Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Digital Charter Implementation Act, 2022

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I appreciate the speech from the member for Windsor West, especially around the issue of artificial intelligence. This is a brand new area. How does the member feel about the importance of this, and does he feel we are ready to legislate in this area? I know it is an area of concern for my constituents, and I would like to hear the member's thoughts on that.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I applaud the minister for bringing the issue forward to Parliament. Again, I want to exercise some caution that the first two pieces of the legislation are much easier to deal with, because at least there was some discussion on those with Bill C-11. It is a bit different in this one, and the tribunal is an issue, but I am open to looking at it. I just have concerns about that. However, the artificial intelligence part of it is critical. I am glad it is in front of us, but it is going to require much more extensive debate and care, and that is why it should be entirely separate.

We in the NDP have proposed a fairly reasonable compromise, and the Speaker will rule on it. The proposed compromise is that there would be a separate vote for that particular part of the bill. The reason is that perhaps the first two parts could lead to a decision that might be different from the decision on the last part, just to ensure that we get enough testimony and time in committee for it.

I am looking forward to all perspectives in the House on this. It is time for us to look at that. It is a reasonable position, and I am glad it is in front of us. I do not like the way it is in front of us, but we will deal with that.

[Yves Perron, Bloc, Berthier—Maskinongé, QC]

Madam Speaker, I thank my hon. colleague for his speech.

This is a very important moment in time. The subject before us is sensitive and extremely complex. As has been mentioned several times, we are wading into areas that have not been regulated until now. It is very important to take the time to get it right. Certain conditions are obviously needed. For example, all legislation must be adapted to legislation that already exists in the provinces and in Quebec. As we know, orders in council issued during the previous Parliament guaranteed that there would be no encroachment on provincial jurisdictions if equivalent legislation exists in those provinces.

I wonder if my colleague could confirm whether his party is committed to not encroaching on provincial jurisdictions. Unfortunately, his party usually has a hard time respecting what happens in the provinces and wants to centralize everything at the federal level. I want him to understand that things might be more efficient if we can avoid duplicate structures. That is the first part of my question, which is fundamental. Furthermore, his political party has a tendency to pass legislation very quickly using gag orders, which are supported by the party. It concerns me that such an important piece of legislation is being voted on after limited debate.

Will the member commit to respecting the time allotted for debate on this bill and to respecting Quebec's jurisdictions?

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I have extensive notes here, more than I could even go through, with regard to this bill being the number of pages that it is.

My party has an exemplary record of respecting Quebec and using, including in this bill, some of the practices in Quebec that are solid for all of us. Therefore, I disagree with the member on that.

Also, I have also seen the member's party close debate many times during the years I have been here. I have been here just over 20 years, and the Bloc has limited debate on different bills at different times for different circumstances and so forth. I want to have a robust discussion about this, and we are committed to it. I have expressed that to the minister and to other parties, including anyone who wants to talk about this bill to try to make sure it gets its due course. Those are the things that are quite strong.

I will conclude by saying again that we have shown that some of the best practices from Quebec are part of our strategy. That is flattery, and it is not at odds with Quebec.

[Lindsay Mathyssen, NDP, London—Fanshawe, ON]

Madam Speaker, I appreciate the complexity with which the bill has been introduced and that it presents to my hon. colleague, and the work involved in going through it. He mentioned the problems in terms of the tribunal process. I know the Privacy Commissioner has raised a lot of concerns.

Could the member perhaps go into a little more detail about the insistence, which our party certainly has, that the Privacy Commissioner has raised, in terms of ensuring that consumers have far more access to fairness within the legislation than organizations typically would have, because they have more monetary resources to pursue things under legal precedence?

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, the member for London—Fanshawe's question is something I did not touch on. Again, there is so much in the bill. She is quite right with regard to the fact that if an individual wants to take a legal right of action against an abuse, it is going to be more cumbersome for them, and a company would have a better chance at that.

