Industry Committee on May 22nd, 2024

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Masse.

Mr. Vis.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Just following up on that exchange, did the department meet with the Canadian Bankers Association in advance of the two letters we received?

[Samir Chhabra]

I believe we may have received an email from the Canadian Bankers Association. There may have been dialogues at various points as well. I don't know the timing of the meetings compared to the letters you're referring to.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

I was referring to the May 7 letter sent to the industry committee.

[Samir Chhabra]

No, there was no meeting around that date.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Okay. Thank you very much, colleagues.

For this subamendment proposed by Mr. Perkins, is there consensus to adopt it?

(Subamendment agreed to)

We're back to CPC-7, as amended.

(Amendment as amended agreed to: yeas 11; nays 0 [See Minutes of Proceedings])

Thank you, colleagues. Congratulations.

I had NDP-6 on my list, but I'm guessing Mr. Masse won't be moving it.

[Brian Masse, NDP, Windsor West, ON]

That's right, Mr. Chair. It's no longer necessary.

Thank you.

[The Chair, Liberal, Joël Lightbound]

Okay. That takes us all the way to CPC-8.

Mr. Perkins.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair.

The consumer privacy protection act makes reference to the term “significant impact” on several occasions, and we are concerned that the CPPA does not currently explicitly include a definition of what this term means. Given the significance of this term throughout the bill, it poses considerable issues in the face of conflicting interpretations and views of what this term constitutes to stakeholders and businesses.

The term “significant impact” is currently featured twice in the bill. In proposed paragraph 62(2)(c), it states, under “Policies and practices” of “Openness and Transparency”, that an organization must make:

a general account of the organization's use of any automated decision system to make predictions...that could have a significant impact on them

It also says that this section concerns how an organization “must make...available [any] policies or practices put in place to fulfill” it.

Then, in proposed subsection 63(3) on access to personal information, concerning the use of automated decision systems, it makes another reference: “If the organization has used an automated decision system [with regard] to an individual that could have a significant impact on them, [it] must, on request...provide...an explanation” to the individual. This section concerns an organization's requirement, on request, to fully inform an individual of any use of personal information and to provide access to that information.

In the same way that “automated decision system” is defined in the CPPA to explicitly explain and outline the use of certain technologies, the impact of these technologies should be explicitly defined in this bill to remove any ambiguity and protect Canadians. The consequences of not including the definition of “significant impact” present a threat to the compliance of personal information and protection. We've worded it in a way that says “prescribed criteria”, which I believe allows flexibility for policies and perhaps even regulations to be drawn up after the bill is passed in this area, but I would ask the officials to comment.

[Samir Chhabra]

We would agree that, as defined here, “significant impact means an impact that meets the prescribed criteria.” The government would need to undertake a regulatory process following this to set those criteria.

[The Chair, Liberal, Joël Lightbound]

All right.

Are there any comments on amendment CPC-8?

(Amendment agreed to: yeas 11; nays 0)

[The Chair, Liberal, Joël Lightbound]

Thank you, everyone.

That brings us to amendment CPC-9.

Before turning the floor over to Mr. Williams, I must inform you that, if amendment CPC-9 is agreed to, amendments NDP-32, NDP-38 and CPC-70 may not be moved as a result of a line conflict; amendment NDP-37 can't be moved either as a result of a line conflict and for reasons of consistency.

Go ahead, Mr. Williams.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thank you, Mr. Chair.

As you noted, this is a rather wide-ranging amendment, making changes in numerous proposed sections and subsections through the CPPA. Its purpose is to transfer power to issue monetary penalties for violations of the CPPA from the privacy tribunal to the Privacy Commissioner, where we in the Conservative Party believe the power should be rested and where it should have been rested in the first place.

We are of the opinion that the tribunal is completely unnecessary and counterproductive. It will make Canada an international outlier compared to how our peer nations operate. It is unneeded bureaucracy, which will only serve to slow down and dilute the resolution of privacy violations. It will hamper the ability of the federal and provincial privacy commissioners to work together to perform joint investigations and, most concernedly, by existing within ISED, the tribunal, whose members will be patronage appointees by the minister, is an attempt to impede and interfere with the independence and jurisdiction of an independent officer of Parliament.

