Industry Committee on May 27th, 2024

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Next on my list I have Mr. Turnbull and Mr. Vis.

I would remind you that we are now discussing the subamendment moved by Mr. Perkins.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you, Chair.

I appreciated the comments made in response to Mr. Perkins.

Can we back up for a second? I'm trying to understand how this subamendment relates to what was originally proposed in CPC-9, which obviously really removes the tribunal from the entire bill, which we were debating. This is attempting to amend the section on “Private Right of Action”, which is on page 51.

[Brian Masse, NDP, Windsor West, ON]

I have a point of order, Mr. Chair.

I'm sorry, Mr. Turnbull, but I can't hear you. Something's going wrong with the audio, and I do appreciate your intervention.

[The Chair, Liberal, Joël Lightbound]

We'll look at it with the technical support here. Let me know, Mr. Masse, if the problem persists. Is it still that you can't hear?

[Brian Masse, NDP, Windsor West, ON]

I'm just getting an echo sound with almost no volume at all, which is new.

[The Chair, Liberal, Joël Lightbound]

There is an issue with the English channel, but I see that's it's been resolved.

Thank you, Mr. Masse.

Mr. Turnbull, you may resume.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you very much. I'm glad to know that Mr. Masse is attentive to my interventions, and I appreciate that.

I was trying to understand, again, the subamendment in relation to CPC-9. This amendment removes the tribunal from the bill, which I understand is pretty central, because the bill was contemplated based on the tribunal being part of the overall legislative framework.

This new subamendment looks like it deletes all of proposed paragraphs (a) and (b) and removes the “if” from page 51 of the English copy, which is 107(1), the private right of action.

What is really the effect of that? That's what I'm trying to understand. Obviously we didn't have any notice of this, so I think it needs to be clarified a little for all of us to make sure we're on the same page.

Thanks.

[Mark Schaan]

I'd like to thank the member for his question.

As noted, the original CPC-9 essentially removes references to the entirety of the tribunal in every instance of its appearance in the act, thereby removing the current separation between investigative and complaint findings of the Privacy Commissioner and the offence findings in terms of the penalties. In so doing, it also stripped out the entirety of this section related to private rights of action. Private rights of action obviously are a separate consideration as it relates to the overall scheme of the act.

The Office of the Privacy Commissioner is an extraordinarily important part of our overall protection of the fundamental right to privacy. It allows for individuals to make complaints to the Privacy Commissioner. It also allows for the Privacy Commissioner to investigate those complaints and to make determinations in terms of the applicability of the act. The Office of the Privacy Commissioner can then make recommendations in the current proposal of the act to a tribunal for the purposes of administering monetary penalties. It could also issue orders, potentially as a remedy for that privacy issue or, as is potentially imagined in some of the amendments that may follow, to reach consent agreement with the parties as to the appropriate rectification of the privacy finding.

What was imagined in the original scheme as one additional kind of tool in the tool kit is as follows: The Privacy Commissioner investigates, determines the applicability of the act, comes to the conclusion that there is actually a finding of fault or that there's a violation of the act, decides to issue an order and decides to come to a consent agreement. Or, they could decide to come the conclusion that there is a finding of a violation, potentially with the recommendation for an administrative monetary penalty.

What was allowed for in that particular instance was for an individual to say, “I'm taking my finding, and I'm going to pursue damages in my own right.”

Suppose the Privacy Commissioner has found that there's been a violation. Maybe he didn't recommend AMPs, and maybe he went through some other mechanism. Maybe he issued an order, and maybe he made recommendations because it wasn't found that the bar for AMPs was necessarily met in this particular instance. The individual then would still be able to take that finding and come to the courts to say, “My privacy has been violated. The Privacy Commissioner has not necessarily recommended the full outcome that I feel I'm in possession of. Therefore, I'm going to pursue this action for further damages.”

The reintroduction of the primary right of action in this particular instance gives back that power slightly. Instead of becoming, “Pass GO once you've crossed the board, and then collect $200,” it's essentially saying, “You don't have to pass GO anymore.” If you feel like your privacy has been violated, if you feel like there's been a contravention of the act, go to the courts and see whether you get the $200.

The challenge that it introduces is as we noted. This was part of a multi-factor tool kit to say, here are the various ways in which fundamental rights of privacy are going to be protected. The Privacy Commissioner is going to be able to make determinations and investigate, and then recommend, among a series of things, an order, a finding, a recommendation of an AMP. Then, if you're unhappy or still feel that there are additional considerations, you can then pursue a private right of action. This actually says “Private Right of Action”, which, as Mr. Chhabra noted, introduces two wrinkles.