The tribunal and the division of power with the Privacy Commissioner are going to be very interesting. What I do not want to do is anything that would undermine the Privacy Commissioner. I suppose I am biased in the sense that from my experience, the Privacy Commission has been an excellent model, has done some excellent work and needs more support. That is the other thing we have to do. If we are going to give it more responsibilities, it will need more support. What is worrisome to me is that the tribunal would be a bit disenfranchised from that consistency, and that is one of the reasons we want to see this legislation debated thoroughly.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Madam Speaker, we know that businesses and companies find data to be very useful for many purposes, including offering consumers the goods and services they prefer.

However, data can also be used to reduce competition, charge certain selected individuals higher prices for a good, or increase delivery charges for food in locations where there is less competition. Data can therefore be used to stifle competition. It seems to me that Canada's regime is very outdated.

I would like my colleague to comment on whether this bill will provide some sort of justice for Quebec and Canadian consumers, who are presently likely to be taken advantage of by companies that use their personal data without their knowledge and against their own interests.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, that is going to be where we really want to steer, as New Democrats, toward more empowerment for consumers and watching that abuse be eroded. The problem we have is that some of the companies and the lack of competition we have in Canada right now could even lead to greater abuse, potentially, because the information and sharing of data can be done behind closed doors and behind the system of accountability. That will be one of the things to watch for, and that really is the objective of parliamentarians.

I am glad the member has raised that, because I think it is one of the things we do not want to lose sight of. A good example is that we see outright abuse of competition right now. When we had the Loblaws bread scandal, those involved were also putting their money offshore, and on top of that they all ended their pandemic hero pay at the same time, so these are good questions.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I will be sharing my time with the member for York Centre.

I am pleased to rise in the House today to speak to the digital charter implementation act, 2022, in particular the aspect on the consumer privacy protection act. If I have time, I will also discuss the artificial intelligence and data act.

I am very proud to speak to these two pieces of legislation that introduce a regime that seeks to not only support the technological transformation, but also help Canadians safely navigate this new digital world with confidence. These past few years, Canadians have witnessed these technological shifts take place. They have taken advantage of new technologies like never before. In 2021, more than 72.5% of Canadians used e-commerce services, a trend that is expected to grow to 77.6% by 2025.

According to TECHNATION, a 10% increase in digitalization can create close to a 1% drop in the unemployment rate. What is more, every 1% increase in digitalization can add $8.7 billion to Canada's GDP. In order to take advantage of those major benefits for our economy, we must ensure that consumers continue to have confidence in the digital marketplace.

Technology is clearly an intrinsic part of our lives, and Canadians have growing expectations regarding the digital economy. It is absolutely essential that the Government of Canada be able to meet those expectations.

With this bill, the government is putting forward a regime that gives Canadians the protection they deserve. First, as stated in the preamble of the digital charter implementation act, 2022, Canada recognizes the importance of protecting Canadians' privacy rights. Similarly, the 2022 consumer privacy protection act also provides important protections for Canadians.

That said, our government has listened to the input of various stakeholders, and we have made changes to improve this bill. I was on the committee in the last Parliament, and there was a lot of discussion about the previous bill, Bill C‑11. I am very pleased to be able to speak to Bill C-27, so that we can get all that work done in this Parliament.

One of the most important changes we have made is enhancing protection for minors. Some stakeholders felt that the previous legislation did not go far enough to protect children's privacy. I agree. Consequently, the bill was amended to define minors' information as sensitive by default. This means that organizations subject to the law will have to adhere to higher standards of protection for that information. The legislation also provides minors with a more direct route to delete their personal information. This will make it easier for them to manage their online reputation. I think this is a really important change, because we know that young people are very aware and very capable of using all types of digital platforms, but at the same time, we need to make sure that they are able to protect their reputation.

In addition to protections for minors, we also made changes to the concept of de-identification of personal information. According to many stakeholders, the definitions in the old bill were confusing. We recognize that having well-defined terms helps ensure compliance with the act and provides more effective protection of consumers' information. In that regard, I understand that, because we are talking about new technologies and an evolving industry, it is important for all members to share their expertise, since that will help us develop a better piece of legislation.

The difference, then, between anonymous information and de-identified information needs to be clarified because, clearly, if information is de-identified but an organization or company is able to reidentify it, that does not serve the purpose of having anonymous information.

