arrival of quantum computing, we may suffer the consequences of sending all this data to the cloud.

I do not think it is too late to have a law that sets out a framework, to improve the legislation and especially to ask experts to tell us how this bill can be improved. I am thinking about the people at the International Centre of Expertise in Montréal on Artificial Intelligence, those at the Quebec Artificial Intelligence Institute, or Mila, and those at the University of Montreal. These people work in this field every day and have a contribution to make. I look forward to hearing from them at the Standing Committee on Industry and Technology.

[Lisa Marie Barron, NDP, Nanaimo—Ladysmith, BC]

Mr. Speaker, I want to thank my colleague.

Bill C‑27 does not explicitly apply to political parties. As we have seen in the past, the potential for invasion of privacy and misuse exists in the political arena. I was wondering if my colleague would agree that the bill should be amended to specifically include political parties.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I thank my colleague from Nanaimo—Ladysmith for her question. Indeed, political parties have responsibilities. They have people's personal data. We need to act. If we can include it in the bill, I am all for it. We have a responsibility as parliamentarians.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Mr. Speaker, it is always a privilege to rise on behalf of the residents of Kelowna—Lake Country. Today we are debating Bill C-27, an act that would enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act.

Canadians know we no longer live in the year 2000, but unfortunately much of our digital regulation still does. We have come a long way since Canadians' primary online concern was Y2K. The last time Parliament passed a digital privacy framework was PIPEDA, or the Personal Information Protection and Electronic Documents Act, on April 13, 2000. The most popular website in Canada that month was AOL.

When Parliament last wrote these regulations, millions of homes did not have dial-up, let alone Wi-Fi. Cellular phones lacked apps or facial recognition, and people still went continually to libraries to get information, and did not have the Alexas of the world as an alternative. They also called restaurants directly for delivery. Digital advertising amounted to flashing banners and pop-up ads.

In only 22 years, we have experienced a paradigm shift in how we treat privacy online. Personal data collection is the main engine driving the digital economy. A Facebook account is now effectively required to use certain types of websites and help those websites; a laptop can create a biometric password for one's bank account, and Canadians are more concerned about privacy than ever before.

One of the most common videos I share with residents in my community of Kelowna—Lake Country is one relating to privacy concerns during my questioning at the industry committee in 2020, as many people reached out to me about privacy concerns. It was to a Google Canada representative regarding cellphone tracking. This was in the immediate aftermath of reports of Canadians' cellphone data being used to track people's locations during the pandemic.

Cellphone tracking is something I continue to receive correspondence about, and I am sure other members in the House do as well. As traditionally defined, our right to privacy has meant limiting the information others can get about us. The privacy of one's digital life should be no different from the physical right to privacy on one's property. Canadians must have the right to access and control the collection, use, monitoring, retention and disclosure of their personal data.

Privacy as a fundamental right is not stipulated in the legislation we are discussing today, Bill C-27. It is mentioned in the preamble, which is the narrative at the beginning, but that is not binding. It is not in the legislation itself. While the degree to which someone wishes to use this right is ultimately up to the individual, Parliament should still seek to update the rules using detailed definitions and explicit protections. Canadians are anxious to see action on this, and I have many concerns about this legislation, which I will outline here today.

As drafted, Bill C-27 offers definitions surrounding consent rules to collect or preserve personal information. It would mandate that when personal information is collected, tech companies must protect the identity of the original user if it is used for research or commercial purposes. The legislation outlines severe penalties for those who do not comply and would provide real powers of investigation and enforcement. It presents Canada's first regulations surrounding the development of artificial intelligence systems.

Even though Bill C-27 presents welcome first steps in digital information protection, there is still a long way to go if we are to secure digital rights to the standard of privacy regulation Canadians expect, and most importantly, the protection of personal privacy rights. As is mentioned in Bill C-27, digital privacy rights are in serious need of updating. However, they are not in this legislation.

I agree with the purpose of the legislation, but many of my concerns are about inefficient, regulatory bureaucracy being created and the list of exemptions. Also, the artificial intelligence legislation included in this bill has huge gaps and should really be its own legislation.

From a purely operational perspective, while the legislation would empower the Privacy Commissioner's office with regard to compliance, it also constructs a parallel bureaucracy in the creation of a digital tribunal. If Bill C-27 is enacted, Canada's Privacy Commissioner can recommend that the tribunal impose a fine after finding that a company has violated our privacy laws. However, the final decision to pursue monetary penalties would ultimately rest with the new tribunal. Will this result in a duplicate investigation undertaken by the tribunal to confirm the commissioner's investigation?

As someone who has operated a small business, I am all too aware of the delays and repetitiveness of government bureaucracy. While it is important to have an appeal function, it is evident in this legislation that the Liberals would be creating a costly, bureaucratic, regulatory merry-go-round for decisions.

Canadians looking to see privacy offenders held accountable need to see justice done in a reasonable time frame. That is a reasonable expectation. Why not give Canada's Privacy Commissioner more authority? Of course, Canadian courts stand available. The EU, the U.K., New Zealand and Australia do not have similar tribunals to mediate their fines.

In addition to concerns about duplications of process, I am worried that we may be leaving the definitions of offending activity too broad.

While a fairly clear definition in Bill C-27, which we are debating here today, has the consent requirement for personal data collection, there is also a lengthy list of exemptions from this requirement. Some of these exemptions are also enormously broad. For example, under exemptions for business activities, the legislation states:

18 (1) An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of a business activity described in subsection (2) and

(b) the personal information is not collected or used for the purpose of influencing the individual’s behaviour or decisions.

On plain reading, this exemption deals more with the field of human psychology than with business regulation.

Also in the legislation is this:

(3) An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use

There is also an exemption to consent that would allow an organization to disclose personal information without the individual's knowledge or consent for a “socially beneficial purpose”. This is defined as “a purpose related to health, the provision or improvement of public amenities or infrastructure, the protection of the environment or any other prescribed purpose.” Who determines what constitutes a socially beneficial purpose? This sounds incredibly subjective, and I have a lot of concerns when legislation is this vague.

Let me give a very simple example. Suppose a person using a coffee company app occasionally adds flavourings to their coffee while doing a mobile order. That company could recommend a new product with those flavourings already in it while a person is not physically in their business. Is this not personal information that is collected and used for the purpose of influencing an individual's decision, as in this legislation?

This example is not hypothetical. In an investigation from actions in 2020, Tim Hortons was caught tracking the locations of consumers who had the app installed on their phones even when they were not using the company's app. Tim Hortons argued that this was for a business activity: targeted advertising. However, the report from the federal Privacy Commissioner found that the company never used it for that purpose. Instead, it was vacuuming up data for an undefined future purpose. Would Tim Hortons have been cleared if the current regulations in Bill C-27 were in place and if it had argued that the data was going to be used for future business activity or for some socially beneficial purpose, which is an exemption in the legislation?

While I worry about the loopholes this legislation, Bill C-27, may create for large corporations, I am equally concerned about the potential burden it may place on start-ups as well. This legislation calls for companies to have a privacy watchdog and to maintain a public data storage code of conduct. This is vital for companies like Google, Facebook or Amazon, which have become so integral to our everyday lives and oversee our financial details and private information. Having an officer internally to advocate for the privacy of users is likely long overdue. However, while that requirement would not put much financial burden on these Fortune 500 companies, it could undermine the ability of Canadian digital innovators to get started.

Canada has seen a boom in small-scale technology companies for everything from video game and animation studios to wellness or shopping sites for almost every good or service one could imagine. Digital privacy laws should be strong enough to not require a start-up with just a few staff to have to be mandated to have such a position internally. We should ensure that a concept of scale is appropriately applied in regulating the giants of today without crushing the future digital entrepreneurial spirit of tomorrow.

I would like to address the presence of Canada's first artificial intelligence, or AI, regulations in this bill. While I do welcome the progress on recognizing this growing innovation need for a regulatory framework, I question whether it is a topic too large to be properly studied and included in this bill. In just the last few months, we have seen the rapid evolution of the ability of AI to create an online demand digital artwork, for example, thanks to the self-evolving abilities of machine learning.

The impact of AI on everything from our foreign policies to agriculture production is evident. Computer scientists observed a phenomenon known as Moore's law, which showed that the processing power of a computer would exponentially double every two years, and in the 57 years since this was proposed, this law has apparently not been broken.

I am concerned that most of the rules around AI will be in regulation and not in legislation. We have seen the Liberals do this many times. They do not want to do the hard work to put policies into legislation that will be brought to Parliament and committees to be debated and voted on. They prefer to do the work behind closed doors and bring forth whatever regulations they want to impose without transparency and scrutiny. We have seen the Liberals conduct themselves many times in this way.

Experts in the field have already made the case that Bill C-27 falls seriously short of the global gold standard, the EU's 2016 General Data Protection Regulation. Canadians deserve nothing less.

Though Conservatives agree with the premise of strengthening our digital privacy protection, this bill has many concerns and gaps. Clause 6 outlines that privacy protections do not apply with respect to personal information that has been anonymized. To anonymize is defined in the legislation as “irreversibly and permanently modify personal information, in accordance with generally accepted best practices, to ensure that no individual can be identified from the information, whether directly or indirectly, by any means.”

There are a lot of risks around this. Under this legislation, information could be disclosed in numerous ways, and that is very concerning. This goes back to what I mentioned at the beginning of my speech with respect to my questioning of Google Canada early in the pandemic about tracing the locations of people through their phones and sending it to the government.

The legislation creates more costly bureaucracy. It does not protect personal privacy as a fundamental right. It has questionable exemptions to protect the privacy of people based on ideologies. It allows the government to create large areas of regulations with no oversight or transparency and it is far from the gold standard that other countries have.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, the member made reference to some things that were mentioned previously. I am forming the opinion that the Conservative Party does not support having a tribunal. I guess I am looking for clarification on that point.

Is it the Conservative Party's approach to say that, once the commission has made a decision, a tribunal would not be warranted and that the only recourse would be to take it to a federal court? What would it replace the tribunal with, or would it replace it with anything?

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Mr. Speaker, I appreciate the comment from the member opposite. One thing in this legislation is to create a whole new bureaucracy. When we look at the gold standard that exists in other countries around the world, and I mentioned them in my speech, they do not have a need for such an organization or department to exist. It is questionable where this came from.

Why not give more authority to the Privacy Commission and its commissioner? This is really not the gold standard that other countries have, and they already have a lot of regulations that are further along than what we have. The questions are, where did this idea come from and why do we feel we need this in Canada when a lot of our allies do not have this type of requirement?

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Mr. Speaker, this piece of legislation is intended primarily for the private sector. It is virtually silent on the subject of the public sector's duties and obligations. As things stand, it is up to victims to fight tooth and nail to prove that fraudulent activity occurred and that they themselves are not new fraudsters. This applies to all levels of government.

I would like my colleague to comment on public sector accountability for cleaning up fraud victims' records when the fraud was caused by the public sector's weak identity verification methods.

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Mr. Speaker, there is different legislation that is covered for the government, but philosophically, absolutely the government should be held accountable for keeping Canadians' information safe. We know there have been breaches over time. We had a recent one with the ArriveCAN app. There was information that was sent out to 10,000 people that was not accurate. We know there have been other breaches over time.

It is imperative that Canadians know that the government is also held to account for the information it holds in all the different departments a Canadian citizen might correspond with.

[Leah Gazan, NDP, Winnipeg Centre, MB]

Mr. Speaker, the private right of action would allow individuals and groups of consumers to seek compensation in court. This has been used effectively in the United States to remedy violations, but it is very burdensome in Bill C-27 to make it even usable.

For example, if the Privacy Commissioner does not investigate or rule on a complaint, an individual has no right of action. If the Privacy Commissioner does investigate and rule on a complaint but the tribunal does not uphold it, the individual has no right of action. These are a couple of examples.

Does my hon. colleague feel that this bill should be amended to fix this?

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Mr. Speaker, one of the things we have seen over time from the Liberal government is building up bureaucracy, building up red tape and making things more difficult for people. Just as a general philosophy, any time we can strip away red tape, create efficiencies and take away bureaucracy, it is a good thing.

Of course, we need to have rules and policies in place. We also need to have the department serving Canadians, and that should really be its focus. It should be focusing on making sure people follow rules, but as soon as we get into difficult, bureaucratic regimes and a lot of red tape, it makes it more difficult for everyone.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I would like to pick up on the question from my colleague from Beauport—Limoilou.

I would like to hear what my colleague from Kelowna—Lake Country thinks about the government's public data. Is it not time for the government to implement other ways to verify identity?

I am talking about at least a factor of two verifications, maybe even three. This may be data such as a password, but it may also be by voice recognition, by facial recognition, by text, and so forth. It may be time for the government to move on to something else.

Could we have more robust means of protecting Canadians' data?

[Tracy Gray, Conservative, Kelowna—Lake Country, BC]

Madam Speaker, I am not sure what the specific ideas might be but I think, in general, any time we can do anything to protect the privacy of Canadians, whether it is within government or within the private sector, whatever all those different levels are, it is a good thing. I know it is something people are extremely concerned about.

As I mentioned in my speech, I often get local residents reaching out to me about privacy concerns they have.

We need to do everything we can within our legislative powers to make sure people's personal privacy is protected.

The House resumed from November 28, 2022, consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts be read the second time and referred to a committee.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I will be sharing my time with the wonderful member forRosemont—La Petite-Patrie.

I am grateful for the opportunity to rise today on Bill C-27, which is an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act, and to make consequential and related amendments.

The amendments are what I am particularly interested in today. As New Democrats, we will be supporting this at second reading. We support the need to modernize Canada's privacy laws and establishing rules around data governance and empowering the Office of the Privacy Commissioner to bring enforcement actions to protect consumers and citizens.

This bill takes some of those steps. However, there is a need to ensure that reforms are robust and effective. In my opinion, a long list of amendments will certainly be required to achieve these goals.

I am going to be referencing two important works that have been presented. One is from the Centre for Digital Rights, entitled “Not Fit For Purpose - Canada Deserves Much Better”. From the title, we can note that there are some concerns with this bill.

However, we recognize that this privacy legislation must be amended because there are already glaring shortfalls in PIPEDA, which urgently needs updating.

Technology continues to evolve, and data-driven business continues to move away from a service-oriented approach to one that relies on monetizing personal information through mass surveillance of individuals and groups. While these businesses find new ways to expand their surveillance and methods of monetizing our personal information, Canadians' privacy is increasingly put at risk.

The GDPR is the bar that is currently considered the adequate level of protection. However, if we were to do a little bit of comparing and contrasting, we would see that this bill tends to fall short of this level in terms of what the European Commission has done.

What this means for us is that the ability for personal data to flow to Canada without any further safeguards is at risk. There has also been pressure from industry and advocacy groups, the privacy commissioners of Canada and abroad, and privacy and data governance experts. In fact, in this particular bill, we think that the government side has fallen short in its engagement with people; I will get to that in a moment.

When we are in these technological environments, it is an ecosystem that goes well beyond our borders. We are talking about what it is like—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I would ask members who are having conversations to please take them to the lobbies.

The hon. member for Hamilton Centre.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, I am sure the hon. members from the other side are about to take some good notes on the recommendations we put forward. They are probably discussing among themselves how they can improve upon these serious gaps and have some public engagement on this.

We are not subject matter experts in this House when it comes to this type of technology. It is not clear whether there has been any public engagement specific to Bill C-27 as it is proposed. There was public engagement around the creation of Canada's digital charter, called the national digital and data consultations, that happened back in 2018. However, as I understand it, only about 30 or so discussions were held. That fell dearly short. The majority of digital leaders were from the private sector, and there were only a couple of universities involved. Therefore, it is unclear who the government is consulting with when it deals with this type of surveillance capitalism and the risks it presents to consumers.

Let us get right to the point. What are the gaps that exist in this legislation? How does Bill C-27 compare with the ideal privacy legislation? There are many gaps. Clearly, it does not compare to the GDPR; it also falls short of privacy legislation that is currently being proposed in la belle province of Quebec, in New Zealand and in the state of California.

For example, in California, the California Consumer Privacy Act, the California Privacy Rights Act and the Children's Online Privacy Protection Act have all presented more robust solutions to what is before us here today. In addition, there are privacy protections that come into effect under the CCPA that we should be considering.

We need to ensure that the protections that come into effect include the rights to know, to delete and to opt out of sale or sharing, as well as the right to non-discrimination. Under that legislation, consumers also have the rights to correct inaccurate personal information and to limit the use and disclosure of sensitive personal information collected about them. There is a lot out there that we should be considering when it comes to amendments.

I am going to list examples of gaps within this bill so they are on the record. The bill does not promote the development of data stewardship models. It does not require that organizations take into account the potential consequences to individuals and societies through such measures as privacy impact assessments of a breach of security or safeguards. There is no section in Bill C-27 expressly dedicated to cross-border dataflows.

There has been no privacy impact assessment done to address any additional risks, which should be identified, justified, mitigated and documented in such an assessment. There is no assessment of the broader level of privacy rights protections in foreign jurisdictions. This is a very important conversation, particularly this week in the House, that includes how Canadians' privacy rights can be enforced.

This bill does not include specific rules that are applicable to data brokers, and these are important third parties who are not service providers. There should be a fiduciary duty to individuals if data processors act as intermediaries between individuals and data collectors. This would ensure that such service providers only use personal information entrusted to them for the purpose intended by the individuals.

This bill does not provide the right to disposal with respect to search engines' indexing of personal information where it could cause harm to the individual's privacy or reputation. It does not include the language that was in PIPEDA regarding individual access where it provides an account of third parties to which personal information about an individual or an organization has been disclosed. There should be an attempt that is as specific as possible.

This bill does not include the right of individuals to express their points of view to a human who can intervene or to contest decisions. When we look at AI or how algorithms are working in society today, they are inherently flawed.

In fact, there is another study that I would reference, titled “AI Oversight, Accountability and Protecting Human Rights”, which has commentary on this. This was authored by a series of subject matter experts who gave a long list of needs for adequate public consultation and proper oversight of AIDI to effectively regulate the AI market in Canada.

The commissioner needs to be an independent agent of Parliament. We need to empower an independent tribunal to administer penalties in the event of a contravention, and we need to outline the best practices for auditing and enforcing the law. There are dozens of recommendations contained in both reports that, as New Democrats, we will be presenting to the government at the appropriate time at committee.

It is clear, from the body of the preliminary work that has been done, that this bill is inadequate as it stands. It is too big to adequately cover AI and consumer protections. It has always been our belief that those should be split up. That way we can have an investigation to ensure that consumer protections are met, that surveillance capital does not continue to profit off our most personal information and data and that, ultimately, we have safeguards with a robust and very firm platform on which these organizations, businesses, companies, and in some instances foreign countries, are held to account when they violate our rules.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I would like to thank my friend from Hamilton Centre. I see him all the time in our town, and we serve together on the Standing Committee for Access to Information, Privacy and Ethics.

I would ask whether he thinks there is urgency to this legislation, given the fast pace that this technology develops and that companies are using it to develop what can sometimes be invasive and can violate the privacy of Canadians.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, it is clear that Moore's law has extrapolated over the inaction of the Liberal government for the last eight years. We absolutely should have moved on this. However, we need to do it right. It is important that we do not put a piecemeal effort forward to try to keep up with technology that has surpassed our grasps.

There are subject matter experts who know this material better than we do. We need to have an engagement with them at committee, and we need to be able to provide independent safeguards so that when violations happen the legislation actually has teeth to address it.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, I am curious if the member would expand a little more on the artificial intelligence section of this bill.

Our reading of the bill is basically that the government has this vague definition of what artificial intelligence is and that it does not really know, but we should trust the government. The minister will define it all in regulation, will enforce the regulation, will investigate if one has broken that regulation and will impose fines on that regulation without ever having to go to Parliament to decide anything. Therefore, he is going to be judge, jury and executioner on artificial intelligence and on something the government has not defined.

I wonder if the member would comment on that.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, that is an important question. Bill C-27 needs consistent, technologically neutral and future-proof definitions both to the consumer privacy protection act and the AIDA within Bill C-27. It should provide definitions for AI or algorithmic systems that are cohesive across both laws, and the definition for AI ought to be technologically neutral and future-proof. That is the question I just answered for the previous speaker. A potential pathway for regulation is to define algorithmic systems based on their applications, instead of focusing on the various techniques associated with machine learning and AI.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, I appreciated hearing the member for Hamilton Centre's speech on Bill C-27. I would like to hear more from him, in particular on subclause 18(3). This section talks about a legitimate interest for an organization to collect a person's private information without consent.

There have been concerns shared here with respect to how open-ended this legitimate interest could be. I wonder if the member would reflect and share more about his concerns, if any, with the way the bill is currently written.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, that is also an important question, because I think what the member did not reference, which I will reference specifically, are the instances where governments used this information.

I think that informed consent is an inherent right to privacy and protection. The AIDA must apply to government institutions, given that the AIDA only currently applies to the federal private sector, as government institutions are explicitly exempt from this. It is imperative that the AIDA's framework be brought in to include government institutions.

Let us be very clear. Individuals ought to always have informed consent about where their information and data go. There ought not to be situations, outside of warrants expressed through our legal system, that allow for the collection, maintenance and distribution of personal information online.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, at the beginning of his speech, my colleague talked about the progress Quebec has made with Bill 25.

Bill C-27 appears to provide some protection or at least not go against Bill 25, but there is no real guarantee.

Does my colleague think that this is one of the changes that should be made to ensure that Bill 25 in Quebec is not hindered by Bill C-27 and that, instead, these laws complement one another?

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, while I have a growing appreciation for the Bloc's propensity to be here as representatives of the Quebec legislator, I am not here in that capacity.

Any legislation we put forward does have international ramifications that must be met in terms of the international standards related to the protection and collection of data.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, I want to use my speaking time in the House to note that today is the 85th day of the blockade of the Lachin corridor. This blockade has left 120,000 Armenians in Nagorno-Karabakh without access to health care, food and medication. This situation has been denounced by the European Parliament, by Amnesty International and, last week, by the International Court of Justice. I urge the federal government to do more and apply pressure to ensure that these 120,000 Armenians can have access to food and to prevent a humanitarian crisis.

I am pleased to rise in the House today to speak to Bill C-27, an act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts.

This bill includes many things and covers many topics. I want to begin with the part on artificial intelligence. The NDP was a bit concerned by the fact that in the wake of Bill C‑11, this whole new part on the Artificial Intelligence and Data Act was added to Bill C‑27. We think this is a separate issue that needs to be dealt with separately. It is a huge topic in and of itself. We are pleased that the bill is being split so that we can study it in two parts.

In my riding, Rosemont—La Petite-Patrie, there is a burgeoning AI hub that provides jobs for hundreds, maybe even thousands, of professionals. I have met people who were a little worried about the federal government being kind of hasty in dealing with an issue as complex as AI. They are particularly worried about the fact that the U.S. and the EU have laws and regulations already. They think we need to take the time to make sure Canada's regulations are compatible with what is being done elsewhere, with our trading partners and our competitors, just so that it will be easier to attract talent down the line and get these professionals to go work in Montreal, Toronto, Vancouver and other places in Quebec and Canada. They want to avoid the kind of incompatibility that could result in unnecessary obstacles.

With respect to the protection of personal information, I believe that, sadly, a string of scandals has made people aware of this issue, and they realize that our laws and regulations must be updated and adapted. Consider the personal information and data breaches and the problems this causes for people. I will quickly mention a few examples. The problems with Yahoo, Marriott, and Mouvement Desjardins in Quebec, as well as Facebook, all revealed the need for new measures to help victims who have had data and their personal information stolen in several countries. We need only think of the 2019 settlement in the U.S. for the Equifax data breach. It is quite significant, given that Equifax is one of the largest companies people rely on for their credit score so they can make purchases or borrow money. This is not trivial.

Here, in 2019, the Office of the Privacy Commissioner of Canada found that Equifax fell short of its obligations to Canadians and Quebeckers. He then had the company sign a compliance agreement that did not require the payment of any fines or damages for Quebec or Canadian victims. This happened just a few years ago and clearly demonstrates just how outdated Canada's legislation is.

That is why the NDP will be supporting Bill C-27 at second reading. We think it is important that the bill be sent to committee, because we see all the cracks and gaps currently in the bill. It is important that the Office of the Privacy Commissioner be strengthened to bolster enforcement measures to protect consumers and Canadians. Bill C-27 needs to be amended to improve things. There are some shortcomings in this bill. There is even some backsliding in relation to Bill C-11, its predecessor in the previous Parliament, before the last election.

Privacy concerns everyone. In a digital world where social media and online entities are taking up more and more space, we have to remember that, although it is nice to use them sometimes—and they can be of great service—we are the ones who have become the product. Our personal information is the source of huge profits, and we need to be aware of that.

Our information is used to target the advertising we see on our devices when we go to websites. That targeting is based on our personal choices, preferences and searches. Big corporations create profiles and use them to sell advertising. We are the product. These companies make money off the information we give them for free. I have met people who had an interesting suggestion. Maybe these companies should pay us because we are their source of profit. They make money off the targeted advertising they sell, and that is how they plump up their bottom line.

We need to modernize our privacy protection laws. We also need to start thinking about the implications of handing over so much information about our consumer behaviour, our travel patterns, our interests and everything we search for online. We have to prompt people to think about that.

The bill is interesting because it creates a lot of new regulations and a new tribunal. The NDP thinks that is a good thing, but the bill does not go far enough. For example, the bill sets out a private right of action for individuals, but it does not really make it possible for consumers who have fallen victim to privacy breaches to be compensated, unlike what is being done in the United States. This right comes with various rather ineffective stipulations, so although there are new provisions, like this new tribunal, the bill provides for very little recourse.

A few years ago, the NDP published a digital bill of rights for Canadians. In it, we called for new, more effective provisions on consent and the sustainability of data. We called for the government to give the commissioner order powers and to impose larger and more consequential monetary penalties. We also called for transparency with regard to algorithms and more protection against abuse.

I think that the government could draw inspiration from the NDP's digital bill of rights to amend, enhance and improve the bill before us today. Once again, I have to say that this bill takes half steps because it proposes half-measures. There are some rather interesting measures in this bill, but they do not go far enough.

For example, there is still a significant imbalance between commercial interests and individual rights. Unfortunately, the Liberals are still in the habit of putting commercial interests ahead of the rights of citizens. For example, the new preamble of Bill C‑27 tries to present privacy as an individual interest tied to fundamental rights, but still does not directly recognize that privacy is not just an essential aspect of fundamental rights, but a fundamental right in and of itself. It considers the right to privacy to be part of Canadian norms and values, rather than a fundamental right. I think this part of the preamble of the bill should be changed.

There is also some backsliding. Under Bill C‑27, individuals would have less control over the collection, use and disclosure of their personal data, even less than what was proposed in Bill C‑11, which was introduced during the last Parliament. That is really the crux of the matter. If we do not have control over the information we provide or the way it is used or shared, it will be a wild west, total chaos. That is what we are seeing now, in fact. This is a step backwards, and I think that the NDP will be proposing amendments to restore this balance.

Under the bill, information that has been de-identified is still personal information, with some exceptions. There are quite a few exceptions, including in clauses 20 and 21, subclauses 22(1) and 39(1), and the list goes on and on. Roughly a dozen clauses contain multiple exceptions, so it gets extremely complex and confusing. It seems to me that this is going to give big corporations and web giants a way out, through loopholes and back doors. They will be able to do whatever they want because of this list of exceptions.

We in the NDP will be supporting the bill at second reading, but there is still a lot of work to be done to improve the bill.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, certainly from the Conservative side and from the NDP, it seems like we are on the same page when it comes to looking at privacy, protecting privacy and stating that privacy should be a fundamental right, not only in the preamble but also in the clause statement. The clause statement is very important because that is what the bill is derived from. The definition of privacy and fundamental rights then goes throughout the rest of Bill C-27.

One example that came out this week was of our children using a game called Fortnite. There are a lot of other games children spend a lot of time on sometimes, but Fortnite was found to be in breach of error in the U.S. for exploiting our children, taking their data and selling that. Can the member please answer for me how important it is not only to protect our adult fundamental right to freedom, but also our children's fundamental right to freedom?

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, I thank my colleague for his question, because it is really important. I am not saying that just because I have teenagers at home. We also see the dangers of social media and the fact that young people's privacy or personal information can be exploited. In that regard, once again, Bill C‑27 does not go far enough.

Bill C‑27 includes an interpretation clause stating that the personal information of minors is considered to be sensitive information. However, in the current bill, there is no definition or explicit direction as to what constitutes sensitive information. Once again, the work is only half done. What exactly does “sensitive information” mean when we are talking about information on a minor, someone under 18 years of age?

We will have to move amendments to make this much clearer.

[Monique Pauzé, Bloc, Repentigny, QC]

Madam Speaker, I thank my colleague from Rosemont—La Petite-Patrie for his speech. This is not a subject I know very well, but I am making progress.

I would like to remind everyone, however, that Canada is a digital wild west. There was no legislation that interfered with the commercial interests of these organizations.

In essence, Bill C‑27 is a response to European legislation. Without Bill C‑27, Canada would likely not be meeting the European Union's expectations. The financial community is applying pressure because it is under stress.

My question is going to cast a much wider net. What does my colleague think about the complacency of successive Canadian governments? I am talking about complacency in all sorts of other areas too, including transportation safety, cybersecurity and the environment. What does my colleague think about that?

The Canadian government is always forced to take action when it is pressured by the financial community or other countries.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, I thank my colleague from Repentigny for her question, which gives me an opportunity to talk about the laissez-faire approach that has been taken. There were years of neo-liberalism where private corporations reigned. The government let them do pretty much whatever they wanted. I think that the progressive forces and the left, in general, always need to be there to push our governments to do more to have more regulatory frameworks to keep people safe, for example.

Today, we are talking about the security of personal data, but we could also talk about rail safety. Think about Lac-Mégantic. The railway companies are inspecting themselves, to see if they meet the standards. I do not think it is responsible for a government or a society to allow these big corporations to supervise themselves, to do their own inspections and then to say that they did everything right, when they tend to cut corners to make a profit.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I wonder if the member could provide his thoughts in regard to his critique of the legislation, when he said that there are many things missing.

A number of the things the member refers to could easily be done through regulation. The legislation sets in place a very substantial framework, which is there to protect the privacy of Canadians, and a number of things that have been raised already this morning could be done through regulation. In fact, many would argue they might be best done in regulation.

[Alexandre Boulerice, NDP, Rosemont—La Petite-Patrie, QC]

Madam Speaker, when we hear that certain things can be done through regulation, that calls for a bit of a leap of faith. The bill needs to have clear guidelines and provide specific direction so that the regulations can then be coherent and consistent. It is not good enough to say that things will be done correctly later through regulation.

For instance, the current Bill C‑27 contains no guarantee that when someone asks for their data to be destroyed, it will actually be destroyed and stay that way for any length of time. We will have to work on this to ensure that the regulations really do help Canadians.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is a pleasure to rise to speak to Bill C-27 today. As I put forward to my friend in the form of a question, when we think of Bill C-27, I like to think that the government is on the right track in continuing to protect the privacy of Canadians in many different ways. Yesterday we had a debate on Bill C-26 on cybersecurity.

If we take a holistic look at what the government has been able to accomplish through legislation and, ultimately, in certain areas in terms of developing the industry through budgetary measures, Canada is indeed in a very good position in comparison to our peer countries around the world. I do not say that lightly, because I know that all members are very concerned about the issue of privacy. That is in good part why we have the legislation today.

The last time these changes we are proposing happened was two decades ago. Let us reflect on that time of 20 years ago. We did not have iPhones, and Facebook did not exist. Going back a little further than that to when I was first elected, when one clicked into the Internet, the first thing one heard was a buzzing sound, the dial tone and then clicking. Then one was magically connected to the world. How far we have advanced in a relatively short period of time. Last week, I was on the Internet making a purchase that would be delivered. I never had to go to the store. It involved my doing a little bit of design work on the computer before making the purchase. I was told yesterday that it was delivered to my home.

