Industry Committee on April 29th, 2024

[Ryan Turnbull, Liberal, Whitby, ON]

I will be quick.

Our position is that amendment CPC-5 is something that can be supported, but based on, I think, Mr. Williams' questions, inferred information may already be included in the interpretation of PIPEDA and the EU GDPR.

Is that not correct, Mr. Schaan?

[Mark Schaan]

Yes. The current interpretation by both the OPC and the courts is that personal information as defined in PIPEDA currently, which is being ported to CPPA, includes inferred information.

[Ryan Turnbull, Liberal, Whitby, ON]

So including it doesn't really add a whole lot, except maybe for greater certainty, as you all say sometimes. I know that's a term that comes up in this committee a lot. It may actually improve the bill ever so slightly in terms of just being a bit more explicit that inferred information is included. Would you say that's sort of—

[Mark Schaan]

That's correct. It takes the current legal and regulatory approach and ensures that it's legislated.

[Ryan Turnbull, Liberal, Whitby, ON]

Okay, great.

I appreciate all the questions on the other amendments that have been proposed, and maybe we'll get into those in a moment, but maybe we can vote on this one. I'm certainly prepared to support amendment CPC-5.

[The Chair, Liberal, Joël Lightbound]

Are there any other comments?

Mr. Van Bynen, go ahead.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

I want to clarify. I think there was some discussion about including the words “but not limited to information”. Is that something you had indicated earlier, Mr. Schaan, that you wanted to see included in that amendment?

[Mark Schaan]

I think in the formulation in CPC-5 that's not necessary, because it still says, “about an...individual” and so—

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Thank you.

[The Chair, Liberal, Joël Lightbound]

I see that there are no other comments, so I will call amendment CPC-5 to a vote.

(Amendment agreed to: 11 yeas; 0 nays)

[The Chair, Liberal, Joël Lightbound]

Thank you, everyone.

Since amendment CPC‑5 has just been adopted, amendment BQ‑1 is now inadmissible due to the line conflict that I referred to.

This brings us to amendment NDP‑4.

Before giving the floor to Mr. Masse, I just want to inform him that, if amendment NDP‑4 is adopted, amendment NDP‑5 can't be moved, due to a line conflict, once again.

You're going to have to choose which one you want to move, because if NDP-4 is adopted, then NDP-5 cannot be moved.

[Brian Masse, NDP, Windsor West, ON]

Mr. Chair, I think we have had a good amount of discussion. I can drop amendments NDP-4 and NDP-5. I'm comfortable with the discussion we've had and with working that through.

[The Chair, Liberal, Joël Lightbound]

Okay, so they are not moved.

I don't think we've ever gone this fast before. Let's keep it going.

That brings us to amendment CPC-6.

Mr. Généreux, you have the floor to move amendment CPC‑6.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you, Mr. Chair.

Amendment CPC‑6 adds, after line 31 on page 5, the following definition of the term “profiling”:

Profiling means any form of automated processing of personal information consisting of the use of personal information to evaluate certain personal aspects relating to an individual, in particular to analyze or predict aspects concerning that individual's performance at work, economic situation, health, reliability, behaviour, location or movements.

In his brief to the committee on Bill C‑27, the Privacy Commissioner of Canada pointed out a gap in the bill. He said that, “unlike the European Union's general data protection regulation (GDPR) and other modern privacy laws in California and Quebec,” Bill C‑27 doesn't contain any provisions requiring organizations to take protective measures against profiling carried out by automated decision‑making systems. As drafted in the bill, the obligations would apply to organizations only when they use automated decision‑making systems to make decisions, recommendations or predictions about an individual. However, as the commissioner stated, “while profiling may be implicitly included in recommendations or predictions, not including it explicitly in the [proposed legislation] could create unnecessary ambiguity resulting in a significant gap” in terms of privacy. As a result, “often‑opaque activities such as data brokering—selling or … making available datasets about individuals which they will typically be unaware of—may not have the same needed transparency.” It's also unclear “if the obligations would apply to personalized digital environments,” such as the metaverse, in this case Facebook.

Although Bill C‑27 as currently drafted doesn't include any reference to the term “profiling”, the Conservatives are moving two amendments that use the term. As a result, this definition must be added.

Amendment CPC‑6 seeks to add a definition of the term “profiling” to the bill in order to support other Conservative amendments that use the term. These amendments seek to allow individuals to file an appeal against automated decisions made about them when they have been profiled, and to introduce a requirement for organizations to explain, in plain language, how their automated decision‑making systems profile selected groups.

With your permission, Mr. Chair, I would like to ask the witnesses a question.

The Privacy Commissioner of Canada and stakeholders from the Centre for Digital Rights have expressed concerns about the current gaps in decision‑making.

Are there currently any other gaps in the bill related to automated processing or decision‑making?

[Mark Schaan]

Although there is no definition of the term “profiling” in the bill, we feel that this concept is already included in the obligations and requirements for automated decision systems. However, if there was a desire to explicitly state that automated decisions include possible profiling, I think that would be a good addition to the bill.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

The European Union's General Data Protection Regulation and other statutes make distinctions about profiling in terms of group settings.

As far as personal information is concerned, are there other clauses of the bill that do not take into account an individual's option to opt out when a group of which they are a member chooses to register? In other words, when a person is in a group, is it possible for them to withdraw from that group?

[Mark Schaan]

Bill C‑27 gives individuals the right to request that personal information about them that is presented in a form that still makes it possible for them to be identified be deleted from a database.

However, as we discussed in the beginning, if that information is anonymized, there is no more information about an individual, so there is no need to make such a request.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Profiling is not defined in the bill, even though we know very well, indirectly, that it occurs. I would even go so far as to say that racial profiling is very important for a number of service providers who do mass data collection. I don't want to get into a debate, but we have seen on a number of occasions—in Montreal in particular—the whole issue of racial profiling in the public safety file.

Inevitably, individuals find themselves associated with certain groups that are profiled based on elements of their private life, such as race or age. Could the lack of an extremely explicit definition of profiling in the bill put these individuals at risk, since they are profiled without even knowing it and will, therefore, not have the opportunity to challenge the law going forward, in one way or another?

[Mark Schaan]

That's a good question.

As we were saying about the previous amendment, personal information refers not only to information used to identify an individual, but to all information that relates to that individual. So that really includes the concept of profiling. If information about an individual is kept in a database and is used to create a profile, or even if certain providers use it for marketing or advertising purposes, it is still personal information about an individual, so that individual still has all the privacy rights and remedies.

[Runa Angus, Senior Director, Strategy and Innovation Policy Sector, Department of Industry]

I would like to add something.

Since inferred information is included in the definition of personal information and there is a proximity between the concept of inferred information and the concept of profiling, that concept would, therefore, also be included.

As my colleague just said, if this information is used to create a profile, it is also used to infer information about an individual based on their membership in a group.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Then I gather that you are not opposed to our proposal to include this definition in the bill. We think this is essential. Would you agree with that?

[Mark Schaan]

We feel that the definition proposed in the bill already includes the notion of profiling, but it would not be a bad thing to add that concept to it. It would be all the more useful, since other amendments that the Conservatives wish to propose are based on the concept of profiling.

According to our interpretation of the bill, the definition already includes this concept, but it would be good to add it for clarification.

[Bernard Généreux, Conservative, Montmagny—L'Islet—Kamouraska—Rivière-du-Loup, QC]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Turnbull, go ahead.

[Ryan Turnbull, Liberal, Whitby, ON]

My understanding from the last exchange is that the concept of profiling activities is already included in the bill.

Is that right, Mr. Schaan?