The proposed tribunal will make Canada an international outlier. No other peer nation—not the EU, the U.S., the U.K., Australia or any other G7 nation—has a privacy tribunal. Each of these other nations has the same system. The privacy regulator investigates and issues monetary penalties to violators. If the violator is unhappy with the result, they take the regulator to court. We know this, because that is the way our privacy enforcement system currently operates. The Privacy Commissioner, PIPEDA and the Privacy Act do not have a tribunal, and the enforcement process is working quite well.

According to the Office of the Privacy Commissioner, for more than 40 years this is how the process has worked, and only once in the 40-year period have the courts taken issue with an OPC ruling. There is no need to reinvent the wheel by introducing a quasi-judicial body into the violation of the enforcement process. By trying to reinvent the wheel with this tribunal, the result will be delayed justice for Canadians whose fundamental right to privacy has been violated. Justice delayed is justice denied.

When I think about the quasi-judicial tribunals of ISED, of course my thoughts immediately go to the equally unnecessary Competition Tribunal. It's a body that in its nearly 40-year existence has never even once blocked a merger that was proven to be anti-competitive by the Competition Bureau. It's a body where the average time for delivering a decision is well over one year, except, surprisingly, in the Rogers-Shaw decision. Even then, those decisions can be appealed in the courts.

The tribunal will also serve to drag out the efficient resolution of cases. I will let the words of the Privacy Commissioner stand for themselves. He stated:

Fourth and probably most important, the fact that the OPC would not be authorized to impose administrative penalties, and that its orders would be subject to appeal to another administrative structure before reaching the courts, would reduce the incentive organizations have under the model in place in other jurisdictions, to come to a quick agreement with the regulator. In these jurisdictions, where the data protection authority is the final administrative adjudicator and where it can impose financial penalties, organizations have an interest in coming to a negotiated settlement when, during an investigation, it appears likely a violation will be found and a penalty may be imposed. Unfortunately, the creation of the Tribunal would likely incentivize organizations to “play things out” through the judicial process rather than seek a negotiated settlement with the OPC, thus depriving consumers of quick and effective remedies. Sadly, but truly, justice delayed is justice denied.

The inclusion of the tribunal in this act, as argued by both federal and provincial privacy commissioners, will also weaken the joint investigation processes that are undertaken between federal and provincial governments. This process will also diminish interoperability between provinces and could result in the federal government making the privacy tribunal a necessary requirement for compliance within the federal act.

We've seen several recent examples of the federal and provincial privacy commissioners working together to protect Canadians' fundamental privacy rights.

In 2021, the federal commissioner and B.C., Alberta and Quebec all worked together to investigate and stop Clearview AI from violating Canadians' privacy rights through illegal scraping of images from social media sites to build a facial recognition database. In 2022, the federal, Alberta, B.C. and Quebec commissioners again worked together to investigate and stop Tim Hortons from illegally tracking Canadians' location data after they made a purchase. In 2020, the federal, Alberta and B.C. commissioners stopped shopping mall owner Cadillac Fairview from collecting and using photos of consumers when they stopped to use the store directory screens.

We have heard and talked a great deal so far during this clause-by-clause process about making sure that privacy protection laws are consistent across the country to allow ease of enforcement as well as ease of business operations. As we heard from both federal and provincial privacy commissioners, the tribunal will threaten the ease of enforcement by regulators across each of the provinces and territories and across the country.

The Privacy Commissioner and his office are one of nine fully independent officers of Parliament. In the words of the Library of Parliament:

Officers of Parliament support both houses in their accountability and scrutiny functions by carrying out independent oversight responsibilities assigned to them by statute. These officers are responsible directly to Parliament rather than to the government or a federal minister.

I want to emphasize that last line again: “These officers are responsible directly to Parliament rather than to the government or a federal minister.”

