Industry Committee on April 10th, 2024

[Som hon. members]

Oh, oh!

[The Chair, Liberal, Joël Lightbound]

How do you think the interpreters feel?

On that note, because we opened that door, Mr. Vis, could you speak a little more slowly going forward, especially when you read?

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

I was trying to be nice to everyone. I had over 10 pages of notes.

[The Chair, Liberal, Joël Lightbound]

It's appreciated, but it's for the interpreters.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Yes, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Mr. Perkins.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair.

If I can just take a brief step back on this, I want to acknowledge MP Turnbull's proposal to try to find a way to put CPC-1 and NDP-1 together.

I want to acknowledge your opening remark that you're supportive of the idea of the preamble going into the legislation itself. I want to thank the government for a genuine effort, I believe, to try to do the overall statement.

On the proposed subamendment, if that's the right term—it says “Mr. Gaheer”, but I think it's in your name now, Mr. Turnbull—our discussion here isn't about parts (c) and (d), which I think show the problem with the references to the artificial intelligence act and bring in an element of MP Masse's amendment. I don't have a problem here; I think we have total agreement with that.

As MP Vis just pointed out, we're struggling with the loss of what we think is a very important concept: the best interests of the child. I have a couple of things I'd like to ask questions about and one thing to make sure about.

Mr. Schaan or Ms. Angus—I don't know who the appropriate one is on this—just to take a step back, what we're talking about here is that the idea of the best interests of the child, as stated in our discussion of these amendments last time, is a subjective construct. That's a legal term, right? I'm wondering if you could explain for everyone watching—to know why we're having this discussion—what a subjective construct is when looking at legislation.

[Mark Schaan]

For the purposes of our considerations, much of what we'll likely offer as responses to questions over the course of the consideration of this bill is about the interpretability of its implementation, which is to say that we are deeply motivated by ensuring that this bill can be understood by corporations of all sizes that use personal information in the Canadian context so they can be held accountable and live up to it.

From our perspective, our considerations and comments were in relation to the fact that for the purposes of the implementer, the corporation—which needs to make a determination about the use of personal information and is not necessarily afforded the efforts of a family court or has not sat and presided over a significant number of cases where this is their bread and butter—being clear about the stronger protection required for minors' information is what we saw as pivotal to relay, hence our comments and considerations.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

In other words, the term “best interests of the child”, if it were put in this bill without some mechanism for defining what that means, would rely on the courts and companies to interpret what Parliament's intent was, because there isn't adequate case law to define the best interests of the child with regard to privacy.

[Mark Schaan]

We imagine this would probably be a zone where the Office of the Privacy Commissioner would seek to issue guidance. We imagine this would be a zone where there would need to be further guidance, either through jurisprudence or through the OPC, to aid commercial entities in understanding how they should interpret the best interests of the child for the use of personal information in the commercial context. This would apply, as per the bill, to every commercial entity operating with personal information in the country. All of them are going to need the capacity to know what to do with minors' information and to understand their obligations. Hence, that's our interpreting frame.

I think the answer to your question would be that there will need to be some meat put around this, which will probably borrow from much of the case law that was cited by the honourable member and in other instances to try to translate it into real implications for commercial entities in their transactions related to the personal information of minors.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

We had some lawyers, although not a lot, thankfully—sorry, Mr. Gaheer—appear before the committee on some of these things.

[Voices]

Oh, oh!

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

We had some lawyers appear for the bill in general. With regard to another aspect of it, when we were discussing the terminology of “legitimate interests” and those things, they said that there was case law around that definition, not in Canada but in other countries, that courts would turn to as well in looking at this.

MP Vis went through the law and presumably case law in other countries around the best interests of the child. Doesn't that help already in guiding the corporate legal counsel advising people, like I was in the marketing field in large corporations, on what we should and should not do, whether you have an internal privacy watchdog or not within the company? It doesn't have to be just Canadian case law, does it, in order to provide a definition for “best interests of the child”?

[Mark Schaan]

I think some measure of OPC guidance on international best practices can afford corporations in a number of these spaces the capacity to know how and when to interpret obligations. I think international case law can be useful, but it obviously always needs to be brought back to the crux of things. What is their legal regime? What is their overall system? How similar or non-similar is it to ours? What obligations do they or do they not possess in terms of their authorities?

There are a number of those questions, but certainly if I were an entity looking for inspiration as to how to start to interpret this, those would be among my places to start.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I'm not going to get into the schedule 1 and schedule 2 thing again, but I am going to make reference to another section, if that's okay. In particular, proposed paragraph 122(1)(e) deals with the regulatory power of the Governor in Council. It basically gives the Governor in Council the ability to make regulations with respect to the replacement of the Privacy Act on some very specific things in proposed paragraphs 122(1)(a), (b), (c) and (d). However, proposed paragraph 122(1)(e) also says, “prescribing anything that by this Act is to be prescribed”.

If the preamble is now part of the opening of the bill and therefore has some legislative and legal interpretive weight, does that not give the Governor in Council the ability to use regulation to provide some legal fence posts around what the government would see as the best interests of the child out of the starting gate?