One wrinkle is we don't know how many individuals are going to be motivated or able to bring their own private right of action in a case without a finding. Because there is no barrier to entry other than the fact that you need to have a court take it on, essentially, there could actually be a considerable volume of individuals who bypass the Privacy Commissioner and go straight to the courts.

The second wrinkle is that we've now asked the court to play the same function as the Office of the Privacy Commissioner. They are resourced and created in the system to be the finders of fact and the interpreter of the act for violations of privacy. We have an investigations-based system whereby essentially people make complaints to the Privacy Commissioner. They interpret the act on the basis of the investigation that they consider, and then they make a finding and a recommendation.

What this essentially says is that you can go down that path or you can go directly to the court, and now the court is placed in the position of performing the same role the Privacy Commissioner would, but the interpretability of the act is actually, therefore, bifurcated. We now have two bodies that are in a position to say well, when I read this act and I see this particular violation, I see it this way and I see this as a violation, but the first interpretation of the act is now spread between two bodies, which does introduce the possibility of conflict and does introduce the possibility of uncertainty.

From our perspective, I think there are three considerations with respect to the subamendment. First is the notion that we now have a private right of action without any barriers. Second is that we have two potential sources of interpretation. Third is that this fits into a broader scheme, in which it potentially fits into a broader amendment that removes the tribunal in its entirety, which, therefore, once again consolidates a number of the powers into one body as relates to the investigation and complaints function and then the actual determination of penalties.

[Ryan Turnbull, Liberal, Whitby, ON]

That was a very thorough explanation, which certainly helped me understand the impact of this and what's being proposed here. It doesn't sound as though it has a whole lot of positive consequences, based on your initial assessment, or that it would allow, based on what you are saying, individuals who want to pursue the private right of action to do so.

Wouldn't this have quite a lot of impacts on the court system? Would it not clog up the courts? How would individuals determine whether they had a good case if they hadn't gone down a track and through a process in which, in a way, an investigation had already happened?

It seems to me that the cases might be weaker or might be inclined to be weaker and that individuals might stake claims to compensation for harms that might not be as justifiable under law.

That's just a thought, but maybe you could build on that if I'm right or correct me if I'm wrong.

[Mark Schaan]

I would say a few things.

One of the most important elements of this statute that have been retained from its predecessor, PIPEDA, is that it remains a principles-based and risk-based statute, which means that it's intended to be technologically neutral and applicable in a vast array of situations. It is not granular insofar as to prescribe in every single instance what a company shall and shall not do. It's principles-based, which means that its interpretation is actually extraordinarily important and that it grows with time.

One of the challenges of taking a principles-based statute and applying a private right of action without a finding of fact first, without the body charged by Parliament with its interpretation finding a first instance of violation, is that you're actually allowing for a wide variety of readings as to what is at stake here.

I can imagine instances in which a private right of action is introduced, instances in which the legal test or the interpretation is extraordinarily rigid and is understood in every instance to say, well, it's just as easy for me to figure out whether or not there's been a violation here as it is for somebody else to do so, but that's not actually what's at question here. This is a principles-based and risk-based statute with respect to which extraordinary deference is given to the Privacy Commissioner in their first-instance findings of violations.

This is something that actually ties back into one of our concerns about the removal of the tribunal, and that is that the tribunal is actually not vested with relitigation of findings of fact. We didn't try to introduce a second body that gets to determine what is or is not a violation of our privacy laws. It gets to make a determination of the appropriateness of an administrative monetary penalty. Actually, one of the concerns we had or one of the considerations we had when creating the tribunal was actually introduced in this particular subamendment in a new way, by essentially giving another body—that is, the courts—the ability to make first-instance determinations that privacy has been violated.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you for that.

One of the other things that occurred to me when I heard you explain that was that individuals may not be able to easily determine whether a violation of their privacy rights has happened. When you think about operating in a digital age, as we are today, you may suspect it, but I think it would put a lot of onus on an individual, and how would they have the capacity necessarily? As you said, the first-instance finding, in the model that was contemplated for this bill, would happen through the OPC, so allowing for an alternative track, I guess, for someone to pursue a private right of action, seems to me to put a lot of onus on them to have to investigate or know how to determine whether a violation has actually occurred.

Is that part of the challenge you see that would kind of weaken the overall approach if this were to pass?

[Mark Schaan]

Certainly previous statutes and this one empower the OPC to be an investigatory body. It's given resources to determine whether or not a violation of privacy has been committed by a commercial actor. Essentially, by allowing a private right of action without the Privacy Commissioner having found a violation, you are essentially asking the courts to do that. Courts are good at many, many things, but what we've tried to do in the scheme of this entire set-up is to preserve for the courts that which is truly necessary, so we give the Privacy Commissioner all of the due deference regarding interpretation of the act and findings of violation, as well as all of the investigatory powers and the ability to make orders; we preserve for the tribunal the administrative monetary penalty setting, and then we preserve for the courts only those parts in which there's literally a failure of the law, where people have misunderstood the law in its entirety, not where there's a finding of fact but actually on an appeal basis.