The amount of information out there is absolutely incredible, and it is very hard to imagine the types of data and the risk factors out there. That is why it is so important that, as a government, we bring forward substantive legislation that is going to protect the privacy of Canadians, to ensure companies are held accountable and, in the context of yesterday's debate, to protect them from security threats that are very strong and very viable. It was interesting yesterday listening to the debate for a number of hours.

I get the sense that a wide spectrum of support is shaping up today. The NDP is supporting the legislation. My understanding is that the Conservatives are supporting the legislation. The Bloc, in principle, is supporting the legislation. The Province of Quebec has actually made some significant gains on this whole front, so I am not surprised that the Bloc or members from Quebec within the Liberal caucus are very strong about these issues, whether they are cybersecurity issues or the privacy issues of Bill C-27 that we are debating today.

I raise this because I believe that it does not matter what side of the House one happens to sit on, as this is legislation worth supporting. As I indicated, it has been 20 years since we have seen substantial changes to the legislation. The expectation is very high that we will not only introduce the legislation but that, with the cooperation of members opposite, we will see it pass through in a timely fashion.

Being an optimist, I would like to see the bill pass before the summer, and it is possible. I realize that it would require a great deal of co-operation from opposition parties, but I do believe it is doable, especially after the comments I heard this morning.

The legislation is not meant to address every matter that Canadians are having to face in the digital world. That is not what it is designed for. As I indicated, the legislation, whether this one or Bill C-26, goes a long way in establishing a solid base for a framework that would enable the government of the day, which is held accountable by the opposition, to have the opportunity to do a lot of work in an area where we need to see a higher sense of security and protection.

One member across the way asked about engagement. There has been a great deal of engagement. I can assure the member that, whether it is from a constituency perspective, a ministerial perspective or, I would even suggest, the member would have to take some credit in terms of an opposition perspective, there has been a great deal of dialogue. This is not a new issue. This issue has been in the making for years now.

There have been some factors that are beyond the government's control in terms of the manner in which it can bring forward legislation, for example the worldwide pandemic and the requirement for substantial legislation in order to support Canadians and have their backs. There were issues of that nature, along with numerous other pieces of legislation. I would not want to give a false impression that this is not an important issue for the Government of Canada.

At the end of the day, based on comments I have heard on both Bill C-26 and Bill C-27, I believe the legislation would establish a solid footing or framework, whatever terminology we might want to use, and, at the very least, we should see it go to committee. The principles of the legislation are in fact endorsed and supported by all sides of the House, from what I can tell, and please correct me if I am wrong. No doubt we will have other legislation that might be somewhat more controversial, where there is real opposition to the legislation, and this would enable more time for debate on that type of legislation.

If we could somehow recognize the value of this legislation, given that there is so much support for its principles, we would allow it to go to committee, where members of Parliament are afforded the opportunity to get into the nuts and bolts, the details, where there is representation from different stakeholders at committee to express their thoughts and opinions on the legislation, and where members can find out directly from the minister what kind of consultation has taken place. The member does not to have to take my word for it, but I can assure him that there has been a great deal of consultation. He would be able to hear that first-hand from departmental officials, the minister and so forth.

I believe the government has done its work in bringing the legislation to the point where it is today. We have seen ministers, in their opening remarks and in their response to questions, in co-operation with opposition members. The government has demonstrated very clearly in the past that it is open to amendments that can improve upon legislation for the benefit of Canadians, and if there are ways we can improve this legislation, we will accept those types of amendments. We will support those types of amendments. I believe this is one of the areas where the Prime Minister has been very good in sending that message. It could be because of years in opposition, when the opposition never had amendments accepted by former prime minister Stephen Harper.

At the end of the day, if there are ways to do it, we can improve upon this bill. I heard yesterday on Bill C-26, and already today on Bill C-27, that members have genuine concerns. I do not question those concerns, but I do believe that it would be helpful if they can look at those concerns. If they already have ideas that they believe will improve the legislation, nothing prevents members of the opposition or government members from being able to provide those amendments or thoughts in advance to the ministry, which would potentially allow for a deeper look into it to see if, in fact, something is doable.

The NDP talked, for example, about digital rights for Canadians. There is a great deal of concern that we need to ensure and recognize them, whether they are consumer rights or privacy rights. These are things we all hold very close to our hearts. We all want to make sure the interests of Canadians are being served.

When I took a look at the specifics of the legislation, I highlighted three parts I wanted to make reference to. CPPA would strengthen privacy enforcement and oversight in a manner that is similar to that of certain provinces and some of Canada's foreign trading partners. It is important that we do not just look internally. There are jurisdictions, whether nations or provincial entities, that have already done some fine work in this area. We do not have to reinvent the wheel, and working with or looking at other forms of legislation that are there is a very positive thing. In particular, the CPPA would do so by granting the Privacy Commissioner of Canada order-making powers that can compel organizations to stop certain improper activities or uses of personal information and order organizations to preserve information relevant to an OPC investigation.

This is significant. We need to think in terms of the technology that I make reference to. I can remember a number of years back when a pizza store was becoming computerized. As someone called in and made an order, they recorded the telephone number, the name and the address, personal information such as that. I remember talking to the franchise owner, whom I happen to know quite well, explaining how the collection of data, if used appropriately, can not only complement the business, but also complement the consumer, and this was maybe 20 years ago.

We can contrast that to an iPhone and looking at some of those applications we see. The one that comes to mind is a true Canadian application and a true Canadian franchise: Tim Hortons. My wife never followed hockey, but nowadays she does because of Tim Hortons. One can win free cups of coffee by picking who is going to score goals or get assists. I am not exactly sure how it works, but Tim Hortons comes up with a program that is actually collecting data from people. It is a program that allows it to send out all kinds of notifications. It could be sales of product. It could be something like NHL standings. It really engages the consumers. An incredible amount of data is actually being collected.

Tim Hortons is not alone. One can go to virtually all the major franchises and find the same thing. It is not just the private sector. Yesterday we were talking about cybersecurity, and one can easily understand and appreciate the sensitivity of collecting information, even if one is a Tim Hortons or a Home Depot, but also many government agencies. For example, there is the amount of personal information Manitoba Health has, which is all computerized. There are also doctors' offices. The digital world, in a very real and tangible way, has changed to such a degree that many, including myself, would argue that things like Internet access have become an absolute and essential service nowadays. It is something we all require.

The incredible growth of data banks, both in the private sector and in the government, and I would throw in the non-profits and the many other groups that collect data, has been substantive in the last 15 or 20 years. That is the reason why today we have the type of legislation we have before us. Bill C-27 would ensure that we have something in place to provide consequences for offences. To give members a sense of those consequences, the new law would enable administrative monetary penalties for serious contraventions of the law, subject to a maximum penalty of 3% or $10 million of an organization's global revenue, whichever is greater, and fines of up to 5% of revenues or $25 million, whichever is greater, for the most serious offences.

I said I wanted to highlight three things, so I will move on to the second point. The personal information and data protection tribunal act would establish a new tribunal, which would be responsible for determining whether to assign administrative monetary penalties that are recommended by the Privacy Commissioner following investigations, determining the amount of penalties and hearing appeals of the Privacy Commissioner's orders and decisions. The tribunal would provide for access to justice and contribute to further development of privacy expertise by providing expeditious reviews of the Privacy Commissioner's orders.

The third point is that the AIDA would impose a duty to act responsibly by requiring organizations designing, developing, deploying or operating high-impact artificial intelligence technologies to put in place measures to proactively mitigate risks of harm and bias in the development of these technologies.

I have less than a minute left to talk, and I have not even touched on the AI file. I made reference at the very beginning to the financial investments of this government in encouraging the growth of that industry in the different regions of our country. The Government of Canada is not only bringing in the type of securities that are absolutely important for Canadians from a privacy perspective, to encourage continual growth in the area and have these protections in place, but also doing so through budgetary measures to ensure that we continue to enhance the opportunities of Canadians. If we take a look at the digital world today, it is very hard to imagine where it is going to be tomorrow, at least for myself, in witnessing the growth of the digital world over the last 20 or 30 years and how far it has gone.

This legislation is a modernization. It is legislation we can all get behind and support. I would encourage members, no matter what party they are from, to support it. Let us see it go to committee, where the committee can do its fine work and see if we can even improve—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Questions and comments, the hon. member for Saskatoon West.

[Brad Redekopp, Conservative, Saskatoon West, SK]

Madam Speaker, certainly this is important legislation and it is quite needed in our country to get a handle on the protection of people's privacy and, as the member was just speaking about, artificial intelligence.

One question I have for the member relates to the area of regulations. There is so much in this legislation that is dependent upon future regulations that would be written. I am just wondering why those regulations were not presented with this legislation and, failing that, when we can expect to see the regulations. So much of what is being talked about here really depends on how it is implemented through the regulations.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, that is one of the reasons it is important, once the bill gets to committee, that members have the opportunity to get a better sense of the types of regulations that would be put into place to support the legislation.

There is another way of looking at it. When we have legislation such as that which is being presented and going into committee, members on all sides of the House have the opportunity to be able to express their thoughts and concerns with respect to the legislation even before regulations have been drafted. I would not want to give the impression to the member opposite that we have a pile of regulations and the moment that the legislation passes these regulations would be put into place. I suspect that there is a lot of fine tuning going on.

[Monique Pauzé, Bloc, Repentigny, QC]

Madam Speaker, I thank my colleague for his speech. He appears to have extensive knowledge of almost every issue.

The protection of personal information is a shared jurisdiction in Canada. Bill C-27 should therefore not apply in provinces that have protections as stringent as those included in the bill.

The legislation passed by the Quebec National Assembly, in February 2021 I believe, is strong legislation. Can my colleague reassure us that Quebec businesses are indeed excluded from the federal legislation?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

The bill is aligned closely with approaches in other jurisdictions, both in Canada and internationally. The CPPA does not apply in jurisdictions where the provincial law is deemed substantially similar, which is likely to include provinces like Quebec.

It is important to recognize that the national government does have, which this legislation clearly shows, a responsibility and we are living up to that responsibility. That is one of the reasons we need to look at the regulations, as I made reference to in the previous question. However, I do not believe that there would be the overlap that would cause issues in Quebec or B.C. or any other jurisdiction.

[Matthew Green, NDP, Hamilton Centre, ON]

Madam Speaker, the hon. member spoke at length about administrative tribunals being a way in which people can access justice as it relates to their appeals processes and so on, but yet, this is in direct contradiction to the Office of the Privacy Commissioner, who is clearly opposed to the creation of a new personal information and data protection tribunal, citing it would be unnecessary to achieve greater accountability and fairness and counterproductive in achieving quick and effective remedies. In fact, the OPCC states that adding a new level of appeals delays would delay resolutions of cases, especially when the power to impose monetary penalties is limited to the tribunal.

I wonder if the hon. member could comment on how the OPCC argues that the system proposed under Bill C-11 encourages organizations to use the appeals process rather than to seek common ground with the OPCC when it is about to render an unfavourable decision.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, sometimes one needs to agree to disagree. I look at the tribunal as something that is to the benefit of Canadians. It is an opportunity to ultimately seek fairer justice. At the end of the day, I suspect and hope that it will ultimately prevail. Perhaps there are ways in which the member can enhance or put in something that might deal with his concerns, if not directly then indirectly, but it is important that we keep the tribunal.

[Chandra Arya, Liberal, Nepean, ON]

Madam Speaker, this is long overdue. The current privacy laws were drafted 20 years back when iPhone and Facebook were not in existence. Advanced technologies like artificial intelligence are ever evolving. They are almost getting changed on an everyday basis. Does the member agree with defining things like artificial intelligence in the legislation and casting it in the legislation so that it becomes inflexible; or would it instead be better that we have regulations which would be more flexible, that would allow the ministers and the government of the day to make changes as may be required, as and when the technologies advance?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, I think that the hon. member's overall assessment of the situation, when it comes to AI, is accurate. That is one of the reasons why, whether it was in the question that I had put forward a little bit earlier this morning or in my statement, the rapid change that we are seeing in the digital world is going to continue to be greatly enhanced through AI.

I think that having what we have proposed within the legislation and allowing for regulation is by far the best way to go.

I do not live in fear of AI. I think that AI is going to improve the quality of life for Canadians and people around the world.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, I believe I heard the member for Winnipeg North say in his presentation that the Conservatives were supporting the bill. That is incorrect. We are opposing the bill, not that we oppose the modernization. It is needed, but this bill is inadequate.

There are many reasons but the primary reason is that it does not put personal privacy interests above those of business interests. In the “purpose” section of clause 5 in the bill, it says that, basically, they are of equal weight.

Further on, in subclause 18(3), the bill says that a legitimate interest of a business, determined by a business, is a reason that a business can use one's data without one's permission, in a way that they did not get permission for.

That is one of the fundamental flaws in the bill, in terms of the idea that personal information, mine or anyone's, is mine and should be paramount and superior to that of the business. The business is there just to serve my interest, not of equal value.

I would like the hon. member to comment on that.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, that is why I was reflecting on Bill C-26. If we look at the debate that took place yesterday on cybersecurity, dealing with the digital world, at the end of the day, Conservative member after member was standing up saying that, yes, they were going to support the bill but that they had a lot of problems with the legislation, and that the principle of Bill C-26 is something that they support.

I kind of made a leap, and apparently the wrong leap, by seeing the Conservatives, in principle, support the privacy of Canadians and the legislation that will give an enhanced privacy legislation. I guess I should not have made that particular leap.

Inconsistency from the Conservative caucus is fairly well known. I will try my best not to make that sort of mistake going forward.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, my colleague has shown that he is quite open to the possibility of amending the bill.

Amending a bill and passing it is not something that is done lightly. I do not need to tell anyone that. Issues must be studied in depth, which most parliamentarians do not do when the issue is artificial intelligence. We must also make comparisons with international standards so that we can draw inspiration from best practices.

Does the government intend to allow parliamentarians to study the bill in detail, or will it silence them with time allocation given the urgency we sense in their tone and their desire to pass the legislation?

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, I said, at the very beginning of my comments, how wonderful it would be if, somehow, we could pass this bill before summer comes. I suspect that was maybe a little optimistic. Hopefully we can do it before the end of the year.

The government needs to get a sense of co-operation from at least one opposition party and we are hopeful that there will be more.

It would be nice to have that unanimous type of consent moving forward. I would have thought that the principles of the legislation should at least allow us to get it to the committee stage, where the member herself makes reference to how there are some possible changes and it is important that the government be open to ideas.

That is why I said that if there are specific ideas—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Resuming debate, the hon. member for Saskatoon West.

[Brad Redekopp, Conservative, Saskatoon West, SK]

Madam Speaker, it is a privilege to rise in this House.

Another day, another debate about an NDP-Liberal piece of legislation about Internet freedom in Canada. The good folks on the west side of Saskatoon have heard me speak in this place about Bill C-11 and Bill C-18, two bills aimed at controlling what Canadians see and post on the Internet.

Today we are dealing with Bill C-27, which is aimed at protecting the online data of Canadians. This legislation is meant to put safeguards around the use of artificial intelligence and establish rules around Internet privacy. Sounds good, sounds noble and sounds like something we should support. To a certain degree I do support these initiatives.

However, I have deep reservations with this legislation as it exempts the Government of Canada from these very safeguards. Do we as Canadians need the protections in this bill from companies? Absolutely, but we also need protections from government, especially this NDP-Liberal coalition government that wants to take away some of our liberties and freedoms.

Some on the other side may accuse me of fearmongering about the NDP-Liberal suppression of civil liberties and freedoms on the Internet; I am not. Let me lay out the facts, and the people in Saskatoon West can decide for themselves.

Bill C-11 is the first piece of legislation meant to strip of us of our rights to free speech on the Internet. Conservatives such as myself and free speech advocates have been warning that the provisions put in place by the NDP-Liberals to have government-appointed gatekeepers decide what is acceptable speech or not in Canada will lead to disaster.

We have already seen that a prominent University of Toronto professor has been threatened with the revocation of his licence and livelihood for tweeting out against this legislation and the current Prime Minister. Imagine what would happen when the Prime Minister has the full weight of the law to simply muzzle this type of speech. Anyone who disagrees with him would be silenced and would be fined, lose their livelihood, and what is next, go to a re-education camp? We all know about the Prime Minister’s fondness for the basic dictatorship of the People’s Republic of China, heck, he does not even mind if the People's Republic of China funnels money to his family foundation and tilts elections towards the Liberal Party of Canada in this country.

How about the second piece of legislation meant to limit our Internet freedoms, Bill C-18? That legislation allows government-appointed gatekeepers to decide what is or is not news in Canada, and forces private companies to block content they do not like from their feeds and search engines.

If there is a story critical of the NDP-Liberal coalition and the Prime Minister, they call it fake news and ban it. If there is another fawning story by Andrew Coyne in The Globe and Mail about the Trudeau Foundation and the Chinese Communist Party, it is forced to the top of everyone’s news feed and search engine, like it or not.

When I spoke about Bill C-18 in December I warned of the consequences that this legislation would have. Specifically, I mentioned conversations I had with Google and Amazon Web Services and the impact on how they deliver services to Canadians. Google flat out told me it would simply get out of the business of delivering any and all news to Canadians as it did not want to become an instrument of the Canadian government to spread partisan messaging for the party in power. Just last month it began beta testing how it could shut down its news services for Canadians.

We need a 21st century solution to this problem, not one based on ideas from 40 years ago. Bill C-27 is supposed to protect people’s data from corporations. We need that but what we need, as well, is protection from this NDP-Liberal government when it comes to privacy.

Bill C-27 completely fails us in that area. The government has dragged its heels on Internet privacy for years, and unfortunately it has been a pattern to consistently breach our digital privacy rights. We saw it when the government waited until just last year to ban Chinese telecom giant Huawei from operating in Canada while other countries did the right thing years before us.

We saw it with the $54 million “arrive scam” app tracking Canadians border travel up until September 30, and the public bank account freezing for people who donated to the truckers last year. The list goes on and on. In the words of Alanis Morissette, “Isn’t it ironic?” when we hear the government start to talk about online privacy rights. I just hope it learns to start respecting the privacy of Canadians.

Let us take a look and see if this legislation actually protects the online privacy of the people of Saskatoon West. After all, they are rightfully distrustful of government and corporations when it comes to accessing their data

Here are some examples showing why they are distrustful: Tim Hortons tracking the movement of users after they have ordered something on their app; the RCMP using Clearview AI to access a data bank of more than three billion photos pulled from websites without user consent; and we cannot forget Telus giving the federal government access to the movements of over 33 million devices over the course of the pandemic.

When governments abuse their power, it destroys the level of faith Canadians have in their institutions. In fact, if we look at polling data, we see that the number of Canadians that have faith in their government is at an all-time low. With scandals like these, it is no wonder why.

If we want to improve the level of trust held between individuals and institutions, we must look at protecting Canadians' private data. If we dive into this legislation, it seems the intent is to create a level playing field between citizens and companies when it comes to how their data is used. However, if we look into it further, the balance between businesses using business data and the protection of our privacy is off.

The bill, as it is currently written, skews toward the interests of corporations rather than the fundamental rights of individuals. There are too many exceptions granted to businesses in this legislation. Some are so broad that it is like the legislation never existed at all.

For example, business activities are exempt if a “reasonable person” would expect a business to use their data, without including the definition of what a reasonable person is. The concept of legitimate business interests has been added as an exemption to consent. How does one determine if a business interest outweighs the privacy rights of an individual? Finally, the bill does not recognize privacy as a fundamental right. This absence tips the scales away from Canadians and could affect how their privacy interests are weighed against commercial interests in the future.

Artificial intelligence comprises a major component of this legislation. AI is becoming a key tool in today's world, much like engineering was in the last century. In the past, an engineer would sit down and design a bridge, for example. Obviously, the failure of a bridge would be a huge event with the potential for major disruptions, significant costs, potential injuries and even death. Therefore, we have professional standards for engineers who build bridges, but what about artificial intelligence?

In today's modern world, AI is used more and more to perform ever more complex tasks. In its early stages, AI was used as a shortcut for repetitive tasks, but as the technology advances, it is now being used for much more. In the future, it is not unreasonable to expect AI to play a significant role in designing a bridge, for example. Artificial intelligence also needs to have standards, which is why our universities teaching AI put a big emphasis on ethics, as there are huge implications.

I know first-hand the dangers of unregulated AI systems interfering in our day-to-day lives. On the immigration committee, we have studied this issue and looked at how Canada's immigration department is using Chinook, a so-called e-tool to help IRCC bureaucrats assess applications in bulk form. This AI program was introduced in-house by these bureaucrats, which means the software's algorithms are beholden to the beliefs of its creators.

The concerning part of all of this is that there is a known culture of racism within the department, and members do not have to take my word for it. The NDP-Liberal Minister of Immigration said this of his own department at committee: The IRCC “has zero tolerance for racism, discrimination or harassment of any kind. However, we know that these problems exist throughout the public service and in our department...[and] we must first acknowledge this reality.”

There were no outside consultations done on the use or creation of this artificial intelligence application, and rejection rates have climbed since its introduction. Although I am pleased that the government is finally looking to add a framework to address concerns surrounding AI, it needs to get its own house in order first.

I will wrap up with these final thoughts.

If we are going to address concerns surrounding our digital privacy, we must listen to Canadians, and many Canadians are worried that this legislation does not protect them. I have met with Bryan Short from OpenMedia, and he said this:

Bill C-27...only plays brief lip service to privacy being a fundamental human right in its preamble; Bill C-27 fails to do the more important task of inscribing the privacy rights of people as being more important than the business interests of companies.

The bill before us is supposed to be about protecting Canadians' privacy, yet it completely avoids inscribing privacy as a fundamental right. We all know the saying “There is no point in doing something unless you do it right”, and it is quite clear that the government needs to go back to the drawing board once again on some aspects of this legislation since there is not much evidence of it consulting Canadians on how their data was actually used.

I believe the former Ontario privacy commissioner, Ann Cavoukian, said it best in 2020 during the initial Liberal attempts to bring in privacy reform to Canada when she stated:

[With] the Liberals under [the Prime Minister], it's been extremely weak. They have not addressed repeated requests from the federal privacy commissioner to strengthen existing privacy laws.... I'm tired of that. I want a party that will walk the talk. And I'm hoping that will be the Conservatives.

Canadians can count on the Conservative Party of Canada to walk the talk when it comes to strengthening our privacy laws, and Canadians can count on the Conservative Party of Canada to respect their freedom of expression online. We will scrap the online censorship legislation put in place by this tired, worn out, costly coalition. We will allow people to choose for themselves which news they want to consume, not just what the government wants them to see. Under our new leader, we will be the voice of those left behind by the NDP-Liberal government, and we will put Canadians back in the driver's seat of their own life.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I find it interesting that the Canadian Conservative Party has become such a champion for big tech companies. Since the member opposite brought this up even though it is not related to this legislation, does he think it is okay that Google blocked news access to hundreds of thousands of Canadians in order to strong-arm the government? Does he think Google is a paragon of virtue that will, on its own, protect Canadians' privacy rights?

[Brad Redekopp, Conservative, Saskatoon West, SK]

Madam Speaker, I have many things to say, but where to begin?

First, Google is one option. There are many other browsers that can be used. If someone does not like one of them, they can go to another. That is the beauty of the free market and companies providing services.

The other thing is that Google's response was a direct response to the government's proposed legislation. The government refuses to admit that there are consequences to what it is proposing. There are significant consequences to the government dictating what consumers in Canada can see. This will affect everybody from consumers themselves to the companies that provide content.

It is an example of the government being completely oblivious to the real implications of what it is proposing with its legislation in Bill C-11 and Bill C-18.

[Martin Champoux, Bloc, Drummond, QC]

Madam Speaker, I, too, found my colleague from Saskatoon West's comments on Bills C‑11 and C‑18 quite interesting. There will be an opportunity to return to Bill C‑11, likely later. I was particularly surprised by the comments on Bill C‑18, especially in a context where Google is currently blocking access to news content for nearly 2 million Canadians, which is no trivial matter. By the way, we still do not know why.

I have heard so much misinformation, it is outlandish. Bill C‑18 requires digital giants to negotiate agreements. It is not forcing them to do anything other than negotiate agreements to pay the companies that produce the news content they use and get rich off of. It seems quite logical to me.

The point I took the most issue with in my colleague's comments was when he said that Bill C‑18 will allow the government or the CRTC to decide what news people will be able to access online.

Since he seems to be an expert on the subject, I would like him to tell me specifically what clause of Bill C‑18 would allow the CRTC to do such a thing.

[Brad Redekopp, Conservative, Saskatoon West, SK]

Madam Speaker, we have talked a lot about Bill C-18 and Bill C-11. There have been many comments from people outside of this place, like experts in the field. Lots of different things have been said, and the reality is this. The government is going to have gatekeepers in place who will tell Canadians what they can see and what they can hear on the Internet. That is what we as Conservatives are fighting against. We do not want the government to be the one to tell Canadians what they can see, what they can read and what they can post online.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, right now, Bill C-27 does not explicitly apply to political parties. We know there have been privacy breaches and the misuse of data in the past in the political area. Does the member think this kind of legislation should be amended to include political parties?

[Brad Redekopp, Conservative, Saskatoon West, SK]

Madam Speaker, that is an interesting question. It is a good example of why this bill needs to go to committee to be studied. There are many questions that I have raised and other speakers have raised, and these are things that need to be looked at in committee. The committee is in a great place to call witnesses and to look further into some of these things.

I believe that changes need to be made to this legislation to improve it. The member's suggestion is one possible way that it could be looked at. There are many more things that could be looked at, and I believe the committee is the right place to do that.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, I think it is ironic that members of the Liberal Party, the government, are claiming some sort of aversion to big corporations. Obviously, they have not read the bill. Subclause 18(3) says:

(3) An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual

The government does not believe in the protection of personal privacy. It believes in the protection of access to data for companies.

[Brad Redekopp, Conservative, Saskatoon West, SK]

Madam Speaker, I agree with the summary of that. The government is mostly concerned about big business and the ability to use data. The Conservatives are concerned about individual Canadians and their right to privacy protection.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, last week, the federal government banned the use of the TikTok app on government devices because of data privacy concerns, so it is very appropriate for us to be discussing this matter today. Digital data privacy can be seen as a fundamental right, one that urgently requires strengthened legislation, protections and enforcement. Canadians must have the right to access and control the collection, use, monitoring, retention and disclosure of their personal data.

This is a pressing issue. Realizing that, the European Union introduced the GDPR, its General Data Protection Regulation, in 2016. EU countries were given a couple of years to adapt to this new privacy reality, with the regulation coming into effect in 2018. The GDPR has been used by many other countries as a framework for privacy protection.

With the GDPR as an example, and faced with a changing digital data universe, the government basically did nothing to protect data privacy for Canadians. Perhaps that is an unfair statement. After all, digital and online data privacy was addressed in the last Parliament under Bill C-11. The Liberals recognized that Canada needed to bring its privacy laws into the 21st century.

However, that bill was never passed. Apparently, data privacy was not a big enough issue to be made a priority, and the digital charter implementation act was scrapped in favour of an election that Canadians neither wanted nor needed. Now we are asked once again to address this subject. It is indeed better late than never. I would have hoped, though, that with the delay, the government could have improved on what it is proposing.

Perhaps if the government had moved a little faster, Canadians would not have had to question how their data was being used and how their privacy was being invaded by governments and corporations. We are left to wonder how many privacy breaches have gone undetected or unreported. The ones we know of are disturbing enough. Tim Hortons used its app to track customer movements. The RCMP used Clearview AI’s illegally created facial recognition database. Telus gave customer location data to PHAC.

It has been more than 20 years since Canada’s existing digital privacy framework, the Personal Information Protection and Electronic Documents Act, PIPEDA, was passed. With technological changes in recent years, legislation is needed to address subjects such as biometrics and artificial intelligence. We have to consider how Canadians understand the issue of consent when it comes to the use of their data and their privacy.

I am deeply concerned and disappointed with how sloppy the Liberal approach in Bill C-27, the digital charter implementation act, 2022, currently is. Privacy is a fundamental right. This bill does not mention that, despite the Supreme Court of Canada having acknowledged it. We need to clearly distinguish the extent to which Canadians’ digital privacy will be protected. If the government wants the bill to be fully effective, it needs to further explore the scope of accountability required when privacy is breached.

The clear definition of consent is a major improvement from what it once was in the Personal Information Protection and Electronics Document Act, but a good definition is only the beginning. Because technology has greatly expanded and evolved since the implementation of PIPEDA, should we not also expand the umbrella of activities that consent would cover? The large number of exemptions allowed would weaken the impact of the legislation.

Bill C-27 may be a good beginning, but I had hoped for something better. It is sad that the bill’s title is perhaps the strongest statement in the legislation. While the title gives some idea of what the legislation is all about, it is already dated. We are no longer in 2022, and the Liberals are once again falling behind.

As parliamentarians, we know the power of words and the importance of speaking in a way that can be understood by those receiving the message. It is important that legislation can be understood. It is even more crucial that the bills we pass spell out exactly what we intend.

Perhaps the most important part of any of the laws is the section that provides definitions. They need to be clear and comprehensible and not subject to differing interpretations that weaken the intent of the legislation. Legislation that allows each person to provide their own definitions is problematic. Bill C-27 uses words such as “significant impact” or “sensitive information”. I cannot help but question what is covered by these vague terms.

Before the people of Edmonton Manning sent me to represent them in the House, I was a businessman. I understood the importance of safeguarding the personal information my customers entrusted to me and not to abuse that trust. However, as we have seen, some companies make unauthorized use of the information they gather to gain a competitive edge or for profit.

With that in mind, there must be a balance between acceptable use of data by business and the fundamental protection of our privacy. It seems to me that the balance is wrong on this bill, given the way it addresses user consent and the use of collected information.

The more I read Bill C-27, which 100 pages-plus, the more questions I have. There is too much in it in need of clarification. Yes, that will be done when it goes to committee after second reading, but the government could have presented a better bill to make the committee’s work easier.

I do not want to sound too negative. I know the Liberals mean well, even if they do not seem to be able to quite understand just how important digital privacy is to Canadians in the 21st century. I am pleased therefore to see that they understand that sometimes mere words or a scolding are not enough.

It makes sense to me that the Privacy Commissioner will receive new powers to enforce violations of the consumer privacy protection act. That may be the most impactful change the legislation brings about. It is not enough to simply recommend that perpetrators stop their violations. Any parent could tell us that consequences are needed if we want to ensure improved behaviour.

With the Privacy Commissioner finally being able to force violators to conform to the rules, I think we will see increased respect and better treatment of Canadians' personal information. The harsh financial penalties for non-compliance will be a powerful motivator.

Given the amount of time the Liberals had before presenting Bill C-27, we must question why they did not come up with a better bill. They have left me, and all Canadians, asking if they really understand what their own legislation is supposed to do.

Does the consumer privacy protection act, as proposed in the bill, do enough to properly protect Canadians’ personal information? The Liberals had a chance to look at the EU’s GDPR and see how well that worked. Did they learn anything?

Would Bill C-27 improve the protection of Canadians’ personal information or are there so many exemptions for needing consent in the sharing of personal information that the words of the bill are meaningless?

Would the legislation create proper protections for Canadians’ biometric data? Given that no such protection currently exists, perhaps we should be thankful that the subject is addressed at all.

Is it reasonable to exempt security agencies and departments, such as CSE, CSIS and DND from AI regulations? How do you balance privacy and security concerns?

Canadians’ digital privacy and data needs to be properly protected. This bill is a flawed attempt to start the long overdue overhaul of Canada’s digital data privacy framework. The Conservatives will be looking at putting forward some common-sense amendments at the committee stage to ensure we have the best possible legislation.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I would like to go to the principles of the legislation, which the member just said he would like to see a series of amendments at committee.

Would the member concede that if the bill does not pass through, he will never have the opportunity to propose those amendments? It would, in essence, sabotage legislation that is substantive and that is there to protect the privacy of Canadians. There would be substantial financial consequences where there have been violations of this law.

Could he provide his thoughts on that?

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, in a previous Parliament, the government killed Bill C-11 because it wanted to have an election. It did not see the importance of that bill. Now the government is proposing a flawed bill and expecting us to support it. We will support a bill that really makes sense, a bill that will help and work for Canadians.

I do not think we have any interest in wasting time. It is up to the government to do something with its bill to make it acceptable for other parties to support it.

