Industry Committee on Nov. 30th, 2023

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Given the emergence of quantum technology in the next few years and the fact that it will be covered by the bill, I believe that guarantees and surveillance mechanisms are necessary. What guarantees and surveillance mechanisms could effectively protect the information and data of Quebeckers and Canadians?

[Sébastien Gambs]

The quantum field will have an impact on many aspects of communications security, not just on data monitoring tools.

I think that the security standards that are being developed by the National Institute of Standards and Technology in the United States and that will apply to the Internet already reveal a willingness to provide security tools that will help resist quantum attacks.

I don't know whether Bill C-27 mentions anything regarding post-quantum resistance. Apart from data-monitoring tools, that may concern personal data or data security in general.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Ms. Levac or Mr. Plourde, Bill C-27, which will replace the Personal Information Protection and Electronic Documents Act, will give consumers a new right to explanations for the use of automated decision systems to make predictions, provide recommendations and make important decisions concerning them, even when the data used have been depersonalized.

However, unlike Quebec's Bill 25, Bill C-27 makes no provision enabling anyone to oppose the use of an automated decision system or to review a decision made by such a system. What do you think are the potential repercussions for consumers of the absence of any such provisions from the bill?

[Sara Eve Levac]

Currently, Bill C-27 would allow someone to obtain on request an explanations of automated decisions. We propose that this should go further, somewhat as you explained with the Quebec example.

First, it may be difficult for consumers to determine whether a decision concerning them was an automated decision. For example, when credit card applications are denied, no explanation is provided to the applicants that would let them know the decision concerning them may have been automated. Consequently, we would recommend that Bill C-27 provide for an obligation to inform consumers that the decision concerning them was an automated decision.

Then we could request that Bill C-27 provide that explanations be provided regarding that decision. An additional step would be to provide as well that a human being may review a decision made by an automated tool, somewhat as is possible in Quebec, so that person can make observations.

There have been media reports of cases in which people were denied credit because the information considered in making the decision included errors. The possibility that such decisions can be reviewed could therefore help avoid situations in which consumers are denied contracts or loans because the decisions concerning them were based on false information.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

So I understand that you are in favour of including provisions similar to those in Quebec's Bill 25 in Bill C‑27 to strengthen it.

Who could be called upon to challenge an automated decision?

[Sara Eve Levac]

As is the case with Bill 25, in Quebec, we propose that consumers who have been the subject of a decision made by an automated system be able to go to the company that used that system in order to make their case and to ask that the decision concerning them be reviewed by a human from that company.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Lemire.

Mr. Masse, you have the floor.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

Thanks to our guests for being here, and thanks to those online.

I'll start with those online and then turn to our guests here.

We have two models with regard to the Privacy Commissioner position: either empowering the Privacy Commissioner and going with that model, or going to a tribunal, which will dilute the Privacy Commissioner's capabilities. I'm just curious. You almost have to pick one at this point, because the tribunal will be new.

Maybe I'll start with our online guests—I can't see their names right now, Mr. Chair, so maybe you can pick—and then I'll go across the table here to get your opinions as to what you would do if you were in our position.

We'll start with Mr. Gambs and then go from there.

If you had to pick one of those models, which one would it be?

[Sébastien Gambs]

I think it will be to empower the Privacy Commissioner, especially, since you also need to add expertise on explainability and also on fairness, so I would basically try to leverage expertise on privacy but also supplement that with expertise on other ethical issues. I think that being able to conduct an analysis on all these topics seems to be the best idea.

[Brian Masse, NDP, Windsor West, ON]

Go ahead, Mr. Mellouli.

[Sehl Mellouli]

Allow me to answer you in French, in the same vein as Mr. Gambs.

It is important to have the ability to increase control over the use of personal data in artificial intelligence systems. In my opinion, instead of looking at AI learning systems—and there are a number of them—the only process that would be important to examine further is the data we are going to learn about. That's the challenge.

How can we help the commissioner ensure that the right data was used to learn? That's my only concern. I say this and I repeat it, as these systems are “black boxes”, and it is not easy when it comes to many, if not hundreds of thousands, of pieces of learning data, to recover the data that was used for learning.

What checks and balances can be put in place? In my opinion, this aspect deserves more thought, but unfortunately I really don't have any solutions to propose today.

[Brian Masse, NDP, Windsor West, ON]

Thank you.

We'll go to our guests here.

