Industry Committee on Dec. 12th, 2023

[Diane McLeod]

I think that my colleagues have covered it quite well.

Several years ago, the federal privacy commissioner in Alberta developed a “building blocks for privacy management” program, which we have referred to since its inception. I think it was 2015.

There are requirements in PIPEDA. There are certain aspects of privacy management programs that are codified within the legislation; you were required to have policies and procedures, and you need to have a contact person.

As you look at modernized privacy laws across jurisdictions, privacy management programs are becoming a standard. They are becoming a standard, in my view, because they are needed to protect the information that is flowing through the data systems in industry.

You're right; it needs to be scalable. It also has to be recognized that, as we move ahead with the digital economy—and it's not slowing down, it's only increasing—novel technologies are going to be used by businesses of all sizes.

As my colleague Commissioner McEvoy said, trust is the foundation of a successful digital economy. It's necessary that this infrastructure be there in order to facilitate the use of these technologies going forward.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

I've talked about the ability to levy fines, some substantial fines. To my way of thinking, when you think of some of these multinational organizations, the fine in itself could simply be considered a cost of doing business.

Are there any additional remedies that you would say a privacy commissioner should have, for example, to disgorge the data that was assembled or to discontinue production?

[Michael McEvoy]

I think you're quite right. In some instances, it would be seen as a licence to continue doing what companies are doing.

I think the most effective remedy that the government can provide in legislation for its regulator is order-making power. The three of us here today have the power to say to a company or an organization, "Stop doing what you're doing", which is a far more effective remedy in some instances where that action or conduct on the part of an organization may be harming a Quebecer, a British Columbian, Albertans or Canadians. That remedy is the most effective.

I know that Bill C-27 would put that order-making authority in the hands of the commissioner, which is a very positive step. As we've indicated, if there's going to be any appeal, that should be directly to the courts, as we have faced them over the years as a means of oversight over what we do.

[The Chair, Liberal, Joël Lightbound]

Thank you.

Mr. Lemire, the floor is yours.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Thank you, Mrs. Poitras, for your comments this afternoon.

I would also like to highlight the innovation and rigour shown by the Government of Quebec in this area.

Although the minister assures in his letter that the Quebec law will prevail in Quebec, concerns have nevertheless been expressed to this committee, particularly by Jim Balsillie. For example, it has been raised that, if Bill C‑27 sets standards that are lower than those in Quebec's Bill 25, that could hinder innovation and jeopardize investments in the Quebec economy.

With that in mind, how do you assess the potential consequences of Bill C‑27 on Quebec's economic landscape, particularly in terms of innovation and investment?

[Diane Poitras]

Thank you for the question.

This goes a little bit to what we were discussing, that is, the issue of interoperability. As I was saying, a company may have to comply with two sets of rules. The two acts may apply at the same time in certain situations. It's happening right now, and I understand that it will happen in the future as well.

There will be situations where a business will have to comply with both the rules of Bill 25 and the rules of a future bill resulting from Bill C‑27, if it's passed. It can certainly be difficult to comply with two sets of rules if the rules aren't similar. In addition, human beings being what they are, there may be a tendency to want to comply with the least restrictive rule.

It's also important to be able to monitor, control and collaborate in our respective actions across Canada.

That said, the scope of the Quebec legislation is quite broad. A business that carries on business and that, in the course of its economic activities, collects, holds, uses, discloses and retains personal information must comply with Quebec law.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

What provisions should be included in Bill C‑27 to bring it closer to the standards established by Quebec's Bill 25?

How can we be more interoperable? As you said, it would be to the advantage of entrepreneurs, since there would be less bureaucracy, among other things.

[Diane Poitras]

I'm concerned about all the provisions of Bill C‑27 dealing with anonymized and de‑identified information, particularly with regard to interoperability. There's also the issue of administrative monetary penalties and the scope of those penalties that could be imposed under the bill.

In addition, there's the absence of certain preventive measures for the use of technology. Before implementing an application or technology, an important preventive measure is to conduct assessments in advance to ensure that it complies with the law and does not constitute an inappropriate intrusion into privacy.