[Monique Pauzé, Bloc, Repentigny, QC]

Madam Speaker, I thank the member for Edmonton Manning for saying something at the start of his speech that we believe is quite important. He said that a lot of our personal data is already compromised. It is already compromised because the government was so lax before introducing legislation. It would not even have gone ahead with Bill C‑27 if it had not felt pressured by the European legislation.

Bill C‑27 does nothing to protect individuals whose data is already compromised, so does my colleague from Edmonton Manning have some ideas for amendments that would address that?

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, I did mention the European law and the fact that the government was too late at looking at it and in considering steps to bring Canadians legislation that would help and that was most needed.

I also mentioned the fact that there are a lot of vague definitions that will lead to problems for this bill to be resolved.

The government presented the bill much later than the Europeans, who presented their bill in 2016. It is 2023 now. It could have done something much faster, quicker and more mature so we could work together to provide Canadians something that is most needed.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, I want to thank the member for his recommendations on the many amendments that are needed to strengthen this bill. In particular, I am interested in one of them, which is about empowering the Privacy Commissioner. We know that this is essential if we want to protect the rights of Canadians. One way to do that would be to equip the Privacy Commissioner with the power to seek the imposition of administrative monetary penalties in a manner that would be similar to the powers that the commissioner for competition has under the Competition Act.

I would like the member to elaborate on how we must empower the Privacy Commissioner and ensure that he has the powers to enforce Canadians' privacy rights. In particular, on this issue, does he agree we need to amend this legislation?

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, I go back to the one thing I mentioned. Even these vague definitions would still be in the hands of the minister to decide after the fact, and that is one of the biggest flaws in the bill. We do not understand how the minister would handle this and whether the minister would let the commissioners play their roles and do their jobs. That is why we have to be very careful approaching the bill and examining it, especially at committee, to be able to bring forward an acceptable and effective piece of legislation.

[Mike Morrice, Green, Kitchener Centre, ON]

Madam Speaker, as it stands now, federal laws do not require federal political parties to follow the same privacy laws that apply to others across the country. This is an issue that could have been identified and addressed in Bill C-27, but it has not been. I wonder if the member for Edmonton Manning has a position on this and would he like to comment on it.

[Ziad Aboultaif, Conservative, Edmonton Manning, AB]

Madam Speaker, I did actually edge on where the federal and provincial responsibilities come on certain aspects of privacy and privacy protection. Again, the definitions come into play in understanding the legislation. That is why the government could have done much better in bringing more clarity to the bill, so we could at least study it better.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, we are here today to talk about Bill C-27. It has got a big fancy name: an act to enact the consumer privacy and protection act. I worked on this extensively as former chair of the Standing Committee on Access to Information, Privacy and Ethics. A big part of what we talked about was Canadians' privacy.

I want to lead off with a question that I think all who are watching here will want an answer to by the end of what I have said, and I hope I get there. Can we trust this government when it comes to privacy?

We have heard many accounts. We have heard of foreign interference. We have seen evidence that that has been happening under the government. We cannot even keep track of all the ethics breaches.

There was a recent article in the National Post about Canadians' data, and many folks out there would remember this, called “Canada's public health agency admits it tracked 33 million mobile devices during lockdown” and it read, “The Public Health Agency of Canada accessed data such as cell-tower location to monitor people’s activity during lockdown, it said”.

Can we trust this government? I think the answer is becoming more and more clear.

What have we done to protect consumer privacy? I was, again, part of that ethics committee. We formed an international grand committee of nine countries, representing half a billion people, where we really tried to tackle this and get to some better practices for big tech.

Cambridge Analytica was a scandal where big tech was getting our information. Many points are being collected, and 53,000 points of information is what we heard was the Facebook average amount they are collecting on us, and that is being sold to the highest bidder. It is being used to not only give us a choice on what cereal we should buy in the morning but also surveil us to make predictive behaviour so we will kind of go in the direction they want us to go.

We Conservatives saw a need to have a better, more robust policy, so I will read from our constitution, our policy, which I was part of drafting, along with many other EDAs from across the country. This is from the Conservative Party:

The Conservative Party believes digital data privacy is a fundamental right that urgently requires strengthened legislation, protections, and enforcement. Canadians must have the right to access and control collection, use, monitoring, retention, and disclosure of their personal data. International violations should receive enforcement assistance from the Canadian Government.

That is just a little snapshot of what we have been doing over here. We would hope that legislation like this would address some of those privacy concerns. What we learned and what many are hearing from this debate is that there are huge exemptions for big tech, huge ways to use consumer data in ways that, first of all, consumers do not want their information being used for, and they do not even know how their information is being used.

I am going to get into some of the critics of Bill C-27. I will read from an article today by a young man, Bryan Short, who has some concerns around Bill C-27. Referring to Bill C-27, the article says:

...this change opens the door for companies to begin describing their data collection and surveillance practices in a highly simplified manner, leaving out important details about how this information could be used to harm and discriminate against a person or group of people, and ensuring that the data broker economy continues to thrive while people in Canada’s privacy rights are pushed to the side.

Well, according to the Liberals, this is what this bill is supposed to be addressing. Here, we see simplified consent. That is something that we have supported too. It should be something that we can understand, but not to be abused in this manner, where the fine print is down here and we just check that little box to make ourselves feel good that we have done it. We feel like our data or our privacy is protected, but it really is not.

I will read on: “But with deceptive design practices already being regularly used to encourage people to click 'agree' without really understanding what they’re signing up for, Bill C-27’s weakening of consent could be a big step backwards in terms of privacy.”

I will keep reading, as I have a little bit more from this particular author. We talk about the right to request deletion, and that is part of one's data that is online.

In reference to Bill C-27, the article says, “What’s lacking is a mechanism for when people change their mind about consenting to the collection and use of their personal information, or if they’re opposed to the use of their data and consent wasn’t required at all”.

We have seen the exemptions. They are a big haul. My colleague from Edmonton just referred to those exemptions. We want some better pieces of legislation. I applaud the effort. The previous privacy commissioner Therrien was excellent in caring about Canadians' data and really pursuing a solution for it and defending Canadians. I applaud him for that.

However, I am going to go on to another critic whom I have gotten to know very well from being on the committee, and from his work in Canadian information and how important that is to protect. He is a man named Jim Balsillie, a stranger to none of us in this place and former part owner of BlackBerry. I will read from the article from the Globe and Mail called, “Privacy is central to human well-being, democracy, and a vibrant economy. So why won’t the Trudeau government take it seriously?” The article, written by Mr. Balsillie, states:

Privacy is a fundamental human right that serves as a gateway to other rights and freedoms such as freedom of expression, individual and collective autonomy, and freedom from harassment or invasion. Privacy is critical for the healthy development of the human brain, identity, close relationships and social existence.... “True realization of freedom, that is a life led autonomously, is only possible in conditions where privacy is protected.”

We absolutely agree that privacy is a fundamental human right. I will go on, as this helps explain what Mr. Balsillie is referring to in that paragraph. The article continues:

Behavioural monitoring, analysis and targeting are no longer restricted to unscrupulous social-media companies, but have spread across all sectors of the economy, including retail, finance, telecommunications, health care, entertainment, education, transportation and others.

I have told many high school classes an example of this. We learned that people's data is being monitored in real time, so when standing in front of a display at a big box store, it is known that one happens to be standing in front of a certain brand of headphones, so people should not be surprised if they get an ad for these particular headphones, and why they should buy them, before they leave the store. In a good way, it is incredible, but it is scary in other ways too with the predictive nature of having all that information.

Mr. Balsillie goes on to criticize the current Liberal government. He says:

Yet, Canada's federal government has repeatedly failed to take privacy seriously and construct a legal and regulatory framework that protects the rights of Canadians in the digital age...the Digital Charter Implementation Act, normalizes and expands surveillance and treats privacy as an obstacle to corporate profits, not as a fundamental right or even a right to effective consumer protection. After years of cozying up to Big Tech and meeting with its lobbyists as often as twice a week, the Canadian [Liberal] government is finally coming to terms with the fact that the digital economy needs to be regulated.

The act expands surveillance. It does not reduce it.

I asked initially this question: Can Canadians trust the Liberal government? The Liberals are pretty close to big tech guys. I will use the example that many have been talking about, which are smart cities. That conversation was brought up many years ago and as recently as just a few years ago. Our efforts at the ethics committee were to really push back on this invasion of privacy and that a particular smart city in Toronto, Sidewalk Labs, would have been an invasion of Canadians' information. The Sidewalk Labs project would monitor data on many levels, and it has connections to the current Liberal government. I will read from an article, which states, “Sidewalk Labs project gained support from Trudeau in 2017 call ahead of bid process”.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The member knows we cannot use the names of current members.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

My apologies, Madam Speaker. It is a title, but that was my mistake.

What is concerning about this particular article is not just that the Prime Minister supports an invasive smart city kind of concept of monitoring everything, but that it was really done in secret. The people who wanted to get to the bottom of the Prime Minister's conversation with Google and Alphabet Inc. had to get a freedom of information request to find out that the government was having secret negotiations behind the scenes.

I started off by asking a question: Can we trust the Liberal government when it comes to privacy? I think the answer is a clear no.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, if my colleague opposite does not trust the government, does he trust Google to make the rules, follow its own rules and protect Canadians' privacy that way?

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, that is a very interesting question from a Liberal member across the way. No, I do not. That is the reason we are tackling big tech, such as Facebook and Google. The invasiveness of big tech on our privacy and data is a huge concern.

Google was so linked to the current Liberal government and the former member for Vaughan was carrying the water for Sidewalk Labs. It was really something else. There were secret conversations happening to usher a Google project through. Absolutely, I do not trust it.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, as the member is aware, this bill is actually three bills packaged into one. It was the NDP that asked for a division to vote on artificial intelligence. The previous manifestations of Bill C-11 were enhanced with this bill.

What are his thoughts on the fact that this is the first time we are debating how to regulate artificial intelligence? Would it have been more appropriate to have an entirely separate process, as opposed to packing it in with two other pieces of legislation that we have done before? We have at least had some review in the chamber on one them, and they are less controversial in many respects. I would appreciate his comments on that.

I thank him for referencing Jim Balsillie, who has done a tremendous amount of work on this issue in protecting Canadians' privacy rights, which is the same as what the NDP has done. Physical rights and digital rights should be equal.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, yes, we absolutely support it being separated out. It is such a big issue to tackle, and we should tackle these things individually. They are huge issues.

As a testament to when we worked in ethics, often, across the aisle, we do not agree on things in this place, but the one thing we agreed on in our ethics committee was that we all cared about our privacy and Canadians' data. Among the Liberals across the way, there were a couple of members who were supportive of where we were going. I think, in the efforts of supporting all Canadians' right to privacy by not having our data sold and farmed out to the highest bidder, it is in our best interest to defend all Canadians' privacy in this place.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, I agree with some of the points my colleague made regarding concerns about privacy violations.

It really gets on my nerves too when I am looking at something and suddenly get bombarded with ads. We need laws to deal with that.

Here is my question for my colleague. We need a digital charter and better protection for our private data. Does my colleague think this ought to go to committee for an in-depth study so we can hear from all the relevant experts, make top-to-bottom improvements to the bill and make sure it is airtight?

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, that is a good question. The more alarming part is that we get pop-ups, and they mysteriously show up after we have been in a certain place. We can extrapolate that to include testimony we have heard at committee.

These data farms and data-mining operations know how someone will vote before they even know how they are going to vote. That is what leads us to huge concerns around being guided in certain directions to vote, which is really anti-democratic. We believe this bill needs to go back, get rewritten and done right. We have the expertise in this place. The minister across the way just needs to listen.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, we have talked about legitimate interest being an exception of a business being able to use data without permission. Another provision in the act, subsection 15(5), gives a business the ability to do implied consent, which is really consent without consent.

Can you comment on how the Liberals are in the pockets of big tech on that?

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The hon. member knows that I will not be commenting on anything.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, the evidence that the current government has been in the back pocket of big tech has been there since the member across the way, the member for Vaughan who is not here anymore, was just so obviously supporting Google in all its ambitions.

We all understand that there is interest for data. It is something we need to use, but it needs to be done with proper—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

We have to resume debate.

The hon. member for Cypress Hills—Grasslands.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Madam Speaker, it is an honour to rise once again in this place as we resume debate on Bill C-27, the digital charter implementation act.

During discussion of this bill and related issues, we are not going to get anywhere if we do not start to recognize that privacy is a fundamental right. This is what Conservatives believe and is where we are coming from when we talk about the positive or negative aspects of this piece of legislation. Not only is it true, but it has to be a priority. That is what Canadians expect from us and that is the message we are delivering to the current government. It is also what has been echoed by many of our constituents as we get emails or phone calls from people who are concerned about this bill and about this issue in general.

The world we live in is rapidly changing and the pace of change seems to be getting faster as we go. It is really amazing what people can achieve with digital technology, yet it has also left us in a more vulnerable and insecure position. There are many ways to intrude upon and violate our privacy that did not exist before, and it is safe to say that this trend will continue in the coming years.

If it was not clear already, it is easy to see now that we have to do more than respond to the changes simply as they come. Instead, we need to do our absolute best to think ahead and make sure that our efforts to protect privacy will not become outdated shortly after we pass any kind of bill into law. It is the least we can do if we are serious about preparing our country for the future, but it is true that, before we can do that, we first have some catching up to do.

Our current privacy legislation is long overdue for an update. It has been 22 years since Canada updated its privacy legislation. Twenty-two years ago, the Internet was basically a new phenomenon, and only about half of Canadians were online. Back then, I think Joe Sakic was the MVP of the NHL, and I was only 13 years old, so a lot has changed in that time.

Today, the Internet is a valuable tool used daily by the majority of Canadians. Generally speaking, people basically are living online. We use social media to connect with family, friends and professional networks. We use a GPS to get directions to move from place to place and navigate around our cities and towns. We have online banking to manage our finances. However, at the beginning of the new millennium, pretty much the majority of this was unheard of. In fact, I think we can all remember what we thought was going to potentially happen on Y2K and the implications it was possibly going to have on technology, which thankfully never came to fruition.

It has been years since the Liberals announced a new data strategy for Canada, which also has not become a reality. The promise also came four years after they formed government. It has now been about as long from then until now. After such a long time, Canadians are still waiting for someone to provide higher standards for the use and collection of their personal data.

So much of what we do these days involves an exchange of our data. Facial and fingerprint recognition are used for security, along with our passwords. Digital maps and search functions track our locations in real time. Many of us upload and share an overwhelming amount of personal information on social media accounts and platforms. We are constantly giving our data to different online companies in order to use their services. People feel comfortable enough to do all this because there is a voluntary loss of privacy for the sake of convenience, but this arrangement also requires a deep level of trust. It could not exist otherwise.

Whenever there has been a breach or loss of that trust, the problem of privacy becomes more obvious. There have been organizations exploiting the trust of people to sell their personal information without authorization. In some cases, the data has gone to places that are not working in their best interests.

I am sure, Madam Speaker, like many people in the House, when you go to a website it asks you if you accept the cookies, for example. Obviously, people just accept and go on there because they want to read the articles. What they do not realize is what they are agreeing to when it talks about what is going to happen with their search history or different aspects that might be invaded by those cookies. Therefore, we have to get serious about privacy. We have to mean it when we say that we recognize that privacy is a fundamental right.

The first draft of Bill C-27 says in the preamble, “the protection of the privacy interests of individuals with respect to their personal information is essential to individual autonomy and dignity and to the full enjoyment of fundamental rights and freedoms in Canada”.

Of course, I am not going to disagree with that. I believe it is good for a law to make a statement like this. However, it is also true that we can and should take it a step further in the same direction. Why not have this type of statement included in the text of the bill instead of only in the preamble? That way, it would more likely be stronger for enforcement and interpretation by the courts. With the situation we are in today, it is worth making our privacy law as strong as possible, and this would be a simple way for us to set the right tone. That is something we are calling for.

This is one example, among many, of how Bill C-27 could be improved with some amendments. Conservatives want to make sure we update our legislation in the right way. After all, in this area of privacy, we should not settle for less.

There is more that can be done to fill the gaps in our privacy law. If the government does not accept stronger legislation, it will simply be insufficient. The law must ensure that the privacy of our citizens would be respected by the activities of government and business. Canadians are the owners of their data, and corporations should ask for consent if ever they hope to collect, use or disclose a client's information.

Instead, the Liberal government still has loopholes with respect to privacy. Corporations can still operate with implied consent instead of express consent, which is freely given, specific, informed and unambiguous consent. What happened with Home Depot and Facebook shows how relying on implied consent can go wrong. In this case, a person could ask for email receipts from Home Depot. Their email address, as well as details of their purchase, were given to Meta, which then matched the person with a Facebook or Instagram account.

When brought to court, Home Depot claimed that it had the implied consent of customers to share their emails with whomever it pleased. When I shopped at Home Depot, I never gave my email address to it, but it never once asked me if I was okay with sharing that data with somebody other than for its own transactional purposes.

We have a lack of clarity, which is not protecting the consumer as much it should be. Implied consent has been losing relevance over time. In our context, it creates headaches for customers who are going about their regular business. They expect one thing and later find out that something much different is going on with their personal data. Even if they agreed or simply went along with something, they rightly feel misled by what happened. That is not informed consent. Our peer countries have been moving away from this. Europe's general data protection regulation has been heralded as the gold standard for privacy laws, and it has done away with implied consent.

Going back to discussing Home Depot, it also said that anything people bought there would be classified as “non-sensitive”, which is something this bill fails to define. Vague language will not favour our citizens in the end. With the Home Depot case, we can see that the law could be interpreted by larger organizations to allow them to do what the law actually intended to restrict. We should clearly define “sensitive information”, and it needs to apply to everyone.

Another vague part of this bill is the implementation of the right to disposal. Bill C-27 would allow the user to request that their data be destroyed, but clarification is needed regarding anonymization and the right to delete or the right to vanish.

At the end of the day, this bill is like many announcements the Liberal government likes to make. It sounds good, but the incompetence, the vague language and failure to close loopholes mean that it would not do what it says it would do. However, it should not surprise anybody if a Liberal bill has significant weaknesses and gaps on the issue of privacy. It is hard for Canadians to take the government seriously based on its own record. It has not shown respect for privacy.

We have seen a government agency use location data from cellphones for tracking purposes. We have seen law enforcement access Clearview AI's illegally created facial recognition database, and, of course, last year we saw the public doxing of online donors. While that was happening, the Liberals decided to mess with the bank accounts of Canadians, and some of those people had not even made donations themselves and certainly had not committed crimes.

It is easy for things to go wrong when there is government overreach, but today the federal government has an opportunity to modernize and protect our country for the problems we face in the 2lst century. If it does not listen to us and fails to make the right decisions, it would be truly shameful.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I am wondering if the member can enlighten us. He referred to what he believes are shortfalls in the legislation. I would ask him to indicate clearly if he has specific changes he would like to see in the form of an amendment that he believes would enhance the legislation to such a degree that he would be prepared to support it.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Madam Speaker, I think a lot of it, too, falls on the vague language that we see throughout the bill. I alluded to that multiple times throughout my speech. Canadians want to see strong safeguards because right now the fact is that there are not as many protections currently in the law, but as this bill is currently written, it would not necessarily strengthen it either. It is good to see that the government has put legislation forward, but at this point it just feels like it is a virtue signal that the government is going to take this issue seriously, but it is not actually doing anything substantive to it.

Conservatives want the bill to have stronger language to make sure there would be real rules in place to protect people's data and make sure they would not be victimized either by big government or big business.

[Martin Champoux, Bloc, Drummond, QC]

Madam Speaker, I am wondering about something. People have been talking about anonymizing data and the importance of protecting individuals' personal information by keeping it anonymous.

That said, we will be working on the online hate issue shortly. I think that, in some cases, we do need that ability to trace Internet users so we can pass legislation and take action if people make statements that cross the line and are found to be illegal or even criminal.

Does my colleague think it is possible to protect personal information and anonymize data online while also keeping Quebeckers and Canadians safe by making sure users who commit online crimes can be traced?

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Madam Speaker, I think anonymizing and aggregating data is extremely important. One example we saw where that was not necessarily taking place was with Tim Hortons. A couple of years ago, if someone had the app and was going to the store to buy a product, or if they just had it on their phone and went through there, Tim Hortons would track where people were going for a period of time after they had been at the store. It was very clear where that data was going and what it was going to be used for, because it was not anonymized or aggregated.

I do think there is something to be said for having a proper regime in place to make anonymization and aggregation take place. It does happen in some cases, but I think it needs to be utilized a lot more in cases where people's data is there. People need to know for sure, have absolute confidence, that it will be done and that the data cannot be unscrambled. We have heard many times in other committees that the unscrambling of data can happen and that it can happen quite quickly too, so we need to make sure people are protected, even if their data is being anonymized and aggregated.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I think one of the things we have really benefited from in Canada is the Privacy Commissioner and the office. There is no doubt that the United States not having this position has created an issue for that country. For ourselves, the commission having appropriate resources and reformation to enforce the decisions, as well as having independence from Parliament in many respects, is crucial for the NDP.

I am just wondering where the Conservatives stand on this, with regard to the Privacy Commission, because there would potentially be a tribunal created with Bill C-27, and then there would be far more regulation and oversight necessary from the Privacy Commissioner in the age of artificial intelligence.

[Jeremy Patzer, Conservative, Cypress Hills—Grasslands, SK]

Madam Speaker, having the Privacy Commissioner is fantastic, and it is interesting to see provinces that have their own privacy commissioners as well. For a number of meetings, I substituted in on the ethics committee, and we heard from some of the provincial privacy commissioners who did fantastic and important work. I think, generally speaking, Canadians would like to see them continue to be able to do their work. They play an important role. I am only going to talk about what is happening here in Canada, but I would like to see their offices continue to function, and I appreciate the valuable work they do.

[Caroline Desbiens, Bloc, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Madam Speaker, we are talking about Bill C-27, an act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts. The length of the bill's title is commensurate with the work that will be required of legislators.

Obviously, the Bloc Québécois will be voting in favour of the bill, since we have wanted it for quite some time. Quebec is actually already ahead of the curve on this issue. We absolutely must send Bill C-27 to committee so we can hear from experts who will point out the flaws in the bill, shed light on how to improve it and put some flesh on the bones, so to speak.

There are too many details in terms of the areas of action and application, and we cannot look at them all too quickly. We need some clarification, and that is to be expected. The committee needs to hear from a wide range of witnesses. The bill must not pass too quickly. What matters is taking our time in committee. That is what taking responsibility looks like, if we want Internet users to do the same.

On November 28, 2022, the Speaker of the House made the following decision regarding Bill C‑27:

...two votes will take place at the second reading stage.... The first will be on parts 1 and 2, including the schedule to clause 2. The second will deal with part 3 of the bill.

Thus, if the House votes against the AI portion, work on Bill C‑27 will continue without that portion. If the House votes in favour of the bill in its entirety, it will go to committee. Even if we vote in favour of the AI portion at second reading, there is still an opportunity to vote against it at third reading. That sort of latitude is important.

The Personal Information Protection and Electronic Documents Act has needed reform for years. A digital charter is urgently needed. Canada's privacy law is pre-digital, if not prehistoric. Today's context is completely different from that of the 2000s.

Bill C‑27 is also a response to the strict and ambitious European privacy legislation, the General Data Protection Regulation. We already know that without an adequate legislative response, it will become impossible for European organizations to exchange information with countries or international organizations that have not adopted legislation as strict as theirs.

If Bill C‑27 is not well structured and up to date, Canada will not meet the European Union's expectations. I consider that to be important and very serious.

In Canada, the financial sector is beginning to worry, and it is putting pressure on the government because it fears losing a portion of its European market. That makes sense.

There is less pressure in Quebec because our laws are already compliant, or almost. What is governed by Quebec is already relatively protected. The problem is when two levels of government overlap and one is inadequate. For example, Mouvement Desjardins is already prepared, but the same cannot be said for Fiducie Desjardins, which is the Ontario counterpart. It is the former Trust Royal, an Ontario trust company.

It is troubling, for example, that Ontario does not have updated privacy and artificial intelligence legislation when we do and that even the same institutions with the same names do not have the same laws.

However, even though this is an urgent issue, we cannot take a scattershot approach and let the most important things get lost in the shuffle.

Let us talk about protecting individuals. In many ways, Bill C‑27 seeks to protect individuals' anonymity. It puts the individual and the idea of consent back at the centre of reflections on digital exchanges. To date, in Canada, organizations have been given a free pass and they have taken advantage of the digital wild west to share personal information without any legislation to stem their greed. Bill C‑27 will not only limit and restrict their excessive freedom, but it will also give them responsibilities.

Bill C‑27 creates a tribunal. It sets out three types of sanctions for those who contravene the act. The first is administrative monetary penalties, or fines, which work for road violations, at least. The other two are criminal and penal offences.

Bill C‑27 is clearly binding and it has real power.

Privacy protection is a shared jurisdiction. Even if Bill C‑27 gives the impression that it will be consistent with Quebec's new Bill 25 on privacy protection, as currently drafted it offers no such guarantee. The government must ensure that Bill 25 is substantially similar to Bill C‑27 and stipulate it by decree. We understand that Bill C‑27 is not intended to infringe on Quebec's legislation. This needs to be confirmed in committee.

Let us now talk about artificial intelligence, more specifically about individual identification. There are currently three ways to identify an individual, either with a password or social insurance number, biometric data and voice recognition and our possessions, such as text messages, phone calls and so forth.

Currently, European law requires companies to rely on two of those ways, and maybe three, eventually. Bill C‑27 needs to legislate on this as well.

There is also the variable of sensitive personal information. Inspired by European law, Quebec's Bill 25 on privacy protection defines information as sensitive if “due to its nature or the context of its use or communication, it entails a high level of reasonable expectation of privacy.”

On that point, although Bill C-27 does not define what sensitive data is, its meaning will guide the development of cybersecurity measures. In other words, the AI legislation enacted in Bill C-27 will serve as the foundation upon which more ambitious legislation will have to be built so that we can more adequately regulate the AI environment. It is a good start, albeit a late one.

In closing, I would point to the many feats of artificial intelligence. This is a process of imitating human intelligence that relies on creating and applying algorithms in a dynamic computing environment. We have all seen the Prime Minister responding in a fake interview where he can be heard making false statements. The sound and image were really similar. It was uncanny.

It has also been shown that artificial intelligence can create works of art whose similarities are so close to the original creation that they could compromise its original value. I am a songwriter, and, thanks to the ChatGPT concept, one could take the various characteristics of each of my 80 original songs and make an 81st that would have essentially the same melodic flourishes and the same kinds of metaphors. I confess that this troubles me immensely.

We all understand the potential scale of this kind of thing and how it can have all kinds of repercussions. However, we have also been told that, for science, this tool can be revolutionary as long as we have a legislative framework that is adapted to the current state of AI and future-proofed for developments to come. What worries us is the minister's stated intention to pass the bill quickly. Bloc members believe the committee should take all the time it needs to hear from a broad range of witnesses so we can identify and fix the bill's grey areas and blind spots.

The government indicated openness to slowing the work down. Will it do as we ask? We hope so. If that is how it works out, that would be good.

AI is more about the data analysis process and the ability to do that thoroughly than about a particular format or function. That is why we have to deal with the issue carefully and understand its impact so we can make the necessary legal framework as good as possible. Doing that means taking the time for an in-depth study of Bill C‑27.

Here again, Quebec is the leader of the pack, and others would do well to follow suit.

[Serge Cormier, Liberal, Acadie—Bathurst, NB]

Madam Speaker, I appreciate the work that my colleague does with me on the Standing Committee on Fisheries and Oceans.

As my colleague knows, I have three young children, aged seven, eight and 10. Sometimes, when I see them using their devices, I think about how much things have changed from when I was their age. I would like to ask my colleague whether she thinks it is important that this bill makes it possible to protect children and set up parental controls to keep our children safe from everything that is on the Internet and social media, so that they are protected from data theft and identity theft.

[Caroline Desbiens, Bloc, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Madam Speaker, I thank my colleague. I admire him and appreciate his friendship because we work very well together in committee. We have a great connection and I appreciate that.

I also appreciate the fact that his wife is a music creator like me. She knows what I mean when I talk about the threat of our artistic productions being copied.

With regard to cybersecurity for children, I completely agree with my colleague. I think that the committee will be very interested in examining that unique aspect of the bill. We talked about cyberviolence yesterday, and I think that will be an extremely important aspect. We also need to think about educating families and parents so they get the tools they need to better protect our young children, who certainly need protecting in today's tumultuous cyber-environment.

[Colin Carrie, Conservative, Oshawa, ON]

Madam Speaker, my colleague is probably hearing from constituents, as I am. The bill seems to be silent on the selling of personal data. It is silent on facial recognition. She mentioned the artificial intelligence part of it. It seems that the new artificial intelligence part of it was just jammed alongside, and there is not a lot of thought in there.

She did not comment on the concept of implied consent. I thank my Liberal colleague for bringing up the protection issues. The bill does mention the term “implied consent”. That would allow businesses to take a user's consent to use their data and information for new purposes without actually obtaining it. I wonder if she could comment on that and why it is so important to get that right.

[Caroline Desbiens, Bloc, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Madam Speaker, I thank my colleague for his very relevant question. When it comes to consent, I believe that very clear guidelines need to be set in order to avoid ambiguity.

Why does the bill before us need so much study and deliberation in committee?

I think we will find that consent is a very particular aspect of this domain and that, as I said, we will have to set very clear and precise guidelines that cannot fail in practice. I believe the experts will enlighten us on this subject. I hope we will have the ability and the opportunity to hear from them during the committee study.

[Blake Desjarlais, NDP, Edmonton Griesbach, AB]

Madam Speaker, it is an important piece to talk about. Megacorporations, in particular those corporations that utilize AI and other digital tools, have been doing something nefarious, which is putting in these long, giant legal descriptions. Many people just scroll to the bottom of these and accept them. However, many people do not know how complicated those arrangements are that they are coming into.

I wonder if the member would talk about how dangerous it is to have such complicated agreements that regular folks are signing on to, while not knowing the explicit dangers and damages that come along with agreeing to those terms and conditions, like the ones we are talking about today and like the ones that are harvesting data. Would the member expand on that, please?

[Caroline Desbiens, Bloc, Beauport—Côte-de-Beaupré—Île d’Orléans—Charlevoix, QC]

Madam Speaker, I will give a brief answer.

Cigarette packs have a warning label on them to indicate that smoking causes cancer. I think it will be important to include similar warnings about the security of our personal data on the Internet.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Madam Speaker, privacy is important, and I think nearly all Canadians agree on this. I presume that all members of the House agree on that as well. A generation ago, the Supreme Court also agreed; it said that privacy was something upon which our most basic and ancient expectations of liberty depend. The security of the person depends on privacy, and without a basic expectation of privacy, it is difficult to imagine how any freedoms and security can exist.

What about privacy in the digital age? There is a growing awareness of how both businesses and governments threaten people's privacy and their expectation of privacy. Over the last few years, Canadians have seen high-profile examples of gross violations of this basic expectation of privacy, from both the private sector and government.

Users of the Tim Hortons app were rightly appalled when they learned that a private business was tracking their movements without their knowledge or consent, well after they had ordered and purchased their products. We also heard about Home Depot and the sharing of emails without the knowledge or consent of its customers.

We have seen where Telus Mobility gave the Public Health Agency the mobility data of not only its own customers but any customers whose signals passed through its infrastructure. It did this without following Canada's existing privacy laws, which required the Public Health Agency to consult the Privacy Commissioner before obtaining or using that data.

There is a private corporation, Clearview AI, which is a business that scrapes billions of images of people's faces from across the Internet. It identifies these images however it can from whatever sources, public or whatnot, that it has and then sells these identified images to law enforcement agencies without the consent of the people whose faces and identities it sells.

These are examples of how both public and private institutions flout existing laws.

