Industry Committee on May 22nd, 2024

[Ryan Williams, Conservative, Bay of Quinte, ON]

Okay.

You mentioned the U.K. privacy commissioner, but this is Elizabeth Denham's testimony. From the top, she said:

My last point is that Bill C-27 creates a tribunal that would review recommendations from the Privacy Commissioner, such as the amount of an administrative fine, and it inserts a new administrative layer between the commissioner and the courts. It limits the independence and the order-making powers of the commissioner.

You mentioned that Elizabeth Denham was supportive of the tribunal. From this testimony, it seems that she was against the tribunal.

[Samir Chhabra]

There are a number of pieces there that I'd like to try to unpack. I think in the context of order-making powers, we've already been clear that the order-making powers in the CPPA would vest with the commissioner, so it's difficult to see how the tribunal would be slowing down the order-making abilities of the commissioner.

The notes that we have here from Ms. Denham include that there is a tribunal system in the U.K. and that administrative tribunals are used across many areas of law. It may seem like a lengthy process, but over time the tribunals become expert tribunals, and the Bill C-27 proposals are aimed at ensuring administrative fairness. That is really what we're talking about here—the carriage of justice, administrative fairness and ensuring that there is an appropriate delineation of powers and responsibilities.

My colleague will take a moment as well.

[Runa Angus]

I just want to jump in on the current commissioner's assertion that the tribunal would add a fourth layer in the process. I think it's important to understand the process now and how the tribunal would change it.

The process now is that the Privacy Commissioner is an ombudsperson. They actually have investigative powers but no decision-making powers, so what happens is that the commissioner issues some findings. A company can choose whether or not to undertake the recommendations based on the findings. If they do not, the commissioner's only option is to take that company to court. When they take that company to court, the court gives the commissioner no deference. It's like any plainant taking a company to court. They have to make their case. As my colleague suggested, many times the commissioner loses those cases, as most recently happened in 2023 with the case against Facebook. Obviously you can appeal that decision to the Federal Court of Appeal and eventually to the Supreme Court. That's the current process.

This new process, first of all, gives the commissioner decision-making powers. The commissioner can issue compliance orders—which is something that it can't do now—which actually compel an organization to do or not do something, and can recommend AMPs. Those decisions can be appealed to the tribunal, but once the tribunal makes a decision.... Actually, even before that, the tribunal has to actually defer to the OPC on many questions of fact and questions of law.

That's the first difference with a court, which wouldn't do that. The second difference is that once the tribunal makes that decision, the decision is final. The decision cannot be appealed. The only recourse possible is a judicial review.

A judicial review is not the same thing as an appeal. An appeal is a substantive reconsideration of the merits of a case. With a judicial review, a court—and in this case it would be the Federal Court—simply decides whether or not the tribunal acted reasonably. It's not a substantive reconsideration of the case, hence it's not an appeal, so the tribunal's decision is final. That means it's a shorter process; it's a quicker process and it's a less expensive process.

[Samir Chhabra]

To add to that, on the point about compliance orders, the current Privacy Commissioner did point out a concern about his ability to enter into compliance agreements that would include financial considerations. An amendment that would give the Privacy Commissioner the ability to enter into a compliance agreement at any stage of the process and to include financial considerations in that has been proposed.

We feel that the commissioner's perspectives on this have been well understood and taken on board.

[Ryan Williams, Conservative, Bay of Quinte, ON]

We had one witness, Jim Balsillie from the Centre for Digital Rights, talk about it from a business perspective. He talked about the other layer. He said what's going to happen is that if you're a corporation trying to negotiate with the commissioner, you'll just shrug your shoulders and say, “Well, I'll see you at the tribunal, which is quasi-judicial.”

We've seen some of this with the Competition Bureau. With the Rogers-Shaw case, it was so bad that when the tribunal made a ruling opposed by the competition commissioner, the company itself was able to then sue the commissioner. It created another layer. It created a precedent that we don't want to see happen with our privacy laws.

