Bill C-27

Digital Charter Implementation Act, 2022

An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts

Part 1 enacts the Consumer Privacy Protection Act to govern the protection of personal information of individuals while taking into account the need of organizations to collect, use or disclose personal information in the course of commercial activities. In consequence, it repeals Part 1 of the Personal Information Protection and Electronic Documents Act and changes the short title of that Act to the Electronic Documents Act . It also makes consequential and related amendments to other Acts.
Part 2 enacts the Personal Information and Data Protection Tribunal Act , which establishes an administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner under the Consumer Privacy Protection Act and to impose penalties for the contravention of certain provisions of that Act. It also makes a related amendment to the Administrative Tribunals Support Service of Canada Act .
Part 3 enacts the Artificial Intelligence and Data Act to regulate international and interprovincial trade and commerce in artificial intelligence systems by requiring that certain persons adopt measures to mitigate risks of harm and biased output related to high-impact artificial intelligence systems. That Act provides for public reporting and authorizes the Minister to order the production of records related to artificial intelligence systems. That Act also establishes prohibitions related to the possession or use of illegally obtained personal information for the purpose of designing, developing, using or making available for use an artificial intelligence system and to the making available for use of an artificial intelligence system if its use causes serious harm to individuals.

Digital Charter Implementation Act, 2022

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, this is an example of circumstances where Canadians are having trouble trusting the government to do the right thing and to truly have their backs in this area. We have already seen circumstances in the past year or two where the banks have had an unbelievable impact on Canadians' lives by having the powers entrusted to them to do things that are out of line and out of step with truly protecting the privacy of Canadians.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Madam Speaker, my colleague talked about the tribunal aspect. It is very important that, in this bill, when it comes to privacy protection, besides the Privacy Commissioner, we would have another element of a tribunal. Most importantly, out of that process, there would still be the Federal Court. When it comes to citizens having their data breached, and the whole premise of this bill is to protect that of citizens, children and adults alike, there is still going be a tribunal added.

Is there any other jurisdiction that is using a tribunal? If not, why does the member think it is included in this bill?

[Cathay Wagantall, Conservative, Yorkton—Melville, SK]

Madam Speaker, it is deeply disturbing to me when I see that, among the European Union, U.K., New Zealand and Australia, none of our allies has chosen to use a tribunal. The power is there for their commissioners to make sure that the various entities are being held accountable with regard to an individual's privacy.

Their rules are far more specific than ours are in this bill thus far, and it just shows that we are weaker in truly protecting Canadians' privacy rights compared to our allies. It is a sign that we are doing things with an ulterior motive. That disturbs me, because it would again give power to a different organization within the system, which the government is creating to basically give different organizations, perhaps government departments, an out—

[The Assistant Deputy Speaker (Mrs. Alexandra Mendès), Liberal, Alexandra Mendes]

Resuming debate, the hon. member for Richmond Hill.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, I will be splitting my time with my colleague, the member for Vaughan—Woodbridge.

I am pleased to rise today in support of Bill C-27, the digital charter implementation act.

Privacy is a long-standing, fundamental right for Canadians, and we have never been more reliant on the digital economy. Even though we are living in this complex technological era, the current privacy law was last updated over 20 years ago, before smart phones or any social media platforms even existed. This brings us to the cardinal step our government is taking today.

We know Canadians need to have confidence not only that their is data safe and their privacy fully respected, but also that their government is striving to enhance the protection of their privacy through the implementation of timely safeguards in an era when the digital economy is driving transformative change. These objectives are exactly what the privacy protection framework of Bill C-27 would aim to accomplish.

We are introducing new legislation to ensure our country has critical protection in place to safeguard the security of Canadians. This legislation proposes not only to increase the confidence of Canadians in emerging technologies but also to strengthen privacy protection for consumers while supporting economic development that results from the responsible use of data and artificial intelligence. It would also pave the path for governing trade and commerce in the private sector, as it relates to regulating how private organizations handle personal information and develop AI systems.

Upon enactment into law, Bill C-27 would be one of the most substantial improvements to Canadian privacy laws in decades, but it would go further by establishing a legal framework to regulate high-impact AI systems to better protect consumers. In essence, this legislation proposes the following key enactments: the consumer privacy protection act; the personal information and data protection tribunal act; and finally, the artificial intelligence and data act, or AIDA. I will expand on each one of these major enactments in detail.

The enactment of the consumer privacy protection act proposes to achieve the following: first, to enhance Canadians' control over personal information by empowering them to request its deletion, and adding new transparency requirements for organizations when obtaining consent from individuals for their information; second, to create new data mobility rights that promote consumer choice and innovation; and third, to bolster our privacy enforcement and oversight by granting the Privacy Commissioner of Canada order-making powers to compel organizations to stop the use of personal information, through administrative monitoring penalties for serious breaches of law.

