Industry Committee on April 15th, 2024

[Mark Schaan]

It's anonymized data.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

It's anonymized, but not de-identified.

[Mark Schaan]

Anonymized data as set out is outside of the scope. Once it's been deemed anonymized, it is outside of the scope of the Quebec privacy law. That's similar to what would occur in the case of the CPPA.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Vis.

I'll now give the floor to Mr. Garon, who is the last person on my list to discuss NDP‑2.

[Jean-Denis Garon, Bloc, Mirabel, QC]

My question is a follow‑up to the conversation we had about aligning with the Quebec legislation. We've discussed it privately as well, but we can do it openly.

According to the federal government, the Quebec legislation refers to best practices. That's true. The Quebec legislation does refer to best practices. Consequently, according to the government, Bill C‑27, in its current form, would be consistent with the Quebec legislation.

That statement seems to me to be absolutely false. Although the Quebec legislation does refer to best practices, companies will have to anonymize and de‑identify data in accordance with the terms and conditions established by the Government of Quebec, by regulation.

Let's agree on the fact that there are best practices, that's one thing. However, it isn't enough to include those words. Mr. Masse said so as well.

We talked about the Canadian Anonymization Network, or CANON network. It's important to note that this is a lobby group. It's a collection of companies. To be able to come and speak to us here, to meet with members of Parliament, members of that network must be registered in the Registry of Lobbyists.

I'm not at all convinced that the industry won't set its own standards in this area. I think that's clear. This is in no way consistent with what is set out in Quebec's Bill 25. The government has no authority to establish criteria by regulation. I'll need to be convinced of that, but it will be difficult.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Garon.

We'll go to Mr. Turnbull, followed by Mr. Vis.

[Ryan Turnbull, Liberal, Whitby, ON]

I wanted to bring in NDP-2, and G-2, which is another amendment the government has proposed. I think you all have it. If NDP-2 is voted through, then G-2 is no longer able to be moved.

I want to bring this in because it perhaps has an impact on the debate we're having and the alignment with Quebec's law, which I think Mr. Garon is rightfully pointing out.

Just understanding why "reasonably foreseeable risk" is something that is needed in order to align with Quebec's law, Mr. Schaan, can you comment on how that concept is relevant but also on how it strengthens privacy protection?

[Mark Schaan]

We have consulted a number of experts, including academics and privacy researchers, and the concept of reasonably foreseeable, which is a well-established principle in law, is a necessary construct. It's mentioned almost 50 times in the existing PIPEDA, which we believe regulators and courts are adept at interpreting. Not including that term would have a potential chilling impact on the use of the technique, which ultimately leads to negative outcomes for privacy protection. We think there should be increased uses of anonymization to try to render as much of the information utilized in that format rather than unidentifiable or de-identifiable formats because of the privacy-protecting value of that.

In fact, using anonymized datasets could help in a number of heavy data user applications, including potentially in the space of AI.

That's our view of why reasonably foreseeable is an important construct.

[Ryan Turnbull, Liberal, Whitby, ON]

I understand. I'm not a lawyer, but I understand that the concept is very well embedded in the law, so "reasonably foreseeable" is quite well understood. Can you speak to that?

[Mark Schaan]

As I noted, reasonably foreseeable has been included in a number of statutes, but it has a strong interpretive value that's been added to the existing private sector privacy law in PIPEDA. It appears there many times and is understood as a construct that can be tested by both regulators and courts as to whether or not it was understood by the individual at the time and whether or not they had taken appropriate measures to anonymize the information.

[Ryan Turnbull, Liberal, Whitby, ON]

Does it raise the bar on the obligation set out in the act for companies to abide by if we add “reasonably foreseeable”? It seems to me it raises the bar even further. Would you agree?