I'd like to go to this other question as well. There's no other privacy law regime in the world that has this tribunal. We're looking at progressive regimes in the EU, as well as regimes in California, Utah, Colorado, Virginia and Connecticut and the proposed American data privacy and protection act, and no one has proposed or established a tribunal like the tribunal being proposed, so why is Canada trying to be an outlier? What would be the benefit?

[Samir Chhabra]

I think it's a really important question.

I appreciate where the committee members are coming from in terms of identifying good practices and opportunities to bring into Canadian practice things that have worked well in other jurisdictions. I also think it's really important to make distinctions about the ways in which the various systems work. We cannot holus-bolus import various pieces without understanding the context and the way they're developed.

I believe the honourable member just mentioned California. California does not have a consent-based system. California has an entirely different establishment whereby people can essentially opt out of having their data collected but in a way that is completely different from actually having to seek consent and have that as the cornerstone of your approach.

The reason I raise this is that understanding the way these legal frameworks work in their totality is really critical to understanding which pieces could simply be added to or extracted from a given mix and would make sense and be coherent within that legal framework and then within the Constitution or other broader legal frameworks in a given jurisdiction. In this instance, we have seen tribunals be effectively deployed in privacy in the U.K. and in Quebec. Particularly, very closely aligned with the approach we're suggesting here would be Australia, New Zealand and Ireland.

There are considerations in Canadian law that suggest that it would be appropriate and that Canadians expect to see procedural fairness. They have an expectation that there will not be a single judge, jury and executioner, but rather that there will be an approach that allows for the investigative function to take place in a way that's unfettered, that allows for joint work and that allows for alignment and collaboration. Simply, on the imposition of monetary penalties, an expert body can focus on determining, on the basis of the investigation, as my colleague Ms. Angus pointed out, with deference to the commissioner's approach, and being able to take those decisions.

The second point that I think my colleague already elaborated on very effectively is that when it comes to an appeal, the tribunal would have to give deference to the fact-finding and investigative results of the commissioner. That is actually a much improved situation for the commissioner and makes a much more streamlined and speedy process to land on a final outcome. If there were situations in which participants engaged in a scenario that the Privacy Commissioner was investigating and disagreed with the Privacy Commissioner, I think most Canadians would expect that there would be recourse or an appeal or a place to go and have that be adjudicated effectively by a body that has expertise in privacy.

This is particularly as we increasingly encounter digital issues and digital market issues, privacy issues that can be quite complex to understand and perhaps beyond what a layperson would ordinarily experience. Having a body that is developing expertise in this space and is able to grow with the digital economy is, I think, a very core element of why it's a useful piece to have.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Why have we not maybe looked at the Quebec model? In Quebec the Commission d’accès à l’information can directly impose administrative monetary penalties. Recently, a new bill was passed in Quebec that enables the Office de la protection du consommateur to impose administrative monetary penalties directly as well.

Why did the federal government not look at what's being done in Quebec?

[Runa Angus]

The Quebec model is really very aligned with the model we're proposing. The main difference is that the tribunal is built into the CAI. The act for the CAI establishes several sections that have very clear purposes.

There's an oversight division and an adjudication division.

On top of that is the president's office, which is actually supported by eight administrative judges who act as an appeal mechanism within that. A case can come from the jurisdictional side for an AMP and be appealed. It's the administrative judges who support the president's office who actually can review that decision. It's actually a tribunal system that's built into the organization.

What we are proposing is very much aligned with that model, except there is a structural separation between the two bodies that perform those functions.

[Ryan Williams, Conservative, Bay of Quinte, ON]

As you noted, the current system right now, which would be then appealed just to the Federal Court...or, sorry, to the sub-Federal Court—

[Runa Angus]

At this time, there isn't an appeal, because the OPC doesn't have any decision adjudicative powers. It's a de novo proceeding.