This aspect of the bill is of the utmost importance to nearly 200 of my constituents in the riding of Richmond Hill who have voiced their pertinent concerns regarding privacy protection and have spoken to me personally in relation to this legislation and what it seeks to achieve for Canadians. Through the mentioned key facets, my constituents, and in fact all Canadians, can rest assured that their government's sole intention is to ensure Canadians' first-class privacy and data protection.

By enacting the personal information and data protection tribunal act, our government seeks to strengthen protection for minors' personal information, introduce greater flexibility for the Privacy Commissioner and explicitly foster more privacy expertise among key decision-makers. This would be achieved through the establishment of a new administrative tribunal to hear appeals of certain decisions made by the Privacy Commissioner.

The third and most crucial aspect of this legislation, in my point of view, would establish a new law on artificial intelligence.

According to a recent study by Nanos Research on behalf of Innovation, Science and Economic Development Canada, key industry stakeholders have expressed a range of concerns regarding artificial intelligence. As technologies have matured, risks associated with AI systems have also come to light, including with respect to health, safety and bias. These concerns speak to the need to ensure the responsible development of AI. Moreover, as companies invest in increasingly complex AI systems, Canadians need to have confidence in AI systems they use every day.

It is therefore essential that the use and collection of data follow best practices to protect the rights and freedoms of Canadians. This brings me to the very reason why I personally identify this enactment as the most crucial aspect of this legislation.

It is in response to these legitimate concerns that our government proposes to introduce a new law to promote a unique approach to AI. It is an approach that would protect Canadians from discrimination, loss of autonomy and serious harm to their health, safety and economic well-being. The newly proposed AI law contains central provisions that would protect commercially sensitive information while ensuring that AI systems do not cause adverse effects on Canadians. Consequently, this approach would establish rules aimed at promoting good data-governance practices and respect for Canadian standards and values.

This new law would support responsible innovation by giving companies a clear framework for developing AI systems; compel organizations responsible for AI systems to mitigate potential harm to Canadians, including bias; establish an AI and data commissioner to support the Minister of Innovation, Science and Industry in the administration of the act to encourage innovation in the marketplace; and, finally, impose serious penalties for all use of illegally obtained personal information.

It is also notable to mention that it would serve as a build-up on our government's previous investments and commitment to expanding the pan-Canadian AI strategy first launched in 2017 to enhance growth in Canada's digital economy.

Each of these acts would work to provide Canadians with more autonomy over their privacy and increase accountability of personal information handled by organizations, while also giving Canadians the freedom to move their information from one organization to another in a secure manner.

In quick summary, by introducing this groundbreaking piece of legislation, our government is working to strengthen and modernize our privacy laws and to protect Canadian consumers by limiting private companies' abilities to access private information in the digital sector. Most importantly, we would be creating new rules for the responsible development of Al alongside the continuation of the advancement of its implementation across Canada.

The digital charter implementation act would ensure Canadians have strong privacy protections and clear rules of the road for businesses, as well as guardrails to govern the responsible use of artificial intelligence. As I stand here today in support of this important piece of legislation, I am confident that, given our country's highly skilled workforce, with this vital step, Canada would be well positioned not only to play an important global role in the field of AI, but also to create an environment where Canadian companies could be world leaders in responsible innovations.

Most importantly, through this cardinal legislation, Canadians would be reassured that we would never compromise on trust and safety for their privacy, and that their government is wholeheartedly committed to advancing Canadian privacy protection laws while unlocking innovation that promotes a strong economy that works for everyone.

I would like to close this intervention by encouraging all my colleagues in the House to support this valuable piece of legislation. We can work together to move beyond traditional privacy protection to ensure data control for all Canadians and modernize our laws to adapt to the realities of a complex digital economy. This is the only way to advance Canadian digital technology and Canadian values across the world.

[Eric Melillo, Conservative, Kenora, ON]

Madam Speaker, I just wanted to pick up on something my hon. colleague talked about around the tribunal. Given the fact that the EU and the United States do not have tribunals and given the fact that the Federal Court has the ability, presently, to appeal the Privacy Commissioner, I have a simple question for my colleague from the Liberal Party.

Does he feels that having that tribunal included is a necessity and, if so, why would he feel that way?

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, it is not a matter of whether it is a necessity. I think it is complementary and it strengthens the existing laws that we have. It also further ensures the protection of the data and provides a venue for the minister, as well as Canadians, to ensure that, if it comes to a point of contention, there are many venues to get the support they need.

