Industry Committee on May 22nd, 2024

[Ryan Turnbull, Liberal, Whitby, ON]

In some sense, is the tribunal actually enhancing the efficacy of the OPC's use of the new powers it would get as a result of the CPPA, or is this a check-and-balance situation in which those powers would be somewhat limited by the tribunal? I think what was implied was that, essentially, having a tribunal—at least as I understood Mr. Williams' intention when he made his comments—would somehow take some of the power away from the OPC, but I'm not sure that's the case.

First of all, we've already established that the OPC is getting significant new powers. The powers the OPC would have as a result of the CPPA would be enhanced. Since the OPC did not have those powers in the past, it might make sense to build trust in this relatively new system in Canada to ensure that those powers are checked or have some limitations, but I can even speculate that there might be some ways in which the monetary penalties might be fairer as a result of having a tribunal look at how to set them at the right level.

It's an open question. I really don't know exactly what the answer is. It's a legitimate question.

[Samir Chhabra]

I think it's probably best to consider it in two ways.

One, when we talk about the ability to set the administrative monetary penalty, which would be done by the tribunal, I think you're quite right that it is a check-and-balance piece. That is about fairness. That is about expertise in setting the appropriate monetary penalty.

When it comes to the appeals process, again, you're quite right that it would, in effect, speed up the finalization of an outcome compared to what it would be otherwise by following the court system. Because the decisions of the tribunal are final, there is significantly more speed and efficiency and effectiveness in getting to the outcome. One could suggest that actually the OPC's powers and the ability of the commissioner to get to a final decision and to influence what's happening in the market and to get companies to comply are in fact sped up and aided by having a tribunal system rather than having to work through multiple layers of court systems via appeals.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you.

I have one other question related to this. I note that some other members on this committee have noted the number of cases that have been contested in the federal courts. Now, I think it's misleading to use that as a way of determining the volume of disputes there might be, given the fact that we're discussing here a new legislative framework. The old one in PIPEDA was 20 years old and didn't account for the digital age that we're in. It didn't account for many of the breaches in privacy that may happen more frequently throughout our economy today.

I think when you're introducing a new legislative framework that comes with the OPC having new powers and authorities, and you have an old legislative framework not suited for the age we're in, my impression would be that there could be a lot more volume of disputes that both the OPC and the tribunal might deal with in the future once we, hopefully, get through installing this new legislative framework.

Can you unpack that for us and whether you think that volume of disputes would likely increase in the future? Again, I could see a case to be made that if we think the volume is going to increase, which I suspect may be the case, then would we want all of those disputes to be going through a federal courts system rather than having a tribunal in place that significantly speeds up the process and gets to outcomes and increases trust and transparency in a system that is relatively new?

[Samir Chhabra]

I think it's very fair to say that the OPC is getting significant new powers. Those powers include order-making powers and the ability to recommend administrative monetary penalties, which are significant changes from the current approach wherein, as my colleague pointed out earlier, the OPC does not have those abilities.

I think it's likely that companies may be more motivated to undertake appeals and try to seek different outcomes because of the nature of how they could be impacted by the OPC's new powers. I think it is quite reasonable to suggest that there might be more activity in terms of follow-on appeals.

[Ryan Turnbull, Liberal, Whitby, ON]

Chair, are we having a vote soon? I'm just double-checking the time.

[The Chair, Liberal, Joël Lightbound]

Well, we are supposed to, but the bells are not ringing.

[Ryan Turnbull, Liberal, Whitby, ON]

They're not. Okay. I'll keep going, then.

My understanding is that other jurisdictions also have a tribunal in place. Mr. Williams was saying that we would be an international outlier, but based on my understanding and based on some of the things you've said already, that is not exactly the case. It may not be the case at all.

Could you clarify for us any of the other tribunals and how things work in those other jurisdictions? I know you've mentioned New Zealand and Australia, but are there any others that you could reference?

[Samir Chhabra]

As you correctly pointed out in the question, Australia and New Zealand are both analogues we've looked at that have tribunal mechanisms. The U.K. has a tribunal mechanism that's organized slightly differently from what's being proposed under the CPPA. Again, as I pointed out earlier, different jurisdictions have different kinds of constitutional frameworks that can drive those differences.

It's also important to recognize that when we're looking at analogues around the world, a lot of the privacy rule sets or legal frameworks have very different applications and very different scope, and therefore would necessitate different kinds of oversight mechanisms. A good example that we referenced earlier today is California, which has come up in this committee a number of times over the last few weeks. California's administrative monetary penalty regime is capped at between $2,500 and $7,500 per transgression. At that level, it may not be necessary to have a body of expertise dedicated to understanding the issues and determining the right level of monetary penalty that would be applied.

In this case, under CPPA, we're talking about going up to $10 million or 3% of global revenues. That is a very significant impact. I think a degree of procedural fairness would be expected. That's why the tribunal is a core part of the government's proposal.

[Ryan Turnbull, Liberal, Whitby, ON]

Based on what you've said, there are administrative tribunals in the U.K., Australia, New Zealand and Ireland. You've pointed to the model in Quebec as being slightly different but effectively an administrative tribunal. I think there are other federal-level jurisdictions or areas. I think there are several other areas where administrative tribunals are used.

Can you maybe talk about any of those other examples—within agriculture, for example, or any of the others that you know about?

[Samir Chhabra]

Certainly.

I have mentioned tribunal models or administrative tribunals in spaces in Canada federally, like agriculture, transportation and international trade. I'll turn to my colleague for some specifics on those.

[Runa Angus]

The first one is obviously in competition as well, and I think we've talked about that.