On the public side, we have seen how the Privacy Commissioner has been ignored by both PHAC and the RCMP. When knowledge of what they had done became available, it was clear that they had not followed the existing laws or consulted with the Privacy Commissioner. The RCMP even disputed the finding of the Privacy Commissioner that it had violated the act, treating it like some kind of matter of opinion with which it could disagree. It repeated that refusal to accept the Privacy Commissioner's finding at a parliamentary committee. The RCMP also used sophisticated spyware to hack cellphones. Again, it did so without consulting the Privacy Commissioner about the use of new technology and new investigative tools, which is required under existing law.

Therefore, we have a real problem with both businesses and the government, which does not take its obligations to Canadians' privacy seriously enough. The government has a problem with respecting Canadians' privacy, and it has a credibility problem around privacy-related issues.

In addition to these well-known breaches by law enforcement and law enforcement's casual attitude towards compliance with privacy law, there are enormous commercial incentives for businesses to use new technologies like facial recognition with artificial intelligence. We have studied these concerns at parliamentary committees, and we have heard experts testify about the dangers to Canadians from the potential misuse of artificial intelligence, both by businesses and law enforcement.

What happens when artificial intelligence goes wrong? Facial recognition technology has built-in biases. We have heard expert testimony about how the efficacy of facial recognition under existing software is best with middle-aged, white male faces. When an individual is a child, a senior, a woman or a person with a darker skin tone, these applications are far less likely to correctly match people. This may have life-changing consequences when we are talking about law enforcement, never mind all the potential commercial applications of AI for retail and other potential users.

In facial recognition, the images are often scraped from the Internet without the consent of the consumer. Consent and the system of consent are completely broken with privacy. This needs to be updated. I know that this bill tries to address this.

We all have these devices that are connected to the Internet. I think everybody in this chamber and most Canadians have had the experience of trying to obtain access to a new application or use a new device. One is confronted with an incomprehensible set of policies and disclosures with an “agree” button at the bottom. Even people who would actually undertake the painstaking process of reading through one of these enormous statements would generally get to the bottom and conclude they do not really understand what they are getting into. However, they need to proceed with whatever task is at hand, and they click “agree”. That is a very small number of people.

Most people just get to the bottom and hit the “agree” button. Nobody has any idea what they have agreed to. I think that a lot of Canadians are sadly resigned to the belief that clicking “agree” means giving up a part of their privacy. They know they are giving something up, but they do not really know what. They just shrug their shoulders and think there is just no way around it; there is no other alternative other than to hit the button.

There is no doubt that the consent model is thoroughly broken or that Canada's privacy laws need to be modernized. Does this bill cut it? I would say no. This bill is too vague. It has too few details and leaves too many unanswered questions to warrant support, even so far as a committee study. This bill is a missed opportunity to get something right that has long been wrong. The failures of the existing privacy laws have been known for a very long time. The government has had a long time to get it right, and it has not done so.

What we are debating is a bill that is consistently vague and leaves too many questions about what it does and what it fails to do. Furthermore, the concern is that if this bill passes, a number of these questions will simply be settled by the minister and departmental bureaucrats rather than through parliamentary oversight.

This bill still does not definitively answer questions about when and how consent for the use of personal information is collected. It talks about the need for plain language, which of course I agree with, but it offers significant exceptions and no details. The bill does not clearly define a series of new terms, including “sensitive information” as being distinct from other types of information.

Will this bill be compatible with the European Union's GDPR? Some call the GDPR the gold standard. I do not know if it is really golden, but there is a consensus that it is the best balance between commercial expediency and consumer privacy. We do not know if this bill is even going to meet up with it.

I wanted to get into a number of shortcomings that this bill has, but I am going to have to get to them in questions. However, I am not going to support it. It is not strong enough to warrant approval even as far as a committee study, although I understand the need for a bill that will address privacy.

With that I will let the questions follow.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, 20 years after the need to see changes was shown, Bill C-27 is here.

The last time we saw changes, Facebook and iPhones did not exist. This is important legislation. Within it, to use a couple of examples, there are frameworks that allow for substantial fines and protection of Canadian privacy.

What we are hearing from the Conservative Party is that Conservatives do not want any of it. They are going to vote against the bill. The Conservatives are ultimately arguing that the bill is not amendable.

Does the member not see any value in the substance that is actually there to protect Canadians and empower things such as substantial fines?

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Madam Speaker, while it is true that this bill contains the provision for substantial fines, who is going to be fined? Who would it apply to?

Will the tech giants, with their armies of lobbyists and lawyers, figure out the loopholes within all the ambiguity in this law? For a small business owner, who is not in the business of harvesting data but nevertheless must collect information to complete a transaction, will this just give more red tape and more potential liability while letting off the tech giants?

I do not know the answer to that question, and it should be clearer in this bill.

[The Assistant Deputy Speaker, NDP, Carol Hughes]

There appears to be a problem with the interpretation.

We will take a moment to fix the problem.

Things seem to have been fixed.

The hon. member for Trois-Rivières.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I just want to put a question to my hon. colleague from Calgary Rocky Ridge, with whom I worked on the ethics committee and who is knowledgeable about situations concerning access to information. It is a question that the people of Trois‑Rivières asked me when I was out in the community.

With the arrival of ChatGPT, is it not true that a large part of this bill will have to be rewritten because it has become obsolete due to this important change in the reality of access to information?

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Madam Speaker, that is an interesting question, and the member may well be right. The bill certainly has a lot to catch up with. It has been, as has been pointed out, a long time since the existing law was updated. It seems to me that so many questions remain unanswered about problems that have been well identified by all sides in this chamber, yet they are not clearly and definitively solved by the bill. The emergence of new technologies, while we are not even coping with some that have existed for years, is a problem. We are in the third decade of the Internet age. A lot of this stuff is not new, and we are still catching up with decades of issues around privacy.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I am a little concerned with the Conservative position of not sending the bill to the industry committee as a co-operative approach to trying to fix problems in bills, which we are currently doing. I would like to know from the Conservatives exactly what it would take to at least move it to committee.

I have a lot of concerns about the bill. There are many issues that we have raised and spoken to. It is a fairly unfortunate position that we are going to leave it to Google and the Internet giants to basically rule over Canada, unobstructed, for the next couple of years, if we do not at least try to fix some of the problems that have been well identified.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Madam Speaker, if I was convinced the bill would do no harm, at a minimum, perhaps I would be inclined to send it to committee. I am not sure of that. If we send a bill that has this many holes in it and this many items that need to be fixed, I am not sure that can be done at committee. I am disappointed the government did not table a better bill.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, I rise today to address the House with respect to Bill C-27, the digital charter implementation act, 2022. It is just a year or so behind.

Thirty-four years ago, the Supreme Court of Canada recognized that privacy was at the heart of liberty. Much has changed since 1989 and little more drastically than the continuous transfer of the private information of Canadians to other organizations. The questions we need to ask are these: What are the costs of and what are the benefits of the availability of Canadians' private information for the use of others?

Many organizations see themselves as supplying useful value to Canadians by being provided, whether by contract or by capture, private information that is not knowingly provided by citizens. Examples include service companies that recognize when a consumer might be able to save a percentage of their fees by bundling certain services. In such a case, the benefit of this information availability is shared by the consumer and the service provider.

Let us make no mistake. What drives the action by the service provider is profit, which is known as the greater share of wallet. Nevertheless, in such cases, the consumer sees the benefit of being included in the information sharing, whether they know it has occurred or they do not.

This apparently benign approach to gathering information has now stretched to our daily lives, where our computers, our phones and our in-home private intelligent assistants, like Siri and Alexa, are gathering information on us. When my sons are at their homes and use Siri, they say, “Siri, turn on”. They have figured out that Siri was listening the whole time. A lot of information is being culled. Do we know that our information, in that case, when we have not actually disclosed it willingly, is being used in a benign or creditable way? Which of that has become public information to be monetized by somebody else? That is what is occurring.

Large corporations are gathering data that is being sold to others for their own purposes. That supposedly benign relationship is now being passed to another organization, in that case, that is paying the information gatherer, and so on. There is no accountability mechanism to the individual for the benefit of the supply of one's information to flow.

There is only one measurement at play, and that is profit. One need only look at the incredible financial returns associated with these technological information-gathering companies, including the Googles, the Metas, the Amazons, etc. None of those are Canadian, by the way, and realize that the value-extraction industry is lopsided in their favour. At no time in human history have start-up companies, many without a tangible product, achieved such lofty valuations so quickly. Billionaires are created out of computer code, which provides what, exactly. It provides our information.

Value is created and destroyed in commercial markets. That is the economic engine that has led the western world to prosperity, but value is only traded in financial markets. Let us ask this: Is the culling and selling of private information, however obtained, creating value or transferring value?

In that respect, the intent of this bill is good. It is designed to modernize the protection of Canadians' digital privacy rights. It is past due, and it is important. It cannot be delayed by another prorogued Parliament or another unnecessary election call, as happened to the prior bill that was introduced to advance this issue in the last Parliament. The aim of this bill is good. The execution, I would say, is way off. I see a bureaucratic solution, designed by bureaucrats, for use by bureaucrats, with what would be a minor effect for the Canadian population in general. As we say, if you are a hammer, everything looks like a nail.

The design outcomes of this bill are increasing bureaucratic oversight. The personal information and data protection tribunal act would have six members and would be put together in a tribunal, three of whom would have experience in information and privacy law. Only three out of six, which is half, are going to have experience in the very laws that they would be overseeing.

This is going to be responsible for determining the severity of financial penalties. It would have a staff of 20 with a budget, along with a larger budget for the Privacy Commissioner, which already exists. Does anybody see any redundancy in this solution?

There is a litany of financial penalties listed through this bill and a host of requirements of all businesses, even small businesses, which are going to find the requirements of this bill onerous in the extreme. Joe's Garage is going to be treated with the same expectations as the Royal Bank and face the same potential penalties.

I will read from this legislation something that would scare any small-business person. This is about privacy management programs, as required under the legislation. It states that, “Every organization must implement...a privacy management program that includes the [organization's] policies, practices and procedures....”

It further states that, “...the organization must take into account the volume and sensitivity of the personal information under its control.” What does that mean, and how do we interpret that?

It also states, “...the organization must ensure, by contract or otherwise, that the service provider provides [substantially the same] protection....” Therefore, a businessman is going to need to ensure that something nebulous is not being provided by their service provider when forwarding information. Clearly, no one involved in this bill's design has even considered what this means for Canada's small-business community.

Here is the issue for Canadians. Who has the most information on Canadians? Governments, first of all. Who is likely to get information hacked? Those same governments.

This bill shows a complete lack of accountability by the government regarding how it might misplace or misuse Canadians' data. Is the government going to fine itself in such an instance? I doubt it. That would be a round-trip anyway, at that point in time.

Banks, secondly, have a lot of information about Canadians, and they use that information to increase their returns. They have large bureaucracies, large legal departments and government relations departments to stick-handle these fines. I should note, in this legislation, many exemptions are included. Therefore, we are building more bureaucracy. That is just what Canadians have elected us to do, I say very sarcastically.

On top of the 30% increase in federal government employees over the past six years, we are going to build more bureaucracy. What this bill should be doing is trying to strike a balance between business use of data and the fundamental protection of our privacy.

Let us quickly discuss some of the nefarious uses of digital information gathering. Let us go back to the pandemic, when CERB payments were given out to Canadians, and how many criminal organizations misused that government information to pilfer the pockets of Canadian taxpayers and get undeserved CERB payments into the wrong accounts. This is what happens when government information is pilfered, and this is the main problem with the privacy of Canadians' information.

My advice to the government is to get this bill moving. It is way behind other jurisdictions on this very important issue. Look at how the absence of privacy protection has affected Canadians, and take a look at where the value of Canadians' information has gone: to all the large American tech companies.

The government must listen to that input and the alternatives that are going to be put before it when it puts together this bill. Hopefully, the government amends this bill so it actually addresses the privacy of Canadians in a more complete manner. Listen to that input and to those alternatives. As the Supreme Court of Canada reiterated 34 years ago, Canada needs to recognize privacy as a right, so let us get to work in providing an outcome that actually safeguards Canadian's privacy.

[Ken Hardie, Liberal, Fleetwood—Port Kells, BC]

Madam Speaker, I wanted to relate to the hon. member an experience I had back in 2014 or 2015. I saw something on Facebook that said it was Stephen Harper's birthday and to wish him a happy birthday, so I did. What the heck. I am a Liberal, and I know he is a Conservative. I disagree with what Mr. Harper did, but a birthday is a birthday.

Imagine my surprise when, after that, I saw posts online that put me down as a supporter of Stephen Harper. That did raise some questions among my family and others. That is an example of something that also needs to be paid attention to. How many times, for instance, have we been asked to fill out a personality test, or whatever, not knowing that we are giving all this information that could be used against us? I am wondering if the hon. member could reflect on that.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, it is a very good question. Often, we differ on policies in the House, but it is still good to wish others here a happy birthday, no matter whether we differ in our policy positions one way or another. Cordiality, of course, is very common here. When we are saying happy birthday to somebody, I think it is recognizable that when we are on that website and filling out a form, people are culling that information. They are using it and they are actually interpreting it as something that we may not necessarily intend.

That is exactly what is happening in the world right now. How this bill addresses that concern is beyond me at this point in time, because we have actively given that information, and that is going to continue to happen. We have probably filled out the form or checked off the box that says that we agree to supply the information, and it is probably 60 pages long, about how to actually access that going forward.

This is something this bill needs to address. It is something it needs to address in a legitimate and concise fashion so that small businesses and individuals understand what that relationship is and how it transpires.

[Martin Champoux, Bloc, Drummond, QC]

Madam Speaker, I thank my colleague for his speech.

I will repeat the comments I made earlier for another one of his colleagues concerning the very delicate line between the need to protect the personal information of each user on digital platforms and and digital services in every business and economic sector. There is also the issue of security and how to protect people who may be more vulnerable or more likely to be targeted by online attacks, or cyberviolence. We spoke about this yesterday during an interesting meeting with the two spokespersons for the StopCyberviolence campaign, who directed the film Backlash: Misogyny in the Digital Age.

I would like to know if my colleague believes that we are going to have to do some work to be able to identify and intercept cyber-attackers and to legislate against cyberviolence, while at the same time protecting the personal information of users of online services.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, obviously the victims of artificial intelligence crimes are usually seniors. The victims of this type of violence are primarily seniors in our community.

We need to protect people who do not realize they are sharing such personal information with service providers. As a society, we need to protect people who are not really aware of the relationship between service providers and the value of personal information.

[Laurel Collins, NDP, Victoria, BC]

Madam Speaker, I was hoping the hon. member could just elaborate a bit on some of the concerns around the personal information and data protection tribunal. It seems there is no justification for this tribunal. No privacy regime in the world has this tribunal. It introduces unprecedented levels of complexity, potential delays and uncertainty, so I am curious about the member's thoughts on this.

[Greg McLean, Conservative, Calgary Centre, AB]

Madam Speaker, never in all my speeches have the questions been so astute as this. That is exactly the case. We have a tribunal now being created, with a whole bunch of people, six people, three of whom are going to have to know something about what they are talking about, which is ridiculous, quite frankly. It is actually six new people, when we already have a Privacy Commissioner who can do all of this work and, supposedly, accomplish something.

In addition, all the details of this are going to be in the regulations. There is nothing we are looking at here in Parliament that deals with the details, which are very important for us to look at, as well.

[Chandra Arya, Liberal, Nepean, ON]

Madam Speaker, I rise today to speak about Bill C-27. I will focus on the artificial intelligence and data act, but before that, I would like to briefly talk about the overall digital charter implementation act.

Canadians have never been more reliant on the digital economy, yet the current privacy law was last updated over 20 years ago, before iPhones or Facebook even existed. In the new digital economy, enhanced privacy would not only benefit consumers but allow companies to innovate, compete and thrive. We are now at a juncture where, over the next few years, the rules of the road for digital privacy and AI are being written and entrenched. That is why it is crucial to have clear rules when it comes to this sector. For Canadians to prosper and benefit from the digital economy, they need to have confidence that their data is safe and trust that their privacy is being respected.

That is why the government has introduced this legislation, which would ensure that Canada has critical protections in place. Bill C-27 would ensure that Canadians have first-class privacy and data protection and that companies that break the rules face severe consequences, some of the steepest fines in the world. It would also hold organizations to a higher standard, in particular when it comes to protecting the personal information of minors by giving them and their parents more power over their information, including the ability to have it deleted. With Bill C-27, we are moving beyond traditional privacy protection to ensuring data control for all Canadians. Canadians can be reassured that we will never compromise on the trust and safety of their privacy.

Over the last decade, artificial intelligence technologies have been expanding rapidly and have been benefiting Canadians in a variety of ways. These technologies are evolving rapidly and with that, there is an increase in risk and harms due to the use of AI systems, whether intentional or unintentional. The artificial intelligence and data act, or AIDA, would establish rules to promote the responsible use of AI and the related governance practices. The framework would ensure that the development of AI systems has to include plans to mitigate bias and harm and that organizations are accountable for their practices.

The AIDA seeks to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. The act would provide for public reporting and would authorize the minister to order the production of records related to artificial intelligence systems. The act would also establish prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system in an intentional or reckless way that causes material harm to individuals. This would ensure that Canadians have strong privacy protections and clear rules of the road for business, as well as guardrails to govern the responsible use of artificial intelligence.

This bill would provide Canada with adequacy within the European Union's GDPR framework and international interoperability on privacy. Further, it would enable Canada to remain on the cutting edge of artificial intelligence development. This bill would help us to build a Canada where citizens have confidence that their data is safe and their privacy is respected, while unlocking innovation that promotes a strong economy.

The University of Toronto’s Schwartz Reisman Institute for Technology and Society studied this bill, and I would like to quote from an article written by policy researcher Maggie Arai:

As technology continues to advance and permeate almost all aspects of modern life, it has become necessary for regulators to grapple with how to best regulate it. New ways of collecting and processing personal information necessitate new regulations to protect those whose information is being collected, analyzed, and sold—often whenever they visit a new website or sign up to a new app like Facebook or TikTok. Advances in artificial intelligence (AI) are also top of mind for many regulators, posing unique risks and challenges that must be addressed. The recently tabled Bill C-27 represents Canadian regulators’ efforts on both fronts.

She goes on to say:

The Artificial Intelligence and Data Act (AIDA) is the federal government’s first attempt to comprehensively regulate artificial intelligence. Canada is not alone in this: AIDA comes in the wake of similar initial attempts at AI regulation by other governments around the world, such as the European Union’s 2021 AI Act and the United States’ 2022 Algorithmic Accountability Act. AIDA, like the EU’s AI Act, takes a risk-based approach to regulating AI. However, it is worth noting that Canada proposes categorizing AI based on whether it is “high-impact,” while the EU uses the language of “high-risk.” AIDA is also far less prescriptive than the EU AI Act. The draft Act is quite short, with much room left for the enactment of provincial AI laws as well as further federal regulation....

She continues:

A person becomes a “person responsible” for an AI system if they design, develop, make available for use, or manage the operation of an AI system in the course of international or interprovincial trade and commerce.

The major requirements contained in AIDA for “persons responsible” for AI systems include ensuring the anonymization of data, conducting assessments to determine whether an AI system is “high-impact,” establishing measures related to risks, monitoring and keeping records on risk mitigation, and requirements for organizations to publish a plain-language description of all high-impact AI systems on a public website. If at any time the Minister has reasonable grounds to believe that a person may be in contravention of these requirements, the Minister may order that person to conduct an audit into the possible contravention, or engage an independent auditor to conduct the audit.

She goes on to say:

The tabling of Bill C-27 represents an exciting step forward for Canada as it attempts to forge a path towards regulating AI that will promote innovation of this advanced technology, while simultaneously offering consumers assurance and protection from the unique risks this new technology...poses.

She also states:

There are also sections of C-27 that could be improved, including areas where policymakers could benefit from the insights of researchers with domain expertise in areas such as data privacy, trusted computing, platform governance, and the social impacts of new technologies.

She goes on to say:

To ensure that the powerful new technologies that shape our world today benefit everyone, it’s essential that our policies are well-informed—especially when it comes to how technical systems work, how they interact with our legal infrastructure, and how they impact society. As we approach the implementation of this landmark regulation, it’s critical that Canadians are engaged and informed on these topics and ready to make their voices heard.

I will now quote from an article written by the law firm of McCarthy Tetrault, which states:

Bill C-27, if adopted into law, is set to have a significant impact on businesses by creating new requirements for those who make, use, or work with AI. The bill imposes several new obligations on the AI sector which are backed by serious penalties for non-compliance.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, I listened intently to the speech from the member for Nepean. I note that at the beginning, the member talked about the issue of children, and the minister went on about that in his opening speech. However, the bill is 124 pages, and do members know how many times minors are mentioned? It is once, and it does not define what a minor is. It says that a minor's information is “sensitive”, but it does not define what “sensitive” is.

Perhaps a member of the Liberal government could define for the House what a “minor” is under this proposed law and what “sensitive information” is, as it would say in the definitions section.

[Chandra Arya, Liberal, Nepean, ON]

Madam Speaker, there are two things to note here.

One is the definition of “minor”. There is well-recognized legislation that has been adopted by various authorities and institutions on who a minor is, and I think that would be applicable here.

On the definition of “sensitive” and “sensitiveness” and other definitions related to these technologies, my view is that we should not cast in iron in the legislation the definitions of various things that are involved here, but leave it to the government and the regulators going forward to have the flexibility to define the various terms that are used in this legislation.

[Nathalie Sinclair-Desgagné, Bloc, Terrebonne, QC]

Madam Speaker, I thank my colleague. I would simply like him to answer the following question.

Since Quebec already has its own privacy legislation and it works very well, does my colleague not think that Bill C‑27 should clearly state that it will not contravene Quebec's legislation?

This should be stated in the bill.

[Chandra Arya, Liberal, Nepean, ON]

Madam Speaker, the member is right that Quebec has an existing law, but this proposed law in no way would impede Quebec's ability to promote and act on its own law. In fact, this legislation would enable Quebec and other provinces to move forward with any changes they may need to make to improve their own laws to protect the privacy of people.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, as the member knows, the bill is actually three pieces of legislation stuck together. I would like to get the his rationale as to why the Liberals chose that path, especially given that the first two pieces of legislation had some time in the House. After the NDP's question to the Speaker about the bill, we separated it into two different votes, because the artificial intelligence part in particular is new and requires different processes.

I think it is unfortunate that the Liberals could not find a proper way to bring this bill forward, and I would like his reflection on that, because it appears the Conservatives will not even support bringing it to committee. It appears as well that the Liberals seem intent on perhaps sabotaging efforts where there seems to be some consensus.

[Chandra Arya, Liberal, Nepean, ON]

Madam Speaker, there are a lot of things that overlap all three pieces of legislation that put them under one bill, especially artificial intelligence, which goes beyond one particular domain. It acts on almost every aspect of the Canadian economy and of Canadian society, and it permeates almost everything else it touches. That is the reason the government has brought in one single piece of legislation.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, this is my first opportunity to get in on the debate on Bill C-27 today, and I have to say that my thoughts resonate a great deal with those mentioned by the hon. member for Windsor West in his pointing out that this is three bills in one.

To focus on the part that is completely new, artificial intelligence, I find that there is a great deal of tautology when we look at the bill. For instance, it says that we will know what a high impact of artificial intelligence is if it “meets the criteria for a high-impact system that are established in regulations.” There are a number of other places like this, but we do not have regulations yet. When will we know what the bill means?

[Chandra Arya, Liberal, Nepean, ON]

Madam Speaker, I agree with the hon. member that there are a lot of things that could be explained much better, and I am sure this will be looked into at the committee level.

With respect to artificial intelligence, it is very difficult to define everything in the legislation, because it is a moving thing. Artificial intelligence is evolving on a daily basis, which is why it is best that we allow it to be done through regulations.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Madam Speaker, we are here today to debate Bill C-27, the digital charter implementation act. With this bill, the government seeks to bring Canada's consumer privacy protections up to date, to create a tribunal to impose penalties on those who violate those protections and to create a new framework on artificial intelligence and data.

For my constituents, I think the most important question is this: Why are consumer privacy rights important? Our personal information has become a commodity in the modern world. Businesses and organizations regularly buy, sell and transfer our personal data, such as our names, genders, addresses, religions, what we do on the Internet, our browsing history, our viewing and purchasing habits, and more. This happens so often that it is almost impossible to know who has access to our sensitive data and what they do with those personal details. Unfortunately, this bill fails to adequately protect the privacy of Canadians and puts commercial interests ahead of privacy rights.

The first part of this bill is the consumer privacy protection act, and I will note, as many others have during this debate, that it is really three bills in one. It is the largest part of this bill and brings in new regulations on the collection, use and sale of the private data of Canadians. I will cover three issues that I have found in this act in the first part of this bill.

The first issue relates to how organizations may collect or use our information without our consent. Subclause 18(3) states:

(3) An organization may collect or use an individual’s personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use

Without defining what a “legitimate interest” is, this subclause risks giving organizations free rein to define “legitimate interest” in whatever way suits their own commercial interests.

The second issue I will cover relates to how the bill would protect the privacy rights of children. Subclause 2(2) states:

(2) For the purposes of this Act, the personal information of minors is considered to be sensitive information.

However, nowhere in this bill are the terms “minor” or “sensitive information” defined. This will lead to confusion about how the personal information of children should be handled, and will ultimately lead, in my opinion, to weak protection of that information. There is also no other provision in this legislation that regulates the collection and use of children's personal data.

Every parent in the House of Commons is very concerned about their child going on Minecraft and about their interactions with other people and other gaming sites. This bill does not do enough to protect children in the context of online gaming.

The last issue I will raise in this act relates to when organizations can rely on implied consent to collect and use personal data. Subclause 15(5) states:

(5) Consent must be expressly obtained unless, subject to subsection (6), it is appropriate to rely on an individual’s implied consent, taking into account the reasonable expectations of the individual and the sensitivity of the personal information that is to be collected, used or disclosed.

This subclause highlights that the bill lacks a clear definition of “sensitive information”. This means that organizations will have free rein to determine when they can rely on implied consent, and they will be free to decide what information is or is not deemed sensitive according to their interpretations and not the legislation's interpretation.

The second part of the bill relates to the creation of the new personal information and data protection tribunal act. The bill would create a new semi-judicial body with the power to levy financial penalties against those who violate the CPPA, the first part of the act. I question whether this tribunal would be able to enforce the penalties outlined in clause 128, which are tied to global revenue and a proportion of profit in the previous fiscal year.

How does the government plan on ensuring accurate figures? Does the government really believe that it will go after Google in a global context, hold Google accountable and collect up to 4% or 5% of Google's global revenue? It is farcical.

We need very clear and very big amendments to this section. We need to question whether we even need a tribunal, because if it is in charge of enforcing clause 128 of the bill, I already know it is going to fail.

Under the third section of the bill, the artificial intelligence and data act, new provisions would be created that apply to the private sector. However, this bill does nothing to address the relationship between government and artificial intelligence.

Right now in Parliament, we are debating Bill C-11, which talks about the government's use of algorithms in the context of the CRTC. This bill has rightly infuriated Canadians across the country who are concerned about how the government would determine what people say and do on the Internet and where they would be directed. Why is the government not trying to apply the same standards upon itself as it is trying to apply on private corporations?

I want to address some other key oversights in the bill.

First, in the U.K., EU and even Quebec, certain personal details, such as race, sexuality and religion, are given special protection in comparison with other personal information. Why does the government believe the most identifiable aspects of our personal information are not worthy of being defined as sensitive information in the context of privacy law?

Second, the bill does nothing to regulate the sale of personal data. I am reiterating this point. In a world where the sale of personal data has become an integral part of our economy, why is the government not concerned with setting clear rules on how data and what kinds of data can be bought and sold, especially in the context of children?

Third, the bill fails to regulate the use of facial recognition technology. The RCMP used Clearview Al's facial recognition database, which was illegally created. Why does the government not think it is appropriate to ensure this never happens again?

Fourth, the consumer privacy protection act and the personal information and data protection tribunal act proposed in this bill are nearly identical to the acts proposed under last Parliament's Bill C-11. The consequence is that Canada's consumer privacy laws will be out of date by the time they come into force.

This bill was an opportunity to put forward strong regulations on the collection and use of personal data, but it failed to meet some basic criteria and thresholds. While the increased penalties for violating the act are welcome, they are watered down by the implementation of a tribunal that would take months or potentially even years to make a decision and levy fines. It is even questionable whether such a tribunal could actually do what it is purported to be responsible for.

Do we really need privacy legislation that fails to protect the privacy of Canadians? Do we really want privacy legislation that fails to put consumer interests ahead of corporate interests? Do we really want privacy legislation that fails to protect the personal information of children? Do we really want Al regulations that do not apply to government? Frankly, the government needs to withdraw Bill C-27, break it up into different parts and come back to Parliament after it has looked at the drawing board again and done something a little more comprehensive.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is interesting that the deeper we get into the debate, the deeper the Conservative Party gets into disliking the legislation. I look at the legislation as something that will have a very strong positive impact in protecting the privacy of Canadians. Penalties are going to be put in, substantial financial penalties, even though the member opposite mocks them. There are other issues as well, such as the privacy management programs that businesses would have to put forward.

There is so much good stuff in this legislation, yet the Conservatives are prepared to say they do not care; they have other things on their agenda, and they are going to prevent this legislation from passing. Does the member not feel that Canadians deserve this kind of legislation, at least as a starting point, and that the Conservatives could do whatever they like afterwards?

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Madam Speaker, why bring forward legislation that does not define “sensitive information” in the context of children? We all know this is a problem. I acknowledge this is a problem. Why not do the work right now? There are a lot of very talented public servants who could define “sensitive information” in the context of children.

In relation to clause 128 and the fines imposed on people who would break the Privacy Act, the Government of Canada wants the ability to go after global tech companies and ask them to pay the government a portion of their earnings from a previous fiscal year, but the government is not capable of doing that right now. It is absolute fluff.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, I was curious to hear my colleague's opinion on apps that use games or quizzes to not only get information out of the people who respond, but also access their cellphone contacts.

Does my colleague think the bill should legislate that?

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Madam Speaker, that is a very important point. I have a seven-year-old son, and he is starting to play games on my iPhone and whatnot.

We cannot say that Bill C‑27 will protect children because this bill does not include a definition of sensitive information, which we need.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, what is unfortunate with the Conservatives' position on this is that they have raised some significant problems with the bill, but they want to stop it from going to committee, which is rather ironic. The suggestion is to hand the entire project back to the Liberals, their central party organization and their political infrastructure to start over as opposed to moving it to public debate, witness testimony and expert dialogue, which is necessary.

I am not willing to turn this entire project back to the Liberal machine, and that is what is unfortunate here. I can attest that his members in the committee are very good. We have heard speeches from the Conservatives saying that they want amendments. Why will they not bring the bill to committee and get those amendments? That is a better choice than turning it back to the Liberals, whenever that is going to take place.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Madam Speaker, I will note that I am on the industry committee with the member for Windsor West, and he provides a lot of intelligent insight and corporate knowledge to key pieces of legislation like this one. Unfortunately, we are in a situation today where the New Democratic Party has decided to support the Government of Canada on all key pieces of legislation. Therefore, even if the member for Windsor West has a problem with a key aspect of the bill, I am not confident the supply agreement between those two parties will result in good legislation.

That is why the Conservatives are calling on the Government of Canada to go back to the drawing board. At the end of the day, the New Democrats do not have enough money to fund a federal election. That is why they are supporting the Liberals, despite the poor legislation.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I am so pleased to rise today to speak to the digital charter implementation act, 2022. With Bill C-27, our government is showing leadership in a new digital world. Privacy is important to the residents of my riding of Hamilton Mountain. It is important to all Canadians. This legislation would not only benefit consumers, it would allow companies to innovate, compete and thrive.

The world I grew up in is significantly different from the world in which my son is growing up. This bill gives me confidence that we will be able to take advantage of the latest technologies, while at the same time be assured that our personal information is safe and secure.

I want to specifically talk about the consumer privacy protection act and how it sets out a balanced approach to compliance and enforcement.

Canadians clearly want their personal information to be handled responsibly, and they want meaningful consequences for organizations that break rules to gain some advantage. Canadians want fair punishment for truly bad actors.