[Andréanne Larouche, Bloc, Shefford, QC]

Madam Speaker, I thank my hon. colleague for his speech.

I would like to come back to the topic of adopting this motion and particularly the importance of sending Bill C-27 to committee, to make sure all the details are in place. It is important that the committee do its work properly. This is very technical.

Quebec has Bill 25. How can we ensure that there is no interference between Bill 25 and Bill C-27? How can we combine the work of both levels of government? This is a shared jurisdiction. Could my colleague comment on that?

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, first of all, I would like to acknowledge the leadership that the Quebec province has shown in developing legislation around privacy. I want to ensure the member that this legislation is very much a complement and a partner with that legislation. There are two other provinces that are faced with the same situation, B.C. and Alberta, as well as Quebec. The key thing is that we are taking a lot of best practices from the Province of Quebec in this, and we look forward to hearing more about that when the bill is unanimously approved at second reading and is sent to committee for further review.

[Brian Masse, NDP, Windsor West, ON]

Madam Speaker, I have enjoyed working with my hon. colleague on committee for several years. I would like to ask him about the delicate balance that we have here between the interests of businesses and that of the individual with regard to privacy, ownership of data and algorithms. I fall more to the individual and the person being protected, as to the strength of where we should go. I just wonder if he has determined where he is at right now.

The bill seems to be a little too slanted toward business organizations at the moment and their use of data. I wonder how he feels about that.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, it is good to respond to my hon. colleague. We have had the pleasure of serving together at the Standing Committee on Industry and Technology. When the bill has passed second reading, it will be sent to that committee.

I actually think it is a very balanced bill between privacy and ensuring that small businesses and organizations who use data have the guidelines to do the work they need to do to serve Canadians. I believe, through the de-identification or the anonymization of the data, the data of individuals is protected, while giving businesses the data that is needed to ensure they foster innovation while also being able to effectively run their businesses and compete not only locally but also internationally.

[Arnold Viersen, Conservative, Peace River—Westlock, AB]

Madam Speaker, my comments are similar to the member for Windsor West's, in terms of the balancing of the interests of business with the interests of the individual. To some degree, the bill fails to do both of those things. Businesses are looking for clarity and businesses are looking for a clear set of rules for how they can operate. I would note that, from clause 17 to clause 50, there are all of these exemptions. Exemptions do not allow for clarity.

I just wonder if the hon. member thinks there are enough exemptions in the bill.

[Majid Jowhari, Liberal, Richmond Hill, ON]

Madam Speaker, can we have the support of the hon. member across the aisle to ensure that the bill can go to the committee, so that we can have the opportunity to have conversations such as the one he is tabling?

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Madam Speaker, I am pleased to rise before hon. members today to speak to the digital charter implementation act, 2022. More specifically, I would like to discuss the new artificial intelligence and data act.

This legislation seeks to not only enhance Canadians' confidence in emerging technologies, but also support economic development stemming from the responsible use of AI systems and data.

As many have noted, Canada is well placed to play an important global role in AI. Thanks to Canada's highly skilled and diverse workforce and experts at research centres across the country, we have a unique opportunity to create an environment where Canadian companies can be world leaders in responsible innovation, taking full advantage of the digital economy.

Pan-Canadian institutes such as the Quebec Artificial Intelligence Institute, or Mila, the Vector Institute in Toronto, and the Alberta Machine Intelligence Institute in Edmonton reflect the abundance of Canadian talent and resources. What is more, according to Global Advantage, in January 2020, the number of AI companies in Canada, in other words, companies with a product or service that implements AI, has doubled over the past five years to 660.

The responsible use of data and AI systems has the potential to drive improvements in all sectors of the economy, leading to groundbreaking discoveries with significant economic, health, environmental and social benefits, including streamlining processes and decision-making, eliminating inefficiencies and enabling better resource allocation.

AI is already augmenting processes and skills in every industry. As noted in the March 2021 report, “Artificial Intelligence Policy and Funding in Canada”, by McGill University's Centre for Interdisciplinary Research on Montreal, the Government of Canada is making massive investments in AI, with $1 billion in government contributions provided across Canada as of August 2020.

In addition, in budget 2021 the Government of Canada committed to expanding the pan-Canadian AI strategy that was first launched in 2017 with an initial investment of $125 million through the Canadian Institute for Advanced Research. Budget 2021 proposes additional funding of $443.8 million over 10 years, starting in 2021–22. It is clear that the government recognizes the potential of this industry and that the development of artificial intelligence technologies will play a fundamental role in the growth of the digital economy.

