Industry Committee on Nov. 30th, 2023

[Philippe Letarte]

Of course.

I'm going to start with proposed section 18 on legitimate interests. Thank you so much, Mr. Williams, for introducing that bill. It really resonates and I think it really drives the point forward.

As you know, the purpose of open banking is to have consent and transparency. If we grant some exceptions.... I'm not against section 18 per se; I just think there should be at least some criteria or a definition of “exception”, because open banking is not about the use of secondary data. In that case, we could have some companies saying, “Yes, we have legitimate business interests,” and kind of breaking the confidence of consumers, because when you agree to share your data, you might not agree to share your data for secondary uses.

To that end, I believe we should have really clear criteria for exceptions to say what a legitimate interest is, because, as I mentioned, if we do not have trust in the system, open banking will not be a success.

We can also look to other legislation. In Europe, they are clearly explicit about what a legitimate interest is, and it's the same in Australia. There's language on which to base that, but I think it's really a confidence issue, and we should not let businesses decide which secondary uses are good.

On proposed section 72, it's because, with what was announced in the fall economic statement, it's important—and you mentioned it—that open banking be mandated in financial regulation. No one should be able to escape or abdicate their responsibility under the regime. They need to participate. It's kind of the network effect in business. We should be really careful with the wording we choose to make sure there's no competitive framework and that no stakeholder can escape their responsibilities.

This is why I come back to the simple notion that it's not “if”; it's “when”. When you enter that framework in which you are a participant, you have to obey the same rules everybody else does. That's kind of the notion of it. As I mentioned, every jurisdiction with successful customer-driven banking has a really strong imposition on banks.

Finally, the last one that I believe you wanted to know about was on clear interest.

[Ryan Williams, Conservative, Bay of Quinte, ON]

That's proposed section 29.

[Philippe Letarte]

This is interesting also, because as with proposed section 18, we're not against it per se, but we should redefine the character of the consumer.

For example, if I'm a company and I'm offering a promotion that will give a better interest rate to a customer, should I get his consent by saying, “Hey, you're going to miss out on that promotion”? Technically it's in his best interests because it may be a lower interest rate, but in the same way, it's a business advantage for me, so we should clarify the exception in the criteria. There are also some use cases we see in the U.K. that are clearly defined.

For example, there is the case of the most vulnerable Canadians. If you take care of a senior person and you are their child, maybe the senior person is not able to consent to give their data away, but maybe you can work with a non-profit that will give you a clear indication of whether this person is being defrauded or there are unusual spending habits. If this person isn't able to consent at this time because they have a mental illness—Alzheimer's disease or anything else—we should have this exception really clearly defined in the criteria.

Again, we're not against it per se, but we should be careful about the kinds of exceptions we grant, because the premise of data portability rights is about consent.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Gaheer, you have the floor.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Thank you, Chair. Thank you to the witnesses as well for appearing before the committee.

My questions are for Monsieur Letarte.

I want to focus on proposed section 9 of the act, which we know requires each organization that's subject to the act to develop and maintain “a privacy management program that includes the policies, practices and procedures” it puts into place in regard to the obligations under the act.

Does your organization already have a management program in place?

[Philippe Letarte]

We don't. We are not client facing. I think this is important to say. We are basically a data aggregator. We create the pipes in the country from an application like Questrade or Wealthsimple to the banks.

It's something we believe every company should have. It's something we see, again, in every other jurisdiction that has an open banking regime. There should be a clear remedy and a clear section on a website or an app that says what remedies and what privacy programs are in place to protect the consumer.

If a consumer feels there was foul play and they need to be made whole, they can consult these policies in real time. It's also a way to unburden any tribunal or entity by making sure that the person checks with the company first.

As a privacy company, we do have one, but it's not as detailed as it should be. We encourage section 9 being put in place. We believe that every company participating in that ecosystem should have some form of remedy in place.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Do you believe this section is too onerous for organizations?

[Philippe Letarte]

I don't. I think it's appropriate.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

How long do you anticipate it will take for Canadian firms to get in line with this new regulatory framework and to adapt to it?

[Philippe Letarte]

It depends. We're seeing astonishing growth in the U.K. Year over year, it's 80% growth. It's a really successful public policy.

As you know, open banking is in the news more and more. People are talking about it because people know about it. Also, an association that we're members of, Fintechs, made a campaign, and a lot of Canadians have signed up to the campaign, saying they need and want open banking. I think adoption for Canadians will be really quick. This is one of the reasons we need to move forward really rapidly with it; it's because there's clearly a need in the population.

