Industry Committee on Dec. 12th, 2023

[Diane McLeod]

In Alberta, the political parties are expressly excluded from the application of our private sector privacy law, PIPA. I don't know off the top of my head whether or not there are privacy provisions in election acts; there usually are.

We are looking at this as part of our recommendations for our PIPA review, and we will be recommending that political parties be subject to the Personal Information Protection Act, so I'll have occasion at that point to look at our Election Act and see what controls are in there.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

[Michael McEvoy]

Sorry, Chair, perhaps for a point of clarification, I should note that in British Columbia there is no doubt that the Personal Information Protection Act applies to B.C.'s provincial political parties. A ruling of our office held that federal political parties operating in British Columbia were also covered by the legislation. That is the point that is now in dispute before the courts, just to be clear, just that aspect.

[The Chair, Liberal, Joël Lightbound]

Yes, understood. Thank you very much.

I'll now get back to our regular programming.

Mr. Vis, the floor is yours.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you, Mr. Chair. Thank you to the witnesses today.

Mr. McEvoy, just touching upon the current court case involving federal political parties, is your office pursuing oversight over federal political parties because the Liberal Party used artificial intelligence to identify possible participants in their nomination and candidate selection processes?

[Michael McEvoy]

First, I should say, that obviously I have to be very careful in terms of what I say about this case because it is before the courts now.

I would say that the case was initiated because of complaints that we received from individuals who were seeking information. I'm just trying to recall off the top of my head; it may have been multiple political parties seeking certain information, and they didn't receive that, and so therefore they complained to our office, and that's what we were looking at.

Then the initial issue was simply whether my office had jurisdiction with respect to federal political parties operating in British Columbia. The answer to that question by my office was yes, and again that matter is before the court and so beyond that, I really don't want to comment about it.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

That's fair. Thank you.

The Artificial Intelligence and Data Act, AIDA, seeks to establish a framework by which we will further regulate, at the federal level, artificial intelligence.

I noticed that, in your recommendations to the Province of B.C., you said there should be public guiding principles of AI in British Columbia.

I believe it states:

[AI regulation or] principles should apply to all existing and new programs or activities, be included in any tendering documents by public authorities for third-party contracts or AI systems delivered by service providers, and be used to assess legacy projects so they are brought into compliance within a reasonable timeframe.

What I am reading there suggests the Province of British Columbia has adopted a model similar to that of the United States, where they received a public order that all government departments automatically begin ensuring they are ready to handle the challenges posed by artificial intelligence.

Is that a correct assessment?

[Michael McEvoy]

My understanding right now is that the British Columbia government is reviewing the principles by which it will deal with issues of artificial intelligence.

I should say that, on the regulation side of things, I have, along with the ombudsperson in British Columbia—as you note—set out some guidance that we think should apply. We also strongly support the federal Privacy Commissioner Philippe Dufresne's proposals to ensure that, where high-impact, significant matters of AI are being undertaken, they be subject to privacy impact assessments. They're the same kinds of provisions that, in our view, the British Columbia government should be using.

We will be consulting with the British Columbia government as they develop their principles and guidelines as to how AI will be deployed in the province.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you.

We've had some discussion here at this committee regarding what a high-impact system would actually be.

In your words, how would you define “high-impact”?

[Michael McEvoy]

That's not terminology we have used in British Columbia.

Any time you're looking at a system that attempts to, first of all, gather large amounts of data used to predict or profile people and involved in making decisions about people.... I'm not sure how you scale that. To me, anything involved in using data to make those kinds of decisions about people impacts them. There is a right to notification where those systems are in place. There should be a right to object.

These are the concerns that I know Commissioner Dufresne has raised publicly and with the committee. We are very supportive of the recommendations he is making and the amendments he believes should be brought to bear on the federal legislation front.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

In the 2022-23 annual report of the Office of the Information and Privacy Commissioner, you highlight the importance of modernizing British Columbia's Personal Information Protection Act, which has not been updated since it came into force in 2003.

What do you think are the most important elements of a modernized Personal Information Protection Act? Could any of your recommendations to modernize it apply to Bill C-27 and, if so, which ones?

[Michael McEvoy]

Let me start with one area where British Columbia, in my view, is behind. It is behind federally. That is on the issue of mandatory breach notification. There is no obligation on private sector companies in this province to report to my office when there is a breach that would cause a real risk of significant harm. Most importantly, there is no obligation on those companies to report it to individuals who are affected. This is something that needs to be changed.

There is a raft of other very good provisions that exist in other legislation, including Quebec's. I'm thinking of Commissioner Poitras' ability to oversee biometrics in the province, which is a burgeoning area and one that impacts people significantly. Facial recognition technology...all those kinds of things, where there is an obligation in Quebec to report the implementation of those kinds of programs. I think that is something British Columbia ought to be looking at.

The automated decision-making processes included in Bill C-27 should be, I think, incorporated in British Columbia, as well. However, I would urge British Columbia's government to go a step further than what is in Bill C-27. Again, Commissioner Dufresne has already alluded to what he believes—and we completely support this—are improvements to those provisions.

[The Chair, Liberal, Joël Lightbound]

Mr. Vis, I'm sorry, but you are way over time.

We'll go to Mr. Sorbara.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Chair, and thank you to our witnesses for being here virtually. We hope everyone is doing well in their respective areas of the country.