[Mark Schaan]

I think what we're pointing to with both “reasonably foreseeable” and “generally accepted best practices” is to further test the assumption that someone could just say, “Well, I anonymized it. To my mind, it was anonymized.” Then we could say, “But was it reasonably foreseeable that it was anonymized? Did you actually test it against the available technologies and what was out in the field? Then, under generally accepted best practices, did you draw on the very best tools to ensure you were actually rendering it un-reidentifiable?” I think both of those elements do raise the bar, because they suggest yet again that someone can't just throw up their hands and indicate that to their mind it was anonymized.

[Ryan Turnbull, Liberal, Whitby, ON]

What's the argument for building in “generally accepted best practices” and “reasonably foreseeable”? I understand both may align with Quebec's law, notwithstanding Mr. Garon's point, which I think is a very good one, that perhaps embedding a requirement for things to be specified in regulation may strengthen it further and address some of the concerns from my colleagues across the way. I think they have all expressed the same concern that industry shouldn't be setting the standards for itself and that perhaps, in fact, there should be a regulation. Can you speak to that?

I'm sorry for going on and on. I have a tendency to do that sometimes. To be clear, the question I was asking was what's the argument for having “generally accepted best practices” and “reasonably foreseeable”?

[Mark Schaan]

“Reasonably foreseeable” aligns with the “generally accepted best practices” in the sense that if it is reasonably foreseeable, one has to draw on those generally accepted best practices on the anonymization front in that if you're holding both ends—that it is reasonably foreseeable but then you're also mandating that people be really up to date on the best practices for anonymization—you're essentially linking those two to say it was reasonably foreseeable in part because you're actually using the generally acceptable best practices.

[Ryan Turnbull, Liberal, Whitby, ON]

So they sort of mutually support one another. They're complementary concepts and they both align with Quebec's law, although there's one key difference. If we voted down NDP-2 and kept “generally accepted best practices” and we supported amendment G-2, which says “reasonably foreseeable”, that would align with Quebec's law, but the only element that wouldn't completely align would be having the regulation, the one that specifies both.

[Mark Schaan]

That's correct.

[Ryan Turnbull, Liberal, Whitby, ON]

What I'd like to propose to my colleagues is that we vote down amendment NDP-2 and that we embed wording that includes that best practices would be defined in regulation. I have suggested wording for that if we get to amendment G-2.

I do think we need “generally accepted best practices” in there in order for those to be defined by regulations. I think that addresses some of the concerns that have been expressed, which I think are valid concerns to have. If the concern is that industry groups can essentially define best practices however they want, this would address that and would essentially make it dependent upon regulation. I think that would strengthen it and certainly allow for consultation to be done. I think that would be very important, but the regulations would be set or those best practices would be defined essentially by the government and the OPC. I believe this would align with Quebec's law. Given the debate we've had, it's what I would propose as a compromise here.

I hope we can vote down amendment NDP-2 together and then, in good faith, move a subamendment to G-2 that would strengthen it in the way I've suggested here.

Thanks.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Vis.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

On those points, I have two questions for clarification.

As per my last question—and I might have missed it—did you say Quebec's law has a similar clause to clause 5 for greater certainty, like what we have on page 8 of the law, or was it solely in regulation that Quebec deems anonymized data as not being subject to its act?

[Mark Schaan]

It's not the same clause. I'll turn to Ms. Angus to clarify, but it's the same outcome. The anonymized information is not subject to the act.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Is that through regulation, or is that embedded in the statute?

[Runa Angus, Senior Director, Strategy and Innovation Policy Sector, Department of Industry]

The statute says:

Information anonymized under this Act must be anonymized according to generally accepted best practices and according to the criteria and terms determined by regulation.

It is section 23 under the title “Destruction or anonymization”. When you get rid of personal information, you're either destroying it or turning it into anonymous information, so you can't reidentify.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Once it's anonymized to a standard acceptable by the Government of Quebec, it is no longer subject to the statute, is that correct?.

[Mark Schaan]

This is why it's in the same category as destructed information.