The industry minister should not have a say over the conduct of the decisions of the Privacy Commissioner. The OPC is supposed to be fully independent. If the minister or government does not like a decision of the Privacy Commissioner, then they can appeal the decision in the courts, as they have done since the OPC was created in 1977. The proposed tribunal will completely undermine that independence. It places an ISED-run, ISED-controlled, ISED-funded and industry minister-appointed privacy tribunal in between every single OPC ruling and decision. The Office of the Privacy Commissioner is an independent body, and this amendment will help to preserve that independence.

This question is for Mr. Chhabra, although any of the officials may answer. We know from submissions and testimony that the current and former privacy commissioners oppose the tribunal; the provincial privacy commissioners oppose the tribunal, and almost all privacy advocates and experts oppose the tribunal. Your department has been the one asking and...taking ministers with stakeholders, the minister's famous 300-plus meetings. Which stakeholders have actively been supportive of the tribunal?

[Samir Chhabra]

As was pointed out, CPC-9 is a very broad set of proposed amendments that would, as we understand it, have the effect of making three important changes. First, it would limit the imposition of cost awards against the OPC. Second, it appears to remove the private right of action that would allow folks who have been impacted by a transgression of law to be compensated for their loss. Third, it would remove the tribunal from part 1 of the act.

We see the tribunal as a critical element that's necessary to ensure that the system is credible and fair. Removing it would be inconsistent with the current commissioner's recommendations. We have since 2018 conducted a significant number of consultations and engagements broadly engaging Canadians. I believe in 2018 there were more than 30 round tables across the country. More than 550 Canadians participated in those engagements. The more recent figure of 300 meetings that the honourable member referenced, I believe, refers to part 3 of the bill, on AIDA, which obviously we will come back to later.

A number of stakeholders pointed out that it would be perhaps unprecedented and certainly out of alignment with international examples, and even some domestic models and examples, to have one individual carry out an ombuds function, an investigatory function and an adjudicative function all in one. There have been, to our count, 50 cases since 2003 that have gone from the Privacy Commissioner on to court. By our count, 70% of those court decisions disagreed with the OPC's position on the issue. Expecting the Privacy Commissioner to carry out these very distinct functions in addition to the significant new powers that have been added....

The CPPA will provide the Privacy Commissioner with a number of new enforcement powers. They include the ability to issue binding orders following investigations, which can order compliance with the CPPA. They can order organizations to cease activities that violate the CPPA. They can force compliance in a compliance agreement and also make public any measure taken to comply with the CPPA.

In addition, the CPPA enables the commissioner to recommend administrative monetary penalties. That's the point at which a recommendation would be made to the tribunal around the penalties. The orders and all those are powers being vested directly with the commissioner and not with the tribunal. It's important to recognize as well that the tribunal has an important appeal function to play and has expertise in the space by virtue of the fact that three of the six members of the tribunal must be recognized as privacy experts.

I also think it's important to point out that we don't see any risk of hampering joint investigations that would be undertaken between the federal Privacy Commissioner and any provincial counterparts. A number of international counterparts do have tribunal-type approaches, including Australia, New Zealand and Ireland, just off the top of my head. The U.K. also has a tribunal approach, organized slightly differently. The CAI in Quebec also has a tribunal approach to doing this function. We don't see any issues around joint investigations at all. In fact, the CPPA specifically encourages and allows for the OPC to engage with other regulators to share information and to leverage that information to the best effect to protect Canadians. It's also consistent with other areas of federal regulation in which tribunals are used—agriculture, transport, competition and international trade.

The efficiency of the CPPA tribunal has also been raised in this recent dialogue. It's important to recognize that we see efficiency gains actually being made by providing a tribunal that, first of all, pays deference to the commissioner's decisions, whereas a court would take a de novo proceeding. By having proceedings that are more informal and easier to understand and engage with for ordinary Canadians, rather than needing to have a lawyer go through the proceedings with the Federal Court, it would be less costly and easier to access as well, for those reasons, and for ordinary Canadians to engage with.

There are a number of very important reasons that we feel the tribunal is the right approach. The department did receive many, many inputs to that effect from a range of stakeholders, dating back to 2018, before the previous Bill C-11 was introduced.

I hope that helps to answer the question.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Thanks.