The commissioner also recommended measures against profiling or, at the very least, more transparency, so that people know they have a right to refuse. These are elements that are in the Quebec legislation for these new technologies. I think Bill C‑27 could be improved in that regard.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

In your opening remarks, you alluded to the new powers of the commission, and I'm not sure if those were human rights. As I understand it, the act provides funding for the promotion of rights, as well as binding powers.

Do you think that Bill C‑27 could have a similar mechanism to protect Canadians from the disclosure of their personal information and to raise awareness with them?

[Diane Poitras]

Our organization, the Commission d'accès à l'information du Québec, has a mission to promote the rights of access to documents and the protection of personal information. I think that all my colleagues across Canada feel it's their duty to do so, even if it isn't written in their respective legislation.

It might be a good idea to add that aspect to the bill. What is very important is that the commissioner be able to have the necessary funds to promote those rights, because informing citizens of their rights and businesses of their obligations is a means of prevention.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you.

Earlier, you referred to a summit on artificial intelligence that was recently held in Quebec.

Can you tell us more about that? I know that the recommendations will soon follow, but what was the context, who was invited and what were the objectives?

[Diane Poitras]

The Government of Quebec has mandated the Conseil de l'innovation du Québec to conduct collective reflection and advise it on how to regulate artificial intelligence. Among the questions is whether it should be regulated and, if so, how it should be done.

As I mentioned, the Conseil de l'innovation du Québec has put together expert groups on six topics. There have been workshops to draw conclusions on each of them. One of them, which the commission was involved in, was the AI governance framework. Then there was a call for public contributions. The public as a whole could submit their comments.

There was a public forum recently, on November 2, I believe. The objective was to test the preliminary findings and recommendations of each of the expert groups and to receive feedback in order to improve them. By the end of the year, a report prepared by the Conseil de l'innovation du Québec must be submitted to the Government of Quebec on the framework for artificial intelligence.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Mr. Chair, could you ensure that the committee will have access to those recommendations when they are made public by the Government of Quebec?

[The Chair, Liberal, Joël Lightbound]

Sure.

Thank you, Mr. Lemire.

MP Johns, the floor is yours.

[Gord Johns, NDP, Courtenay—Alberni, BC]

It's great to be joining the industry committee today. I've worked with a few of you—Mr. McDonald and Mr. Vis—on protecting wild salmon. It's always good to come to the industry committee.

I do sit on the government operations committee, so I'm going to focus on things that are related to Crown corporations in government. as the evaluation and analysis of this bill has progressed, the question about whether the government and Crown corporations should be included in the scope of the act has been raised.

Could you maybe provide your thoughts on whether the government and Crown corporations should be included? We know that Canada Post was guilty of breaking privacy laws, using personal information from delivered envelopes for a marketing program. This was according to the federal privacy watchdog. Maybe you could speak to that or could connect to that.

Mr. McEvoy, perhaps you could start.

[Michael McEvoy]

On the point of the public sector being covered, in British Columbia, the public sector is covered. That's everything from the Crown corporations, which you talked about, to school boards, municipalities—all the functions, basically, of the public sector.

The British Columbia government recently made changes to our Freedom of Information and Protection of Privacy Act that require public bodies now to produce privacy management programs, the thing that we just talked about in the private sector. We believe that's a very positive development. It means that every single public body in the province has to focus on what personal information they have about all of us and how they're going to deal with it if things go wrong—what the emergency plan is in place. As well, in the public sector now, there's mandatory breach notification; when breaches happen, individuals are notified.

Of course, in the public sector, it's not a consent-based model. We, as citizens, really don't have much of a choice, in most cases, about giving over our information to public bodies to get the services that we require. Therefore, it's very important that the law carefully authorize that collection and that it be regulated. We certainly believe that, in British Columbia, it is done in a very effective way.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Do you want to add to that, Ms. McLeod?

[Diane McLeod]

Thank you, yes.