Data-based innovation offers many benefits for Canadians. These changes contribute to appropriate safeguards to prevent unauthorized reidentification of this information, while offering greater flexibility in the use of de-identified information.

The new law also maintains the emphasis on controlling the use of their personal information by individuals. That remains a foundation of the law, namely that individuals must be able to fully understand the purpose for which information will be used and consent to that purpose in the most important circumstances.

However, the modern economy must also have flexible tools to accommodate situations that are beneficial but that may not require consent if the organization respects certain limits and takes steps to protect individuals.

The approach advocated here continues to be based on the concept of individual control, but proposes a new exception to consent to resolve these gaps as a tool for safeguarding privacy. The new provisions propose a general exception to cover situations in which organizations could use personal information without obtaining consent, provided that they can justify their legitimate interest in its use for circumstances in which the individual expects the information to be used.

In addition, to prevent abuse, the exception is subject to a requirement that the organization mitigate the risk. For example, digital mapping applications that take photos of every street and that we use to view them, particularly to help with navigation, are widely accepted as being beneficial. However, obtaining individual consent from every resident of the city is impossible.

I believe that everyone in the House will agree that it is hard to imagine how we managed before we had access to those navigation applications. Last evening, I had a visit with a family member in Ottawa and was very happy to have my mapping application to find my destination.

The presence of an exception, combined with a mitigation requirement, therefore allows individuals to take advantage of a beneficial service while safeguarding personal information. The example shows another key aspect for building trust and transparency. Digital mapping technology presents a certain level of transparency. The vehicles equipped with cameras can be seen on our streets and the results can also be seen posted and available online.

However, there are some technologies or aspects thereof that are more difficult to see and understand. That is why the bill continues granting individuals the right to ask organizations for an explanation regarding any prediction, recommendation or decision made in their regard by an automated decision-making system.

What is more, these explanations must be provided in plain language that the individual can understand. These provisions also support the proposed new artificial intelligence act. However, I do not think that I have time to get into that, so I will end there.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Madam Speaker, the member spoke about the protection of minors. I have a simple question. I cannot find anywhere in the bill where it defines a minor or a reference to “sensitive information”. Could the hon. member please inform the House how the bill defines a minor and sensitive information?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I appreciate the concern the member brings with that question.

We have many definitions of “minor”, but it is generally understood that it is the different provinces that would legally establish who a minor is. We can understand it being youth using the Internet, and we need to make the extra effort to protect them and ensure they have the tools to protect themselves.

[Marie-Hélène Gaudreau, Bloc, Laurentides—Labelle, QC]

Madam Speaker, I commend my colleague. I sat with her on the Standing Committee on Access to Information, Privacy and Ethics for a few months.

We had concerns about privacy. Several recommendations were made, and that is why Bill C‑11 became Bill C‑27. I acknowledge that the bill has been improved. That being said, I wonder about two things.

First, in 2022, I do not think it is right that banking institutions are taking the lead on showing us how important it is to protect privacy. Second, this bill is important, but I would like to know if we should refer it to a committee to study it properly because it is really two bills in one. The first is on artificial intelligence, and the second is on privacy protection. What does the member think?

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, I know that my colleague opposite is very interested in this matter because our personal information was leaked by a Quebec financial institution. That was very worrisome.

I believe that it is in the business interests of financial institutions to protect their customers and not to lose them. They have really taken the lead in this area. The provinces have followed suit, but I believe it is also the federal government's role to enhance these protections and ensure that standards exist across the country.

[Taylor Bachrach, NDP, Skeena—Bulkley Valley, BC]

Madam Speaker, it is notable that Bill C-27 does not explicitly apply to political parties. Given the potential for privacy breaches and other issues to exist in the political arena, I wonder if my colleague across the way could comment on the potential for amending it to explicitly reference and include political parties in the scope of the bill.

[Brenda Shanahan, Liberal, Châteauguay—Lacolle, QC]

Madam Speaker, that is a very interesting question, which I believe has come up at different times in this Parliament and previous Parliaments. It is an area, I am sorry to say, that I do not have a lot of insight into, but the overriding principle of safeguarding the information of Canadians has to be first and foremost, especially for any political party that hopes to earn their votes.