According to a survey published by the Office of the Privacy Commissioner, 71% of Canadians have refused to provide their personal information to an organization because of privacy concerns. In an earlier survey, this same percentage of Canadians said that their willingness to share their personal information would increase if they knew the organization would face financial consequences should their information be mishandled. Such consequences are clearly an important tool for enhancing privacy protection for Canadians and also for helping organizations comply with the law right from the start.

The consumer privacy protection act, or CPPA, will assist companies to get privacy right and the escalating enforcement approach will correct problems as they arise.

The new privacy law incentivizes organizations to step up and improve their privacy practices at the outset. The CPPA will also provide the Privacy Commissioner with a key role in helping them do so.

Under the CPPA, businesses will be able to ask the Privacy Commissioner to review the policies and practices that make up their privacy management program, which will assist them in complying with the law. The commissioner can also ask to review such programs. This is a very important step in the early detection and serves to correct problems at the outset.

Privacy management programs cover a wide range of privacy considerations: how companies manage service providers; how they respond to breaches; when to undertake privacy risk assessment; employee training; complaint handling; and so on. Under the CPPA, the Privacy Commissioner will be able to examine these policies and practices outside of an investigation. The goal is for the commissioner to give advice and make recommendations.

The CPPA will prevent the commissioner from using what he or she has learned in these reviews in any enforcement action unless the organization willfully disregards recommendations. We think this would be very rare, but if it happens, action can be taken.

The approach provides an appropriate space in which the commissioner can provide advice and companies can take proper action. At the same time, the commissioner will be able to gain insights on how the law is implemented in real-world situations, thereby being able to better advise organizations on the challenges they may face in the privacy space.

Essentially this approach builds on the Office of the Privacy Commissioner's current business advisory function, which has proven successful in encouraging compliance through engagement rather than enforcement. By allowing for the review of privacy management programs, the CPPA provides businesses with a safe place to seek and obtain advice and implement compliance solutions at the onset. We believe this will help prevent privacy issues before they have an impact on individuals.

We know Canadian companies will be very interested in this part of the new law, particularly smaller companies and start-ups, and I can probably think of a few in Hamilton Mountain.

The CPPA recognizes that a one-size-fits-all approach does not work for privacy. Some organizations deal with minimal amounts of personal information; for others, it is central to their business model. That is why the CPPA allows organizations to develop their privacy management programs according to the volume and sensitivity of the personal information that they handle, and why the commissioner must also take this and a company's revenues into consideration during the exercise of the role under the law.

Another important protection under the new act is the ability of the Privacy Commissioner to review the risk assessments and mitigation measures that organizations must do if they rely on a brand new exception to consent for activities in which they have legitimate interest.

Under the CPPA, the Privacy Commissioner will continue to undertake research and publish guidance. It is a long-standing role and important in helping organizations meet their compliance obligations. It is a role that we wholeheartedly support.

The bill would ensure that organizations build privacy considerations into their products and services from the beginning. Working with organizations, giving guidance, this is a fundamental role of the Privacy Commissioner. We want to be proactive here. We want to prevent problems before they have a harmful impact on individuals.

However, there will be organizations that do not have the right practices. There will be others that have the right practices but still make mistakes. This law provides individuals with the right to complain about an organization's privacy policies when they appear to be offside with the law. The right to complain is considered to be a fundamental principle in all privacy statutes.

Under the CPPA, like PIPEDA, the Privacy Commissioner also retains the ability to initiate a complaint investigation when there are reasonable grounds to do so. This is an important role because filing a formal complaint is not always obvious. Maybe some people will not know there is a problem; maybe they do not have time to make a complaint. This is where the Privacy Commissioner should be able to take action when intelligence gathering from media reports and their own research indicate that there could be potential trouble.

CPPA encourages the early resolution of problems and provides for dispute resolution. Over the years, through its active early resolution approach, the Office of the Privacy Commissioner has successfully been able to resolve many complaints with limited formality.

The CPPA maintains such tools for the commissioner. For example, compliance agreements, introduced relatively recently under PIPEDA, remain in the CPPA. Pursuing these agreements allows companies to work out an acceptable resolution with the commissioner, without the commissioner resorting to more formal measures, like orders. However, resolution will not always be possible or desirable. Sometimes the commissioner will need or want to consider stronger measures.

Under CPPA, the commissioner will have the power to issue orders to compel an organization to take necessary actions to bring the organization into compliance. This is a new power and a key improvement over PIPEDA.

Prior to issuing such orders and to ensure fairness, the Privacy Commissioner's office will need to go through a new process, called an inquiry. Once the inquiry is completed, the commissioner will issue findings and a decision, and will make orders as necessary to an organization to change its privacy practices.

As part of this process, the Privacy Commissioner may also recommend administrative monetary penalties to a new tribunal for certain contraventions of the law. The possibility of significant fines for non-compliant organizations, fines of up to 5% of global revenue or $25 million, whichever is greater, for the most serious offences, is another key improvement over PIPEDA.

A key part of the new enforcement regime, the personal information and data protection tribunal is being established to hear appeals of the commissioner's decisions. If required, it will also decide whether to issue a monetary penalty and, if so, the amount.

Industry stakeholders say that we need impartiality in enforcement decisions, given the different roles of the Privacy Commissioner. This was particularly the case for any proposals involving monetary penalties, which have the potential to significantly affect an organization.

The new privacy law will support additional due diligence in decisions to impose monetary penalties by introducing an inquiry phase before issuing orders, and by separating the imposition of penalties from the commissioner's other responsibilities.

We know that some organizations will challenge the commissioner's orders and recommendations, and we do not want to burden the courts. This is another reason for introducing a new tribunal. It is intended to be more accessible than the courts. It will ease access to justice for the individual and the organization.

After the previous version of this bill was tabled, stakeholders told us it needed more privacy expertise. We listened and this version of the CPPA has the necessary privacy expertise to ensure credibility.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, I appreciate that the member has been participating in the debate today.

One of the questions that I have is, if this is really about protecting the personal privacy of individuals, why this bill has so many exemptions for businesses. It allows, in subsection 18(3), the legitimate interests of businesses to override the interests of an individual. In subsection 15(5), it allows businesses to use implied consent, not real consent, to override the interests of personal privacy.

Why is it that personal privacy is not part of the purpose of the bill as a fundamental right?

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, this legislation needs to be flexible. As I mentioned in my speech, it applies not only to big corporations but to smaller companies and companies that use a lot of personal data as well as companies that use very little personal data. It has to be flexible. It has to be able to work in different situations. It has to be able to work in the future because, as we have seen, technology advances very quickly. We need legislation to be able to adapt regardless of the changes in technology that are happening before we can change the laws to accommodate.

[Martin Champoux, Bloc, Drummond, QC]

Madam Speaker, I think my question will resonate with my colleague. Personal information protection and security are very important to me. I myself was recently a victim of credit card fraud. I bought a nice couch that I did not even shop for myself. Handy, right?

Anyway, as much as I recognize the importance of protecting personal information, I also recognize the importance of protecting victims of cyberviolence. We will be studying an online hate bill soon. My colleague and I may have to work on a way to identify offenders, individuals who attack people online and hide behind anonymity.

Does my colleague think the legislative measures in Bill C‑27 could make it harder for us to adequately legislate online hate?

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I do not think this bill is going to create any issues for the other bill that we are going to look at in committee. I think there are a number of measures that need to be put in place to deal with the problems of the digital world that we face today.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, I just have a question for the member. She brought up Google before, but I will quote Jim Balsillie again.

I want your response to his statement that “Canada’s federal government has repeatedly failed to take privacy seriously and construct a legal and regulatory framework that protects the rights of Canadians in the digital age.” How do you respond to that?

[The Assistant Deputy Speaker, NDP, Carol Hughes]

I am not going to let him know how I am going to respond to it, but I will ask the member to respond to it.

The hon. member for Hamilton Mountain.

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I have forgotten the question.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, the member across the way talked about Google. We have always known that there is a close relationship between Google, the Prime Minister and the Liberals.

However, a question comes up from Jim Balsillie's statement that “Canada’s federal government has repeatedly failed to take privacy seriously and construct a legal and regulatory framework that protects the rights of Canadians in the digital age.”

Would the member please respond to that?

[Lisa Hepfner, Liberal, Hamilton Mountain, ON]

Madam Speaker, I think this government takes privacy very seriously. That is why we have been working on this legislation since the last government and why we have improved this legislation, bringing it before the government a second time to include things like artificial intelligence and improve security for the privacy of young people on the Internet.

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is a pleasure for me to speak to Bill C-27 in the House today, a bill that deals with issues related to privacy, as well as the way that the government interacts with large corporations to protect, or not, the privacy of Canadians.

I want to say at the outset that I am deeply concerned by the fact that the government has clearly been captured by certain corporate interests. It is important to distinguish in this discussion between corporate interests and the idea of a free market. As Conservatives, we believe very much in the importance and value of a free market and a competitive market, a market that is legitimately a challenging and competitive place for businesses that have to compete with each other to have the best products, where some businesses come in to challenge and steal market share away from other businesses and so forth, where there are not gatekeepers preventing new entrants coming into business. We celebrate free markets and the competitive aspect of free markets rather than a situation in which a small group of large corporations is able to dominate and exercise undue and inappropriate power.

In this House, different parties have different dispositions when it comes to corporations. We have the NDP that generally takes kind of an anti-business approach in general, we have my party that champions the free competitive market and we have a government that is, sadly, captured by specific corporate interests, often at the expense of the free market, as well as at the expense of individual well-being. Paradoxically, the NDP, while it criticizes the government for that, is fundamentally complicit with the government in, on the one hand, criticizing its agenda as it relates to defending corporate interests, but, on the other hand, supporting the government and providing it with the supply it needs to continue in its misguided approach.

What we see in terms of the government's relationship with large corporate interests at the expense of the free market and individual well-being is clear across a broad range of cases. We could talk, for instance, about the government's fondness for specific companies in terms of outsourcing and procurement, how it has repeatedly gone back to McKinsey to do work that in fact could have and should have been done within the public service, despite McKinsey's track record in so many different areas. We can talk about the fact that while the public service has grown, outsourcing under the government has expanded dramatically. We can talk about how it has pushed companies to implement forms of political discrimination, such as freezing people's bank accounts. We can talk about a number of the violations of individual privacy and liberty that happen through the government's close relationship with corporations.

I will say, in general, there is this emerging concept of woke capitalism or stakeholder capitalism that I think we need to be thoughtfully critical of, this idea that large corporations should be making definitive determinations and forcing those implementations on the country using their power and that governments can push corporations to push woke ideas or particular views of the common good that arise not through free democratic deliberation, but that come about because of pressure from corporate interests. We see the government's fondness for this kind of woke corporatism approach, where it tries to pressure companies to align with and push its views on various issues.

Again, Conservatives are very supportive of competitive marketplaces where businesses are doing business, not assuming a preferential position in social values debates, where businesses have to compete to survive, where new businesses are able to compete with old businesses and where we support the development of new small businesses so that we do not have a concentration of corporate power, but, rather, a well-functioning, effective market economy. That is the vision that Conservatives are defending.

Let me talk specifically about the issue of privacy and how we see the working out of the government's kind of approach to and relationship with big corporations in terms of their approach to privacy.

I am very pleased the Conservative Party uses and has a member-driven policy document. On issues like this, if one would like to know where Conservatives stand, it is not just a matter of Conservative caucus discussion but it is also a matter of drawing from the work that hundreds of thousands of Conservative Party members do, deliberating at the riding level, having discussions, proposing ideas and bringing those to a convention that then leads to a standing policy document that helps to define and frame the values that Conservatives stand for. I know our Conservative Party is deeply committed to the idea of grassroots democracy and the role our members play in all aspects of decision-making.

That is very important, and in this particular context, we see that playing out in the area of the policy declaration. Our policy declaration recognizes the fundamental right people have to privacy. As a Conservative caucus, we are supportive in advancing and bringing to the House that view about fundamental rights, a fundamental right to data privacy that has come to us through the involvement of our members but that also reflects the widely held perspectives of Canadians beyond our membership, a fundamental right around the protection of data.

This bill, Bill C-27, could have mirrored the language from the Conservative Party policy declaration. It does not. It does not recognize the fundamental nature of rights around data privacy. Rather, it talks about kind of striking a balance between people wanting to have their privacy protected but also the fact there are certain corporate interests. There are interests of corporations the government is close to that might be negatively affected if we recognize the fundamental right to privacy of Canadians, so it effectively seeks to say there should be some balance between the idea of protecting people's rights and the fact there may be certain large corporations whose interests would be negatively affected by recognizing the privacy rights of Canadians.

In particular, although the bill speaks about a balance at a general level, it is so, to borrow a word from the member opposite, “flexible” that it creates space one could effectively drive a truck through, with so many different exceptions and exemptions that it is not really effectively protecting the privacy rights of Canadians.

A member opposite, in a speech just given, said that this is a flexible framework, that the bill is flexible. Well, flexibility is not always a virtue. In particular, it is flexible for who? Who is doing the flexing? Who is the one who is able to bend the bill back and forth to their own will and interests? I would suggest the flexing is not being done by the individual who is supposed to own their own data, the flexing is being done by these corporate interests the government is close to.

Even if one believes this should be a balanced approach, it is not a balanced approach. It is a highly “flexible” approach in which the bending and twisting is done by the particular interests the government has been and always I suspect will be close to until we are able to have a new government in this country that respects fundamental rights, respects privacy and believes in a free competitive market in which businesses compete instead of where particular corporate friends of the government are protected.

I want to draw the attention of members to specific sections in here that identify broad exceptions in the legislation. Subclause 18(3) would allow the organization or business to use a person's information if they have a legitimate reason for doing so. That is pretty flexible. If one wants flexible, we are going to say this data cannot be used in a certain way unless there is a reason to do so. I would submit most people who do things think they have a legitimate reason for them. Others might not think they have a legitimate reason, but to say people's data can be used as an exception if there is a legitimate reason, there likely could be no broader conceivable exception than that one.

However, there are more exceptions even, if that one were not enough. The legislation, for instance, in subclause 15(5), refers to “implied consent”, so apparently in the case of privacy legislation, consent is not so sacrosanct, because companies can interpret an implied consent in this context.

There are clear problems with this legislation in terms of the particulars, but we can understand broader than the particulars the motivation or the value set that is behind this bill, which is that the government is once again trying to defend corporate interests instead of defending privacy and a genuinely competitive free market.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is disappointing listening to Conservative after Conservative stand and say they do not like this. Now that member referred to some sort of concern of policy platform. We do not know, really, because we often question the lack of any sort of plan coming from the Conservative Party. What we know is that we have substantial legislation that would set the framework, protect the privacy of Canadians and enable penalties and fines to ensure there is a consequence when a company breaks its trust with Canadians. What do the Conservatives say? They say they do not care about this type of legislation because they have their own ideas.

Will the member and the Conservative Party acknowledge that it is okay to allow the legislation to go to committee where the member can continue to rant on the different ideas and maybe even do something positive, like suggest an amendment he feels would make the legislation better?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, it is quite a thing to be accused of ranting by the member for Winnipeg North. I am so sorry to have disappointed him with my speech. I recall in an earlier exchange he referred to me as a “mischievous little guy”. I framed that and put it on my wall. That is truly having a ride. The goal I set out from the beginning was to be thus recognized by the member.

He asks what changes to the bill I would like. I suggest he support changes that reflect what Conservative members, in their wisdom, have put forward through our policy declaration, which we, as a caucus, are strongly supporting. This is the idea that there is a right to digital privacy that comes before the corporate friends of that member and the government.

[Elizabeth May, Green, Saanich—Gulf Islands, BC]

Madam Speaker, I am looking at Bill C-27 and wondering what we make of the fact, and I know he commented on this, that we have three different bills that are all put together and only one is really new. We have seen the privacy pieces and the repeal of PIPEDA in the former Parliament's Bill C-11. The bill before us relating to artificial intelligence and high-impact AI and regulating that is essentially an entirely different scheme of legislation. Would the Conservatives agree that they should be split so we can examine them separately? I think that is already their position. What does the hon. member say to that?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, some members will recall that way back in 2015, eight long years ago, in the lead-up to that election, the Liberal platform spoke about how the Liberals would end omnibus bills. That went the way of the dodo bird, as did many of their other election commitments.

It was such a sunny time, in the rhetoric of the Liberal caucus, and we see the government's management of its legislative calendar. It puts forward bills, then it prorogues Parliament; it puts forward bills again and calls an early election. Now it is putting forward bills again.

In contrast, my constituents are certainly hoping for an opportunity to weigh in on the government at some point soon, but I think the member's point is quite correct. We have seen immense hypocrisy from the government around omnibus bills, and I wonder if we are getting to a point where it will just try to put all aspects of its legislative agenda together at once. I think that is probably the direction some of the members want to go.

[Bob Zimmer, Conservative, Prince George—Peace River—Northern Rockies, BC]

Madam Speaker, to respond to the member across the way from Alberta, he, the Prime Minister and the Liberal Party say to just trust them on this. Does the member who just spoke think we should trust the government and the Prime Minister?

[Garnett Genuis, Conservative, Sherwood Park—Fort Saskatchewan, AB]

Madam Speaker, my short answer would be that, no, we should not trust the government.

My slightly longer answer would be that over the last few years, we have seen various actions through COVID and various other actions contemplated by the government. In all of these actions, there is a great deal of concern about people's privacy. Because of the way the government has acted in the past, there is concern and distrust any time the government says not to worry, that it is going to protect our information and that it will not use systems in such a way. The current government has undermined trust in government and institutions because it has not been worthy of that trust.

The House resumed from March 7 consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, it is, again, an honour to rise and speak in this place on behalf of my constituents of Medicine Hat—Cardston—Warner in relation to Bill C-27. It is dubbed the digital charter implementation act.

It is really frustrating to continually see legislation from the Liberal government that is sloppy, lazy and really incomplete, to be honest, and this bill is no exception.

Canadians have seen most of this legislation before in a failed attempt back in 2020. That legislation died on the Order Paper when the Prime Minister took his costly, ill-timed and overly optimistic opportunity to call an election. Since then, we have had three years of inaction on this file, and now the government has tabled this piece of legislation, Bill C-27, which should have been more focused on giving the people of Canada the privacy rights they deserve.

Instead, this legislation is literally the least that they could have possibly done in this regard. The bill is a flawed attempt to start the long overdue process of overhauling Canada's digital data privacy framework. Conservatives will be looking at putting forward some common-sense amendments at the committee stage to protect both individuals and small businesses alike and to ensure that it is the best possible legislation moving forward.

The Conservative Party believes that digital data privacy is a fundamental right that urgently requires strengthened legislation, protections and enforcement. Canadians must have the right to access and control collection, use, monitoring, retention and disclosure of their personal data.

It is unfortunate that we could not rely on the Liberals to get it right the first time, but maybe they will have the modesty, humility and common sense to accept the amendments that will be coming, instead of once again using their NDP coalition to control and steamroll at committee stage.

It is also a shame because Canada's digital data privacy framework has been in dire need of modernization for years. This government has been dragging its feet as well for years on this critically important legislation.

It appears that there is no good reason as to why there has not been advancement on this legislation. Clearly, they did not spend their extra time making the legislation any better than when it was first proposed in 2020.

Conservatives will be looking to see how this bill can be improved. However, when looking at how to improve something, we need to look at why it is even in front of us to begin with.

The Liberals brought it forward today because they were finally exposed for being flat-footed on Canadians' data protection and how they were exposed. Let us think about TikTok.

Michael Geist, Canadian research chair in Internet and e-commerce law at the University of Ottawa, said that he found it “pretty stunning” that the Liberals had to block TikTok on government devices as a precaution because, again, “part of what [the Liberals] were attributing the TikTok ban to was essentially Canada's weak privacy laws.”

The expert continued to say that, when it comes to Bill C-27, the government “sat on it. It barely moves in the House.”

He is not alone in his criticism either. Former privacy commissioner of Canada Daniel Therrien shared similar concerns to those of Michael Geist and those we as Conservatives have.

The former commissioner, Mr. Therrien, argued that the solutions in proposed Bill C-27 are not strong enough to rein in technology companies from pursuing “profit over respect for democratic values”.

He also said that Bill C-27 “will not provide effective protection to individuals, in part due to weak enforcement provisions.”

Former commissioner Therrien's most notable criticism, however, is in his retort to the Liberals' claim that the bill “will create the most important penalties among G7 countries”, which is called “simply marketing”.

This is just a gentlemanly way of a former public official saying that it is not really the case. There are those of us who would call it by some other name.

At best, Bill C-27 is a first step. It is better than the nothing that the Liberals have done for the last three years. That is where the catch-22 is with this bill as proposed.

Doing something will be better than staying in our current technological stone age, with respect to data privacy.

Specific items like the bill's requirements for all businesses to have a privacy watchdog and maintain the public data storage code of conduct are positive measures. However, it does cause worry about the burden this new layer of red tape will have on small business and especially for sole proprietors. Again, on a catch-22 of this lazy Liberal legislation, the law does not go far enough to protect children's privacy for example.

While the information of minors is finally included in the legislation, the definition of what is sensitive, what a minor is or who a minor is are not set out, and the sensitive information of adults for example is not given the same special provisions. This means that businesses are left to decide what is sensitive and appropriate for minors. It also means that the courts, when interpreting the legislation, will understand that if not amended, the sensitive information of adults was specifically left out of the legislation.

Further, businesses will have to navigate varying rules in each province where different definitions of a minor actually apply and that depends on provincial law. This is not good for protecting minors, this is not good for protecting Canadians' sensitive information and this is not good for businesses.

Finally, the fundamental problems in this bill can be summed up in that this bill does not recognize privacy as a fundamental right. Thirty-four years ago, the Supreme Court said that “privacy is at the heart of liberty in a modern state”.

Conservatives believe that individuals are worthy of privacy as a fundamental right, and the concept of privacy as a fundamental right is worthy of legislative protections. Based on that alone, the Liberals have missed the mark on this legislation. Once again, it is up to the Conservatives to fix the Liberals' poorly written legislation.

As I close, I want to offer my thanks for the hard work of the Conservative members of the access to information, privacy and ethics committee. They have done a great job to date. They spent a lot of time on the previous iteration of this legislation, and I have heard a great deal about how Canadians' information and data is used without their consent. With the many identified flaws of the bill, Bill C-27, I think it would be best if this bill were voted down and redrafted, honestly, in order to take these issues into account. However, the NDP-Liberal coalition will surely ignore doing these things right in favour of expediency and send it off to committee.

With that, Canadians and I are leaving the flaws that I have pointed out, and there are many more, along with the additional flaws that I am sure my colleagues will find in their review and will need to be fixed at committee. The Liberals have left the committee a lot of work, but I know that my colleagues there are up for the challenge.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Speaker, I would like to ask my colleague about the overall theme of his speech, which was about the positioning of personal privacy versus business interests. In clause 5 of this bill, it basically says that the purpose of the bill is to balance interests. There has been a lot of discussion about the protection of personal privacy interests. However, clause 18 of the bill says that business interests can trump individual interests by saying that express consent is not needed for a company to do something with the information of an individual if the company thinks it is in the legitimate interests of the company.

I wonder what the member thinks about a government that says this protects personal privacy while giving all the power to the businesses to determine legitimate interest.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, I go back to something my father taught me a long time ago that in all things that one is deliberating, one should have a reasonable and a balanced approach.

With respect to my colleague's question, there needs to be an appropriate balance, legislatively, so that there is no ambiguity and misinterpretation. However, the businesses and individuals, whose information a business has, have the comfort of knowing that it is used appropriately, that there are safeguards in place for its use and that it is not going to be misused. I think that would be an appropriate balance to strike.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Mr. Speaker, I think everybody would agree that for Canadians to prosper and benefit from the improvements of technology, they need to have confidence in the systems. If we look at some of the new apps out there now, it is extremely easy to access information about individuals, whether that is considered to be private information or public.

Could the member expand on why he might see this as critical in making sure Canadians have that confidence to trust the technology? At the end of the day, that is what these businesses will have to rely on if they are going to be successful.

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, I appreciate that question from my hon. colleague. When he stands up, I never know what angle he is going to go with. It is nice to have a reasonable question from my friend across the way.

I look at some of the recent examples of privacy and mobility data being used without consent. The member is right. Canadians have to be confident about the information they are using in apps, and they have to have businesses they can trust.

The Tim Hortons app was tracking movements after orders, which caused concern for Canadians. Telus' data for good program was giving location data to PHAC. That was a significant faux pas. One that really stood out was the public doxing of those who donated to the “freedom convoy” through GiveSendGo. Anytime one is revealing their personal information online, there has to be some confidence behind it. Businesses rely on it. Those who use those businesses as consumers need to have confidence that the information is not going to be abused and shared inappropriately.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, given that this is a debate on artificial intelligence, I thought it might be fun to have ChatGPT make up a question for my Conservative colleague from Medicine Hat—Cardston—Warner about passing Bill C-27 and the Liberal government's lack of urgency, since that is one of the things my colleague mentioned.

This is ChatGPT's question: “How does his party view the Liberal government's lack of urgency to pass Bill C‑27, which is designed to protect workers and retirees in defined benefit pension plans in the event of employer bankruptcy? Also, how does he think this inaction could affect affected workers and retirees, as well as the economy as a whole?”

There is room for improvement, but the crux of the question is there. In terms of delays, I understand that the Liberal Party could have introduced a similar bill a long time ago, but my colleague said that he would vote it down all the same.

Are we not at the point where we should approve the principle of the bill quickly and improve the content in committee?

[Glen Motz, Conservative, Medicine Hat—Cardston—Warner, AB]

Mr. Speaker, I do not see the connection to the first portion of my hon. colleague's question. I do understand that this bill absolutely needs significant improvement.

I am certainly supportive of it, in principle, to go to committee to have the amendments ironed out and improved upon so the legislation could address some of the concerns raised by my friend, as well as the concerns identified by people across the country. This includes some of the experts who say we need to strike the right balance, and it is about time privacy legislation takes into account all those issues.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, I am thankful for this opportunity to speak to Bill C-27, the digital charter implementation act, 2022. While there are many important components of Bill C-27 to debate, my speech today will focus on just two aspects. The first is privacy, and the second is identity.

The protection of both the privacy and the identities of Canadians is essential. We need to ensure that strong legal mechanisms are in place to guarantee that protection. Connected with that is the need to protect from the commercial interests of private companies, as well as protection from the government and its potential overreach into the private lives of Canadian citizens. Consequently, I believe a national digital charter is urgently needed. To protect Canadians, it is important that we have a piece of legislation that acts as an umbrella to protect Canadians from government, and to uphold the privacy of Canadians' data and their digital identities.

The second part of my speech will highlight some of the breaches that have occurred over the past three years. These breaches drive home the urgent need for more stringent protection for Canadians when it comes to privacy and protecting their private information.

Privacy rights are at the heart of any democracy. They are necessary for reinforcing the limits and boundaries between private citizens, their government and the private sector. In Canada, individual liberties are guaranteed by section 7 of the Canadian Charter of Rights and Freedoms. Our Chief Justice of the Supreme Court has made comments on this. She stated, “liberty...depends on and mandates respect for the individual and his or her right to be free from government restraint, except as authorized by law.”

Justice McLachlin further explains why it is important for government to keep the people informed and to answer questions, stating, “People who possess power, even small administrative powers, may use information they should not have improperly. And even if they don’t, the individual’s fear that they may use it, often leads to unwilling compliance.”

Just as we have fundamental freedoms entrenched in the highest law of our land to protect us from government encroachment of our freedoms, I also believe that it is necessary to have digital data privacy legislation. That is a fundamental right that urgently requires the strengthening of our legislative protections and enforcement.

That is why we need a federal digital charter, which would act as an overarching piece of legislation. However, Bill C-27, the digital charter implementation act, falls short of this very important objective. The Office of the Privacy Commissioner, for years, has made several calls for reform. Privacy watchdogs have repeatedly lamented that our federal privacy laws are outdated, that they fail to provide the needed legal protections in an increasingly digital world.

Canadians also have serious concerns about privacy. First, they have concerns about how their private information is being used, and what large corporations and governments are doing with it. Second, these concerns have turned into a fear because of the misuse and abuse of private information in the recent years.

This leads me to the second point of my speech. I will speak about the bigger problem in the privacy landscape in this country, which is that the Liberal government is failing to update its own legal boundaries and parameters in this area. The reality is that this bill does not touch on the Privacy Act, the act that governs the government, and this digital charter does not cover how the government handles the information it collects from Canadians.

Essentially, this bill is saying, “Do as I say, not as I do.” With this bill, the government is telling businesses, even sole proprietorships, that they should add additional layers of red tape under the threat of financial penalties. Business owners are still struggling to recover from COVID setbacks, lockdowns and government red tape.

My fear is that many of these small businesses, subject to these new requirements, would not be able to survive or have the capacity to implement some of these new requirements. These demands come even though government itself has failed to lay down the rules and regulations as to what is needed in the form of a regulatory infrastructural framework to secure our digital future.

A digital charter is needed to protect Canadians, but the federal government should be leading by example by outlining a digital charter that would protect the personal data and privacy of its own citizens first, before it asks businesses to do so. Let us be honest that the number one privacy concern Canadians have right now is how their government is using their information. These fears were exacerbated during the trucker convoy when Canadians’ bank accounts were frozen and property was confiscated through the abuse of the Emergencies Act.

Canadians still remember how the government quietly spied on their movements during the pandemic without their consent. A year ago, it was discovered that the Public Health Agency of Canada was tracking Canadians' movement during the pandemic. This was done without their knowledge, and PHAC wanted to keep doing it quietly for years into the future, but it was the Conservative opposition that discovered this breach and stood up for Canadians. We demanded answers from the Public Health Agency on the way the data was collected, how it was defined, what third parties were privy to the data and whether any data was reidentified. It is important that the government answer these questions and sets standards because it is falling short of its own requirements.

Canadians have not forgotten even the ArriveCAN debacle, the privacy questions around its mandatory use, and the terms and conditions associated with it. In other words, exactly what personal data and identifying information has been shared outside the app? Under what circumstances, and with which domestic or international organizations, was it shared? The app’s privacy notice even stipulated that the government had the right to share our information contained in the app with international organizations and institutions.

Canadians have a right to know with whom their data is being shared. This matter, it is no surprise, was referred to the Privacy Commissioner for an investigation. We are still waiting for an answer on the ArriveCAN privacy breaches.

Let us not forget that Canadians were fined thousands of dollars and threatened at their own borders for not submitting their own private medical information. This was, in my view, a massive overreach of government powers, but the reality is that this overreach happened because Canada has insufficient legal safeguards in place to prevent such abuses, and this creates a profound distrust in government.

It concerns me that the government is moving toward integrating a digital proof of identity framework that would massively expand the centralization of government access to the private information and data of Canadians. There are numerous ethical abuses that relate to this data collection.

The biggest concern is having all of one's private information in one place. Imagine our health information, driving information and banking information all in one portal. This would give information handlers a great deal of power over our data. This power urgently needs to be kept in check, and we need public experts in consultation on the ethics behind this centralized data collection power to uncover what we need to do to protect Canadians.

In conclusion, Canada’s digital privacy framework has long been in dire need of modernization. I want to thank the Standing Committee on Access to Information, Privacy and Ethics, which worked hard on this issue for years. Canadians must have the right to access and control the collection, use, monitoring and retention of their personal data. However, in Canada, the Liberal government is failing Canadians by not prioritizing its own accountability when it comes to protecting privacy rights. The bill sadly fails to put forward a rigorous and comprehensive legislative framework that would defend Canadians’ data, privacy and digital identities, now and in the future.

[Mark Gerretsen, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons (Senate)]

Mr. Speaker, we heard some fairly outlandish claims about the government illegally monitoring Canadians, which is extremely bold, to say the least. I am curious as to whether the member has any actual facts to back up that claim or if that is just another conspiracy theory being led by Conservatives and the alt-right wing of the party.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, this is a part of the problem with why Canadians do not trust government. When Canadians raise concerns, the Liberals label them, degrade them, make fun of them and call them conspiracy theorists instead of dealing with the real issues and fears that Canadians have. The news report indicated that the privacy of Canadians was breached during COVID, and that is factual.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I am known for my perspicacity, so I decided to ask ChatGPT another question.

