Industry Committee on April 15th, 2024

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you.

My second question relates to the broad discussion we've had, but it's a question that hasn't been asked yet. Does Bill C-27 provide for the scenario whereby data, once deemed anonymized under the possibility of new technology, is deemed to be reidentified?

Would it be, therefore, subject to the act again if that data was reidentified? Is there a clause you can specify in the bill that addresses that scenario?

[Runa Angus]

That's one thing that generally accepted best practices do. They require organizations to ensure their information is anonymized in accordance with generally accepted best practices. Those practices evolve. For example, ISO has a standard on anonymization, and that standard may evolve.

If you're no longer compliant with those generally accepted standards, your information is no longer anonymized pursuant to the act. It becomes identifiable, and, therefore, becomes personal information.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Okay.

I have a concern based on what the Privacy Commissioner said. I don't see why the term “anonymized” would preclude the use of best practices in a regulation.

I'll stop right there.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Vis.

We will continue with Mr. Garon, who will be followed by Mr. Masse.

Go ahead, Mr. Garon.

[Jean-Denis Garon, Bloc, Mirabel, QC]

First of all, Mr. Chair, I would like to express some mild discomfort.

The process that led us to the clause‑by‑clause study of this bill isn't clear. We know this, and it's been said many times. The department held private meetings. We haven't received a report or brief on the subject. We don't know what was said. It's difficult for me, as a parliamentarian, at times.

I'm assuming the officials aren't doing this voluntarily. I don't know if they're defending the industry or not, but I get the impression that they're selling us Bill C‑27 much more than they're answering our questions. What's more, we don't know where the information they have comes from.

This situation makes things difficult and undermines confidence in the witnesses we're hearing from today. For example, there's the question of harmonization with Quebec's Bill 25. Witnesses could have told us that this aspect can be regulated in Quebec and that it's in the legislation. But instead, they're trying to sell us on the bill. It's a sales pitch.

I find it very difficult to accept the way the government has acted. We're working in good faith. I'm not filibustering, but we want to work in good faith, and parliamentary work isn't easy.

The attitude of the witnesses may not be voluntary, but I urge them to make an effort, to answer questions much more than give us with a sales pitch. At the end of the day, we were elected by the people to study this type of bill. We can't know everything in detail about the bills of the ten provinces and three territories. In my last turn, the answer I got was to convince me that the current version of the bill is in line with what Quebec is doing. I find it very difficult to work this way. It's problematic in the context of our parliamentary work. Our work requires rigour. I just want to say that.

Now we're trying to determine whether it's up to the industry to tell us what the best practices are and whether we can compromise on that. Mr. Turnbull showed me the subamendment he's proposing to amend G‑2. It proposes that “businesses must comply with best practices and with what has been determined by regulation”.

I don't know if you've read that subamendment or not. We can ask ourselves whether this text gives the government the possibility of not regulating, of making the decision not to adopt regulations and, as in its current version, leaving the choice of best practices to the industry.

Obviously, since the bill is already drafted like that, it implies that it would be the preference of the government, or of the current government, at least.

Can the government make that decision? Can it table a regulation with no content?

[Mark Schaan]

Thank you for the question.

It depends a bit on the specific words used in the subamendment. If we use the expression “prescrit par règlement”—I don't know if that's the right word in French—it requires the government to produce those regulations.

[Jean-Denis Garon, Bloc, Mirabel, QC]

I'd like to read you the text of the definition, and I'd like to know your opinion on it:

Anonymizing means irreversibly and permanently altering personal information in accordance with generally accepted best practices to ensure that there is no reasonably foreseeable risk in the circumstances that a person can be identified from the information, directly or indirectly, by any means, in accordance with the criteria and terms set out in the regulations.

In concrete terms, what is the government's regulatory obligation?

[Mark Schaan]

Worded that way, it says that regulation is necessary.

It's required to be able to fully live out the clause, so the government would be under obligation to have the regulations in place to be able to further the effort.

[Jean-Denis Garon, Bloc, Mirabel, QC]

From what I understand, the former privacy commissioner of Quebec also said that the current version of the bill had the weakness of allowing a government to regulate somewhat in a vacuum.

I'm really trying to get a sense of what the right thing to do is.

Mr. Masse's amendment says that, in case of doubt, the aggrieved person is always right. So the standard is very high.

In the initial version of the bill, the government tells us that it will let industry determine best practices and that people will live with the consequences.

We're looking for a middle ground in the compromise. I'm trying to understand the nature of the trade‑off from a regulatory perspective.

Do you understand?

[Mark Schaan]

No. Could you repeat that, please?

[Jean-Denis Garon, Bloc, Mirabel, QC]

If we remove the expression “best practices”, that imposes a tremendous obligation on businesses. The fact that the commissioner can determine, among other things, that a person has been wronged and should not have been identified gives him—and I think this is Mr. Masse's intention—substantial power. It's a very important protection.

In the current version of Bill C‑27, it says that generally accepted practices would be determined de facto by the private sector. Mr. Turnbull's amendment proposes a compromise between the two.

What I'm trying to get at, then, is whether the proposed subamendment to G‑2 gives the government an opportunity to shirk its obligation to regulate properly.

Do you understand my question?

[Mark Schaan]

I think so.

I have three points on that.

The introduction of the concept of “best practices” temporarily provides clear standards on how to properly anonymize data. It is specified in the regulations to provide clear standards on the use of the data and to provide guidance to the commissioner.