I wish first to speak to Michael. Greetings to beautiful British Columbia, my birth province and home province for many years. I'll be out there to see my family, my folks, over the holidays.

You did make a comment, and I do wish you could start off on it in terms of order-making powers or order-making ability.

Each of you has a very important role, I would say, in today's world of innovation, technology and data. Data is the new oil of the 21st century.

Could you comment on that order-making ability?

[Michael McEvoy]

It is a very important part, and just one part of the tool box that we have as regulators. Commissioner McLeod and Commissioner Poitras have talked about our role as educators, because that's kind of where things begin. Almost all organizations that we encounter want to do the right thing, and so part of our responsibility is to ensure that they understand their legal obligations, and once understood, businesses comply. That deals with lots of the issues that might otherwise have to be dealt with.

Where organizations simply choose to ignore the law is not in a very large number of cases. We have, as part of our tool box, a compliance order-making authority, which simply, in many cases, means that we can order an organization to stop doing what is illegal, in effect, to bring them into compliance with the law. That can ultimately be enforced in the court system. Again, it's an effective, important tool, I think, for all regulators, not just in the privacy field, but for regulatory authorities right across the board that want to ensure that the public is protected in so many ways.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Ms. McLeod, can you comment on that as well, please, briefly?

[Diane McLeod]

Yes, I can. I worked for a number of years in a jurisdiction where I did not have order-making powers, and it was fraught with challenges when bodies would refuse recommendations, and the only recourse was for the public to go to court, and of course that was unlikely to happen.

It's important from that aspect as well. It protects the public. It gives the commissioner the ability to require an organization to come into compliance with the legislation when they otherwise refuse to. As I indicated in my opening remarks, the majority of our cases—85% of them—are settled by informal means. Referring to what Commissioner McEvoy said, most of the organizations either don't understand their obligations or misinterpret the law, and we can settle that quite easily through our informal case resolution process.

The orders are really the last resort, if you will, to bring an organization into compliance when they otherwise might not be, if there's recommendation power.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you.

Can I get the last comment from Diane, please?

[Diane Poitras]

I agree with my colleagues. This is a power that encourages compliance. If a business doesn't wish to comply, it knows that, at the end of the day, it can be ordered to take the necessary steps to comply. I think it creates an incentive for businesses to comply, and it makes it easier for authorities to do that monitoring.

Our powers are quite broad. In Quebec, we can order any measure to ensure compliance. We can ask a party to destroy personal information or to stop a practice. This power is an important lever to dissuade businesses from taking the path of non-compliance and encourage their compliance.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you.

I have just a quick follow-up question. In terms of Canada being a fiscal federation, sometimes the provinces lead before the federal government, and vice versa. In terms of the consumer privacy protection act, Bill C-27, if I'm understanding this right—and please correct me if I'm not—do you think it's important to allow provinces a reasonable transition period? Why or why not?

I can go back to Michael on that.

[Michael McEvoy]

I guess the answer would be, “it depends”. I think you're quite right to say that, in many instances, the provinces have been ahead of the federal government. I think an order-making power is one. The federal government brought in legislation first on the privacy front, before British Columbia, but when British Columbia brought its in, it actually advanced the case and brought in order-making authority.

I think every case will be different, but an area, again, where I would say we're behind in British Columbia would be on mandatory breach notification. Frankly, I don't think that would take a considerable amount of time in advance. It would take a little bit of time just for organizations to be made aware and also for the regulator time to get set up, because that, obviously, will increase the demand at our office. I don't think there's any precise science about it; it could be a matter of months.

A lot of these things, of course, are well known in the business community already, and businesses are already having to comply, for example, in Quebec, or across the rest of the country or if they're doing business in Europe. These are standards and benchmarks that have been pretty well established, and again, I don't think they're going to come as a great surprise, once, hopefully, the federal government raises its game here.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Lemire, you now have the floor for two and a half minutes.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

Mrs. Poitras, the former Privacy Commissioner, Mr. Therrien, told us that the federal commissioner and the provincial commissioners collaborated on various topics when it came to investigations of non-compliance.

Do you think lower standards, such as those set out in Bill C‑27, could hinder the investigations and co‑operation of privacy commissioners, if the federal legislation doesn't establish the same standards as those set out in Quebec's Bill 25?

[Diane Poitras]

There definitely needs to be harmonization. My colleague Michael McEvoy mentioned this in his opening remarks. So there are obligations. For the most part, right now there are slight nuances in the terminology in the application of the laws, but we can work well together if the rules, at first glance, are general.

There must also be a harmonization of powers, such as the power to issue orders and the power to impose administrative monetary penalties. They are an incentive because they ensure that a company can quickly put an end to the default. If they are subsequently imposed by a court, that could undermine our co‑operation, which, I must point out, is excellent at the moment.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you.

On another note, you mentioned earlier that, when it comes to artificial intelligence, you were in favour of adopting high standards, which you think would be preferable to a voluntary code of conduct. We know that this last option is the one chosen by Canada, as confirmed by Minister François-Philippe Champagne a few months ago. This is a trend that is increasingly strong in other countries around the world when it comes to legislation.

Are you concerned that Canada will end up letting things slide and will be content with voluntary measures?

Do you think that Canada should impose higher standards and that such standards should be adopted by a group of countries?