Industry Committee on April 15th, 2024

[The Chair, Liberal, Joël Lightbound]

Good morning, everyone.

I call this meeting to order.

Welcome to meeting number 118 of the House of Commons Standing Committee on Industry and Technology.

Today's meeting is taking place in a hybrid format, pursuant to the Standing Orders. In addition, pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C‑27, an act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other acts.

Today we are continuing clause‑by‑clause consideration of the bill.

I'd like to welcome back the representatives from the Department of Industry and thank them for joining us again.

We have Mark Schaan, senior assistant deputy minister, strategy and innovation policy sector; Samir Chhabra, director general, marketplace framework policy branch; and Runa Angus, senior director, strategy and innovation policy sector.

Colleagues, as you will recall, we were at amendment NDP‑2, which relates to clause 2.

(Clause 2)

Monsieur Williams, you had the floor when we were debating NDP-2. I'll give it back to you as we resume the clause-by-clause on Bill C-27.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

It's nice to see the witnesses again. I'm sure we'll see you a few more times before summertime.

When we were debating this last week, we left off with talking about the definition of “anonymize”. Amendment NDP-2 was to take out the words “in accordance with generally accepted best practices” in that definition. We are in agreement with that.

The main reason for that is that we need these definitions to be clear and concise. As it stands right now, organizations can anonymize personal information using commonly accepted best practices. However, the draft lacks clarity on these practices and what constitutes generally accepted best practices. The ambiguity allows for the potential reliance on anonymization techniques recommended by specific experts, which may not be adequate for a particular dataset.

We want to talk to you on a couple of these points. This isn't very clear, and we believe that it has to be very clear. When we look at how this act is going to be enforced, it is by the Privacy Commissioner. The Privacy Commissioner has stated that he needs this definition to be clear and concise.

With a lack of consistency in anonymization methods across different organizations and without clear guidelines on what constitutes generally accepted best practices, there's a risk of inconsistency in the level of data protection and a potential for the undermining of privacy standards.

We have a few examples of where that has happened, and that's why we're looking at this. I think the bigger point, looking across the board, is that in what we've heard from witnesses there's been a difference between anonymization and de-identification. The problem I had and the problem we've had when we've talked to witnesses about de-identification was that in the definition it said that a risk of identification of the individual still remained. That's a major issue when we're talking about what we're trying to achieve here.

In terms of privacy, individuals should have the right to have their private information not just de-identified, knowing that there's a risk of that information being reidentified, but to have their information completely anonymized or able to be protected under this privacy act.

I want to give two examples of how this has happened in the past. All of us recognize that we have had our information breached, our privacy breached, on many different occasions. I get emails on certain apps and sometimes even my bank or Netflix will send an email that says, “Your information has been compromised. Please change your password.” This happens all the time.

I'm going to give two examples, one American and one Canadian, of how this has happened and caused harm to consumers. In 2006 Netflix launched a competition known as “The Netflix Prize” offering a million-dollar prize to improve its recommendation algorithm by 10%. Netflix released a dataset containing movie ratings by anonymous users; however, researchers later demonstrated it was possible to reidentify individuals in the dataset using external information.

In 2007, two individuals showed that, by combining the Netflix dataset with publicly available IMDb data, they could identify specific individuals and their movie preferences. This raised serious privacy concerns as it highlighted the risk of reidentification even when data is anonymized.

In Canada, we had the 2011 Ontario Ministry of Health and Long-Term Care's data breach. In this incident, the personal health information of thousands of Ontario residents was compromised due to inadequate de-identification measures. The ministry had released health data to researchers for an analysis but failed to sufficiently anonymize the data, allowing individuals to be reidentified. As a result, sensitive information, such as medical conditions, treatments and hospital visits, became accessible to unauthorized parties. This breach raised serious privacy concerns and highlighted the importance of robust de-identification practices, especially when dealing with sensitive health data.

The main point is we have to be clear and concise. We have to ensure that the Privacy Commissioner, who has raised concerns about this definition, does not see ambiguity whenever he's looking at this, but at the same time ensures that we have businesses that can't skirt the rules and be lenient with private data. I think that's the main point we're making.

Mr. Schaan, I think I asked you some questions the last time we were here. I don't have the blues, so I can't see if I asked this already. I think I asked you about generally accepted best practices for anonymizing information. If I haven't, can you please answer that?

[Mark Schaan, Senior Assistant Deputy Minister, Strategy and Innovation Policy Sector, Department of Industry]

I thank the member for his question.

One feature of generally accepted best practices is that they continue to evolve with the state of the technology. It's one of the reasons we believe it's an important consideration for inclusion within the act, so that it continues to ensure that it meets the state of the art.

We have concerns that absent a commitment to generally accepted best practices, organizations would not have a North Star or a guide as to what they should be doing as it relates to the anonymization of information. There could be a plethora of approaches taken.

Generally accepted best practices would vary, but I think you'd find within industry and within users a lot that they could turn to as it relates to that.

That would be my primary response.

[Ryan Williams, Conservative, Bay of Quinte, ON]

At the end of the day, you're putting a definition in that is not defined in the act. Is that correct?

[Mark Schaan]

We're putting a concept into the act that then tags along with the definition. The definition remains “anonymized” as it appears and then it has the concept of “generally accepted best practice” alongside it.

[Ryan Williams, Conservative, Bay of Quinte, ON]

The biggest question is, who would be determining if the data was anonymized according to those generally accepted best practices? Is it the department, the Privacy Commissioner or is it a case of self-regulation?

[Mark Schaan]

Mr. Chair, I would offer a couple of things.