We here in Alberta have three privacy laws, actually. We have the private sector privacy law that covers everything except for aspects of our non-profit sector. We have our public sector privacy law that operates similar to what Mr. McEvoy just explained, and we also have the health information law that governs the health sector in our province.

We here in Alberta are looking at harmonizing our own laws as we are looking at advancing our digital economy here and using technology to innovate. We're looking not only in Alberta but also, of course, at Bill C-27 as we consider what the landscape needs to look like.

[Gord Johns, NDP, Courtenay—Alberni, BC]

As the bill is, federal political parties are not included in this bill.

Do you think that political parties should be subject to the provisions of this bill?

[Michael McEvoy]

Maybe I could start on that one, if I may.

It happens that British Columbia.... It is not the only jurisdiction—because there's some application of the law in Quebec, which Ms. Poitras can talk about—but essentially, the full application of our Personal Information Protection Act applies to political parties, and we've utilized that aspect of the law to review political parties in this province and to collect, use and disclose information about voters, which we think is really important.

The short answer to your question is that, yes, in my view the federal law should apply to federal political parties. The basic reason is that it will enhance the trust between voters and all of our parties and the candidates seeking information from citizens. Citizens will know that, when they exchanges views with their political parties and communicate their views or whatever information they give over, this information is going to be properly dealt with. They will also know that, if there is an issue, there's going to be an independent oversight authority that can basically adjudicate any disputes.

That can do nothing but enhance the trust that Canadians will have in federal political parties, in my view.

[Gord Johns, NDP, Courtenay—Alberni, BC]

Ms. Poitras, I'll go to you.

With the Biden administration's recent executive order on AI regulation, what is your perspective on how AI regulation has been approached in Canada versus the United States?

[Diane Poitras]

I think it's possible to adopt a number of approaches to an AI framework. However, a consensus is emerging—in Quebec at least—that artificial intelligence must be regulated and that, as we have seen so far, self‑regulation has its limits. Quebec's position, or the position of the Commission d'accès à l'information du Québec—I can speak more to the commission's position—is that we must at least have framework legislation with principles.

In Quebec, we had considered developing an approach to the issue of artificial intelligence. A few years ago, in Quebec, we adopted the Montreal declaration, which is a declaration of principles on the responsible use and development of artificial intelligence, but it is on a voluntary basis. We saw that this had its limits, and the expert panel on which I was a member recognized that, from now on, more stringent frameworks and obligations are needed to ensure the responsible and prudent development of artificial intelligence.

[The Chair, Liberal, Joël Lightbound]

Thank you, MP Johns.

If members allow me, I'll just take two minutes to ask a question because I'd like to do a bit of mileage on MP Johns' questions.

Regarding political parties, Mr. McEvoy, I understand there is a case in British Columbia where political parties, the NDP, Liberals and the Conservatives, are fighting your office so as not to be covered under PIPA. The Bloc for some reason is not contesting that, I guess they don't garner much information in B.C., understandably.

My question is mainly for Mrs. Poitras and Ms. McLeod.

In Quebec and Alberta, what provisions require political parties to comply with privacy and personal information protection rules?

Could you give us an overview of that subject for the benefit of the committee members?

[Diane Poitras]

Perhaps I can answer the question first.

This is something new in Bill 25. The provisions are first set out in the Election Act, meaning that Quebec's Election Act provides that provincial political parties and independent members must comply with the provisions set out in the Act respecting the protection of personal information in the private sector, unless there are specific provisions set out in the Election Act.

There are a few. For example, there's no obligation to destroy personal information. In addition, we don't have the right to have access to personal information and to request that it be corrected when it is held by political parties. As you can imagine, the commission would have preferred that to be the case, because one of the best ways to assure citizens that their rights are respected and to know what political parties or other entities have on them and what they do with that information is to promote the exercise of the right of access.

Essentially, most of the obligations applicable to businesses under the private sector Privacy Act apply, except the ones I mentioned. However, there's a limit to what political parties can use and communicate. The information has to be collected for electoral purposes.

[The Chair, Liberal, Joël Lightbound]

Thank you.

Ms. McLeod, I'll ask you the same question.