Evidence of meeting #124 for Industry, Science and Technology in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was tribunal.
A recording is available from Parliament.
Director General, Strategy and Innovation Policy Sector, Department of Industry
The point is that it's three to six members, not six members firm—I apologize for that. Three of the members have to have expertise and experience in information and privacy law as a background.
I'll have to get back to you on the question about the tiebreaker, but the positions would be full time or part time. I guess it's going to depend on the degree of volume that's moving through the tribunal system.
NDP
Brian Masse NDP Windsor West, ON
It's interesting.
Here's part of my concern. I'll just give you an example. With my private member's bill that's in the Senate right now, Parks Canada has this policy it's pulling, and it best described its own policy as trying to build, paint and fly the plane at the same time.
What I'm worried about with this tribunal, if it's the same type of a process, is that perhaps in the future, if there is the will or the requirement, we could add the tribunal back for another Parliament if the system doesn't work very well for the Privacy Commissioner.
Director General, Strategy and Innovation Policy Sector, Department of Industry
To make sure I understand the question, it's whether the tribunal could be added to the system after the fact.
NDP
Brian Masse NDP Windsor West, ON
Yes. I know it's a hypothetical. We can do anything, really, at the end of the day. It's a matter of legislating a change.
Director General, Strategy and Innovation Policy Sector, Department of Industry
The implementation question that would be most present, I think, before the committee is whether the other important aspects of the CPPA could be advanced in their current form without having the tribunal there, as it's currently built into a number of different portions of the act.
As you see, the effect of CPC-9 is actually very broad and throughout part 1 of the act. I think it would be important to consider alternative mechanisms to achieve the policy intent that the tribunal would play in a number of different zones across the proposed amendment.
Answering your question in the hypothetical about whether a tribunal could be added downstream is a bit challenging, because we would need to look at each and every instance in the bill where the tribunal currently plays a role and ask if are there alternative approaches that could be developed instead.
I think that's the implementation challenge that the committee would face now.
NDP
Brian Masse NDP Windsor West, ON
That's fair. I don't want it to appear that it's an easy thing to do later on. That's definitely not the case. It would require.... What I'm struggling with is whether or not introducing this is necessary at this time.
I'll turn it to other colleagues to ask questions, but that's what I'm wondering at this point in time.
Conservative
Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC
This is a very important discussion, and I will admit there was very strong testimony received on both sides of the tribunal. If I understand it correctly, right now, the Privacy Commissioner has investigative powers. Those investigative powers would obviously still be retained if Bill C-27 were passed.
I'm speaking hypothetically here. The Privacy Commissioner conducts an investigation. If this bill passes in its current form, the Privacy Commissioner will recommend to the tribunal an administrative fine for a breach of privacy. The tribunal will then have to decide....
Am I correct so far? No. Please, correct me.
Director General, Strategy and Innovation Policy Sector, Department of Industry
In the proposed model under the CPPA, an investigation would be done by the Privacy Commissioner. The Privacy Commissioner would have the ability to enter into a compliance agreement that would have.... There are a number of outcomes that could happen.
The Privacy Commissioner could issue an order and say, “I'm ordering this company to cease or desist a certain behaviour,” or, “I'm ordering this company to take this remedial action to improve its privacy management program and its practices.” They could enter into a compliance agreement whereby those requirements are featured and a financial discharge is also included.
All of those things are possible and within the Privacy Commissioner's remit without the tribunal.
Conservative
Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC
Right. What about the cases when the tribunal is involved?
Director General, Strategy and Innovation Policy Sector, Department of Industry
The case when the tribunal would be involved is one when the Privacy Commissioner has gone through the entire process, may or may not have issued orders and then wants to recommend that an administrative monetary penalty be applied. He or she would then make a recommendation to the tribunal, on the basis of the facts of the case and the investigation, saying, “Here's the AMP that would be recommended.”
The tribunal would specialize in narrowing down and deciding on the level of the administrative monetary penalty on the basis of the facts of the case as presented.
Conservative
Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC
Would the tribunal be commencing a de novo study of the issue at hand, or would it be solely based on the findings of the investigation conducted by the Privacy Commissioner?
Director General, Strategy and Innovation Policy Sector, Department of Industry
In a case in which the Privacy Commissioner is recommending an administrative monetary penalty, it would not be a de novo consideration by the tribunal. It would be about taking the facts of the case and identifying the right level of administrative monetary penalty.