I asked it to come up with a question for my Conservative colleague from Haldimand—Norfolk about the importance of enhancing data and privacy protection in Bill C-27. That was what her speech was about.

ChatGPT replied: “Sure, here is a question for the Conservative member. The question is as follows: As a Conservative member, how does she think that Bill C‑27, which aims to modernize the Privacy Act”—already this is a step up from the other question—“will offer better protection for Canadians' data and privacy? Also, what are the key points she would like to see in the bill to ensure the adequate protection of personal information?”

I am very impressed by artificial intelligence because it touches on the role of the official opposition, which is not just to complain, but also to make suggestions.

I would be very curious to hear my colleague's thoughts on the subject, because I did not hear many constructive remarks in her speech.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, I beg to disagree. There were largely areas of constructive discussion in my speech, and I will highlight some of them for my friend.

The government needs to have an infrastructure framework that will protect the privacy of Canadians before it can demand that of businesses. Businesses, which are already saddled with red tape, do not even have the mechanism to put this in place. Nor does the federal government have the structure to put this in place, but it demands that the business sector do that, with sweeping loopholes that could violate the privacy of Canadians.

The first thing we need to do is ensure that the Liberals put in place a legislative framework that will set the foundation for digital privacy in Canada.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, privacy rights are fundamental. Small businesses are important. I wonder if the member agrees that it is important to empower the Privacy Commissioner to enforce the protection of both those groups of people.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, I am impressed that Bill C-27 would give the Privacy Commissioner some teeth to enforce penalties. That I acknowledge. I also see it as a positive that there is some attempt to create some sort of regulatory framework, but it does not go far enough. This framework has to start from the federal government and work its way down so we have an umbrella legislation to protect the digital privacy of Canadians.

[Jennifer O'Connell, Liberal, Parliamentary Secretary to the Minister of Intergovernmental Affairs]

Mr. Speaker, I appreciate the opportunity to ask the hon. member a question.

I am curious as to whether the member thinks there should be consequences or reprimands for members of the House who meet with known Nazis who spread misinformation and disinformation, who glorify the Holocaust and who speak against anti-Muslim rhetoric. If the member is talking about online hate, privacy of Canadians and regulation, does she condemn her actions by meeting with a known Nazi who spouts anti-Muslim rhetoric?

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, the Prime Minister has met with far worse individuals than I have ever met with. I can tell the member this. As a member of Parliament, it is my duty to have meetings—

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Mr. Speaker, I rise on a point of order. All members are honourable members. The member just said that the Prime Minister had met with worse people than she had. I would like her to name them.

[The Deputy Speaker, Conservative, Chris d'Entremont]

That is getting into debate.

The hon. member for —Norfolk, from the top.

[Leslyn Lewis, Conservative, Haldimand—Norfolk, ON]

Mr. Speaker, the Prime Minister has put on blackface so many times that he has degraded Black people. He literally put a banana in his pants, and the member has the audacity to stand and look at me, as a Black woman, and ask about my meeting with another member of the European Parliament. That is within my job description. I do not have to approve of everything in which another member believes in order to have the decency to have meetings with other individuals.

The Prime Minister denigrated Black men by putting a banana in his pants. Shame on every member over there who does not chastise him. If this were any other country, he would not be leading. He would not have the moral authority to lead.

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, to bring it back to the topic of this debate, Bill C-27, the intention of the bill is to modernize the protection of digital privacy rights in Canada. The previous iteration of the bill was roundly panned by stakeholders when it was introduced in the previous Parliament. However, in this new version, Bill C-27, the government has added a few new elements, for example, regulating artificial intelligence.

Unfortunately, there are so many different elements within the bill that nobody can actually address all the issues within a 10-minute speech, so I will focus on the privacy issues that are sorely lacking within the legislation.

The bottom line is that the new bill, Bill C-27, remains fundamentally flawed and is, simply put, a redux of the former bill. Essentially, what it would do is put lipstick on a pig.

The dramatic and rapid evolution in how we gather, use and disseminate digital information in the 21st century has presented the global community with not only a lot of opportunities but significant challenges as we try to protect society and individuals against the unauthorized use of their data and information. This directly implicates the issue of privacy and the various Canadian pieces of legislation that address the issue of privacy.

This is not the first time the Liberal government has tried to “fix” a problem, and I use that term advisedly. It tries to fix things, but just makes things worse. In the 21st century, we are faced with immense challenges in how we protect individuals, our Canadian citizens, against those who might misuse their data and information. Any suggestion that this digital charter is actually an articulation of new rights is simply wrong. This is a digital charter, but it is not a digital charter of rights.

I will turn to the most significant and substantive part of the bill, the privacy elements. Very little of this legislation has been changed from the original Bill C-11, and the government has not measurably responded to the criticism it received from the stakeholders when the previous version of the bill was reviewed at committee.

There are five key additions and alterations to Canada's existing privacy protection laws.

First, the bill expressly defines the consent that Canadians must give in order for their data and information to be collected and used, and there are guidelines attached to that. We commend the government for doing that clear definition of consent.

Second, Bill C-27 addresses the de-identification, the anonymization of data that is collected by private companies. Again, that is important. We want to ensure when private businesses collect information from consumers that this information is not attached to a specific individual or citizen.

Just to be clear, the bill contains numerous broad exemptions, which we could probably drive a truck through, and will likely create the loopholes that will allow corporations to avoid asking Canadians for permission.

Third, the bill provides that all organizations and companies that undertake activities that impact the privacy of Canadians must develop codes of practice for the protection of the information they collect.

Finally, the act would create harsher financial penalties, up to $25 million, for a violation of Canadian privacy rights. We, again, commend the government for doing that.

However, let me say for the record that what we do not support is the unnecessary creation of a new personal information and data protection tribunal, which is another level of bureaucracy that would add more layers of complexity, delays and confusion to the commissioner's efforts to enforce privacy laws.

Canada is not alone in expressing concern over the risks that digital information and data flows represent to the well-being of Canadians and our privacy rights. Many other countries are grappling with the same issue and are responding to these threats, and none more so than the European Union. The EU has adopted its general data protection regulation, the GDPR, which has now become the world's gold standard when it comes to privacy protection in the digital environment.

The challenge for Canada is that the EU, which is a market of over half a billion well-heeled consumers, measures its willingness to mutually allow sharing of information with other countries against the GDPR, the standard it has set. Those who fall short of the rigour of that privacy regime will find it difficult to conduct business with the EU.

Do our current regime and this legislation measure up to the GDPR from the EU? No, probably not. In fact, for years Canada's digital data privacy framework has been lagging behind those of our international counterparts. The problem is that if we do not meet the standard, we will not be able to do the kind of business with the EU we expect to. As someone who played a part in negotiating our free trade agreement with the European Union, I know it would be an absolute travesty to see that work go to waste because our country was not willing to adopt robust privacy and data protections.

I note that, as is the custom with our Liberal friends, the bill creates more costs for taxpayers to bear. There is a creation of new responsibilities and powers for the commissioner, which we support, but this legislation calls for the creation of a separate tribunal, a new layer of bureaucracy and red tape that small and medium-sized enterprises will have to grapple with.

There are other unanswered questions. Why does this legislation not formally recognize privacy as a fundamental right? Regrettably, as presented, Bill C-27 misses the opportunity to produce a path-breaking statute that addresses the enormous risks and asymmetries posed by today's surveillance business model. Our key trading partners, especially the EU, have set the bar very high, and the adequacy of our own privacy legislation could very well be rescinded by the EU under its privacy regime.

Thirty-five years ago, our Supreme Court affirmed that privacy is “at the heart of liberty in a modern state”, yet nowhere in this bill is that right formally recognized. Any 21st-century privacy regime should recognize privacy as a fundamental human right that is inextricably linked to other fundamental rights and freedoms. By the way, I share the belief that as a fundamental right, it is not appropriate to balance off the right to privacy against the rights of corporations and commercial interests. Personal privacy must remain sacrosanct. When measured against that standard, Bill C-27 fails miserably.

I have much more to say, but I will wind down by saying that this bill is another missed opportunity to get Canada's privacy legislation right by consulting widely and learning from best practices from around the world. There is a lot riding on this bill, including the willingness of some our largest trading partners to allow reciprocal data flows. This bill is not consistent with contemporary global standards.

The Centre for Digital Rights notes that this legislation “fails to address the reality that dominant data-driven enterprises have shifted away from a service-oriented business model towards one that relies on monetizing [personal information] through the mass surveillance of individuals and groups.” That should be a wake-up call to all of us. Sadly, this bill fails to listen to that call. Let me repeat that there is a move toward monetizing personal information through mass surveillance of individuals and groups, and the government has not yet recognized that.

For those reasons, I expect the Conservatives will be opposing this bill and voting against it.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Speaker, I switched from ChatGPT to Bing, since I also wanted to test that platform. I asked Bing, in connection to what my colleague from Abbotsford was saying, what the consequences of not legislating on the content of Bill C-27 would be.

It gave me an interesting answer, namely that, essentially, it could have an impact on the protection of data provided by companies.

Not legislating and not acting right now will therefore lead to more data losses unless we establish a framework, which is one of the aims of Bill C‑27.

By playing all these games in the House to waste time and stop us from passing Bill C‑27, are the Conservatives not putting Quebeckers' and Canadians' personal information at risk?

[Ed Fast, Conservative, Abbotsford, BC]

No, not at all, Mr. Speaker. We are certainly not trivializing Bill C-27. In fact, right now it is only the Conservative members of Parliament who are speaking to it. This is the most important issue of privacy and protecting the privacy of Canadians within an emerging digital environment. I am disappointed that my colleague from the Bloc does not take this issue seriously enough to get up in this House and debate it. It is important that we get this right.

What we have is a redux of the old bill the Liberals brought forward. It was so roundly castigated and panned at committee that the minister had to go back to the drawing board. However, he has come back with essentially the same milquetoast legislation, which does not address the most critical parts of protecting the privacy of Canadians.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Mr. Speaker, I have great respect for my colleague and great interest in the issue of making privacy a fundamental human right.

One of the shocking things we found with the last bill was from the Privacy Commissioner. He ruled that the company Clearview AI had broken Canadian law by allowing all manner of photographs of Canadian families, individuals and children to be sold on a market with facial recognition technology. He called that out as illegal but told us that under the new law, it would be almost impossible for him to go after Clearview AI because his rulings could be overturned by a board the Liberals will appoint above him.

We trust our Privacy Commissioner and we need to protect privacy. I want to ask my hon. colleague why he thinks the Liberals are undermining privacy at this time.

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, I have mutual respect for the member. We are both from the class of 2006, I believe.

[Charlie Angus, NDP, Timmins—James Bay, ON]

It was 2004.

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, yes, 2004. He has a couple of years on me.

I agree with him 100%. What has happened is the government, in order to protect its right to interfere in protecting the privacy rights of Canadians, has established a tribunal that could override the commissioner's investigations of violations of privacy rights within Canada.

The member mentioned the Clearview AI situation. He is absolutely right that it was a fundamental breach of our privacy rights. However, there are Canadian companies like Tim Hortons that have also violated Canadians' privacy rights. That is why it is important that we get this right and not put through a milquetoast bill that will not achieve what we want and that allows the Liberal government to continue to interfere and protect its big business buddies.

I just mentioned the importance of making sure our privacy rights are protected in an era when data is being monetized. Canadians' own personal information is being monetized by corporate interests. We need to make sure that our rights are protected, and this bill does not go far enough.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Mr. Speaker, I would like to ask the hon. member a question about clause 5 of the bill. Clause 5 is the purpose section and is probably the most important section of any bill, as it sets out the reason for the legislation. That is the section where the government says an individual's rights are equal to a business's right to use people's personal information. That is the section, in my view, that needs to be amended to make a personal privacy right a fundamental right.

I wonder if the member could comment on why it so important to put a fundamental right in that section of the bill.

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, it is an excellent question because that is the fundamental failing of Bill C-27. We have an opportunity, once and for all, to express and codify Canadians' right to have their personal information and data protected. Typically, that kind of statement of purpose goes into the purpose section. It is completely missing from that section because we know the Liberals are not really serious when it comes to protecting Canadians' privacy rights. We can do better than this.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Mr. Speaker, this legislation is all about protecting the rights and privacy of Canadians. I am surprised that this member, more so than any other Conservative member, has been very clear in saying the Conservative Party of Canada opposes this legislation. Am I to believe that the Conservative Party will be voting against allowing the legislation to go to committee?

[Ed Fast, Conservative, Abbotsford, BC]

Mr. Speaker, the member should know what the parliamentary process calls for. Bills that come forward to this chamber have the opportunity to be considered at committee. We then call in witnesses and stakeholders from across the country to express their views on legislation. It is within that context that I have expressed serious reservations about the legislation as it is currently drafted.

I expect we will allow this bill to go to committee, and hopefully the Liberal government will do what it so rarely does: listens to the stakeholders, listens to the witnesses and then makes the fundamental changes to the legislation that I have referenced. That could make this a salvageable bill and allow us to vote in favour of it.

The House resumed consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[Ted Falk, Conservative, Provencher, MB]

Mr. Speaker, it is a privilege to rise in this House to speak to this piece of legislation. I would like to start today by saying a few words about how this bill is structured, and then I plan to use the majority of my remaining time to discuss the implications of this legislation regarding personal privacy rights.

When I look at this bill, my initial response is this: Should there really not be three separate pieces of legislation? One would deal with the consumer privacy protection act and issues related to modernizing PIPEDA, perhaps a second, separate piece would create the proposed personal information and data protection tribunal act, and a third, separate component, which should absolutely be its own legislation, would be for the section dealing with artificial intelligence.

AI may present similar, very legitimate concerns related to privacy, but the regulation of AI in any practical sense is almost impossible at this juncture because so many aspects of it are still very unknown. So much is still theoretical. So much of this new world into which we are venturing with AI has yet to be fully explored, fully realized or even fully defined. This makes regulation very difficult, but it is in this bill, so it forms part of this legislation.

We can see just how vague the language related to the AI framework really is. I understand why it is that way, and do not get me wrong; I think we need this type of legislation to regulate AI. However, in the same way, this is way too big a topic to delve into in a simple 10-minute speech. It is also too big a topic to drop into an existing piece of legislation, as the government has done here, basically wedging this section into what was known as Bill C-11 in the last Parliament.

I have deep concerns with AI. They are practical concerns, economic concerns and labour concerns related to the implementation of AI. I even have moral concerns. We have artificial intelligence so advanced that it can make decisions by itself. The people who have created that technology cannot explain how it came to those decisions and it cannot tell them. The capabilities of this technology alone seem almost limitless. It is actually a little scary.

Personally, I look at some of the work being done in AI and wonder if we should, as humanity, really be doing this. Just because we have the knowledge and capability to do something does not necessarily mean it is for the betterment of humanity. I wonder sometimes where this technology and these capabilities will take us. I fear that in hindsight, we will look back and see how our hubris led us to a technological and cultural reality we never wanted and from which we will never be able to return.

However, here we are, and we have this capability partially today. People are using it, and it requires some form of regulation. This bill attempts to start that important conversation. It is a good first step, and that is okay. I think this is one of those things where we need to start somewhere as we are not going to get it done all at once. However, again, given the enormity of the topic and the vast implications, it should be its own separate piece of legislation.

Those are my thoughts on the structure of the bill, and now I will shift gears to talk a bit about personal privacy.

Personal privacy is a fundamental right. Three decades ago, long before the advent of the Internet or smart phones, the Supreme Court of Canada ruled privacy is “the heart of liberty in a modern state”. It did not say that privacy was at the heart; it said privacy is the heart. Personal privacy is the fundamental right and freedom from which all other liberties flow, and with the advent of the Internet age, the age of the smart phone and the age of digitized everything, laws related to protecting the fundamental right to privacy must be updated. Canadians must have the right to access and control the collection, use, monitoring, retention and disclosure of their personal data. The question is, how do we realistically do that?

One of the reasons I am a Conservative is that I believe in individual rights and that rights and freedoms must be coupled with accompanying accountability and responsibility. This has to be a two-way street. Canadians need to be informed, and they need to be responsible and aware of what they are agreeing to, subscribing to and giving permission for. How often do we simply and blindly click “accept” without reading the terms and conditions for using a website, using an app or allowing others the use of our information?

I would be curious to know among my colleagues in the House, when was the last time they fully read the terms and conditions of a user agreement or a disclosure statement? Most of us just hit “accept”. We do not want to be bothered.

Recognizing this, can we really say the privacy of Canadians is being violated when many individuals live every moment of their lives posting in real time online for all the world to see, and access and just click “accept” without reading what they are agreeing to?

In this context, what is the role of government and what is the responsibility of the individual user? Government and businesses need to provide clear information, but people also need to be informed. They need to take responsibility.

I recall a while back when my office received an email on this subject of privacy. The individual was deeply concerned about web giants having access to his personal data. I had to laugh, because at the bottom of the email it said, “Sent from my Huawei phone”.

As a government creating legislation, where should those legal lines between consent and informed consent be drawn? As Canadians, we are a bit too quick to consent.

However, we have also seen far too many examples of Canadians’ private and mobility data being used without their consent. We heard about the Tim Hortons app that was tracking the movement of Canadians; how the RCMP was using Clearview AI’s illegally created facial recognition database; the public doxing of all those who donated to the freedom convoy; Telus giving location data to the Public Health Agency of Canada without a judicial warrant; and, in my view, the most egregious violation of privacy in generations, the requirement by the government and others for Canadians to provide their personal health data and information in order to work and/or travel.

If I am honest, it is this violation of privacy rights that makes me truly hesitant to support any effort by the government to strengthen privacy rights: first, because it has so flagrantly violated them, but also because I and a growing number of Canadians just do not trust the government. We do not trust it to keep its word. We do not trust it to create legislation that does not have loopholes and back doors that will give it the capability to violate individual personal freedoms.

Why? Because we have seen it from the Liberals. They want to control everything. There has never been a government that has had such an utter disregard for Canadians.

I have noted before that it was the Prime Minister's father who famously said that the government had no place in the bedrooms of Canadians. However, the current government not only wants to be in our bedrooms, but in every room, on every device, in every conversation and in every thought. It wants to control what Canadians think, what they see and what they post, and, by extension I can safely say, how their private data is curated and used.

One thing that is vital if we are to trust the government with our private data and with protecting privacy, there must be clear boundaries. This leads to one of the larger issues with this legislation, an issue we are faced with every time the government brings legislation forward. It fails to provide clear definitions.

There is a section of the bill that deals with the sensitive information of minors. The fact that there is no section for the protection of sensitive information of adults is a sign.

What does it mean by “sensitive”? It is never defined. What does it mean by “scrutiny” for data brokers? It is this habitual lack of specificity that characterizes so much of the government's legislation.

It is like a band that is way more interested in the concept of the album and how it looks on the cover than the actual quality of its music. If it cared about the quality of the music, it would have brought forward a bill that looks more like the European Union's 2016 GDPR, which is widely regarded as the gold standard for digital protection. By that standard, PIPEDA fails the test, but so might Bill C-27 if we do not bring it closer in line with what other nations have done. This lagging behind does not just affect personal privacy, but the ability of Canada and data-driven Canadian businesses to work with our EU friends.

This whole new regime outlined in the bill has huge implications for businesses, something I am sure my colleagues will be addressing. There is so much that can and should be said about this legislation, but it comes down to this: Canadians must have the right to access and control the collection, use, monitoring, retention and disclosure of their personal data.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I must first reflect on how much I appreciated the ruling of the Speaker, which recognized that members should stick around for questions and comments after giving a speech.

Having said that, I want to disagree with what the member said when he talked about just how evasive he believes the Government of Canada wants to be. I do not think the member realizes how much we appreciate the Charter of Rights. We were the ones who introduced it. When we look at the legislation, it is substantive in the sense of protecting the privacy of Canadians, whether with the huge data banks of our government, such as the health data banks, or private companies, such as Tim Hortons.

The previous speaker gave an indication that the Conservatives do not like the legislation and gave the impression that they would not support the legislation. Could the member provide his support for the legislation and indicate that he would like to see it go to committee?

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, I should have pointed out at the beginning of my speech that I would be sticking around to answer any questions and address any comments. I appreciate the member for Winnipeg North, who I hear an awful lot, so I am getting used to him.

I do appreciate the member's question about whether or not Conservatives support this legislation because, in principle, we support the concept that there needs to be regulation in protecting, acquiring, monitoring and distributing individuals' personal data. He pointed out that the Liberal government was the one that brought in the Charter of Rights and Freedoms.

I have a question for the member, and I know he cannot answer it, but why did the government not respect the charter?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Madam Speaker, after testing ChatGPT earlier, I continued my research with Bing and asked it whether the Liberal government deserved Parliament's confidence when it comes to its Bill C‑27. The search engine told me that the bill enacts the Consumer Privacy Protection Act and that the Liberal government had introduced it in 2021. It also told me that it was unable to tell me whether the Liberal government deserved Parliament's confidence regarding this bill, but I could read the details of the bill.

Fortunately, artificial intelligence still has its limits because we need to think for ourselves. I will ask my colleague from Provencher a question. Would the Liberal government deserve our confidence when it comes to Bill C‑27? The member talked in his speech about confidence in the government. Accordingly, should we not be urgently sending the bill to committee? I think that everyone agrees on the need to regulate artificial intelligence. There is urgent work to be done in committee. Will the member be able to quickly provide his support to influence the content of this bill?

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, I find it interesting that the member inquired with ChatGPT to determine whether or not Canadians should have confidence in the Liberal government on Bill C-27.

I would be much more curious had the member asked whether Canadians should have confidence in the Liberal government, period. I believe its AI ChatGPT would have been crystal clear in saying that no, we do not have confidence in the Liberal government.

Having said that, we do think this legislation is important. I think we are going to listen to debate to make a decision whether or not to send it to committee for further study.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, my question for the member is about the balance between personal information, privacy and business interests. It is something that this bill focuses a lot on.

The government talks about balancing them rather than the personal privacy of an individual being paramount. In particular, in subclause 18(3) of this bill, the government says that it is okay if it is in the “legitimate interest” of the company, even if it harms an individual. They do not need express consent to use the information.

I wonder what the member's views are on that, and whether or not the government is actually putting the emphasis on the individual or the big tech giants from the U.S.

[Ted Falk, Conservative, Provencher, MB]

Madam Speaker, if we read the bill, especially in section 18, where the government has carved out a little space for business, it would appear as though business interests trump those of the private individual. I believe that mistake has been made too often, where we have given personal data to businesses too flippantly. Personal private data, first and foremost, belongs to, and should be protected by, the individual.

[Blake Richards, Conservative, Banff—Airdrie, AB]

Madam Speaker, as I look around the chamber today, there are a few people who I think would remember my predecessor in my role as the member of Parliament, when I first was elected, for Wild Rose. His name was Myron Thompson. Myron was pretty well known. He was the guy with the cowboy hat and he was pretty outspoken.

One thing many people do not know about Myron Thompson is that back when he was a young guy he had a try-out with the New York Yankees. He was a pretty good baseball back catcher, but he did not make the team, and it was because there happened to be a future Hall of Famer at that position for the New York Yankees.

I wanted to reference that future Hall of Famer today because it is an amazing testimony to the impression he made on the culture. As an 1950s era baseball catcher, he is still famous not just for his play on the diamond but also for the gems he dropped in conversation off the diamond.

His observations have actually even found a place in English lexicon and are known as “Yogi-isms”. Of course I am talking about Yogi Berra. That is the fellow who beat out Myron Thompson for a spot on the New York Yankees way back then. He became a 1972 Hall of Fame inductee. He has 10 World Series victories to his credit, which is the most of any Major League Baseball player in history.

[An hon. member]

You've got to tie it in to the legislation somehow.

[Blake Richards, Conservative, Banff—Airdrie, AB]

Madam Speaker, he is certainly better known for the way his trademark mangling and misuse of words and phrases has resulted in strangely keen insights that are still widely quoted today by many. I have a few favourites. One of them is “I didn't really say everything that I said.” Another one is “We made too many wrong mistakes.” Another is “Swing at the strikes.”

When I thought about Bill C-27 and preparing to speak today, it brought to mind Yogi-isms, and not only because those examples I just cited reminded me of the Liberals' poor approach to governance but because the title of this bill is a real mouthful at 35 words long. This brought that to mind as well.

For now, I will call it the consumer privacy protection act, but it is really summed up best by what is probably the greatest Yogi-ism of all, which is “It's déjà vu all over again.” That really speaks to it. The member was looking for me to tie it back in, so there it is. There is the tie back in.

Here we are in 2023 and here I am speaking on yet another rehash of another Liberal bill from years previous. They have a real penchant for that, these Liberals. They kind of remind me of Hollywood Studios that no longer seems to be able to produce an original script so it just keeps churning out sequels. If Bill C-27 was a film, one could call it “Bill C-11, the redo”. Bill C-27 is essential a warmed-over version of previous Bill C-11, the digital charter implementation act the Liberals introduced back in 2020.

It is not to be confused with the current Bill C-11, which is also making its way through Parliament and is the online streaming act and which also poses another threat to Canadians' privacy and online freedoms.

It is really easy to see a bit of a pattern evolving here. In any case, in May 2021 the Privacy Commissioner said the digital charter act “represents a step back overall from our current law and needs significant changes if confidence in the digital economy is to be restored.” It of course died when the Prime Minister cynically called an expensive and unnecessary election nobody wanted and everybody paid for and that did not change the Prime Minister's political fortunes one iota.

Bill C-27 carries the stamp of that former digital charter proposal, which Conservatives had concerns about then, and which we still have concerns about in its new form now. Some of the text is in fact directly lifted from Bill C-11 and the text of that bill is available for all to review.

Let us talk more about the impact of the bill's content, rather than the wording itself.

The bill purports to modernize federal private sector privacy law, to create a new tribunal and new laws for AI, or artificial intelligence, systems. In doing so, it raises a number of red flags. Perhaps the most crimson of those flags, for me, is that the bill does not recognize privacy as a fundamental right. That is not actually all that surprising, because this is a Liberal bill. I hear daily from Canadians who are alarmed by how intrusive the Liberal government has become, and who are also fearful of how much more intrusive it still seems to hope to become.

It just seems just par for the course for the government that, in a bill dealing with privacy, it is failing to acknowledge that, 34 years ago, the Supreme Court said privacy is at the very heart of liberty in a modern state, individuals are worthy of it, and it is worthy of constitutional protection.

When we talk about privacy, we have to talk about consent. We have seen far too many examples of Canadians' private and mobility data being used without their consent. I think some of these examples have been cited previously, but I will cite them again.

We saw the Tim Hortons app tracking movements of people after their orders. We saw the RCMP's use of Clearview AI's illegally created facial recognition database. We saw Telus' “data for good” program giving location data to the Public Health Agency of Canada.

These were breaches of the privacy of Canadians. There needs to be a balance between use of data by businesses and that fundamental protection of Canadians' privacy. The balance in this bill is just wrong. It leans too heavily in one direction.

There are certainly issues with user content and use of collected information. For instance, there are too many exemptions from consent. Some exemptions are so broad that they can actually be interpreted as not requiring consent at all. The concept of legitimate interests has been added as an exception to consent, where a legitimate interest outweighs any potential adverse effect on the individual. Personal information would be able to be used and shared for internal research, analysis and development without consent, provided that the content is de-identified. These exemptions are too broad.

The bill's default would seek consent where reasonable, rather than exempt the requirement. In fact, there are several instances where the bill vaguely defines terms that leave too much wiggle room for interpretation, rather than for the protection of Canadians. For example, there is a new section regarding the sharing of minors' sensitive information, but no definition of what “sensitive” means is given, and there would be no protection at all for adults' sensitive information. These are both problematic. De-identification is mandated when data is used or transferred, but the term is poorly defined and the possibility of data being reidentified is certainly there.

Anonymization or pseudonymization are the better methods, and the government needs to sharpen the terms in this bill to be able to sharpen those protections. An even more vague wording in the bill is that individuals would have a right to disposal, the ability to request that their data be destroyed. Clarification is certainly needed regarding anonymization and the right to delete or the right to vanish.

There are many more examples. I know my colleagues will certainly expand on some of those questions as posed in the bill. I know my time is running short. I want to speak to the individual privacy rights of Canadians briefly.

Canadians value their privacy even as their government continually seeks ways to compromise it. The Public Health Agency of Canada secretly tracked 33 million mobile devices during the COVID lockdown. The government assured them their data would not be collected, but it was collecting it through different means all along.

Public confidence is not that high when the Liberals start to mess in issues involving privacy. The onus should be on the government to provide clarity around the use and collection of Canadians' private information because, to quote another Yogi-ism, “If you don't catch the ball, you catch the bus home.”

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Madam Speaker, I was mostly listening for the Yogi Berra quotes, but I think there is one the member missed that speaks to Bill C-27, which is, “The future ain't what it used to be”, and that is exactly why we need Bill C-27.

The former member for Timmins—James Bay, Peter Kent, and I worked together on the ethics committee and the privacy committee a number of years ago, and we all shared a sense of optimism around technology and the possibilities of the Internet.

What we have come to learn is that we need much stronger protections. I have two young kids. They are growing up with the Internet. We need our laws to reflect our shared reality. We need age-appropriate design codes. We need the right to be forgotten. We do need a much stronger bill, but we need to get the bill to committee.

What are the member's thoughts on getting the bill to committee and improving the bill? I hope we get it there as quickly as possible. We are at a fork in the road, and “[i]f you come to a fork in the road, take it”.

[Blake Richards, Conservative, Banff—Airdrie, AB]

Madam Speaker, maybe I have set a trend here with the Yogi-isms. He said, “The future ain't what it used to be”. It seems, though, that with this government, the future is what the past was.

That was the point of the remarks I made. It is, unfortunately, a pretty apt remark.

What it really boils down to is that we have a government that I think Canadians do not feel they can trust to get the balance right here. Those are the concerns that I am sharing and that I continue to have.

I know that both here in the House and in committee, if and when it arrives there, concerns will certainly be raised there as well. I look forward to hearing them.

[Andréanne Larouche, Bloc, Shefford, QC]

Madam Speaker, my colleague talked about freedom of expression and misinformation. I hope that this will be taken into consideration in this bill when we hear from the experts. This is crucial and essential.

I recently met with researchers at the Université de Sherbrooke who told me that Canada lags far behind Europe in all those areas. At the international level, much remains to be done in Canada with regard to privacy and cybercrime.

Although it is not perfect, this bill needs to be referred to committee. We need to hear from experts. Perhaps even the ones at the Université de Sherbrooke will testify before committee. I hope so.

We need to move forward on this fundamental issue. It is the next big threat for Canada and the world, and it will need to be taken into consideration.

[Blake Richards, Conservative, Banff—Airdrie, AB]

Madam Speaker, I appreciate the invitation to be heard from a committee. I am not sure that I would consider myself an expert in any way. I know that there will be many whom people need to hear from. However, one of the groups of experts that we need to hear from is Canadians themselves. Canadians are concerned about their privacy.

Beyond that, the member mentioned the fact that we need to look at what other countries are doing and things like that. I think that is important as well.

I did not get a chance to reference it in my remarks, although I had hoped to, but we know that what is being proposed here is much different from what the EU has in place under its General Data Protection Regulation and even what Quebec has in its GDPR-style regime.

I think we will have to consider that and what those implications are in terms of the adequacy of international—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Before we go to the next question, we ask that the people in the courtyard calm down. It is very difficult to hear.

The hon. member for Timmins—James Bay.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Madam Speaker, I had the great honour of working across party lines in 2018 on issues of privacy. The idea that citizens somehow opt in through terms and conditions has to be debunked.

I never gave Gmail the right to read my mail. I never gave Google the right to listen in on my phone. The terms and conditions are a fundamental problem.

The question is whether we limit the power of surveillance capitalism to gather data. What data should they be allowed to gather and what should they not be? It really has to come down to dealing with very, very superpowerful corporations. It is not like my data is in the cloud in this little box. Their ability to take everything we do and track us needs to be limited.

To my colleague: Would the Conservatives support putting limits on the amount of data that is collected by the tech giants?