I just want a few more specifics. Can you give me a couple of examples of who suggested the tribunal for stakeholders? Did you meet with them?

[Runa Angus, Senior Director, Strategy and Innovation Policy Sector, Department of Industry]

The department published a white paper in 2019 on the proposals, in which we specifically asked questions on the tribunal, whether the Privacy Commissioner should be given AMP powers and whether those AMP powers need an oversight mechanism. To that, we received a number of responses from industry, from privacy stakeholders and from the Privacy Commissioner himself. I'm just going to pull up a list.

[Ryan Williams, Conservative, Bay of Quinte, ON]

I'm just going to get Mr. Chhabra to correct himself.

You mentioned that the current Privacy Commissioner recommended it. We can't find that recommendation. We have that the current Privacy Commissioner does not recommend the tribunal right now. Is that correct?

[Runa Angus]

The current Privacy Commissioner has two recommendations with respect to the tribunal.

They've asked that the tribunal's decisions be reviewed by the Federal Court of Appeal, as opposed to the Federal Court, and they've asked for more flexibility with respect to compliance agreements. Those are the two recommendations from the current Privacy Commissioner.

[Ryan Williams, Conservative, Bay of Quinte, ON]

From what we understood, those were if a tribunal were to be in place, but their preference would be to not have a tribunal and give more power to the privacy commissioners themselves and their office.

Just to counter one other claim as well, they've asked for and have said that they need more resources to carry out the duties they'd have. To handle the burden you mentioned, there would be a whole division that handles the fines and the penalties, and then the commissioner would be freed up to be able to handle more of a caseload. I think that was what was stated in testimony.

I'm just going to mention witnesses who were against the tribunal, because we have a list of those, if you're still looking for the list of those who were for it.

We had the Centre for Digital Rights. The Privacy Commissioner of Alberta was against the tribunal. The Option consommateurs was against it. The former U.K. privacy commissioner was against it. You could say that the Public Interest Advocacy Centre was against it. The Canadian Civil Liberties Association was against the tribunal. The Privacy and Access Council of Canada was against it, as was the University of Ottawa. A lawyer at McInnes Cooper, David Fraser, was against it. Daniel Therrien, the former Privacy Commissioner, was against a tribunal. Philippe Dufresne, the Privacy Commissioner of Canada now, is against the tribunal as a whole.

While you're looking for your list of the ones who supported it, these are all witnesses we had who were against the tribunal. Have you found your list?

[Runa Angus]

I do have the list of the testimony of witnesses who supported the tribunal.

There was Elizabeth Denham, the former U.K. information commissioner, and also the former B.C. commissioner, who spoke about the U.K. tribunal system and how it aids the process and ensures administrative fairness. We also had Adam Kardash, who supported the tribunal. He's a lawyer with CANON, which is the Canadian Anonymization Network. Michael Geist also suggested that the tribunal is granted some deference when it goes to court, and that has the potential to strengthen the outcomes of the process. Mr. Scott Lamb, a partner at Clark Wilson LLP, also supported a tribunal, as did Mr. Antoine Guilmain and Ms. Michelle Gordon.

Those are the witnesses during the committee hearings who supported the tribunal.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Okay. I'm now going to give you testimony from the current Privacy Commissioner. I know it was mentioned at the beginning.

Mr. Vis was going back and forth with Mr. Dufresne, and Mr. Vis asked, “Is it your belief that a tribunal will delay your ability or the ability of people to have sensitive information wiped from the Internet?”

Mr. Dufresne answered, “My view is that adding a level of review to the process will add a delay and a cost, and so I've given two options to solve that.”

The other part he mentioned was this:

There remains the proposed addition of a new tribunal, which would become a fourth layer of review in the complaints process. As indicated in our submission to the committee, this would make the process longer and more expensive than the common models used internationally and in the provinces.

Basically, he and former commissioners who we saw have added the burden of this. I want to go down to another line of questioning with you, and it goes to—

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

I have Elizabeth Denham's too.

[Ryan Williams, Conservative, Bay of Quinte, ON]

I'm sorry. I'm going to add—

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Hers is contradictory to what she said.