What this essentially does is to say that you can go down that track; you can go to the OPC, but you can also go to the court, and if you go to the court without having gone to the OPC, the court is now going to be charged with the test of determining whether or not this is a finding of violation.

That means you're essentially giving it an investigatory role, which is not what's envisioned in this scheme; nor is it necessarily what the court is set up or resourced to do. Moreover, it actually creates the possibility for duelling investigatory findings potentially, because notwithstanding the fact that one would like consistent outcomes every single time, the reality is that, particularly when we have an office of subject matter expertise in the Privacy Commissioner, we have a body that's actually set up to know how the act is supposed to apply.

[Ryan Turnbull, Liberal, Whitby, ON]

One of the arguments the Conservatives made when they introduced the original amendment CPC-9 was that it would somehow erode the powers given to the OPC.

I was arguing last time—and I think you were providing some helpful testimony—that with how the bill was contemplated, that wasn't the case, but I think this subamendment certainly has that effect. Perhaps you would agree that this effectively almost allows people to opt out of utilizing the Office of the Privacy Commissioner and that its investigative role becomes somewhat...I wouldn't say obsolete, but it certainly seems as though people could just choose a different track and bypass the Privacy Commissioner.

[Mark Schaan]

What the subamendment contemplates is the possibility for two distinct bodies, one being a body that is a subject matter expert created for the sole purpose of making findings as they relate to violations of privacy and enshrined in law as the interpretive body for the statute, because by its investigatory power and its findings power it has the ability to determine what is or is not offside of the law.

Instead, we would now have a new body with wide responsibilities, so not necessarily the subject matter expertise that potentially comes with having this as your sole job, and this new body would have the same capacity now to make findings of violation and therefore interpretation of the statute in competition with or at least in parallel with the Privacy Commissioner. This essentially does at minimum bifurcate the interpretation of the act. It gives the interpretation of the act to two bodies, because essentially if a court is allowed to make a first-instance finding of a violation and to make rulings on what is and/or is not a violation in the first instance, it is now essentially equal to the Privacy Commissioner in coming to that determination.

[Ryan Turnbull, Liberal, Whitby, ON]

You have one track where you have an individual and contemplate a tribunal that has expertise interpreting the statute, and then, on another track, you have the courts, which may not necessarily have the expertise to interpret it, and those two interpretations may come into conflict from time to time. We might even expect them or anticipate them to do so.

I don't know if there's historical context for this, but I imagine, if you were designing a process, you would probably not create two tracks that are going to cause conflicts in how the statute is interpreted. I mean, that wouldn't be ideal. Am I right? You probably wouldn't do it that way. I can understand why it wasn't contemplated that way, but this subamendment has that effect. That's what you're pointing to. What are the ramifications of those interpretative conflicts as we move through? Who would decide on what effectively becomes the interpretation if those interpretations come into direct conflict with one another?

[Mark Schaan]

One can imagine a time period in which the two findings would live simultaneously in conflict. You could have essentially a first-instance ruling. Like stare decisis, it's a path-dependent kind of approach to how one approaches particular types of activities in violations of the privacy law, which is then the prevailing standard upon which further violations are heard. You could in parallel have a ruling of a low court that comes to the conclusion that there's been a violation of privacy that's not in keeping with either the current practice of the Privacy Commissioner or potentially how the Privacy Commissioner may ultimately come to that conclusion. Until such time as there is an appeal or a future finding by the Privacy Commissioner, you live in a world of uncertainty.

What might happen is that the Privacy Commissioner gets a similar violation down the road and comes to the same conclusion he or she had previously and says, “Just for the record, I'm making it known to lower courts that this is how I continue to view the interpretation of the act and its applicability.” Or you could have someone appeal the lower court determination, and the Privacy Commissioner may or may not seek to try to influence the outcome of the appeal. The potential risk that's at play here is that, for a time period, you could have a period of certainty until such time as the Privacy Commissioner can recommit their views on a particular subject. Then you may very well have conflicting judgements. You could have a lower court that's made a determination that is at odds with the current interpretation as understood by the Privacy Commissioner.

[Ryan Turnbull, Liberal, Whitby, ON]

Who determines what becomes this sort of precedent or body of law, because then you have direct conflicts in the interpretation? You have essentially the OPC in terms of its history of decisions. It sort of has a body of precedence in a way. Then the courts would as well, and they would be on separate tracks.

[Mark Schaan]

Yes.