[Alexandre Plourde]

If I understand your question correctly, you're asking about the model of the personal information and data protection tribunal proposed in the bill. Is that correct?

[Brian Masse, NDP, Windsor West, ON]

Well, yes, does the Privacy Commissioner have a tribunal that's going to decide the penalties and so forth or is it empowering the Privacy Commissioner to have those capabilities? If we create the tribunal, it creates its own entity of punishment and correction of behaviour and so forth, versus having that come from the hands of the Privacy Commissioner.

[Alexandre Plourde]

That is one of the problems that Option consommateurs raised in its brief. There are some good aspects to Bill C-27, since the Office of the Privacy Commissioner of Canada is given the power to issue orders, and the bill provides for administrative monetary penalties of up to $10 million or 3% of sales. That's meaningful.

However, this punitive system does have flaws. The office of the commissioner will only have the power to recommend these administrative monetary penalties, which only the specialized tribunal can then impose. This process seems to us too long and unnecessary. Furthermore, these administrative monetary penalties do not cover all breaches of the act. We believe that any breach of the act should be subject to an administrative monetary penalty, imposed directly by the office of the commissioner.

We see no reason to delay the imposing of such a penalty by referring the matter to a court. If the office of the commissioner chooses to impose an administrative monetary penalty, it is because it has made numerous representations regarding that company, it has warned it several times and the decision is carefully considered. So I don't see why the process would be slowed down.

In Quebec, the Commission d'accès à l'information du Québec can directly impose administrative monetary penalties. Recently, a new bill was passed in Quebec that enables the Office de la protection du consommateur to impose administrative monetary penalties directly, as well. We do not see why the federal government could not do what's being done in Quebec.

[Brian Masse, NDP, Windsor West, ON]

Thank you.

Mr. Letarte, would you like to comment?

[Philippe Letarte]

We don't have any particular opinion on that front.

That being said, in the fall economic statement, it was said that in order to enforce customer-driven banking finance, they need to have some form of government entity. Is it the Office of the Privacy Commissioner? If yes, it should add additional resources or manpower to do so, but we're not for or against any specific tribunal versus giving this power to the Privacy Commissioner.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Masse.

Mr. Williams, the floor is yours.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

Thank you to all our witnesses.

Mr. Letarte, it's nice to have you here today. I introduced a bill about a month ago in Parliament to make sure that consumer-led banking—open banking—gets going. Actually, I'm going to have a bet with my colleague from Abitibi-Témiscamingue—about $50—on whether we'll get third reading of Bill C-27 first or open banking first. I'm not sure. I think I can win some money off him.

[Voices]

Oh, oh!

[Ryan Williams, Conservative, Bay of Quinte, ON]

The premise of this is that it seems these are actually in the right stride, parallel to each other. Bill C-27 deals with data. For those listening at home, the whole premise around consumer-led banking is really to make it mandatory that the banks have to share your personal data with other entities who can bank you, which allows.... In the U.K., where we saw it with 4,000 companies, U.K. residents are saving 12 billion pounds a year and businesses eight billion pounds a year. It's really great.

My first question for you as we look at the key to unlocking consumer-led banking is this: Can consumer-led banking, open banking, exist without this legislation right now?

[Philippe Letarte]

I will say from the get-go yes, but I think Bill C-27 is a really good first step into those regulations. It really lays the foundation upon which we can build and it levels the playing field about modernization and privacy in this country, which is greatly overdue.

In terms of my own interests, I hope we're going to get open banking sooner rather than later. I really believe it is kind of an emergency to have open banking at this point in time, for several reasons.

First, we know that the cost of living in Canada is problematic. We know that we need to give more resources to Canadians. We also know that we are losing competitiveness on international ground, so whatever gets it done the fastest is good, but Bill C-27 is a good foundation upon which we can build.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Okay. I'm going to focus on how this industry can thrive with this legislation.

You had three amendments, and I want to focus on those. I'd like you, on each one, to just elaborate a little bit more about exactly what we need. If you have wording that you'd like to see in an amendment, you can submit it to the clerk—which is probably the best way—so then we will have that.

Let's start with legitimate interests.

You mentioned proposed subsections 18(3) and 18(4). Just elaborate a little bit more on those, and if you want to go through all three of them, then it's proposed section 72 and then proposed subsection 29(1). Just walk us through a little bit more detail on why these amendments are needed for open banking.