There is another point that I think is really important to understand here procedurally, which is that the Privacy Commissioner could go through the process and develop, for example, an order to say, “I'm asking this company to cease and desist this behaviour,” or, “I'm asking them to adjust their privacy management plan to change the governance structure.”
If there were an appeal of that decision, the tribunal would hear that appeal, and again, it would not be hearing it as a de novo proceeding. They would have to give deference to the findings of the commissioner. It would not be relitigating the entirety of the findings or the investigation but reviewing it in a more narrow approach, as compared to if there were not a tribunal and the Federal Court had to take it on. It would be a different proceeding.
Conservative
Brad Vis Conservative Mission—Matsqui—Fraser Canyon, BC
I'll stop there for right now.
Thank you, Mr. Chair.
Liberal
Ryan Turnbull Liberal Whitby, ON
Thanks.
I'm happy to get into this debate. I wanted to challenge the claim that Mr. Williams made in his remarks, which was I think solely based on an argument that's claiming the tribunal would slow things down, add bureaucracy and make things less efficient.
The way I'm reading it, and even in just what you responded to Mr. Vis, suggests to me that “deference” literally means that the evidence that was the result of an investigation by the OPC would be considered within the tribunal's work, whether it was an appeal or whether it was determining the right volume of an administrative monetary penalty.
Could you unpack that for us? How is this.... I get the perspective that the Conservatives and some others are bringing up here. I get it: We don't want to add bureaucracy and slow things down. That is not the intention. My understanding is the tribunal would actually speed things up.
I'll get to this after with a separate question, but I want to ask you about trust and administrative fairness and unpack that more. Let's just start with efficiency and eliminating bureaucracy, if you could unpack that for us.
Director General, Strategy and Innovation Policy Sector, Department of Industry
We believe that having a tribunal in place will increase the speed and efficiency of the process. The tribunal, unlike a court, is going to be required to give deference to the commissioner's decision. I think that's the important first piece to understand. What that means is that the tribunal does not need to start all over again, or de novo, when reviewing a file. It can consider and adopt the work and the reasoning that the commissioner has already done.
That allows for a more streamlined and efficient process to move forward and, most importantly, the tribunal's decision itself will be considered final. That means it's not something that can be appealed to a higher-level court. Somebody could seek a judicial review of the decision, but a judicial review of a decision is far narrower. It does not reopen the findings of the case. It's about determining whether the decision of the administrative body was fair, reasonable and lawful. Generally speaking, what that means is that the court is being asked to review whether the tribunal acted within its authority or mandate.
That is an entirely different scenario from going through an appeals process to various courts, relitigating and reopening the case at each stage and having new facts brought to bear. In that way, it would be expected to be resolved far more efficiently and sooner than if you're going through an appeals process.
Liberal
Ryan Turnbull Liberal Whitby, ON
Thank you for that.
I also understand that one of the other benefits of a tribunal would be the expertise of the individuals who are a part of that tribunal process.
Can you speak to how, if you look at two possibilities—one where the tribunal is in place and one where there is no tribunal and one has to go through the Federal Court system—that would affect the timelines and perhaps the trust in...? I have in my notes, and I think you referenced it, Mr. Chhabra, a case with Facebook in which the OPC was deemed to maybe not have had enough evidence, or the quality of the evidence.... You can correct me if I'm wrong, but I just wonder how important it is, not only to procedural fairness but also to a speedy process, to have people with specific expertise in privacy.
Director General, Strategy and Innovation Policy Sector, Department of Industry
I think we've seen that these issues tend to be quite complex when it comes to personal information, data flows and how information is being utilized. It's not necessarily a straightforward proceeding. It's not necessarily one where a judge would typically have a significant amount of experience in previous case law to build from. There is, obviously, some case law in this space, but not to the level that might be considered a commonly understood approach.
The speed element comes from making sure both that the tribunal's decisions themselves are considered final so that they're not being appealed but also that the degree of expertise resident in the tribunal is specifically designed to respond to stakeholder feedback that was received before Bill C-27 was tabled, about the importance of having at least three members of that group having expertise in privacy and information law. That is a growing field of law where experts have been developing their understanding of the issues and also of how emerging issues in the digital technology space, in terms of how data is being used, could have important effects on individual privacy.
