Industry Committee on April 15th, 2024

[Mark Schaan]

Absent the terms “generally accepted best practices”, the definition has nothing but a goal, which is an incapacity for reidentification.

Our view is that the term “generally accepted best practices” obligates organizations to continuously ensure that anonymization techniques they use are in line with evolving standards. Without the reference to “generally accepted best practices” in the definition, organizations may determine for themselves what is an appropriate technique regardless of whether it meets widely recognized standards or is even a credible technique.

Our view is that, by obligating in the definition organizations to conform to what is the best-in-class approach to anonymization, we've actually got a higher standard than leaving it as solely the goal.

[Ryan Turnbull, Liberal, Whitby, ON]

If Quebec's law obligates companies to abide by generally accepted best practices, if the law that we end up passing through this committee doesn't include that, what would be the risk there? It seems like that would compromise interoperability. Wouldn't it also have some kind of an impact on...? Potentially, at least, I could foresee that best practices in Quebec would be recognized but perhaps not in other provinces across the country. Wouldn't that create some problems?

[Mark Schaan]

Obviously, what we're hoping for with the construct of “generally accepted best practices” is that we set a very high standard that requires corporations to continue to evolve the process and to ensure that they're using those best possible techniques.

If there's an obligation in Quebec to do so but not in other places, we run the risk that some organizations may not be seeking out those best techniques, and then we'll have differential privacy, depending on which law you're conforming to.

[Ryan Turnbull, Liberal, Whitby, ON]

The other thing I wanted to ask is who the experts are on anonymization. We've heard lots of people reference the Privacy Commissioner, but I imagine that the Canadian Anonymization Network, which been asking for this to be included, might actually have more experience when it comes to anonymization than the Privacy Commissioner. It's nothing against the Privacy Commissioner. I love the guy. He's fantastic. I dealt with him when he was the legal counsel, and he was just fantastic. I have the utmost respect for him, but isn't it true that the Canadian Anonymization Network, or CANON for short, has a lot of experience? What are they saying about this?

[Mark Schaan]

CANON is a not-for-profit organization that does have representation from public, private and health sectors in Canada and also includes the participation of experts in the field of de-identification and anonymization, including Statistics Canada, for whom the anonymization of information is a principle consideration. I do think there is a well of capacity and expertise in their recommendation that generally acceptable best practices are a useful standard to hold people to.

[Ryan Turnbull, Liberal, Whitby, ON]

To the point that one of the strengths of including this is that it evolves, I think some of the comments we have heard from others suggest that if it's not an exhaustive list today, in essence that provides some ambiguity that would be taken advantage of, but I think the opposite is the case. The argument could be made that it needs to evolve because the technology and the methods for anonymization are changing quite quickly. How do you ensure that the OPC can...? What's the mechanism for continually updating that? I think that's the clarity a lot of us sound like we need to have in order to feel this is robust enough that it's not going to open that door.

How do we envision the general guidance around generally accepted best practices evolving? Would it be the OPC guidance? Where would the expertise come from?

[Mark Schaan]

I will defer to Mr. Chhabra on this one.

[Samir Chhabra, Director General, Marketplace Framework Policy Branch, Department of Industry]

I think it's important to recognize that de-identification and anonymization techniques live on a spectrum. Anonymization is at the far extreme end. De-identification is something far more simple.

The committee in its earlier deliberations today referenced some cases that go back to the mid-2000s where information was stripped out of a dataset and it was easy to reidentify it. That's exactly the kind of issue we're trying to combat by establishing a higher bar for anonymization.

Anonymization techniques are generally algorithmic in nature. They involve things like differential privacy, or K-anonymization. These are very sophisticated mathematical algorithmic techniques that, of course, because they are algorithmic in nature can over time have their efficacy degraded. As other algorithms are developed, as new mathematical techniques are developed, as computing becomes more powerful vis-à-vis quantum computing, for example, there are opportunities downstream for what was at one point considered anonymous in nature to later, in a matter of years, become much more easy to break.

The reason for including a standard that says “generally accepted best practices” is that it requires an organization to continually review and update.

The whole point of anonymization in the context of the act here is to ensure that truly anonymized data can be used for beneficial things like improving health informatics, health systems and delivery. When it is at risk of reidentification, it means it's then back into the auspices of the act and all the requirements apply.

In practice, the way we would see the Office of the Privacy Commissioner using a generally accepted best practices requirement is if there were a case in which there was a security breach, or the personal information was leaked, they would then be able to point at the act and say the act requires that you anonymize in accordance with generally accepted best practices and we can or cannot find evidence that you have done so, or that you have maintained a modernity or contemporaneously with generally accepted best practices. Maybe you did it eight years or 10 years ago, but then you left the dataset alone and it became breachable.

What this does is it requires a constant evolution of standards that says if you're going to try to maintain this as being an anonymized dataset and the protections that includes, you have to keep updating the standards by which you have applied that anonymization.

[Ryan Turnbull, Liberal, Whitby, ON]

In essence, because anonymization includes not being able to reidentify, and the anonymization process and techniques are evolving quite quickly, if you don't have this then what's the risk?

The risk to me is that perhaps it goes out of date, or organizations and companies are not keeping up with the pace of those generally accepted best practices.

What's the big risk, though, in terms of the public and privacy concerns? Mr. Chhabra, your comments really point to a risk that I haven't heard anyone talk about yet, and the main reason why our position is against removing this clause.

[Mark Schaan]

We have acknowledged the construct of anonymized information, but have set the bar very high for its usage, first of all, to have no reasonable prospect of reidentification and second of all, for conformity to the generally accepted best practices. I think, absent that, the worry is the commitment is solely to the purposes of non-reidentification and it doesn't necessarily provide that ongoing obligation back to industry to say have you assured yourselves that you're continuing to meet the new bar.