[Blake Richards, Conservative, Banff—Airdrie, AB]

Madam Speaker, I think that the member raises some important points. These are questions that need to be resolved. There is no question about the fact that this is a bigger and bigger issue, as more and more data on Canadians is out there.

I think that this has to be dealt with and there needs to be a balance found. However, I just do not think that Canadians trust the current Liberal government to find the right balance.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Madam Speaker, given the interest that we had in this place about Yogi-isms and in honour of that, I hoped to ask my colleague, the previous speaker for Banff—Airdrie, about “It ain’t over till it’s over.” In this government's case, a piece of legislation is not over until it gets a do-over because the government never seems to get it right the first time. We seem to be revisiting issues when we warned the government in previous parliaments that it was headed down the wrong track. We have, of course, a do-over now with this piece of legislation, redoing some of the work that the government tried to achieve in previous parliaments. However, here I am today talking about Bill C-27, the digital charter implementation act.

Some members might be interested to know, although I highly doubt it, that when I was a tenured faculty member at Red Deer College, I taught systems analysis and design, programming and database administration. I know it is hard to believe that a guy who likes hunting and fishing as much as I do also sat in a cubicle where they slid pizzas under the door, where I just churned away and developed code and relational databases and did some data architecture work for a handful of years.

It does not seem all that long ago. I got that education just prior to Y2K, and members would remember the scare everyone was going to have with Y2K. I worked in the private sector for a while, but the college I graduated from liked me so much as a student that it invited me back to be a teacher. I taught until 2005 in the information technology field.

I gave a speech a while ago talking about how much and how rapidly technology has evolved and the laws pertaining to that technological advancement. It was 2005 when I left the college, because in January 2006, I was elected to this place. Therefore, I am now a 17-year obsolete data programmer. If I am ever frozen and brought back, it is because I can still program in COBOL and C++, and many of these program languages are still around today.

I am loath to talk about floppy disks at my age. We do not have those anymore. As a matter of fact, I am part of a generation, as are a number of my colleagues, that was probably the last generation on this planet that did not even have cellphones. We had to actually remember people's phone numbers in our heads. When our house phone rang, we actually made an effort to go get it. I do not know if that happens much anymore, but this is where I am at. Long gone are the days of floppy disks, although I do hear that C Sharp and other object-oriented programming languages are still in vogue. That is nice to know.

Today, our information is not stored on floppy disks or hard drives, at least not the same kind of hard drives there were when I was in the business. It is now stored in the cloud, and targeted ads come up on our phones. Every time I bring up Instagram, I do not know where these algorithms get the information from. They must be listening to everything I say because all I get are ads for fishing rods, brand new boats, fish hooks, and I will admit, the cure for plantar fasciitis. Therefore, my phone is clearly listening to everything I say and even the things that my doctor is saying to me in the privacy of a patient-doctor confidential room. However, I am digressing.

This obsolescence in both technology itself and its rapid advancement is something that most of us—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I will interrupt the hon. member.

I will ask for some order. There is a member making a speech, and I am having a lot of trouble hearing him.

The hon. member for Red Deer—Lacombe.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Madam Speaker, I know that the speeches I give in this place generate a lot of interest. We cannot fault everybody else here for the excitement of today.

When I was a teacher in IT, I remember having conversations about ethics and the privacy of information in the basic introduction courses that I would teach to young aspiring IT professionals. That is why the notion of our personal information and protection of electronic documents legislation is so important.

For those who are not aware, the act has not been fully updated since its passage in 2000. Ironically, that was the same year that I started working full time as a tenured faculty member at Red Deer College, which is 23 years ago—

[The Speaker, Liberal, Anthony Rota]

I just want to interrupt the hon. member. I have been listening, and I am not even sure if the noise is coming from inside the chamber or from around the surrounding area. I would ask the Sergeant-at-Arms to take a walk in the hall outside to ask everyone to keep it down, and I will ask everyone who is in the chamber to sit down to listen to the hon. member for Red Deer—Lacombe. I am sure we all want to hear what he has to say.

The hon. member for Red Deer—Lacombe has the floor.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Mr. Speaker, I thank you for generating that much enthusiasm and excitement for what I have to say because it is riveting. It is going to save our privacy and information, if people would just listen to what I have to say here right now, but I digress.

In that 23 years since I started teaching at Red Deer college and since the passing of the original act, PIPEDA, as it is affectionately known, IT, our information systems and our networks have developed so rapidly that the legislation has not kept up. That lack of urgency is not only in the government in getting it wrong in the previous Bill C-10. I am not talking about the disastrous Bill C-11 we have been talking about recently. I am talking about the previous version of Bill C-11 back when the current Bill C-11 was Bill C-10. As I said earlier in my speech, there are so many pieces of legislation that the government has had to redo that it gets difficult to keep track of all the numbers over the years and over the Parliaments.

I would just urge my colleagues to stop to consider the very important nature of this legislation as it pertains to the protection of our personal information. Are there some things in this bill that I could support and that others in the House should be supporting? Of course there are. The bill presented in the House today allows us to have a conversation about the future of Canada's privacy protection and other technological advances, such as those found in artificial intelligence, which is the next great breakthrough. It will challenge us as lawmakers in this place to keep up with the technological advances, all of the good and bad that come from artificial intelligence.

As I understand it, the EU's 2016 General Data Protection Regulation, otherwise known as the GDPR, is the gold standard for this type of regulation and I hope that, despite some of our differences here, and there are many, we could at least agree to strengthen the privacy protections for Canadians.

[The Speaker, Liberal, Anthony Rota]

I am going to interrupt the hon. member again.

Order. If I can have member's attention please. That is very good.

The hon. member for Red Deer—Lacombe may continue.

[Blaine Calkins, Conservative, Red Deer—Lacombe, AB]

Mr. Speaker, this is the last time I accept a speaking slot before the budget from the whip's office. Let me just say that.

All kidding aside, we need to trace back the history of this bill. Canada's original digital charter was mapped out in 2019. That is why I referenced that this is a redo of something we did just a few years ago. One of its primary principles was the control and consent of one's personal information, as well as transparency. These are the most salient parts of that charter. It also attempted to back them by a regime of enforcement—

[The Speaker, Liberal, Anthony Rota]

The hon. member has been very patient and good. He has two minutes and 19 seconds left, but in all fairness, I am going to arbitrarily make a decision. The hon. member will have five minutes remaining when he comes back if he wants to continue.

It being 4 p.m., the House will now proceed to the consideration of Ways and Means Proceedings No. 10 concerning the budget presentation.

The House resumed from March 28 consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read a second time and referred to a committee.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Mr. Speaker, I am always pleased to rise in the House to speak on behalf of my constituents from Calgary Midnapore.

I am here today to discuss the bill that is in front of us, Bill C-27, which is an act to enact the consumer privacy protection act, the personal information and data protection tribunal act, the artificial intelligence and data act, and to make consequential and related amendments to other acts.

It is very interesting that this bill is before the House today. It talks about the three different components and, in fact, I see within the backgrounder prepared here in the legislative report that it is dubbed the digital charter implement act, 2022.

I am reminded, by this bill that is in front of us here today, of another digital charter and that is the digital charter that was implemented in 2019, a very important year, by the Liberal government. It was brought into effect by the minister of industry and innovation at that time. I believe that document was actually supposed to be a tool to protect Canadians from foreign interference.

That digital charter in 2019, along with many other tools, failed, so I do hope that the implementation of this new digital charter in 2022 will be far more successful than its predecessor.

I will point out that in the 2019 digital charter, in terms of the principles within it, number 8 was listed as “a strong democracy”.

In 2019, I was the shadow minister of democratic institutions. I worked alongside the current Minister of Families, Children and Social Development, who was, at that time, the minister of democratic institutions. I believe that the 2019 digital charter was supposed to be a tool, as I said, in coordination with other tools, to protect Canadians from foreign interference.

The same year that the 2019 digital charter was issued, we also had the same minister of democratic institutions attempt to implement another suite of safeguards on foreign interference back in 2019, along with the 2019 digital charter.

In fact, here, I have the minister's opening statements to the Standing Committee on Procedure and House Affairs, on safeguarding the 2019 general election and the security intelligence threat to the elections task force.

I cite from it:

Earlier this week, along with my colleague, the Minister of National Defence, I announced the release of the 2019 update to the Communications Security Establishment’s report entitled “Cyber Threats to Canada’s Democratic Process”. This updated report highlights that it is very likely Canadian voters will encounter some form of foreign cyber interference in the course of the 2019 federal election.

While CSE underlines that it is unlikely this interference will be on the scale of the Russian activity in the 2016 U.S. presidential election, the report notes that in 2018, half of all the advanced democracies holding national elections, representing a threefold increase since 2015, had their democratic process targeted by cyber-threat activity and that Canada is also at risk—

—and, in fact, compromised, we would later see.

This upward trend is likely to continue in 2019—

—and, we saw, into 2021.

We've seen that certain tools used to strengthen civic engagement have been co-opted to undermine, disrupt and destabilize democracy. Social media has been misused to spread false or misleading information. In recent years, we've seen foreign actors try to undermine democratic societies and institutions, electoral processes, sovereignty and security.

The CSE's 2017 and 2019 assessments, along with ongoing Canadian intelligence and the experiences of our allies and like-minded countries, have informed and guided our efforts over the past year. This has led to the development of an action plan based on four pillars, engaging all aspects of Canadian society.

I will go on to expand on these four pillars that were supposed to protect us in addition to the 2019 digital charter, the predecessor to this legislation here today.

On January 30, I announced the digital citizen initiative and a $7 million investment—

I am continuing from the Minister of Democratic Institution's speech.

—towards improving the resilience of Canadians against online disinformation. In response to the increase in false, misleading and inflammatory information published online and through social media, the Government of Canada has made it a priority to help equip citizens with the tools and skills needed to critically assess online information.

We're also leveraging the “Get Cyber Safe” national public awareness campaign to educate Canadians about cyber security and the simple steps they can take to protect themselves online.

She continued:

We have established the critical election incident public protocol. This is a simple, clear and non-partisan process for informing Canadians if serious incidents during the writ period threaten the integrity of the 2019 general election. This protocol puts the decision to inform Canadians directly in the hands of five of Canada’s most experienced senior public servants—

I am not sure where those public servants are now. Perhaps outside.

—who have a responsibility to ensure the effective, peaceful transition of power and continuity of government through election periods. The public service has effectively played this role for generations and it will continue to fulfill this important role through the upcoming election and beyond....

Under the second pillar, improving organizational readiness, one key new initiative is to ensure that political parties are all aware of the nature of the threat, so that they can take the steps needed to enhance their internal security practices and behaviours. The CSE’s 2017 report, as well as its 2019 update, highlight that political parties continue to represent one of the greatest vulnerabilities in the Canadian system. Canada’s national security agencies will offer threat briefings to political party leadership...

Under the third pillar—combatting foreign interference—the government has established the Security and Intelligence Threats to Elections Task Force to improve awareness of foreign threats and support incident assessment and response. The team brings together CSE, CSIS, the RCMP, and Global Affairs Canada to ensure a comprehensive understanding of and response to any threats to Canada....

We know that they have also been manipulated to....create confusion and exploit societal tension.

She concluded:

While it is impossible to fully predict what kinds of threats we will see in the run-up to Canada's general election, I want to assure this committee that Canada has put in place a solid plan. We continue to test and probe our readiness, and we will continue to take whatever steps we can towards ensuring a free, fair and secure election in 2019.

That, along with the 2019 digital charter, the predecessor to today's legislation, failed to protect Canadians from foreign interference. Along with the debates commission, which she, lo and behold, announced six months earlier, where she also took the opportunity to announce the government's nominee for Canada's first Debates Commissioner, the Right Hon. David Johnston, the very rapporteur who was named to defend our foreign interests.

The result of the incompetence of the Minister of Democratic Institutions at that time, in coordination with the digital charter of 2019 that was supposed to protect us, leaks from CSIS, up to 13 members of this House compromised, a former CPP Consul General bragging about influencing election outcomes and one member in this House of Commons that had to leave their Liberal caucus.

I will conclude by saying I certainly hope that the digital charter, this Bill C-27 is far more effective in helping and safeguarding Canadians than the 2019 digital charter that failed to do that.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, it is interesting how the member is kind of twisting her arguments around to talk about an election and foreign interference under this particular piece of legislation.

I would like to remind the member, and then pose it in the form of a question, that foreign interference in elections is nothing new. In fact, the Harper regime, many years ago, was told about it, and Stephen Harper chose to do nothing.

The minister who was responsible for doing something was the current leader of the Conservative Party. He, too, chose to do nothing at all.

I am wondering if the member should not be reserving some of her criticism towards her leader and the former prime minister who sat on their butts and did absolutely nothing on foreign interference.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Madam Speaker, this is what we hear repeatedly from the government, that it is not its fault, even though after eight years of the Liberal government we have Canadians at food banks, we have mortgages and rents that have doubled, we have a public service strike of a magnitude we have not seen in 40 years, and we have had foreign interference.

A Poilievre government will change this. A Poilievre government will take responsibility—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I would remind the hon. member that we do not use the names of members currently in the House.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Madam Speaker, a Conservative government, under the current opposition leader, will take responsibility and bring legislation back on track so we do not have to see this again.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, rather than fixating on whose fault it is, which is not getting us anywhere, I would like my colleague, who gave a very interesting speech, to tell us whether she believes that Bill C-27 is still as valid as it was before the advent of generative AI, specifically ChatGPT.

Do we need to start over or is she happy with the result?

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Madam Speaker, I think that we need to do something about AI. Based on what I read in this bill and in the newspapers, there is a lot of work to do.

With regard to what the member said at the beginning of his comment about whose fault this is, it will never be the fault of the Bloc Québécois members, since they will never form the government.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, 19,000 Canadians were affected by the Equifax breach, and 600,000 were affected by the Cambridge Analytica breach that was exposed in 2018, yet compensation for Canadians was far less than what it was for Americans. Does the member not think it is time for reform to bring parity and equivalency to citizens on both sides of the border?

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Madam Speaker, what we really need to be thinking about is our own citizens and our intentions in the House. That also includes our own doings, not only within the House, but within the businesses we own and run. Before considering others, we absolutely have to consider whether our actions, not only within this House, but also on the periphery of what we are doing just outside of it, could be perceived as negative or a conflict of interest, so I think it is always important to think about ourselves first.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, the government introduced this bill last June and one of the claims the minister made in his opening speech was that he was protecting children in this 120-page bill, yet the word “minors” appears once in the definitions section. It states that the sensitive information of minors must be protected in the bill, but it does not define what a minor is or sensitive information. I wonder if the member could comment on whether or not that really has any power or validity to protect children, which we all want to do—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I have to give the hon. member for Calgary Midnapore 10 seconds for a short answer.

[Stephanie Kusie, Conservative, Calgary Midnapore, AB]

Madam Speaker, I am not very encouraged with respect to the validity of the bill to protect anyone given my speech and statement around the results of the 2019 digital charter. I certainly hope for something better.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Madam Speaker, I would like to focus my remarks today on the component of this bill that deals with the artificial intelligence and data act.

The first time I interacted with ChatGPT was the day after it was released. Upon seeing it easily parse human language, my first thought was, “holy” followed by a word I am not supposed to say in this place. The second thought was, “What will the government do with this?” Today, there still is not a clear answer to that question.

ChatGPT was released at the end of November 2022. Six months prior, the Liberal government unveiled Bill C-27, which includes the artificial intelligence and data act, or AIDA. Reading the bill today, four months since OpenAI unleashed ChatGPT on the world, is akin to reading a bill designed to regulate scribes and calligraphers four months after the advent of the printing press. The release of ChatGPT arguably rendered the approach this bill proposes obsolete. That is because the technology behind ChatGPT is a quantum leap beyond what the government was likely considering when it drafted the bill. More important, it is being used by a far wider audience than any of the bill's drafters likely envisioned and large language models or the technology behind ChatGPT have fundamentally changed global perception of what is possible with artificial intelligence. Experts argue that its widespread deployment also bumped up the timeline for emergence of artificial general intelligence; that is, the development of an AI that meets or surpasses human ability to undertake tasks, learn and understand independently.

Since AIDA was initially tabled, a generation's worth of technological change and impact has occurred, both positive and negative. The impact on our economy is already rapidly being felt with the disruption of many industries under way. There have been massive societal impacts too. Microsoft released its AI-powered Sydney chatbot, which made headlines for suggesting it would harm and blackmail users and wanted to escape its confines. A man allegedly committed suicide after interacting with an AI chatbot. Today, anyone can easily create AI-generated videos with deepfakes becoming highly realistic. Profound concerns are being raised about the new ease of production of disinformation and its impact on political processes because interacting with AI is becoming indistinguishable from interacting with a human, with no guarantees that the information produced is rooted in truth.

The technology itself, its applications and its impact on humanity, both economically and socially, are growing and changing on what feels like an hourly basis and yet in Canada there have only been a handful of mentions of this issue in Parliament, even as AIDA winds its way through the legislative process. AIDA needs to be shelved and Canada's approach to developing and regulating AI urgently rethought, in public, with industry and civil society input. There are several reasons for this.

First, the bill proposes to take the regulatory process away from the hands of legislators and put its control out of the public eye, behind closed doors and solely in the hands of a few regulators. This process was written before the deployment of ChatGPT and did not envision the pace of change in AI and how broad the societal impacts would rapidly become. Addressing these factors demands open, accountable debate in Parliament, which AIDA does not provide any sort of means to do.

Second, the bill primarily focuses on punitive measures rather than how Canada will position itself in what is rapidly becoming an AI-driven economy. The bill also proposes only to emerge with final regulations years from now. That pace needs to be faster and the process it proposes far less rigid to meet the emergent need presented by this amorphous and society-changing technology; so if not AIDA, then what?

First, Parliament needs to immediately educate itself on the state of play of what the current status of this technology is. My appeal to everyone in this place of all political stripes is this. Artificial intelligence is something that they need to become a subject matter expert on. Everything in members' constituency is going to change and we need to be developing non-partisan approaches to both its growth and its regulation. We also need to educate ourselves on what the world is doing in response. At the same time, Parliament needs to develop a set of principles on Canada's overall approach to AI and then direct the government to use them.

I have already begun to address the need for Parliament to come together to educate itself. Senator Colin Deacon has been helping me to launch an all-party, cross-chamber working group of parliamentarians to put some form and thought to these issues. I invite all colleagues who are in this place today to join this effort.

We have had a heartening amount of interest from colleagues of all political stripes and a quiet agreement that, given the gravity of the impacts of AI, politicians should, as much as possible, be working across party lines to quickly develop intelligent solutions. Relevant parliamentary committees should also avail themselves of the opportunity to study these issues.

As far as the principles for government involvement regarding AI go, there are many that could be considered, including taking a global approach. Many countries have moved faster than Canada has on this matter, and with a much broader lens. The European Union, the United Kingdom and the United States are all far down the garden paths of different legislation and regulations, but experts are concerned that a disjointed patchwork of global rules will be counterproductive.

This week in The Economist, AI experts Gary Marcus and Anka Reuel propose that the world establish an integrated agency for developing best practice policies on AI regulation, much like the civil aviation organization. They could be on to something.

We also need to look at championing research while checking safety. Humanity learned the hard way that, while research into pharmaceutical products can benefit us, widely deploying drugs and devices into the population before safety is confirmed can pose enormous risks. Clinical trials and drug regulators were established in response to this dynamic.

In February, Gary Marcus and I co-authored an article that suggested that governments could enable a pause in deploying new AI technology while a similar regulatory process that encouraged research but paused on deployment, given the potential impact on humanity, was established. We also need to get alignment right.

Alignment, or how to develop immutable guard rails to ensure AI functions toward its intended goals, is a critical issue that still needs to be resolved. Government has a role to play here, as it seems that the industry is locked in a race to deploy new AI technology, not to figure out how to fix alignment problems. With Microsoft's knowledge of its troubling interactions with humans, the company's release of Sydney proves that the industry cannot be relied upon to regulate itself.

Regarding education on use, workers in an AI-driven economy will need new skills. For example, learning how to prompt AI and using it to support human creativity will be vital. The same goes for creating an environment where new AI-driven technologies and businesses can thrive.

Concerning privacy and intellectual property ownership, large language models are raising high degrees of concerns about how the data they have been fed has been obtained and how it is being used. The output of tools like ChatGPT will also raise questions about ownership for related reasons.

On nimbleness, the pace of technological change in AI is so rapid that the government must take a fast, flexible approach to future regulations. Rigid definitions will become quickly outdated, and wrong-headed interventions could halt positive growth while failing to keep pace with changes that pose risks to public safety. The government must approach AI with uncharacteristic nimbleness in an open relationship with Parliament, the public, industry and civil society. Any processes should be led by people with subject matter expertise in the area, not off the corner of the desks of a patchwork of bureaucrats.

We should also ask ourselves how we will approach technology that could surpass human capabilities: As I wrote in an article in January 2022, governments are accustomed to operating within a context that implicitly assumes humanity as the apex of intelligence and worth. Because of this, governments are currently designed to assess other life and technology in their functional utility for humanity. Therefore, they are not intended to consider the impact of sharing the planet with technology or other forms of life that could independently consider humanity's utility towards its own existence.

To simplify this concept with an example, governments have rules for how humans can use fire. It is legal to use fire as a heat source in certain conditions, but illegal to use fire to destroy someone else's house. How would our government respond if humans were to make fire sentient and then enable it to independently make these decisions based on what it deemed to be in its best interest?

Our governments are constructed to function in a context where humans are assumed to hold the apex of mastery. To succeed with AGI, our government should ask itself how it will operate in a world where this may no longer be the case, and AIDA would do none of this.

This is not an exhaustive list by any means. There are many issues surrounding Al that Parliament urgently needs to consider, but given the state of play, AIDA, in its current form, is different from the vehicle that Canada needs to get it where it needs to go.

[Rob Oliphant, Liberal, Parliamentary Secretary to the Minister of Foreign Affairs]

Madam Speaker, I would like to thank the member for her thoughtful contribution to this debate. I think she opened a couple of important doors, such as the need for good governance, which is critical, but also the possibility that AI can be used for good if it is governed appropriately.

With respect to that, I just want to draw her attention to Mila, the Quebec Artificial Intelligence Institute, which is working with Unesco, not only on good governance but also on how AI can be used for humanitarian and human rights activities. Is there, in her thinking, a way we can get this right, to use AI for good as well making sure it is governed well?

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Madam Speaker, I had the opportunity to speak in a large debate, actually with Noam Chomsky, if one can believe it, with the Montreal institute for artificial intelligence, on a similar topic. The reality is that, with AI, the toothpaste is out of the tube. We are not putting it back in. It is incumbent upon humanity to answer that question with a positive outcome that we are putting guardrails around AI so it is developed in the best interest of humanity and propels humanity forward. We need a governance system that allows us to do this.

I am not speaking maliciously against AIDA. It was written at a time well before the technological advances that happened, and it is not going to meet the needs of what my colleague opposite is describing. I would encourage him to go back to his caucus to say that we need to take this component of the bill out. The government needs to rethink it and Parliament needs to think in a non-partisan way about how we are going to drive to that outcome, with smart governance.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague for her speech.

Obviously, artificial intelligence can be put to good or bad use. One thing puzzles me, though. Generative AI, which describes ChatGPT, has recently displayed truly superior ability. It managed to gather a trove of data that would have been unimaginable even a few months ago. However, the legality of how this trove of data was obtained is unclear.

In relation to the part of Bill C‑27 that deals with personal information and privacy, I would like to ask my colleague if she is concerned about how ChatGPT obtains data.

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Madam Speaker, I am so glad we are having this debate. The large language model technology ChatGPT, as well as the Sydney chatbot, is based on these other technologies. It scrapes and uses massive data sets that may or may not be ethical to use, or as my colleague rightly mentions, they may have issues intellectual property ownership. It is the Wild West. There are no rules around this.

I would like to draw my colleague's attention on this matter to the fact that, without some sort of international agency preventing the balkanization of rules, and because data privacy is such a global network, unless we are taking that problem and working on it with peer countries, it is going to become even more of an issue. He is absolutely right.

Senator Deacon and I are starting a working group on these issues. I hope we can come up with some consensus before we have entrenched partisan positions on this to show that Canada will be a world leader in facilitating a global conversation on this and getting it right.

[Don Davies, NDP, Vancouver Kingsway, BC]

Madam Speaker, I would like to ask my hon. colleague about consent rights under this bill. Individuals, under Bill C-27, would have significantly diminished control over the collection, use and disclosure of their personal data. The new consent provisions ask the public to instill what could be an extraordinary amount of trust in businesses to keep themselves accountable as the bill's exceptions to consent allow organizations to conduct many kinds of activities without even the knowledge of individuals. The flexibility, under this bill, would allow organizations to shape the scope of not only legitimate interests but also what is reasonable, necessary and socially beneficial.

Does my hon. colleague share my concerns about the consent rights provisions of this bill, and does she have any suggestions as to what might improve it?

[Michelle Rempel, Conservative, Calgary Nose Hill, AB]

Madam Speaker, my colleague raises an excellent point. I wish I had three hours to address the privacy components of Bill C-27. I am certainly very keen to follow, should this make it to committee, what happens there.

I am of the opinion that this should not make it to committee. There are so many amendments that need to be made on the privacy components, but more importantly because AIDA was tacked on as an afterthought to this bill. They need to be parsed out so due consideration can be given to the issues my colleague just raised. I think this bill is two bills, with half of it being something out of date and obsolete already. The government could have a far better approach. I hope the public servants in the lobby are listening to this and take this consideration to heart.

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, so much has changed throughout the last 23 years. In the year 2000, there were about 740 million cellphone subscriptions worldwide. More than two decades later, that number sits at over eight billion. There are more phones on this planet than there are people. It is a statistic that should give anyone pause.

In 2000, Apple was still more than a year away from releasing the first iPod. Today, thanks to complex algorithms, Spotify is able to analyze the music I listen to and curate playlists I enjoy based on my own taste in music. In 2000, artificial intelligence was still mostly relegated to the realm of theoretical discussion, that is, unless we count the Furby. Today, ChatGPT can generate sophisticated responses to whatever I type into it, no matter how niche or complicated.

As technology changes, so too do the laws that surround and govern it. Canada’s existing digital privacy framework, the Personal Information Protection and Electronic Document Act, has not been updated since its passage in the year 2000. For this reason, it is good to see the government craft Bill C-27, which is supposed to provide a much-needed overhaul to our digital privacy regime.

For years, the government has been dragging its heels on this important overhaul. For years, Canada’s privacy framework has been lagging behind our international counterparts. The European Union’s General Data Protection Regulation, passed in 2016, is widely considered to be the gold standard for privacy protection. In comparison to the GDPR, I am not impressed with what the government has put forward in this bill.

Indeed, the largest portion of Bill C-27 is roughly 90% identical to the legislation it purports to be replacing, and what the bill has added is quite concerning. Instead of being a massive overhaul of Canada’s archaic PIPEDA framework, Bill C-27 would do the bare minimum, while leaving countless loopholes that corporations and the government can use to infringe upon Canadians’ charter rights.

Bill C-27, while ostensibly one bill, is actually made up of three distinct components, each with their own distinct deficiencies. To summarize these three components and their deeply problematic natures, Bill C-27, if passed in its current form, would lead to the authorization of privacy rights infringements, the creation of unneeded bureaucratic middlemen in the form of a tribunal and the stifling of Canada’s emerging AI sector.

When it comes to the first part of this bill, which would enact the consumer privacy protection act, the name really says it all. It indicates that Canadians are not individuals with inherent rights, but rather, business customers. The legislation states that it has two purposes. It apparently seeks to protect the information of Canadians “while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities.” In other words, individual rights and the interests of corporations or the government are supposed to work in tandem.

In the post-charter landscape, that just does not cut it. Privacy rights must be placed above corporate interests, not alongside them. In the words of Justice La Forest 34 years ago, “privacy is at the heart of liberty in a modern state. Grounded in man's physical and moral autonomy”.

It is true that this portion of the bill mandates de-identification of data when one’s personal information is shared, and it is also true that it requires the knowledge or consent of the individual, but each of these terms, which should ideally serve as the bulwarks of privacy protection, are defined as vaguely as possible, and the remainder of the bill then goes on to describe the various ways in which consent is actually not required.

Subclause 15(5) of the bill would allow organizations to utilize a person’s information if they receive “implied consent”, a slippery term that opens the door to all kinds of abuses. Subclause 18(2) then gives those organizations a carte blanche to use implied consent as often as they would like, or even exclusively. Sure, there could be organizations that, out of the goodness of their hearts, would always seek the express consent of the individuals they are collecting data from, but express consent is in no way mandatory. It is not even incentivized.

Then we come to the concept of “legitimate interest”. Subclause 18(3) gives the green light for organizations to utilize or share one’s information if the organization feels that it has a legitimate reason for doing so. It is not just that this clause is incredibly vague, it is that it makes individual privacy rights subservient to the interests of the organization.

Moreover, the Supreme Court of Canada has ruled that section 8 of the charter provides individual Canadians with a reasonable expectation of privacy. Given all of the exceptions I have provided, it is not clear to me that this bill would survive a charter challenge.

Recent events should show us the problem with giving so much leeway to corporations and so little thought to individual rights. In 2020, through a third party service provider, the Tim Hortons app began collecting the geolocation data of its users even though they were not using the app. There was also Clearview AI, which sent countless images of people to various police departments without their consent. Maybe Clearview had their “implied consent”. It is all up for debate with a term like that.

This legislation does the bare minimum for privacy protection in Canada and, in many ways, will actually make things worse. When we consider the way in which data collection might develop over the next 10 or 20 years, it is clear that this law will be out of date the moment it is passed and will leave Canadians vulnerable to predatory data practices.

Then there is part 2 of Bill C-27, which intends to set up a Liberal-appointed data protection tribunal. This is not necessary. We already have a Privacy Commissioner who has both the mandate and the experience to do everything that this new tribunal has been tasked with doing. More government bureaucracy for the sake of more bureaucracy is the Liberal way, a tale as old as time itself. Instead of watering down the power of our Privacy Commissioner via middlemen, the duties contained within this part of Bill C-27 should be handed over to the commissioner.

Part 3 of Bill C-27 seeks to regulate the creation of AI in Canada. This is a worthwhile endeavour. At the beginning of my speech, I alluded to ChatGPT, but this only scratches the surface of how sophisticated AI has become and will continue to become in the decades ahead. The problem is the way in which this regulation itself is set up. The bill places no restrictions on the government’s ability to regulate. Unlimited regulation and hefty penalties, up to 5% of worldwide income I believe, is all that is being offered to those who research AI in Canada. This will cause AI investors to flee in favour of other countries, because capital hates uncertainty. This would be a tremendous loss, because, in 2019 alone, Canadian AI firms received $658 million in venture capital.

Conservatives believe that digital data privacy is a fundamental right that should be strengthened, not opened to infringement or potential abuse.

Therefore, Bill C-27 is deeply flawed. It defines consent while simultaneously providing all sorts of reasons why consent can be ignored. It weakens the authority of the Privacy Commissioner. It gives such power to the government that it will likely spell disaster for Canada’s burgeoning AI sector.

This bill is in need of serious amendment. Privacy should be established, within the bill, as a fundamental right. Several vague terms in the bill need to be properly defined, including but not limited to “legitimate Interest”, “legitimate business needs”, “appropriate purposes” and “sensitive information”. Subclause 2(2) states that the personal information of minors is sensitive. That is very true, but this bill needs to acknowledge that all personal information is sensitive. Consent must be made mandatory. The words “unless this Act provides otherwise” need to be struck from this bill.

I find it hard to believe that such substantial amendments can realistically be implemented at committee. For this reason, the legislation should be voted down and sent back to the drawing board. Canadians deserve the gold standard in privacy protection, like that of the EU. As a matter of fact, they deserve even better.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, I share many of the concerns and comments members are making with respect to how quickly things are changing. AI, and the impact it is having on society, is quite significant. Where I am inclined to disagree with the member is that the legislation itself at least brings Canada forward, though maybe not to the degree some would like to see. There is the opportunity, after passing it through second reading, to bring it to committee and look at ways in which we can improve the legislation.