It's also possible that the commissioner, through the actions he'll take to enforce the act, will contribute to the evolution of these concepts in all facets of the bill. The commissioner also has the ability to influence the definition of these concepts.

That happens all the time, in the sense that with enforcement actions comes even further precision about how this will be understood. At the outset, there will be a commitment to use the best technology available. That will, then, get laid out in the regulation-making process, which is consultative by nature, and then further established in enforcement.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Okay.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Garon.

Mr. Masse, you have the floor.

[Brian Masse, NDP, Windsor West, ON]

I think there are a couple of things that are very to important to reinforce. I know that we're talking a little bit about G-2 as well, which was introduced later on and apparently needs some fixing, but in the first argument the government had against this, they actually tried to use the Privacy Commissioner against the Privacy Commissioner. The Privacy Commissioner still stands by a suggested change for a lot of reasons and that hasn't altered.

The second part was to use the fear factor with Quebec, which has been diminished in all important aspects. The reality is that the former commissioner of information in Quebec noted an important distinction in regimes. This could provide more protection for Quebec through the Privacy Commissioner.

If we are going to move to some type of regulation, that also means taking this away from Parliament and putting it in the hands of others who are less independent. I cannot see, for the life of me, when we look at best practices, how it's then assumed that the Privacy Commissioner would have the worst practices. In fact, the Privacy Commissioner could actually have awesome practices; they could be quite different from those of the best practice argument. In some industries, in earlier times, best practices included things like seat belts being optional in cars. Those are different points in time where we've had a change, an altering. We have an important industry emerging here.

Again, I think it's a philosophical thing. I do not want to let this go back to the government. It was interesting to hear the arguments about this, to keep this in here, from organizations that have on their board of directors Loblaws, Sun Life, Private AI, Telus, Microsoft, TD Bank, BMO, CIBC, RBC, Rogers, Magna and MetroLinx, a whole bunch of other lawyers and so forth, and that was the primary discussion used to actually support this.

With that, I hope that we can move on to a vote. I think it's important that we have this philosophical point finished. I'm siding with the Privacy Commissioner, I'm siding with the public interest, I'm siding with that versus taking it out of our hands and giving influence to the backroom lobbying and other nefarious organizations that may not have the public interest at heart but have your information interest at heart.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Masse.

Mr. Williams is next, followed by Mr. Turnbull.

Go ahead, Mr. Williams.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, and I do agree that we need to get this to a vote.

I think this is a really good debate because it looks at the core of what we're trying to protect here. I believe that when we introduce language other than the simplest language, especially for “anonymize”, we are actually introducing ambiguity in the fact that it is going to be the Privacy Commissioner and the courts that set precedence. As my colleague, Mr. Masse, just mentioned, it's going to be the Privacy Commissioner who's going to give best practices and the courts through precedence that will look at cases and then set those best practices for business.

It's not up to the government to have an evolving list. The GDPR was mentioned. The GDPR, which we consider the gold standard for privacy, does not explicitly define “generally accepted best practices”. They say it aims to provide a broad framework that can adapt to evolving technologies and societal norms. They've removed it, not added it in. Parliament can in no way be as quick as business to protect it but also can in no way be as quick as business to ensure that it gets out of the way.

If we want businesses to protect privacy, it's going to the Privacy Commissioner who has to be the be-all and end-all of what privacy is and how it's debated and how it's adhered to, and again, the courts would have the final say. But adding language in, including there's “no reasonable foreseeability”, because again we're not adding context to that, and adding “accepted best practices” without concrete context to that would be adding ambiguity to anonymization, which we don't want in a bill that is supposed to protect privacy for Canadians.

So for both of those amendments we'll be voting no and hopefully we'll move on to the important parts of this bill.

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you.

The floor is yours, Mr. Turnbull.

[Ryan Turnbull, Liberal, Whitby, ON]

It's not surprising.

We've already had the debate. Mr. Williams, I respectfully disagree with the fact that you reference something about keeping up to date and evolving, which is exactly what the “generally accepted best practices” is designed to do. I've sent around a subamendment for G-2. Mr. Garon and I discussed it and he was referencing it and I wanted to make sure that every member had the wording.

[Brian Masse, NDP, Windsor West, ON]

I have a point of order.

[The Chair, Liberal, Joël Lightbound]

Hold on just one second, Mr. Turnbull.

Mr. Masse, you have a point of order.

[Brian Masse, NDP, Windsor West, ON]

I understand you have some latitude that's necessary for this, but now we're trading notes on a future amendment without dealing with the current amendment in front of us. I think we have to deal with the amendment in front of us.

[Ryan Turnbull, Liberal, Whitby, ON]

Can I speak to that point of order?

[The Chair, Liberal, Joël Lightbound]

I'll respond to that.

We do, of course, Mr. Masse. You are correct. We will, in any event, deal with NDP-2 before we go any further. However, given that G-2 is rendered moot if NDP-2 is adopted, I think it's fair to allow for a discussion of the amendments going forward as well, because they're impacted by that too. We're not going to vote on anything else before NDP-2, of course.

[Brian Masse, NDP, Windsor West, ON]

That's fine. I appreciate your ruling, Mr. Chair. The only point I would make to that is none of that was ever introduced by the government until, basically, a few minutes ago. We've been dealing with this amendment for hours and hours, and even the original intervention by the government really didn't deal with this issue, but all of a sudden it's coming up now. Perhaps in the future we could have some more courtesy with regard to how we spend so much time on something and then see another thing come to fruition.