Another interesting example is the CRTC, which is also an administrative tribunal. What's interesting is that under Canada's anti-spam legislation, there is a chief enforcement officer who has all of the powers the OPC would have. They conduct investigations, issue notices of violation and make recommendations, potentially, for AMPs, but it's the tribunal that actually makes those decisions, again, as an oversight mechanism.

Again, it's very similar to the CAI model in the sense that there is an appeal mechanism within the organization, like the CRTC, but it's in one organization as opposed to two different organizations. The Competition Bureau is another example in which there are two different organizations. There's the Competition Bureau and then there's the Competition Tribunal, which performs the same function.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you.

On a slightly different topic, I think this amendment also removes the private right to action. Can you speak to the importance, from a principles perspective, of having that incorporated into...? That seems to be a pretty important piece of the legislative framework that hangs together.

Can you speak to the importance of that?

[Samir Chhabra]

The importance of maintaining a private right of action has been raised by civil society stakeholders throughout the consultations that have taken place since 2018. It's also been raised as an important feature by the Office of the Privacy Commissioner.

Because of the way the law is set up, although it's possible for the commissioner to recommend an administrative monetary penalty, that's not going to compensate an individual who may have suffered a transgression of the act on their own personal information. It wouldn't do anything to make them whole. What a private right of action does, as it's proposed in the bill, is allow the individual in that finding, on the basis of a decision and a finding of the Privacy Commissioner, to go and seek awards or compensation on the basis of the impacts they faced through the transgression of the law.

[Ryan Turnbull, Liberal, Whitby, ON]

Essentially, they wouldn't be able to seek rewards for breaches of their privacy as a result of this amendment. Is that what I'm hearing?

[Samir Chhabra]

If the proposed amendment in CPC-9 were to move forward, it would remove the ability for individuals to take a private right of action in these situations. That's right.

[Ryan Turnbull, Liberal, Whitby, ON]

It seems pretty counter to what I've heard some members on this committee say they would like to be able to protect, which is the fundamental right to privacy.

I really appreciate your testimony. This is the last thing I'll ask, because it's still nagging in my mind.

I think Mr. Williams and Mr. Vis implied that the OPC doesn't want a tribunal. I think Ms. Angus said that's not exactly correct. Can you just square that for us, because it seems like it's a fundamental disagreement here?

Where does the current Privacy Commissioner, Mr. Dufresne, who I have a lot of respect for...? I would love to know how we ensure....

What is the Privacy Commissioner's perspective on the tribunal? Can you give us just the highest overview of that again? I know you've already told us, but it seems like there's a difference of opinion about what the Privacy Commissioner has said, and it would be helpful just to clear that up once and for all, if possible.

[Runa Angus]

Sure. Last year, the Privacy Commissioner published 15 recommendations that were his top priorities or top changes that he wanted to see in the CPPA, and none of them requested the removal of the tribunal. He requested two things. One was with respect to the tribunal and one was with respect to his other enforcement powers.

With respect to the tribunal, what he said was that he would prefer the tribunal decisions be appealed to the Federal Court of Appeal rather than the Federal Court, which is currently the system. As we've said, it's not an appeal, it's a judicial review, so it's not quite the same thing. Skipping a step is not really going to make it faster, because it's not an appeal.

The second recommendation was about giving more flexibility with respect to compliance agreements. Specifically, he wanted to be able to enter into a compliance agreement at any point in time; he wanted financial consideration, so the equivalent of AMPS, to be part of the compliance agreement that he could conclude, and there are government amendments to that effect.

[Ryan Turnbull, Liberal, Whitby, ON]

Is there any residual disagreement in terms of what the OPC has recommended and the approach currently being taken in the CPPA?

[Runa Angus]

It would be the OPC recommendation that asked for the decisions of the tribunal to go to the Federal Court of Appeal that we would not do. My understanding is that it would require an amendment to the Federal Courts Act, which is not under consideration at this time. We couldn't amend the Federal Courts Act to that effect.

At the same time, from a policy perspective, that's not necessarily going to speed up the process, because, as we've discussed, it's a judicial review and not an appeal.

[Ryan Turnbull, Liberal, Whitby, ON]

To clarify again, the OPC did not ask for taking the tribunal out of this legislation.

[Runa Angus]

That is correct. The current commissioner did not ask for that.

[Ryan Turnbull, Liberal, Whitby, ON]

Okay. Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Turnbull.

Mr. Garon, go ahead.

[Jean-Denis Garon, Bloc, Mirabel, QC]

Thank you very much.

I want to go back to what Mr. Turnbull said. Some good questions have been raised, and that's necessary for debating purposes.

We've discussed at length the number of cases the Commissioner has handled under the present legislative framework. I've questioned the parliamentary secretary, the minister and the deputy minister on the subject. We can agree that amending the act could increase the number of cases and expand the case law, for example, which raises the matter of expertise.

To my mind, expertise has to be acquired at both the Commissioner's office and the tribunal. I think this is a something of a side issue. We're interested in knowing what expertise has been built at the Commissioner's office.

How many of the Commissioner's decisions have been challenged in Federal Court, and how many of those were invalidated?

[Runa Angus]

It's important first to point out that the Commissioner doesn't currently have decision-making authority. The Commissioner publishes an investigation report that contains recommendations and if the business doesn't want to comply with them, that's when the Commissioner or complainant can take the business to court.

We looked into this issue and found that, from 2003 to 2024, some 50 decisions concerned an investigative report prepared by the Commissioner and that, in 70% of those cases, the court did not agree with the Commissioner's findings and investigation report.

More recently, in a case involving the Commissioner and Facebook, the Federal Court found that the Commissioner had not discharged his burden of proof. He hadn't really made his case. It should also be noted that the Commissioner appealed that decision. As we said, since that's obviously a long process, we'll have to see how long we have to wait for a final decision in the case. It doesn't always happen that way, but it nevertheless happens often enough.