[Brian Masse, NDP, Windsor West, ON]

I have just a quick point of order, Mr. Chair.

Could we get that page number?

[The Chair, Liberal, Joël Lightbound]

It's page 61.

[Brian Masse, NDP, Windsor West, ON]

Thanks.

[Mark Schaan]

I've had enough correspondence with the Standing Joint Committee for the Scrutiny of Regulations to know better than to provide a definitive answer to Mr. Perkins as to whether or not the regulation-making authority in proposed paragraph 122(1)(e) would compose sufficient room to issue regulations on the basis of the preamble, but I'll say likely not. Normally, a statute needs to indicate that regulations are to be prescribed, or it can use terms like “prescribed entity” and then draw on the power of paragraph (e) to say what those prescribed entities actually are.

As I said, I am not going to be definitive, but all of that is to say that if this term ends up in the preamble, as I've noted, it's the likely space from which OPC guidance would probably be forthcoming.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

In a number of areas that the Minister of Innovation, Science and Industry oversees in his responsibilities, he has issued policy directives. I'm thinking of things around the Investment Canada Act. I'm thinking of things already around artificial intelligence, for example, and voluntary codes.

If this amendment passes and becomes law with the term “best interests of the child”, and if you and the lawyers believe you can't use proposed section 122 to define it under regulation, can you not provide some similar policy guidance for companies and anyone else in the public who wants to understand where the government sees the fence posts for this definition? I know that it doesn't have the same legal standing, perhaps, in court, but it provides a sense of guidance and intent, does it not?

[Mark Schaan]

The interpretive authority of the CPPA will be the same as the interpretive authority of PIPEDA. The interpretive authority is the Office of the Privacy Commissioner. They hold the capacity to interpret the statute as enacted. There is a capacity for the minister, proposed under the CPPA, to ask the commissioner to issue guidance and take up any particular issue related to the interpretation of the act.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

That's interesting. In other words, you can issue guidance, just not necessarily the government. It's the Privacy Commissioner.

This brings me to the document that MP Vis referenced, which was issued on October 4 and 5, 2023, at a conference and signed by the federal and provincial privacy commissioners. It's on the website of the Office of the Privacy Commissioner of Canada.

I know there are a lot of people watching this, because we get emails, texts and phone calls after every meeting about what we got right or wrong. There seems to be a lot of lawyers. Hi to all the lawyers watching this.

I'll start.

The opening of it is called “Context”. It says, “Canada ratified the United Nations Convention on the Rights of the Child...in 1991.” There's a long URL that links to it. That would have been by the Mulroney government. It goes on:

The UNCRC affirms children’s rights, including the right to privacy, and introduces the concept of the best interests of the child.

This concept implies that young people's well-being and rights be primary considerations in decisions or actions concerning them directly or indirectly. As a guiding principle, this concept can be applied in a variety of contexts to help assess and balance the interests of young people against others.

In over 30 years, the UNCRC has had a tremendous influence on young peoples rights around the world, including privacy. Many jurisdictions have recognized that young people may be impacted by technologies differently than adults, be at greater risk of being affected by privacy-related issues, and therefore require special protections.

Some of the most authoritative and current policy and legal instruments that focus on or include provisions for young people’s right to privacy are....

There's a list of them here. I won't go into the URLs, but they are as follows:

The UN General comment No. 25 on children's rights in the digital environment, which supplements the UNCRC;

The OECD—

I think my colleague referenced the Organisation for Economic Co-operation and Development, of which Canada is a member.

—Council Recommendation on Children in the Digital Environment....

There's a URL link. It goes on:

The OECD Guidelines for Digital Service Providers;

The Age Appropriate Design Code, or Children's Code, created by the U.K.'s Information Commissioner's Office;

The resolution by data protection authorities from around the world on children's digital rights;

France's Commission nationale de l'informatique et des libertés's—

Excuse my French. I'm working on it.

—recommendations to enhance the protection of children online;

Ireland's Data Protection Commission's Fundamentals for a Child-Oriented Approach to Data Processing....

My colleague Mr. Vis mentioned the following:

The G20 Digital Ministers' call for actors involved in the digital environment to uphold the child's best interests;

The California Age-Appropriate Design Code Act; and

The EU's Digital Services Act.

It goes on to say the following:

These initiatives and many others recognize that the digital environment presents many opportunities for young people, but they are also a necessary response to the well-documented harms to young people, such as mental health related harms.

These initiatives are promising, but the signatories believe that there is still work to be done in Canada to ensure that young people are protected from these harms through legislative measures to make their best interests a primary consideration in the design of products and services that concern or impact them.

Therefore

Canada’s Privacy Commissioners and Ombuds with responsibility for privacy oversight call on their respective governments to put the best interests of young people first by taking immediate action as necessary to....

There's a series of bullets:

protect young people from commercial exploitation and the use of their personal information to negatively influence their behaviour or to cause them harm;

promote the privacy rights of young people;

review, amend or adopt relevant privacy legislation to be consistent with internationally recognized policy and legal instruments to ensure adequate protection of the privacy rights of young people; and

require private sector organizations that collect, use and disclose the personal information of young people to:

implement strong safeguards;

be transparent about these practices;

enhance access to effective remedies for young people.