All of this is definitional, which means that it then relates to the powers and obligations that people would be scrutinized by as it relates to the enforcement of that act. The enforcement of the act is by the Office of the Privacy Commissioner.

The determination as to whether someone had actually anonymized information for the purposes of meeting the test of generally acceptable best practices would be determined by the Privacy Commissioner should there be concerns about a violation of the CPPA.

The conception of generally acceptable best practices, as I noted, appears within Quebec's law. It's also the approach that's consistent with what experts have called for.

The Canadian Anonymization Network, or CANON, is a not-for-profit organization with representatives from public, private and health sectors in Canada. It includes the participation of experts in the field of de-identification and anonymization, including Statistics Canada. They stated that the inclusion of the phrase generally accepted best practices “will help future-proof the definition of 'anonymize', as it sets a statutory obligation for organizations to consider the evolving de-identification techniques and standards that would sufficiently protect personal information for their industry and context.”

[Ryan Williams, Conservative, Bay of Quinte, ON]

We've heard from some of those witnesses, but it was the Privacy Commissioner himself who noted that this was not something that he'd like to see in there, especially if there was not a clear and concise concept of who was setting those and what businesses knew what the best practices were.

Do we have other countries that we've looked at? You've mentioned Quebec, but did you look at other countries that had generally accepted best practices in their legislation when it came to anonymization?

[Mark Schaan]

The one I'm most familiar with is Quebec's law 25, which does make that.... I'm not sure of others.

[Ryan Williams, Conservative, Bay of Quinte, ON]

From what we've seen, there aren't many others and the CPPA does not have that in there.

When it came to consultation for this, we had many witnesses here at the committee. You in the department met personally with quite a few witnesses.

Is that correct?

[Mark Schaan]

That's correct.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Did you meet with all the witnesses that we had here at the committee?

[Mark Schaan]

I'd have to review the witness list, but I would say that over the course of the years I've been within the department, it's probably likely that I've met with all the witnesses that you heard testimony from.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Did you meet with any witnesses more than others? Were there any that requested more meetings with you on this and other topics?

[Mark Schaan]

I'd have to review. I'd say that in general there's a strong representation from the academic sector and a strong representation from industry.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Of that, we did note that you met with the Canadian Marketing Association—which has been a strong advocate for this kind of language being included in the bill—10 times.

Are you aware that they're trying to keep general best practices in this definition?

[Mark Schaan]

I know that it's one of the issues the CMA has raised in its submission to this committee.

[Ryan Williams, Conservative, Bay of Quinte, ON]

I know we've had some testimony, but because you've met with them 10 times...are they stating that it is going to hurt their business if they don't have this included?

Were there any concerns that this definition of anonymization could be too strict for them?

[Mark Schaan]

No. I think you will find the specifics within their submission as well as within their own testimony, but I think their view is—I don't want to paraphrase their view but as I understand it—they would like a standard by which they could know where to follow. They want to be able to ensure that there are standardized approaches, which is why they believe generally acceptable best practices, I think, is helpful.

[Ryan Williams, Conservative, Bay of Quinte, ON]

In terms of how that's going to be identified, accepted best practices, is the department going to have those best practices? If it was included, would there be a list somewhere that the public and businesses could find?

[Mark Schaan]

I think there are two considerations for that. One is there is industry standards that can be referenced and leveraged. There's a specific opportunity for that within the CPPA. Then there's the opportunity as well for the Office of the Privacy Commissioner to issue guidance.

[Ryan Williams, Conservative, Bay of Quinte, ON]

To my point, if the Privacy Commissioner is stating at the onset here that this provides no guidance, that it's going to be ambiguous, I'm wondering where it's supposed to live?

Our fail-safe is to go to the Privacy Commissioner, because first and foremost the whole premise of this act—where we're coming from on this side—is that privacy needs to be a fundamental right and there should be no ambiguity. If some organizations want this wording in to provide more elbow room, that's not really what we're here for. We're here to protect Canadians' fundamental private rights.

When we look at this bill I can't see any reason why so far—except for it being in Quebec's legislation—we're seeing it as a best practice anywhere else to include this language, except for the fact that some of these organizations like the Canadian Marketing Association are saying that it's not going to allow them to collect and be free with Canadians' private information.

Mr. Chair, I will leave this here just so the rest of the committee can come in, but on our side we can't see why this amendment would be here.

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Williams.

I now give the floor to Mr. Garon, who will be followed by Mr. Masse, Mr. Turnbull, Mr. Généreux and Mr. Perkins.

Mr. Garon, go ahead.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Thank you very much.

I will continue in the same vein as my colleague Mr. Williams. Obviously, we are introducing the concept of best practices, a rapidly evolving concept. According to a University of Toronto professor who appeared before us, some practices that were considered effective three or four years ago are no longer considered effective.

You are telling us that you are introducing a concept, not a definition, into the act. I get the impression that, at some point, if there is a lawsuit or if the rights of an individual or group are infringed, it will be up to the courts to interpret that concept. It introduces a lot of uncertainty.

Why did the concept not work in the best interests of the child at the time? You know we've discussed this. It's a concept. Now we are being told that this leads to uncertainty, that there is no definition, that the courts will have to get involved, that it is terrible for companies.

How is it that, with this concept here, all of a sudden it's okay and it doesn't introduce too much uncertainty? Is it because there is a kind of consensus and there is no uncertainty as to how companies will interpret this?

[Mark Schaan]

I think the concept of best practices has an objective, since there is an objective in the definition and it's really about the inability to reidentify an individual. A method is associated with the concept of best practices—using the best practices from around the world to make it impossible to reidentify people.

So it is not a concept without an objective. It's a method, a process for comparisons used for—