[Ryan Turnbull, Liberal, Whitby, ON]

Could you then choose, if you were to analyze the body of evidence in the courts and the OPC, which one you feel is more favourable to your particular case? Would that be something that someone would naturally want to do, pick the environment where they would be most likely to be successful or have the highest chances of success? That seems like a very strange unintended consequence of this.

[Mark Schaan]

There certainly is incentivized behaviour, potentially, for people to find a venue that they believe will be more sensitive to their cause, so you may very well have people avoiding the OPC and opting instead to go to the courts until such time as the law can be clarified. This would lead to more challenges until either the Federal Court of Appeal or the Supreme Court can make a determination in these particular instances, and then I think it's worth remembering that this goes back to living in the schema that's set out in CPPA.

In the government's view and version of the statute that's before members right now, the Privacy Commissioner receives complaints, makes investigations, makes determinations, uses the full tool kit available to the Privacy Commissioner and orders findings of violation and recommendations of administrative monetary penalties. Then, in the government version, if he or she goes the AMPs route, the tribunal rules on AMPs, and what is then only reviewable is not findings of fact. Again, the Privacy Commissioner's view would be determined as per the Privacy Commissioner's original findings. There are other amendments that are coming later, potentially, about making it judicially reviewable only if there's a determination.

Then you'd have one track potentially on the private right of action side that has this possibility for regular review and renewal on the part of the courts, because you get different courts reviewing it, and then, on the Privacy Commissioner side, findings of fact on their violation that will not be reviewed, because it's determined that he or she is actually the sole determinant of findings of fact and violation as it relates to the interpretation of the act.

You'd have two very jarring systems, because one has a ton of variability and one has privileged an actor to say, “You're the first-instance finding and we have belief in your capacity, and we'll only continue to appeal insofar as you potentially have made an error in law or potentially that we want to review the determination of the tribunal.”

That's the last thing I'll say. There are other powers associated with that investigatory function that are quite important—the compulsion of information, for instance. They're a resource body for the purposes of investigating people's complaints about privacy. The court has the evidence that is provided to it, so the plaintiff and the defendant, in this particular case, will be the sole determinants of the information that the court can make a determination on, as opposed to in the case of the OPC, where they fill the record with what they need to be able to come to a determination on the fundamental violation or not.

[Ryan Turnbull, Liberal, Whitby, ON]

That seems like a really big difference. In cases with the OPC involved, they're taking on that investigative function, so they're gathering all the evidence to make a determination, whereas in this separate track, where you're going directly to the courts, who would be responsible? Each one of the plaintiffs then would be responsible for hiring their own investigators. Is that right? Who is investigating? We're not talking about criminal law here, are we? Who's actually doing the investigation? It's not the police force, so who is it?

[Mark Schaan]

The defence and the prosecution would both mount their respective cases and place information on the record of the courts to make their determination. The court is bound to make a determination on the basis of both case law and the information that's been placed before it by both the defendant and the plaintiff. It would be up to the two parties to ensure that the court is furnished with sufficient information.

Unlike the Privacy Commissioner, who has a compulsion power that allows them to fulfill the record with what they need, the court would be limited to that which is actually before it, which means that because there is no investigation, it would be a slower process, because essentially the parties are having to furnish the court with all of the recommended information, and one of them does not necessarily have compulsion powers to be able to force that evidence to be put before the court.

[Ryan Turnbull, Liberal, Whitby, ON]

It would be significantly slower but also more costly for the individuals who are seeking compensation for a violation of their privacy rights. Would it not be a lot more expensive for them, not having a first fact-finding from the OPC to base their case upon?

[Mark Schaan]

The scheme we imagined, as it relates to the private right of action, is this: The first finding of violation essentially allows people to proceed to court with a finding. It allows the court, essentially, to make the determination as to whether or not additional remedy is required or justified. It's supposed to be a short-circuiting in part, because there's already been a found violation by the entrusted, resourced entity the legislation holds responsible for making first-instance determinations of privacy violations. It's not the case in a private right of action scenario without that requirement.

[Ryan Turnbull, Liberal, Whitby, ON]

One thing that also occurs to me is this: From an access to justice perspective, if the OPC were not involved and performing its investigative role in cases where you're bypassing the OPC and pursuing a private right of action through the courts, you're essentially having to spend more money and, I would think, wait longer. We're talking about individual people whose privacy rights have been violated. At least, they feel this has happened. They're seeking compensation for the harms done to them, and we're saying, “You can go through the court system—which may be more favourable—if you feel like it, but it's going to be more time-intensive and costly, and you may not get the decision you're looking for, obviously.”

Doesn't that also create another asymmetry? Some people might be motivated to go to the OPC in one respect, if they're lower-income or don't have the resources. If they have the resources, they might find themselves paying costly fees going through the court system. Would that not be the case?