[Ryan Turnbull, Liberal, Whitby, ON]

That bar is continuously moving, so the standard that we're setting will continue to increase as technology evolves. That obligation for those companies would then be tethered to that moving target. The standards best practices are going to have to be followed. They can't just check out, use outdated anonymization techniques and forget about staying up to date with the best practices, am I right?

[Mark Schaan]

That's right. Essentially, it ensures that, as opposed to having a potential for a reidentification test that ultimately results in a breach, it is then revealed by the Privacy Commissioner to not have met the standard.

Instead, there are two elements. There's a non-reidentification, and the commitment to the use of generally acceptable best practices. This means you're continuing to ensure you're actually drawing on the techniques that are most modern.

[Ryan Turnbull, Liberal, Whitby, ON]

I have a final point, just to really punch home the point that leaving this in, and not taking it out as the NDP has proposed, continues to align Canada's legislation with Quebec's privacy law. I would also want to point to the fact that our next amendment, which Mr. Masse read out—the Quebec law on reasonably foreseeable risk—further aligns our legislation with Quebec's privacy law. Is that correct?

[Mark Schaan]

That's correct.

[Ryan Turnbull, Liberal, Whitby, ON]

Okay. Thanks Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Généreux, you now have the floor.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you, Mr. Chair.

I would also like to thank the witnesses for being with us.

At the outset, madam, gentlemen, I would like to say that the series of questions I am going to ask you are not so much about the amendment itself as about the process that led to it.

I think we all agree that the definition of the verb “anonymize” in Bill C‑27 is a very important element for the future and for the interpretation that will be made of it going forward.

I absolutely do not want you to consider my series of questions as a form of judgment. I just want to understand the process.

Almost two years ago, the government introduced this bill, which is now being studied in committee. We analyzed it with the help of witnesses, and today we find ourselves with more than 50 amendments from the government.

Were you the ones who drafted the bill in the first place?

[Mark Schaan]

In collaboration with my colleagues from the Department of Justice, my team is responsible for the drafting of Bill C‑27, whose objectives were set by ministers and cabinets.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Okay.

Following consultations held after this bill was introduced, the Minister of Innovation, Science and Industry put forward a series of amendments last September. He told us that you had consulted about 300 individuals and groups.

In addition, during the consultations, people who were called to our committee meetings told us that their names were not on the list of those 300 individuals and groups. Some came to tell us that they had not been consulted or that they would have liked to be consulted, or that they would have liked to see much broader consultations. In fact, we have been told several times that the consultations on Bill C‑27 should have been much more extensive.

Now we have a series of amendments, including amendments NDP‑2 and G‑2, which again show that some people have tried to get you to change your perception of the bill or the way you're drafting the bill.

You met with some groups much more intensively than others, if I understood correctly. That is the case for representatives of the Canadian Anonymization of Data Network, CANON, whom you have apparently met with about 10 times.

Why has it been necessary to meet with representatives of this group more than 10 times since the bill's introduction and our analysis of it in committee?

[Mark Schaan]

Thank you, Mr. Chair.

We are open to the idea of meeting with all stakeholders on Bill C‑27. We have received many requests for meetings, which I have accepted.

Obviously, my schedule is quite busy, especially because I come to testify before House committees, but members of my team are available to meet with those people.

I think there are two important parts to your question.

We met with representatives of the Canadian Marketing Association, as well as representatives of the Canadian Anonymization Network, CANON, a non-profit organization that brings together experts, other non-profit organizations and academics. That group has attended a number or conferences and meetings on the bill.

As I said, I accept any requests for a meeting to discuss the bill.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Okay.

In September, the Minister of Innovation, Science and Industry proposed a series of amendments, and the government is now proposing some 50 more as a result of the meetings you had with the various groups.

Do these amendments stem from the testimony we heard during the study of the bill or do they also stem from the meetings you had with representatives of certain groups? I would remind you that you have met with them more than 10 times.

[Mark Schaan]

The process of drafting a bill is not linear. An amendment does not necessarily come out of a meeting where representatives made recommendations.

Stakeholders actually propose improvements or concepts, or express their interests. The department then conducts an analysis to ensure that the bill continues to achieve the objectives identified by cabinet and the minister.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

I will come back to the amendment we are currently discussing.

The government is proposing a new definition. The NDP is proposing another one, which is consistent with the one used in Quebec, if I understood correctly.

What is the government's intention in terms of changing the definition? In our opinion, the definition is less appropriate than the one in the NDP amendment, which aligns with the definition used in Quebec.

As was mentioned, you've met with various stakeholders over 10 times. They were trying to influence you so to draft a particular definition.

Are you currently still meeting with those stakeholders?

[Mark Schaan]

If I understand correctly, there are two parts to your question.

It's important for me to clarify something. An NDP amendment asks that a few sentences be removed from the definition proposed in the bill. The original definition was consistent with the Quebec definition. It's important to encourage the use of anonymized information because it better protects the privacy of Canadians.

Getting back to the amendment and what motivated it, as well as the current definition set out in the bill, I must say that many stakeholders have conducted analyses, and that's what the proposed definition was based on in May 2022.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Do you think that the large number of interventions made by some groups, far more than others, could give the impression that industry players are trying to soften Bill C‑27, to make it more acceptable to them or easier to interpret and implement?

Are industry players looking to make their jobs easier at the expense of the real need to fundamentally protect privacy or children?

The purpose of the proposed legislation is to protect Canadians. Do you get the impression that these organizations want to water down the bill—if I can put it that way—to make it easier to interpret?