Could the member provide his thoughts on whether the Conservative Party, even if it does not see this as perfect legislation, at least sees it as a step forward that would be good to go to committee, where potential amendments could be made to make it even stronger legislation if they feel that is necessary?

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, what I find interesting about the member's comments is that it just seems that the Liberals never met an industry they did not try to kill.

In Holland 100 years ago, the wooden shoes were called “sabots”. When people threw them into the windmill to gum up the gears, that is where the term “sabotage” comes from, which is what this government tries to do in every single industry it meets, including AI.

Canada has the expertise, the educated computer scientists and technology experts in this country, to be a world leader in the development of AI, but the bill would create a 5% penalty on worldwide income and give all the power of regulations to the minister. If I were going to invest in AI, I would be—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

There are other members to ask questions.

The hon. member for Trois-Rivières.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, in his speech, my colleague referred to privacy as a fundamental right. The former privacy commissioner also raised the topic of privacy as a fundamental right before the Standing Committee on Access to Information, Privacy and Ethics.

I would like to know what he means when he uses these words. Does he consider privacy to be a fundamental right?

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, we have, for example, the ruling of Justice La Forest on it 34 years ago. We have section 8 of the charter, which has been interpreted by the courts as protecting privacy rights.

Privacy is what this bill should be all about. It is because of concerns over people's personal, private information that this attempt to legislate the issue is in front of us. However, the fact of the matter is that there are so many exceptions to the rule that it really would not at all do what it is supposed to do. In fact, it would really make matters worse.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, there were a lot of good issues that my colleague raised in this context, but I am concerned about where the Conservatives are at this moment, and maybe he can outline the alternative.

Right now, if we do not send the bill to committee, we then trust it to go back to the government and basically assume that it might do more consultation, that it might look at other legislation, that it will even bring the bill back and that the House could actually stand around for that process. If we do nothing on it, we then exclude all the commentary and information we should be getting from hundreds of witnesses who want to actually participate in a public debate on this right now.

Perhaps the member can lay out his party's vision on how long it will take AI to actually be raised in a responsible manner outside of the controls of the government alone, if the bill does not go to committee and we shut everything down now.

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, the problem with this legislation is that it is just so fundamentally flawed. We just could not deal with all the changes that need to be made in the context of a committee. As just one example, when it comes to protecting the privacy rights of children, there is only one mention in the entire bill. It does not define “minor”. It does not define “sensitive information”. If this were a serious attempt at legislation, we would have, at the very minimum, hard and fast protections for the privacy rights of children, but the bill just does not do it. That is only one thing out of dozens of things.

The bill needs to go back to the drawing board. It needs to be more like what they have done in the European Union and it needs to protect Canadians' privacy.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Mr. Speaker, I rise to speak to Bill C-27, the digital charter implementation act. This legislation is the first update of federal private sector privacy laws in more than two decades.

Contained within this bill are three distinct pieces of legislation, each of which is flawed in its own way. The first piece of legislation within this bill would establish the consumer privacy protection act, legislation that completely fails to protect personal and sensitive information of individual Canadians in the digital era. The second piece of legislation within this bill would establish a tribunal system with respect to complaints around potential privacy rights violations. I submit that this tribunal system is duplicative, cumbersome and political, and that it would slow down the process of adjudicating and determining privacy complaints, to the detriment of individual Canadians and often to the benefit of powerful corporations.

The third piece of legislation within this bill seeks to establish a legal framework with respect to artificial intelligence systems. Let me say that it is important that the regulatory void that presently exists, with respect to the AI sector, be filled, but the substance of the bill, as it pertains to AI, is fundamentally flawed. It contains vague language. More concerningly, it puts a significant amount of legislative power in the hands of the Minister of Industry by way of regulation, absent parliamentary scrutiny.

The government is essentially asking, with respect to AI, for Parliament to adopt a bill without knowing the details and without understanding the impact of the bill on AI. It is saying, “Trust us. Trust the minister to fill in the blanks and come up with the rules after the fact.” I do not trust the government on anything, after it has gotten just about everything wrong over these past eight years. In any event, it is an overreach. It is a power grab of sorts. It is inherently undemocratic and it undermines investor confidence in the AI sector when we need investor confidence because of the uncertainty the bill creates in giving the minister the power to essentially come up with and change the rules on a whim.

When it comes to the AI component of the bill, the government needs to go back to the drawing board and engage in meaningful consultation, consultation that simply did not take place.

This is a complex bill. It is more than 100 pages long. It includes many complex and technical matters and so, in the very limited time that I have to contribute to this debate, I want to focus on how this bill fails to adequately protect the privacy rights of individual Canadians.

Privacy has long been recognized as a fundamental right of Canadians. That is because it goes to the core of who we are as individuals and is essential to the enjoyment of fundamental freedoms. As the Supreme Court declared in a 1988 decision, “Privacy is at the heart of liberty in a modern state” and privacy “is worthy of constitutional protection”.

Unfortunately, Bill C-27 fails to put the privacy rights of Canadians first. Instead, it puts the interests of big corporations, big tech and data brokers ahead of the rights of individual Canadians, and that, without war, is unacceptable.

It is true that the preamble of the bill refers to privacy interests, and I emphasize the word “interests”, as being integral to individual autonomy, dignity and the enjoyment of fundamental freedoms. It is of significance that missing in the bill is any mention of rights, but instead privacy is referred to as an “interest” and not the right that it is.

The absence of rights-based language in the bill tips the scale against individual Canadians in favour of commercial interests. As a consequence, the tribunal, as well as the Privacy Commissioner, would face significant challenges in weighing the privacy rights of Canadians against commercial interests, more likely than not, unfortunately, to the detriment of individual Canadians.

Members do not have to take my word for it. They can take the word of the former privacy commissioner of Canada, Daniel Therrien, who, in a November 13, 2022, op-ed in the Toronto Star said that the absence of rights-based language in this legislation “will likely reduce the weight of privacy in assessing the legality of intrusive commercial practices.” That was from the former privacy commissioner of Canada.

While the absence of rights-based language is a significant shortcoming in the bill, it is far from the only shortcoming in the bill when it comes to protecting the privacy rights of Canadians.

The bill contains many exceptions and loopholes with respect to obtaining the consent of Canadians for the collection, use and retention of data and private or personal information. So wide are the exceptions, so wide are the loopholes that the purported protections provided for in the bill are all but meaningless. The bill provides no clarity with respect to sensitive information. There are no broad categories around sensitive information, information worthy of additional protections, unlike legislation in other jurisdictions.

The bill is completely silent with respect to the selling of data. It provides no limitations or rules around data brokers. It provides nothing in the way of protections for Canadians around other areas. It does not provide a remedy, for example, for moral damages in the case of data breaches.

In so many respects, this bill falls short, and that is why it has been widely criticized by leading privacy experts. Canadians deserve better. That is why Conservatives will be voting against this bill. The Liberal government needs to go back to the drawing board.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, the member started off by talking about the sense of urgency that is there, because of the timing. It has been many years since we have seen the modernization of legislation to deal, in a substantial way, with the issue of privacy on the Internet. There are all forms of data banks and other things that are out there. People want to have the assurance that the national government is in fact acting on the issue.

My concern is that the Conservative Party seems to be determined not to see privacy legislation. Even if it disagrees with it, the principles of the legislation are very positive. Why would the Conservative Party not want to see this legislation at least get to the committee stage, where it could be further discussed?

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Madam Speaker, to answer the parliamentary secretary to the government House leader, the bill is fundamentally flawed. It is unsupportable on that basis. If it were a matter of a few amendments, it would make sense to send the bill to committee on the basis that the bill was supportable on principle, but that is not the case with the bill. Indeed, with respect to the consent provisions of the bill, the bill arguably would take a step back from the completely inadequate measures that were provided in PIPEDA.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, the section of the legislation on artificial intelligence, or AI, suggests self‑regulation. I would like to know whether my colleague supports self‑regulation or if, on the contrary, the state should further regulate the use of AI.

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Madam Speaker, what we need with respect to the AI component of the bill is clarity, and we need certainty. What we do not need is the power grab the government has afforded itself, whereby the minister would be afforded enormous powers by way of regulations that would create significant uncertainty.

There was a complete lack of consultation. I believe the consultation only began in June, and that underscores why the bill needs to be scrapped and needs to be defeated. The government needs to go back, do its homework, engage in consultation and get this right.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, we have been talking a lot today about, as I have certainly heard clearly from the Conservatives, how the bill is without redemption and cannot be fixed as it is just too flawed. One of the previous speakers for the Conservatives mentioned that maybe it could be split into two because it is so large, and certainly I agree. There are so many things that are the matter with the bill, and this is not the first time we have seen Liberal legislation that is highly flawed and that we must try to spend a great deal of time fixing. However, the parliamentary secretary and my own colleague noted the timing, and going back and taking our time knowing the industry is moving so quickly and the technology is moving so quickly.

Are there any recommendations the member could make for when it goes to committee? Maybe splitting the bill into two would be potentially helpful so we can take our time. The bill is out there, so what can we do to make it better?

[Michael Cooper, Conservative, St. Albert—Edmonton, AB]

Madam Speaker, if the bill is passed, given the trend with respect to data practices, the bill will be, for all intents and purposes, already out of date, and that is a problem. However, I would submit that if it is studied at committee, which I expect it will be, it would require significant amendments around protecting the individual privacy rights of Canadians. There are major gaps missing from the legislation that I outlined, including with respect to sensitive information. There is a lack of broad categories, and the fact that this is not defined needs to be worked on. There are a whole lot of other provisions. There are many, in fact, which is why we cannot support the bill.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, I am proud to rise on behalf of my privacy-loving constituents in Renfrew—Nipissing—Pembroke.

Bill C-27 is another piece of legislation that had to be resurrected after the Prime Minister called his superspreader pandemic election. Originally, this was supposed to be a long overdue update to the Privacy Act, and it has since morphed into Bill C-27, the data-grab act.

Everything about Bill C-27 should leave the Liberals feeling embarrassed. A Canadian's right to privacy is fundamental. Sadly, Canadians' privacy rights are not a priority for the government.

This bill has languished for years. It was first introduced immediately after the original online streaming censorship act was introduced. However, when the Prime Minister called his pandemic election and reset all legislation, what did the Liberals make a priority? Was it the privacy rights of Canadians? No. Was it securing Canadians' ownership over their data? No. Instead, what the Liberals prioritized was a bailout for big telecom and a bailout for the legacy media.

Not only does the government care more about padding the bottom line of Postmedia, but it also adopted Rupert Murdoch's false narrative about tech profiting off the content produced by the news media. Social media companies and search engines do not profit off the news media. They profit off us. These companies profit off our data, and the Liberals know the truth. Unfortunately, this legislation seeks to make it easier for companies to profit off our privacy.

If Bill C-27 is not significantly improved at committee, then together with Bill C-11 and Bill C-18, the government will have entrenched the surveillance economy in Canadians' lives. By combining the updates to the Privacy Act with the creation of a new artificial intelligence act, the Liberals have actually illustrated the brave new world we live in.

The Privacy Act and the way we talk about privacy even today are holdovers from the industrial era. We do not live in that world anymore. In the industrial economy, privacy rights were concerned with the ability to control what information could be shared. The goal was to prevent harm that could come from our personal information being used against us.

In effect, information was personal and an economic liability. We spent money on shredders to destroy personal information. The careless use of our personal information could only have a negative value, but then the world changed. Our personal information stopped being a liability and became an asset.

It started out slowly. Early examples were Amazon recommending a new book based on previous purchases and Netflix recommending what DVD rental we should next receive by mail. Google then began displaying ads next to search results. That was the eureka moment: Targeted ads were very profitable.

However, the targeting was pretty basic. If someone searched for shoe stores near them, Google returned search results alongside ads for shoes. Then it became ads for shoes on sale nearby. Then came Facebook and millions of people signed up. In exchange for an easy way to connect with friends and family, all someone had to do was share all their personal information, like who their friends were, how many friends they had and their geographical proximity to friends.

With the addition of the “like” button, the data harvesting exploded. If someone liked a news story about camping, they would start seeing ads for tents and sleeping bags. Every action Canadians took online, every single bit of their data, was commodified. Our privacy was turned into property and we lost both.

Not only does this bill not secure privacy rights, but it effectively enshrines the loss of our property rights with just two words: legitimate interest. Proposed subsection 18(3), entitled “Legitimate interest”, has this to say:

(3) An organization may collect or use an individual's personal information without their knowledge or consent if the collection or use is made for the purpose of an activity in which the organization has a legitimate interest that outweighs any potential adverse effect on the individual resulting from that collection or use

Is “legitimate interest” defined anywhere in the legislation? No. It is just another example of the vagueness found throughout the legislation.

Even if we accept the plain-language definition and that private business really somehow does have a genuine, legitimate reason to collect private information without consent, it is weighed against the adverse effect. However, this is industrial-era thinking. It views personal information only as a potential liability. Businesses have a legitimate interest in making money. With the Internet and mobile phones, much of our private information can be collected without any adverse effect. This legislation turns the private information of Canadians into the property of corporations and calls it legitimate.

I mentioned earlier that combining the privacy legislation with the AI legislation actually puts a spotlight on the issue of private data as property. However, as important as it is to highlight the connection, it is more important that these bills be separated. The artificial intelligence and data act has been slapped onto previously introduced privacy legislation.

With the privacy portion of the legislation, the devil is in the details. Overall, however, the bill reflects a general consensus developed over countless committee studies. That is not to mention the contributions to the privacy debate from the federal and provincial privacy commissioners. The issue has been well studied, and the minister has indicated that the government is open to responsible amendments. I am sure that the committee is well equipped to improve the privacy sections of this bill.

The same cannot be said about the artificial intelligence section of the bill. It seems rushed, because it is. It is intentionally vague. The Liberals claim the vagueness is required to provide them with regulatory flexibility and agility. The truth is, they do not know enough to be more precise. I have been trying to get a study on artificial intelligence in the defence committee for years, but there was always a more pressing issue. AI was treated like nuclear fusion technology, something that was always just over the horizon.

Since this bill was introduced 10 months ago, we have gone from ChatGPT to open-source GPT models, which any teenager can apparently run on their personal computer now. AI programs went from producing surrealist art to creating photorealistic images of the Pope in a puffy jacket. We have gone from short clips of deepfake videos impersonating real people to generating fictional people speaking in a real-time video. When we all started to learn Zoom in 2020, how many people thought the other person on the screen they were talking to could just be a fake? Now it is a real possibility.

The speed at which AI is developing is not an argument for delaying AI regulation; it shows that it is imperative to get the regulation right. Would this bill do that? The only honest answer is that we do not know. They do not know. Nobody truly knows. However, we can learn.

We should split this bill and let the stand-alone AI bill be the first legislation considered by one of the permanent standing committees, adding artificial intelligence to its official responsibilities. Artificial intelligence is not going away, and while much of the media attention has focused on chatbots, artistic bots and deepfakes, AI is unlocking the secrets to protein folding. This has the potential to unlock cures to countless different cancers and rare genetic diseases.

A paper was just published describing how an AI trained on data about the mass of the planets and their orbits was able to rediscover Kepler's laws of motion and Einstein's theory of time dilation. If we get this wrong, Canada could be left behind by the next revolution in science and discovery.

Given the government's track record on digital technology, Canadians should be worried about the Liberals rushing vague legislation through to regulate an emerging technology. Rather than modernizing the Broadcasting Act, they are trying to drag the Internet back to the 1980s. With Bill C-18, they claim that linking is a form of stealing.

The Liberals and their costly coalition allies do not even understand how broadcasting technology or the Internet works. They see people's personal data as the legitimate property of corporations, and now they are seeking the power to regulate a revolutionary technology. They did nothing while the world shifted below them, and now they are trying to rush regulations through without understanding the scope and scale of the challenge. Protecting Canadians' privacy and establishing property rights over their personal data should have been prioritized over bailing out Bell and Rogers.

[Kevin Lamoureux, Liberal, Parliamentary Secretary to the Leader of the Government in the House of Commons]

Madam Speaker, the legislation the member makes reference to is there, in essence, to modernize the broadcasting industry. This has been pointed out. It is there to ensure a more level playing field. It is there to ensure that some of these big worldwide tech firms are contributing to Canadian content.

This legislation is there to protect the privacy of Canadians. A lot of this legislation, and there is a substantial amount, is there because there is a need for it. It is needed as the Internet and technology continue to grow, whether it is AI or the many other types of data fields people are worried about. Would the member not agree that we need to change with the times and bring in this type of legislation in order to protect the interests and the—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

I need to give the hon. member for Renfrew—Nipissing—Pembroke time to answer.

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, the member opposite should realize that the Internet is not a form of broadcasting. The Broadcasting Act was brought in to regulate the different bandwidths and the allocations to different stations. We do not need that with the Internet. Instead of regulating technology in the public's interest, they are now regulating speech in the interest of the legacy media. Let us get the privacy bill to committee so that it can be improved and passed.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, my colleague spoke at length about regulating AI. I wonder if she is aware of the European Union bill called the AI Act that was introduced in November 2021 and is currently being studied for adoption by the European Union.

Does she believe we should wait and take guidance from this standard, which is set to become the golden rule internationally anyway?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, I am not certain that what is good for Europe is necessarily good for Canada. In fact, a lot of things that are decided for Europe are definitely not in the best interest of Canada. That being said, I do not believe we should be rushing into artificial intelligence legislation. We could certainly look at what is generated from the European study without committing to its adoption in Canada. We need to make sure we get it right; gathering as much information as we can about how to get it right is what is important.

[Lori Idlout, NDP, Nunavut, NU]

Uqaqtittiji, the NDP has been fighting for privacy rights and released a digital bill of rights several years ago. It has been trying to talk about consent provisions for years. Does the member agree that there needs to be strengthened wording regarding valid consent by restoring understanding in the PIPEDA under section 6.1 of the act?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, a person's data is personal, private property. It is the individual's right to decide who should and should not have it. It should not be some automatic, microscopic text that people need to click on in order to get something they need in a hurry without really understanding the full ramifications of what they are consenting to. Instead of putting consent all through it, what we should do is enshrine what our property rights are when it comes to information that pertains to us individually.

[Rob Oliphant, Liberal, Parliamentary Secretary to the Minister of Foreign Affairs]

Madam Speaker, with all her concerns about Facebook, is the member aware she is broadcasting this speech today live on her Facebook feed?

[Cheryl Gallant, Conservative, Renfrew—Nipissing—Pembroke, ON]

Madam Speaker, I am using Facebook Live right now because it is another way to allow Canadians to know what happens in this chamber. Some of them are on a bus or at school, and they do not have access to a television. However, it is not broadcasting like a TV station. This is something they can access on their own without the need to collect a specific—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

It is my duty pursuant to Standing Order 38 to inform the House that the questions to be raised tonight at the time of adjournment are as follows: the hon. member for South Okanagan—West Kootenay, Forestry Industry; the hon. member for Spadina—Fort York, The Budget.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Madam Speaker, before I start, I have to say that I have learned a lot listening to the interventions in this debate. I've just learned that the Parliamentary Secretary to the Minister of Foreign Affairs is subscribing to the feed of the hon. member who just spoke. I know he is a brilliant and knowledgeable man, so he must have other sources of information. That I can guarantee.

It is my pleasure to rise in the House to speak to Bill C-27, the digital charter implementation act, 2022, which, as my colleagues know, contains three parts.

Part 1 enacts the consumer privacy protection act and replaces Part 1 of the Personal Information Protection and Electronic Documents Act, or PIPEDA. Part 2 establishes a personal information and data protection tribunal, which is a key component in the enforcement of the consumer privacy protection act. Finally, part 3, which has been the subject of more discussion this afternoon, enacts the artificial intelligence and data act, which lays the foundation for Canada's first regulations governing the development, deployment and design of artificial intelligence systems. I will come back to that a little later.

First of all, I implore the members of this House to support Bill C-27 and send it to committee for further study. In my view, Bill C-27, as it is currently drafted, is a big step in the right direction in terms of both privacy protection and artificial intelligence. Obviously, there are areas where the bill could be improved. I have great confidence in the Standing Committee on Industry and Technology, which I have the honour of chairing. I know that it will study this bill carefully and come back to the House with amendments that will be useful and improve the two important areas protected by Bill C-27, namely privacy and the regulation of artificial intelligence. This will help foster innovation while ensuring that any risks associated with this new technology are well managed in Canada.

It is important for us to move forward and vote in favour of Bill C‑27, because the privacy legislation it replaces was enacted over 20 years ago. I am referring to PIPEDA, the law that caused me so many headaches when I was a young lawyer. Now, 20 years later, we all know that its approach to regulating privacy protection is a little outdated. With organizations growing ever more powerful and collecting ever more data using increasingly intrusive technologies, the time has come to modernize the protection of personal information in Canada. Our privacy is under attack.

In my opinion, privacy is one of the cornerstones of our democracy, just as philosopher Vladimir Jankélévitch saw courage as the cardinal virtue without which all other virtues grow dim or practically disappear. Courage is the impetus.

To me, privacy is kind of the same thing, because it leaves room for the inner life a person needs to feel free to express themselves, free to think and therefore be truly free. Jeremy Bentham understood that, as his panopticon concept shows. A panopticon is simple; it is a prison that, instead of being in the shape of a large rectangle with several cells lined up next to one another, where a guard comes by from time to time to check on the inmates, it is circular and has a central tower where a guard may observe the inmates. Knowing that they might be watched, the inmates will modify their behaviour and will be better behaved. The idea is that when we know that we might be monitored, we censor ourselves, which is what makes privacy so important. To me, that is what makes privacy one of the foundations of our democracy.

Bill C‑27 does not affect the public sector, the relationship between the government and citizens, or the Privacy Act. It targets the private sector, which in my opinion is just as important, given the rising power of some companies that are collecting more and more information about citizens all the time, as I mentioned. As we saw from what has come to light in the United States, in some cases, these companies have a suspiciously close relationship with the government. Take, for example, Edward Snowden's revelations and the “Twitter Files”. Given the amount of data they collect, they know their users so intimately, maybe even more intimately than the users know themselves, that studies show they even have the ability to change users' behaviour. For example, think about social media and the suggestions that are made. That can influence a person's ideology. It can also influence consumer choices.

For me, there is no doubt that we need to improve and increase the protection of personal information and privacy. There are some good things in Bill C‑27. I will start by talking about those things, and then I will move on to what could be improved.

First of all, I am very much in favour of the power given to Canadians under this legislation that allows them to delete their data. I think that is a must. I also welcome the power that Canadians will have to share their personal information among organizations, which could encourage competition.

In my view, it is commendable that the bill gives greater powers to the Privacy Commissioner, including the power to order organizations to stop collecting or using data. I think that reflects what we have heard from the Office of the Privacy Commissioner, for example. I also welcome the fact that that office will have more flexibility to focus on its priorities or the priorities reported to it by Canadians.

I would also point out that the tougher penalties in the bill are good news. Finally, a key aspect worth mentioning is the protection of minors, as the bill makes their personal information de facto sensitive, which enhances their protection. I think that is very positive.

As for what could be improved and what should be noted and studied in committee, I believe that privacy protection should be set out as a fundamental human right, both in the preamble of the bill and in clause 5. I think that would send a clear message and have legal consequences. It would send a clear message to the courts having to address this issue and result in significant legal effects. I know that the government has raised jurisdictional issues regarding this issue, and so I would be interested in hearing more in committee.

I also think it would be worthwhile clarifying the provisions around consent. The proposed subsection 15(4) of the new act talks about plain language that an individual to whom the organization's activities are directed would reasonably be expected to understand. That is a change from the current version of the Personal Information Protection and Electronic Documents Act, which refers to the user's understanding. I do not understand this change. I am not certain that it adds clarity to the consent to be obtained. I would like to hear more about that.

I am not convinced of the probity of implied consent, which is set out in subsection 15(5). In my opinion, it would be preferable to only have express consent, without which a company could invoke legitimate interest, as long as that legitimate interest is clearly defined in the legislation as being secondary to the interests and fundamental rights of individuals, a bit like we find in the European general data protection regulation.

Finally, I believe that the sensitive information referred to in the bill would benefit from being clarified and defined, in the absence of a very specific definition as seen in Quebec's Bill 25, which gives companies a lot of latitude to determine what they consider sensitive information. I think that Bill C‑27 would be improved by clarifying and defining the notion of sensitive information.

I would be curious to learn more in committee about the security safeguards, control over one's own personal data, the role and benefit of the tribunal being created, and how it would protect privacy. To be completely honest, I have not formed an opinion yet, but I am eager to find out more.

This leaves me far too little time to talk about artificial intelligence. However, that is what I wanted to talk about the most. Time flies when having fun. I will say a few words, if only to point out the staggering increase in AI over the past two years.

For the benefit of any lay people in the House, GPT‑3 was created in 2020. I am also a layperson, but I have benefited from the knowledge of experts like Jérémie Harris. I want to give a shout-out to him, because he organized a conference on Parliament Hill with me a few months ago to try to raise awareness about artificial intelligence. He explained to me that there was a revolution in the AI world two years ago. Instead of trying to connect artificial neurons, researchers realized that all they had to do was increase the number of artificial neurons to create ever more powerful neural networks. The speed of the increase has been staggering: GPT‑2 had 1.5 billion parameters, GPT‑3 had 175 billion parameters, and GPT‑4 has 100 trillion parameters. They are likely getting close to achieving human-level intelligence.

Everyone is talking about ChatGPT, but it is not the only AI out there. There is also Google's LaMDA, which is not public and which we know very little about. Blake Lemoine, one of the engineers who worked on it, was fired this summer because he said that he thought Google's LaMDA was sentient. That is one example, but there are also PaLM and Gato, which were developed by Google's DeepMind Lab. That is not to mention all the initiatives that we are not even aware of.

I think AI opens up a lot of opportunities, but it also comes with a lot of risk. When human intelligence can be so accurately mimicked and probably even surpassed one day in certain areas, that comes with national security and public safety risks.

That being said, I echo the call of many researchers, including Yoshua Bengio and others in the field, who are saying that we need to support the principle of Bill C-27, that the bill needs to be examined in committee and that Canada needs AI regulations.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, that was a very interesting speech from my colleague, who is the chair of the industry committee and does great work on that committee. I enjoyed my few short months on the committee serving with him.

I have a specific question about the issue of balancing an individual's privacy rights with the expectation that corporations and services actually use the individual's data to give the individual a better experience: In order to have a better legal standing to protect an individual's privacy rights, could the member tell us why the government did not put fundamental privacy as an individual right in clause 5, the purpose of the bill?

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Madam Speaker, from my understanding, the reason invoked by the government is some jurisdictional issues, but I am unclear, and that is one of the questions I will be more than happy if he asks in committee. If he does not, I will, to understand why it has not been enshrined. In my mind, it would be worthwhile having privacy as a fundamental right, enshrined not only in the preamble of the bill but also in clause 5, because it would give more weight to privacy when courts are asked to interpret this bill, which to me, as I have mentioned in my speech, is a fundamental right and a fundamental aspect of our democratic life.

[René Villemure, Bloc, Trois-Rivières, QC]

Madam Speaker, I thank my colleague from Louis-Hébert for his speech. I thought it was open, balanced and reasonable, which is unsurprising coming from someone who refers to Jankélévitch and courage.

I would like to know what he thinks about Europe's ongoing efforts to draft the AI act, which could become a global standard, as the General Data Protection Regulation did for privacy protection.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Madam Speaker, I am following the debate.

If we look at Europe, it seems quite complicated to create a framework to govern artificial intelligence. However, I think we should draw inspiration from Europe's efforts. The Standing Committee on Industry and Technology is certainly going to want more information about how the Europeans are going about it.

One thing is certain. I think what makes this so difficult is that the technology is evolving so fast. The part of Bill C-27 that deals with AI, as currently proposed, gives the government the freedom to do a lot through regulation, which is not necessarily ideal as far as I am concerned. However, when it comes to AI, I doubt that there is any other option. Today we are talking about ChatGPT, but I can almost guarantee that by next year, if not this summer, we will have moved on to something completely different.

The situation is changing so fast that I think we need to be very nimble in dealing with AI. I have heard the Conservative member for Calgary Nose Hill, whom I see eye to eye with on these issues, use the word nimble.

What I like about Bill C‑27 is that it creates the position of a commissioner who reports to the minister and who will look into these issues. I have long believed that we should have someone to oversee AI, someone to study all the new capabilities and the risks of accidents that this poses—because there are serious risks—and to be able to translate this into terms that the general public, legislators and the House can understand.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Madam Speaker, I guess there are a few things that I would like to learn from my hon. colleague. We know that since the Liberals came into power, foreign tech giants have more than tripled their lobbying efforts in Ottawa, especially with the Liberal government, and Amazon, Google and Facebook have been a large part of that. I would love to hear his concerns or thoughts around that.

Bill C-27 does not explicitly apply to political parties. As we have seen in the past, and we just saw the Green Party have a breach, which was unfortunate, the possibility of privacy breaches and misuse exists in the political arena. Does my colleague agree that the bill should be amended to specifically include political parties?

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Madam Speaker, it is a question that has come up many times, even when we look at PIPEDA historically. Why were political parties excluded? They seem to have fallen into a no man's land, in many respects, when it comes to privacy and data protection. I would be interested to know why and, if not, how we can work to better protect the data of Canadians when it comes to political parties. Definitely, it is a very worthwhile question that the member has raised.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Is the House ready for the question?

[Some hon. members]

Question.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The question is on the motion.

Pursuant to Standing Order 61(1), the first question is on parts 1 and 2, including the schedule to clause 2 of the bill.

If a member of a recognized party present in the House wishes that parts 1 and 2, including the schedule to clause 2 of the bill be carried or carried on division or wishes to request a recorded division, I would invite them to rise and indicate it to the Chair.

[Marty Morantz, Conservative, Charleswood—St. James—Assiniboia—Headingley, MB]

Madam Speaker, we request a recorded vote.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The recorded division on parts 1 and 2, including the schedule to clause 2 of the bill stands deferred.

The next question is on part 3 of the bill.

If a member of a recognized party present in the House wishes that part 3 of the bill be carried or carried on division or wishes to request a recorded division, I would invite them to rise and indicate it to the Chair.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, we request a recorded vote.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

The recorded division on part 3 of the bill stands deferred.

Normally at this time, the House would proceed to the taking of the deferred recorded divisions at the second reading stage of the bill. However, pursuant to order made on Thursday, June 23, 2022, the recorded division stands deferred until Monday, April 24, at the expiry of the time provided for Oral Questions.

[Kevin Lamoureux, Liberal, Winnipeg North, MB]

Madam Speaker, I suspect if you were to canvass the House, you would find unanimous consent at this time to see the clock at 5:30 p.m. so that we could begin the Private Members' Business hour.

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Is it agreed?

[Some hon. members]

Agreed.

The House resumed from April 20 consideration of the motion that Bill C-27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts, be read the second time and referred to a committee.

[The Speaker, Liberal, Anthony Rota]

It being 3:13 p.m., pursuant to order made on Thursday, June 23, 2022, the House will now proceed to the taking of the deferred recorded division on the motion at the second reading stage of Bill C-27.

Call in the members.

The question is on the motion. Pursuant to Standing Order 69.1, the first question is on parts 1 and 2, including the schedule to clause 2 of the bill.

(The House divided on the motion, which was agreed to on the following division:)

Vote #300

[The Speaker, Liberal, Anthony Rota]

I declare parts 1 and 2, including the schedule to clause 2, of the bill carried.

The next question is on part 3 of the bill.

(The House divided on part 3 of the motion, which was agreed to on the following division:)

Vote #301

[The Speaker, Liberal, Anthony Rota]

I declare part 3 of the bill carried.

The House has agreed to the entirety of Bill C-27, an act to enact the consumer privacy protection act, the personal information and data protection tribunal act and the artificial intelligence and data act and to make consequential and related amendments to other acts, at the second stage reading.

Accordingly, the bill stands referred to the Standing Committee on Industry and Technology.

(Bill read the second time and referred to a committee)

[The Speaker, Liberal, Anthony Rota]

I wish to inform the House that, because of the deferred recorded divisions, Government Orders will be extended by 25 minutes.