The signatories recognize that the privacy rights of a young person are their own rights. Any limitation to their exercise (e.g. vis-à-vis parents/guardians or public bodies) must start from that principle, be specific and limited to the particular circumstances, and be consistent with the best interests of the young person.

The signatories also recognize that privacy rights apply both within and outside of the digital environment. While this resolution mainly focuses on the digital environment, its principles should be applied broadly.

The signatories highlight that young people's personal information is particularly sensitive.

The bill addresses that with the definition.

Any collection, use or disclosure of such information must be done with this in mind.

The signatories recommend that public and private sector organizations...adopt the following practices, which also reflect principles that should guide legislative reforms:

1. Build in young people’s privacy and best interests by design

Digital privacy risks to young people should be identified and minimized as early as possible. Organizations should ensure that privacy and the best interests of young people are built into the product or service right from the design stage.

Organizations should:

conduct privacy impact assessments...for projects involving the data of young people or to examine the specific potential impacts on them;

adapt their traditional PIA process to think specifically about the perspectives and experiences of young people (as individuals and as a group) before collecting, using or disclosing their information;

I know the officials are very familiar with this, but I'm not sure that everyone who's watching is, so the next point is what organizations should do:

actively involve young people, their parents/guardians, teachers, or child advocates in this assessment process;

conduct an intersectional analysis to consider the specific privacy risks to vulnerable groups of young people (e.g. those with disabilities, First Nations, 2SLGBTQI+).

That means two-spirit, lesbian, gay, bisexual, transgender, queer, intersex and others.

2. Be transparent

Transparency is necessary for informed decision-making and consent.

Organizations must:

provide privacy information to young people (and their parents/guardians as appropriate) in a concise, prominent and clear manner suited to the maturity of the young person;

inform young people of who to contact if they have questions about the information presented;

be transparent about the privacy risks associated with using their product or service. This could include information on their special efforts to protect young people from those risks...

3. Set privacy protective settings by default, and turn off tracking and profiling....

There's a whole list of things there.

4. Reject deceptive practices

Young people must not be influenced or coerced into making privacy-related decisions contrary to their interests.

Organizations must not:

incorporate into products and services manipulative or deceptive design or behavioral incentives that influence young people to make poor privacy decisions or to engage in harmful behaviours;

encourage young people to provide more information than what is necessary to use the product or service or to turn off protective privacy settings.

Organizations should:

design products and services intended to empower young people to make informed, privacy protective choices and take assertive action to advance their privacy and transparency rights.

5. Limit the disclosure of personal information....

There's some more guidance for organizations:

6. Allow for deletion or deindexing and limiting retention....

7. Facilitate access to and correction of personal information

Young people have a right of access to their personal information. This right is fundamental to ensuring that the information held is accurate, up to date, and retained for appropriate purposes. The right of access also serves to hold organizations accountable.

All organizations have a general legal responsibility to provide timely and complete access to a young person’s personal information upon request from that person, and in most cases, upon request from their parent/guardian. It is recognized that a parent/guardian’s access to information may be limited by a young person’s privacy rights as is qualified by the individual’s best interests and dependent upon the particular facts of each case.

It goes on to describe more responsibilities for an organization and has a number of footnotes and references. You can see the logos of all the various privacy commissioners in there.

You said you expect the Privacy Commissioner might issue guidance, that he or she has the ability under the act to do this and that this would probably be the appropriate route. However, the Privacy Commissioner has already done that. This looks pretty specific to me. He could reissue it under his power, I guess, once this bill goes through, but it's pretty specific guidance right now.

I don't know how an organization in Canada wouldn't understand the guide-posts that have been set out. They are very detailed and clear. Perhaps the Privacy Commissioner would provide even more detail if this provision on the best interests of the child is passed, but I'm struggling, as my colleague MP Vis is, to claim that it's subjective. It doesn't look subjective to me. It looks very specific. Privacy experts have defined this very well, so we struggle with the idea that the removal of that term is something the government wants to do, rather than provide that term in legislation, not only for the courts to interpret but also, as you pointed out, to allow the Privacy Commissioner to give very specific guidance if he needs things to be more detailed than this under the act.

Without the term “best interests of the child” in the act, it's difficult for the Privacy Commissioner to provide that legal guidance, which you said he has the power to do with that terminology. Is it not?

[Mark Schaan]

I think the goal of providing guidance on stronger protections is what we imagine the Privacy Commissioner would rely on.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

How can the Privacy Commissioner issue guidance on the best interests of the child if that's not the terminology in the act? You can't issue guidance on something that doesn't exist in the act.

[Mark Schaan]

What we're indicating is that the general construct of having stronger protections for minors would be elucidated through the specific obligations contained in the CPPA and would also be the subject of guidance in terms of actual, implementable capacity for an organization. It's not just the general value of “best interests of the child” as an interpretive frame, but also the actual, specific ways in which an organization would be able to draw on that in making a determination—for instance, on the disclosure of personal information or the specific use of a piece of personal information.