Information & Ethics Committee on May 10th, 2021

[Daniel Therrien]

We have produced several public reports recommending that federal legislation reform be approached from the angle of protecting privacy rights. We have submitted several reports to Parliament along these lines. We had some exchanges with officials at the Department of Innovation, Science and Economic Development, but we never saw the bill before it was introduced. Cabinet secrecy was invoked to limit our discussions with the department during the development of the bill. However, the department was still aware of our position, through our public reports presented in Parliament and elsewhere.

I have to say that I am disappointed that the bill that has been tabled departs so broadly from what the regulatory agency believes is necessary for adequate privacy protection.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

If you were asked to do so, would you be able to propose a series of amendments that would ensure that citizens' privacy is better protected? Would you consider making a concrete proposal?

[Daniel Therrien]

We did more than just consider it, we prepared a brief.

Following the bill's passage in November, we worked very hard to analyze it from every angle. Members who wish to do so can review this brief, which analyzes the bill and makes several recommendations to amend it.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

I, for one, would like to, and I believe everyone here wants to as well. It would surprise me if anyone said otherwise.

Would it be possible to send us a copy, Mr. Therrien?

[Daniel Therrien]

If the committee requests it, I will be more than happy to do so.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

Mr. Chair, on behalf of my colleagues, if they agree, I am formally requesting that we be sent a copy of this brief.

[The Chair, Conservative, Chris Warkentin]

I think the commissioner has said that he'd make it available. As a committee, I think we would be happy to accept anything the commissioner would provide for us.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

Thank you, Mr. Chair.

Thank you, Mr. Therrien.

Mr. Therrien, you were saying that the Clearview AI investigation was almost complete. When can we expect to receive the report?

[Daniel Therrien]

The Clearview AI investigation is complete.

The investigation that is coming to a close, and is not quite finished yet, is about the RCMP and its use of Clearview AI technology. We should be able to release that report in the next few weeks.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

If I understand correctly, it will be before the summer adjournment. Is that correct?

[Daniel Therrien]

Yes, that's right.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

We don't have much time, as you know. So I'm going to go back to the question I asked you earlier about other countries that are leaders in privacy protection.

You mentioned Germany, South Korea and Singapore. What makes them different? How are they ahead of Canada in this regard?

[Daniel Therrien]

It depends on the country. In Europe and elsewhere, such as in some Latin American countries, Japan, and, if I am not mistaken, South Korea, the approach we suggest exists, which is to have the protective provisions enforced within a human rights framework.

Then there are considerable penalties so that consumers can have confidence that their data is being handled with respect for their privacy. As one of the committee members said earlier, many companies are acting in a compliant manner, but some really need incentives. So there need to be significant penalties, and there are penalties in their legislation.

I would remind you that failures like Clearview AI's would not be subject to administrative penalties under the provisions of Bill C-11, which is rather hard to understand.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

That is disappointing.

[Daniel Therrien]

It's very hard to understand.

There need to be significant penalties, a rights-based approach, and more flexibility in how data is used. This must go hand in hand with greater corporate accountability. Among other things, this means that the regulatory agency can, not arbitrarily, but by being focused on its assessment of the environment, do proactive audits and not wait until there is a privacy breach. A proactive aspect is very important to properly protect consumer privacy, in my opinion.

[Rhéal Fortin, Bloc, Rivière-du-Nord, QC]

Are you optimistic, Mr. Therrien?

[The Chair, Conservative, Chris Warkentin]

Thank you, Mr. Fortin.

We're going to turn to Mr. Angus.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you very much.

Mr. Therrien, when we first learned of the Clearview AI case, it seemed to be the worst possible scenario. Here we had this company that scraped millions of photos of Canadians without their consent—our kids' birthday parties, our backyard barbecues, us at work—and then created a database that they were selling to all manner of organizations.

They claim it was for police, but we know that individual police officers had it without oversight. We know that a billionaire, John Catsimatidis, used it to target his daughter's boyfriend. You launched an investigation. Clearview AI's attitude was “Too bad, so sad. You're just Canadians and we don't even feel obligated to follow the law.”

We had a new law, Bill C-11, come in. My understanding, my gut feeling, was that Bill C-11 would fix these things so that we would have more powers and we'd be able to target these companies to make them respect the law. Are you telling us that under Bill C-11 the weight of support would actually go to rogue outliers like Clearview AI over the rights of citizens?

Are you saying that, on the monetary penalties we've been told about that would ensure compliance, a company like Clearview AI would be completely exempt from that? Is that what we're seeing under this new law?

[Daniel Therrien]

Two main mechanisms are relevant to Clearview's situation under CPPA.

The first one is the purpose clause—proposed section 5—of the CPPA, which confirms the PIPEDA's approach to balance commercial interests with privacy considerations. That clause does not say that privacy is a human right. That clause adds a number of commercial factors compared to the current law. There would be a balancing exercise, with the likelihood of greater weight given to commercial factors than under the current PIPEDA. That's point one.

Point two is that assuming it would be inconsistent with the CPPA for Clearview to do what they did, there's an administrative penalty scheme under Bill C-11 and a criminal penalty scheme under Bill C-11. The administrative penalty scheme is limited to an extremely narrow slice of violations of the CPPA. These violations have to do with a form of consent with the understanding requirement that I referred to before—with whether Clearview had the right balance between commercial interests and human rights. All of that cannot be the subject of administrative penalties under the CPPA.

In order for penalties to apply, the office would have to first make a finding, which would take about two years. Secondly, they would make an order. The penalty would be excluded. The tribunal would sit in appeal of our order, assuming the company would still not comply with the order. If the company would not comply with an order several years after it has been made, then it would be the subject of criminal penalties and the criminal courts would be involved.

The process that leads to penalties is very protracted. We think it's something like seven years after the fact, as opposed to what should be happening, which is that we should be able to impose penalties—of course subject to court review for fairness considerations vis-à-vis companies. We think the delay would be roughly two years in that model compared with the model in Bill C-11.

[Charlie Angus, NDP, Timmins—James Bay, ON]

This is really important because I think most Canadians would agree that Clearview AI's situation was very concerning. We could see many more examples of this as this technology becomes more commonplace, yet we have legislation that seems to be going backwards. It's willing to protect Clearview AI rather than citizens.

I ask this because we have Bill C-10, which should have been a pretty straightforward bill about making the tech giants pay their part. Instead, it has turned into this legislative dumpster fire with the minister running around looking like a chicken with his head cut off. Our committee had brought forward really clear recommendations on the issue of privacy rights.

You're telling us, with Clearview AI, that this law is actually not taking the lessons we learned on issues like facial recognition and from the big data giants ignoring their obligations under Canadian law, but actually writing in more protections for that abuse because we're not looking at it in a human rights frame. Is that correct?

[Daniel Therrien]

I think very significant amendments to Bill C-11 should be made to adequately protect privacy.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

I just want to follow up on the RCMP investigation. The RCMP refused to tell the Canadian public whether they were using this technology at all.

Are you looking at laws that would ensure the compliance of our police services using companies like Clearview AI?

[Daniel Therrien]

My report will address that theme generally. I'll leave it at that.

[Charlie Angus, NDP, Timmins—James Bay, ON]

Thank you.

[The Chair, Conservative, Chris Warkentin]

Thank you.

We'll turn to Monsieur Gourde now for the next round of questions.

Mr. Gourde, you have the floor.