I really believe that for four or five years, there's going to be super mainstream adoption.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

My next question is for the witness panel generally, so it's for anyone who wants to take it.

We've heard witness testimony on this point before as well. It's with regard to the fact that there is a new tribunal. The tribunal, instead of the Privacy Commissioner, will directly impose those fines.

I want to get the impression of the witnesses on the panel.

[Alexandre Plourde]

Our views on the new personal information and data protection tribunal are mixed. On the one hand, it may be interesting to have a specialized tribunal with expertise in this area to make privacy decisions. On the other hand, we have reservations about the fact that this tribunal will have a lot of powers to review or overturn the office of the commissioner's decisions. Since the office of the commissioner is a body that can be trusted, in our opinion, the overturning of its findings should perhaps be avoided.

The fact remains that, for us, the basic problem is not so much the existence of this tribunal as the fact that the office of the commissioner can only recommend administrative monetary penalties. We believe that the office of the commissioner should have the power to impose them directly.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Don't you think the concentration of that power with just the Privacy Commissioner will be too much?

[Alexandre Plourde]

That is the model that has been adopted in Quebec for the Office de la protection du consommateur. A recent bill on planned obsolescence gives that body the ability to impose administrative monetary penalties directly.

I don't think that would give too much power to the office of the commissioner. Because of the spirit and the way the bill is designed, it gives non-compliant businesses multiple opportunities to comply with the act. The office of the commissioner's role includes providing information, but also establishing compliance agreements and having discussions with non-compliant companies to bring them into compliance with the act. It is really only as a last resort that the office of the commissioner should impose a monetary penalty. So I don't think we need to worry about that.

[Iqwinder Gaheer, Liberal, Mississauga—Malton, ON]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you.

Mr. Lemire, you have the floor.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you.

Ms. Levac or Ms. Plourde, I have a quick question for you. We are talking about amending clause 107 of Bill C‑27 to remove all restrictions on the exercise of consumers' right to pursue civil remedies. In your opinion, to what extent does that clause restrict the exercise of consumers' right to file a class action suit?

I think that's a fairly unique aspect that we haven't heard about at this table yet.

[Alexandre Plourde]

Thank you very much for your question. You said it was brief, but I have a lot to say.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Then it will be up to the chair to intervene.

[Alexandre Plourde]

The problem we have with clause 107 of Bill C‑27 is that it threatens Quebeckers' right to pursue civil remedies, an issue that seems to have fallen off the radar in this bill, but that really worries us.

Based on this clause's current wording, the private right of action—the right to sue a company in a civil court under federal legislation—can only be exercised under very strict conditions: if the Office of the Privacy Commissioner of Canada has found that a company has failed to meet its obligations; if a compliance agreement has not made it possible to compensate the consumer; or if a fine has been imposed in one of the very specific cases set out in the bill.

Otherwise, the consumer cannot sue the company in a civil court, cannot sue for compensation, and cannot assert their rights in court. They could find themselves in a situation where the office of the commissioner, for example, did not accept the complaint they filed against the company or did not make a finding, thereby failing to meet the requirements set out in clause 107. The consumer would then be deprived of recourse in court and would not be able to sue the company in a civil court.

Option consommateurs is an organization that files class action lawsuits and pursues civil remedies before the courts. In many situations, it has launched class action lawsuits against tech giants. For example, it filed a lawsuit against Google. However, that class action lawsuit is not the result of a complaint handled by the office of the commissioner. If we had to interpret clause 107 of the bill strictly, such a class action lawsuit may not be able to take place.

As a result, in order to avoid endless constitutional debates before the courts, we ask that the legislator's intent be clarified, since it is not, I am sure, to limit remedies available to Quebeckers. To that end, we are asking that a subclause be added to clause 107 of Bill C‑27 indicating that it does not exclude provincial civil law remedies. The provincial remedies, the civil remedies, would then be in addition to the remedies set out in clause 107. That would solve a lot of problems and legal debates for us and would give consumers a great deal of access to justice.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

I'm out of time. Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you.

Mr. Masse, you have the floor.

[Brian Masse, NDP, Windsor West, ON]

Mr. Chair, I apologize for leaving the room; I'm multi-tasking. There is only one of us here.

I hope this wasn't asked, but I think my colleagues will actually appreciate it. We'll go around the table again. Maybe we'll start this time in person.

Should political parties be part of this oversight included in the bill, or should they be excluded? I'd appreciate your opinion, and if you don't know, that's okay too. That's fine.

[Philippe Letarte]

I pass.

[Brian Masse, NDP, Windsor West, ON]

Okay.