[Ryan Williams, Conservative, Bay of Quinte, ON]

However, in terms of the powers of the commissioner, which would be to issue orders and administrative monetary penalties going up to $10 million or 3% of sales, those powers will be in effect, no?

[Samir Chhabra]

I'm sorry. I'm not sure. Are you saying they would be in effect under the CPPA?

[Ryan Williams, Conservative, Bay of Quinte, ON]

Yes. The commissioner will have those powers to issue orders. The tribunal then, you're saying right now, is the only way to have recourse. If we take the tribunal away, there would be no recourse to the courts. Is that what you're saying?

[Samir Chhabra]

Depending on the decisions that this committee makes and how it's structured, I think there would be some potential challenges in terms of the implementability of CPC-9 as it's structured now, including with regard to part 2 of the bill. I think there would probably need to be several.... We would need to take some time to go through it again to see what the....

I think what you're asking is what the default would be if the tribunal is removed. I think that there are issues of principle as well as of implementation that could arise. On the principles point, there's a principle of natural justice and administrative fairness that I think needs to be managed. I think you could still imagine a scenario in which we move through the federal courts and the Court of Appeal and the Supreme Court, which is kind of what we mentioned earlier.

You would end up in a situation that is roughly analogous to today's, in that the decisions could be appealed. Each appeal would be a de novo proceeding. Each appeal would have to review the basis of fact to begin. That is going to be a more lengthy, drawn-out, challenging process than the one that would be undertaken under a tribunal system.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Okay, so I'm going to let this go into more discussion from other members, Mr. Chair, but I think what I'm understanding is that we'd have to relook at part 2. I think that's the whole point of this amendment, that part 2 is about a tribunal.

You know, a lot of what we do from our side is listen to the witnesses, specifically the current Privacy Commissioner and the former privacy commissioners when they're looking at the system, how it operates and how they'd like it to operate. More importantly, when we look at protecting Canadians' consumer rights, at a fundamental human right for privacy, we're looking at a system that looks at best practices across the world, not just reinventing the wheel. Specifically, from our side, we're looking at what's happened from the tribunal's and the competition commissioner's aspect and at how it hasn't worked or perhaps hasn't been working as well as we'd like it to.

I'm going to leave it, Mr. Chair, that I still feel that the tribunal is unnecessary. I think we can go through better aspects to improve that process on the appeals system and the powers and, of course, give more power to the Office of the Privacy Commissioner.

I'll leave it at that. Thank you, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Williams.

I have Mr. Masse, Mr. Vis, Mr. Turnbull, Mr. Garon and Mr. Perkins.

[Brian Masse, NDP, Windsor West, ON]

Thank you, Mr. Chair.

I'd like to draw a picture, I guess, for people following this. How many members would be part of the tribunal?

[Samir Chhabra]

It's proposed to have six members, three of whom would have to have experience in information and privacy law. I think it's also worth pointing out that the proposed approach is to have them be appointed by the Governor in Council. They would not be ministerial appointees under the proposed act.

[Brian Masse, NDP, Windsor West, ON]

Okay. What would happen, though, for example, if the tribunal split three to three?

Don't worry if....

[Samir Chhabra]

There's a tie-break procedure. I just want to make sure that I'm getting it right before I respond.

[Brian Masse, NDP, Windsor West, ON]

Yes. I'm just trying to paint a picture of the practical process for people who are—

[Samir Chhabra]

I understand. I'm sorry about that.

[Brian Masse, NDP, Windsor West, ON]

No, that's okay. It's a pretty big bill.

[Samir Chhabra]

If you have another question, maybe we can come back to that one, if that's all right.

[Brian Masse, NDP, Windsor West, ON]

Yes.

Would these be full-time positions? What's the compensation? Can we get an idea of how this even works?

One of the concerns that I have is that this also becomes a political appointee process that, you know, maybe doesn't have the right trust or can be influenced by industry. Those are legitimate questions, I think. I questioned some of the large companies that were here.