It's understanding the nexus of cybersecurity, understanding the nexus with de-identification or anonymization techniques, understanding the importance of governance approaches taken within organizations and understanding the approaches being taken in other jurisdictions as well. There are a number of reasons that having expertise in the domain of privacy law and privacy and information protection would be helpful for speed and to make the decisions more effective and procedurally fair.
Liberal
Ryan Turnbull Liberal Whitby, ON
Thank you for those clarifications. I think your comments have helped me understand how specifically the tribunal would make the process more efficient and not more bureaucratic and laden.
Let me back up for a second before I go forward. Do we know exactly how much more quickly things can move through a process of appeal, for example, in other jurisdictions where a tribunal is in place? Do we have any kind of idea of how a tribunal might shorten that timeline in comparison with going through a Federal Court process?
Director General, Strategy and Innovation Policy Sector, Department of Industry
Unfortunately, I can only answer in the most general sense. We obviously have all likely been exposed to court cases and appeals that can take many, many years to move through both the initial decision system and the follow-on appeal systems. It's possible for them to drag out for many years. Currently, the first-level court takes up to two years to engage. We would think that a tribunal could be much more rapid than that, particularly because it would cut down on the number of follow-on appeals that would go after the tribunal's decision.
Liberal
Ryan Turnbull Liberal Whitby, ON
Thank you for that.
I want to ask you another question, again to differ with Mr. Williams' opening remarks when he introduced the amendment. To use his wording, according to my notes, he said it would make us an “international outlier”. He also said there would be “delayed justice”, which I think we've talked about. I think he also said—I'm sorry, my notes are not as clear as I thought they were—that the efficacy of the OPC, the power of the OPC, would be somehow diminished by having a tribunal in place.
I'm not sure that's true, based on my reading. My understanding is that what the CPPA is proposing gives the OPC quite a number of new authorities and powers that are above and beyond what the OPC has had in the past.
Could someone just list and unpack the specific new powers? Then I have a couple of follow-up questions to that.
Director General, Strategy and Innovation Policy Sector, Department of Industry
New powers afforded to the commissioner would include the ability to issue binding orders following investigations. As I mentioned earlier, those could include an order for an organization to do something to comply with the CPPA. They could also include an order that an organization stop doing something that violates the CPPA.
The commissioner would also have the ability to enter into compliance agreements. As I mentioned earlier, government amendments that have been tabled would allow for those compliance agreements to be entered into at any stage throughout the process and also for financial considerations to be included within that compliance agreement. That means, for example, if an organization were found to be in contravention of the CPPA, the OPC would have the power to negotiate a compliance agreement that could include, in essence, a financial payment or penalty.
All of those things are new powers the OPC would have as a result of Bill C-27, which are not currently available to the commissioner.
On the issue of alignment with other jurisdictions, as I pointed out earlier, we should always be very cautious about thinking narrowly about alignment on any one specific issue. We do see tribunals in effect in the privacy space in the U.K., Ireland, Australia and New Zealand, taking an approach that is very analogous to the one being taken here, with some slight variations across them, but again, every jurisdiction has its own constitutional framework and other laws in place that drive those slight variations.
The point is that we are taking into account the best practices and the best approaches that have been undertaken internationally, and we are undertaking significant consultations here in Canada to bring forward a proposal that we think significantly improves the enforceability of Canada's private sector privacy law and gives the commissioner significant new powers to do so.
Liberal
Ryan Turnbull Liberal Whitby, ON
Thank you for that.
There are binding orders and compliance agreements that may include monetary penalties, and I understand that the tribunal would come into effect only if there were an appeal or there were some question around the rate at which to set that monetary penalty. Is that correct? Are those the only two cases in which the tribunal would come into play?
Director General, Strategy and Innovation Policy Sector, Department of Industry
That's right. I think in practical effect, you can imagine scenarios in which a company would not agree with the commissioner's position on what the compliance order should include, for example.
If the commissioner were in a position of not being able to negotiate such a decision or outcome, the commissioner could then recommend an administrative monetary penalty to the tribunal, or the individuals or companies involved in the case could seek an appeal to the tribunal. As previously pointed out, those are the two points at which the tribunal could be engaged, and in both instances we find that it would be more efficient and effective than the alternative process would be.