Canadians are also optimistic about the future benefits of AI. For example, a recent study by Nanos Research on behalf of ISED shows that Canadians are almost seven times more likely to say that the impact of AI will be very positive rather than very unfavourable. However, stakeholders have also expressed a range of concerns regarding AI and automated decision-making systems.

As some of these technologies have matured, risks associated with AI systems have also come to light, including with respect to health, safety and bias. The same Nanos survey I mentioned earlier noted that Canadians are most concerned about job loss, AI replacing humans, privacy and security, AI malfunction, and biased decision-making and ethics considerations.

These concerns speak to the need to ensure the responsible development of AI. The proposed consumer privacy protection act will address protections related to privacy and related security elements, but what about health, safety and bias? As machines learn from datasets they are fed, they may replicate many of the past failings that resulted in systematic disparate treatment of minorities and other marginalized consumers in vital sectors such as banking, housing and health care.

In order to increase Canadians' confidence in the use of AI technology, our laws need to be adapted to the realities of the digital economy. Some issues were identified through our consultations on digital media and the feedback we received following the publication of the consultation document on the modernization of the Personal Information Protection and Electronic Documents Act.

Many stakeholders expressed concern regarding individuals' potential loss of control over the use of their personal information in the application of AI, the lack of transparency regarding the resulting decisions, and the impacts on individuals and groups.

While businesses are investing in increasingly complex AI systems and algorithmic technologies, Canadians need to have confidence in the AI systems they use every day. They also need to have recourse when automated systems make important decisions that can impact their lives.

The advancement of AI systems requires data, a lot of data. Personal information is particularly sought after to help develop algorithms and customize services. It is therefore vital that the collection and use of this data follow international standards and best practices in order to protect Canadians' rights and freedoms.

The artificial intelligence and data act is needed to address these types of concerns by establishing rules to promote a human-centred approach to artificial intelligence, good data governance practices and respect for Canadian standards and values. This approach will protect Canadians from a range of potential harms including discrimination, loss of dignity and autonomy, and serious harm to their health, safety, and economic and social well-being.

The artificial intelligence and data act will support responsible innovation by giving businesses a clear framework to guide the design, development and deployment of artificial intelligence systems.

The AIDA will ensure that entities responsible for AI systems that have a high impact on Canadians identify and mitigate potential harms, including bias. By aligning with internationally recognized standards, this will ensure market access for Canadian innovations. The proposed AI law contains provisions that protect commercially sensitive information while ensuring that AI systems do not have adverse or negative effects on Canadians.

More precisely, the AIDA contains obligations for organizations that design, develop or deploy high-impact AI systems to conduct assessments to determine the level of impact of their systems; adopt reasonable administrative, policy and technical measures to mitigate risks and assess compliance; maintain records about their artificial intelligence systems, and report harm or risk of imminent harm.

The AIDA will also give the Minister of Innovation, Science and Industry the necessary tools to engage with organizations and to ensure compliance with the law. While voluntary co-operation will always be the first course of action, the AIDA provides that the minister may order an organization to provide documentation relevant to assessing compliance with the act. Under the AIDA, the minister may also refer questions to the other relevant regulatory bodies, such as the Privacy Commissioner or the Competition Bureau.

Also, in cases in which there are reasonable grounds to believe that the AI system may cause serious harms, the minister may order suspension of its use or operations. The minister will also be able to communicate compliance issues to the public as a means of further raising awareness about the requirements of the act.

The artificial intelligence and data act also creates a position of artificial intelligence and data commissioner to assist the minister in administering the act and to help businesses understand their responsibilities and how to comply. The commissioner will have a dedicated structure and budget for that purpose. These measures will help increase consumer confidence and their understanding of these technologies, support the ecosystem and maintain a flexible legislative framework that is responsive to international technological and regulatory developments.

[Julie Vignola, Bloc, Beauport—Limoilou, QC]

Madam Speaker, I would like to take 15 seconds to congratulate my colleague on delivering half his speech in French. He has improved by leaps and bounds in less than a year.

Now, the moment we have all been waiting for, my question. Quebec has a law that protects its citizens' privacy, law 25. We talked about it earlier. In the early 2000s, PIPEDA's paragraph 26(2)(b) stated that the Governor in Council would, by order, respect Quebec's legislation. Essentially, the federal act would not apply with respect to personal information about individuals' property or their civil rights. In other words, the act would leave matters under Quebec's jurisdiction alone. Even though Quebec's law 25 already complies with EU expectations, Bill C‑27 contains no clause guaranteeing that the federal government will respect the application of Quebec's law.

My question is simple. Will my colleague work to ensure that the federal government respects Quebec's law 25 and that there will be an order to that effect?