Industry Committee on May 29th, 2024

[Samir Chhabra]

Our testimony over the last several meetings has been very clear, but I'm happy to recap.

We see there being significant efficiency gains by implementing a tribunal. It's absolutely and fundamentally important, in order to maintain alignment with the Constitution, to have procedural fairness and due process built into the system. Doing so via a tribunal is the most efficient and effective way to do so. We've thought very carefully about how to make sure that it does not become an additional layer of review, for example, by ensuring that the tribunal gives deference to the commissioner's findings and decisions and by ensuring that it's a final level of review and not subject to appeal.

There are many ways in which this has been designed carefully to ensure that the important objectives of procedural fairness, efficiency, effectiveness and access to justice are appropriately centred, and to ensure that, in so doing, the role of the Privacy Commissioner remains primary and cannot be subverted by a large corporation that's able to drag out court proceedings and drain the Privacy Commissioner of the resources and time needed to effectively steward consumer and Canadians' privacy through the markets.

[Vance Badawey, Liberal, Niagara Centre, ON]

Thank you. I appreciate that.

I only had to hear it once. I appreciate your repeating it, so some of the members can hear it a few more times. Hopefully, that will make a difference, because, again, I want to go back to what I said earlier.

It's the outcome that we're actually trying to accomplish here. It goes back to dealing with fairness, and fairness to people who, to some extent, for the most part, are very hurt by the situations they're finding themselves in, especially some of the youngsters experiencing some of these situations who would otherwise find themselves in a tribunal and/or a court of law.

I have one last question. When discussing tribunals, we've referenced other international jurisdictions. I know I've heard this already—you referred to it—but, again, I do want to be repetitive, and I do not apologize for that because some do need to hear it maybe more than once.

When discussing tribunals, we've referenced other international jurisdictions that do not have.... I'm sorry. They do have privacy tribunals. We've talked a lot about comparisons with the Competition Bureau, but are there other examples, throughout governments, possibly? How are those models used to inform this tribunal, and what benefits have we seen with tribunals in other areas of federal regulation?

[Runa Angus]

We've discussed several international examples, but also domestic and other federal examples where tribunals are used.

I'll start with domestic. The CAI, which is the privacy regulator in Quebec, is an administrative tribunal. It operates extremely efficiently and is able to reach the outcomes that you outlined.

Within the federal system, there are many examples of tribunals. We have the CRTC, the Canadian Radio-television and Telecommunications Commission, which is responsible for administering the Broadcasting Act and Telecommunications Act. We have Canada's anti-spam legislation. These are not trivial issues. These are administrative tribunals that are very highly respected.

I spoke earlier about the administrative tribunals support service that provides administrative services to tribunals. It supports 12 federal tribunals, including the Competition Tribunal and the Social Security Tribunal. We've seen that it cuts time in terms of access to justice and getting to the outcomes as quickly as possible. Right now, the OPC faces a two-year delay in getting to court. In the Social Security Tribunal, it's less than 100 days.

There are significant benefits in terms of getting to the outcomes faster and in a cheaper way, because tribunals, typically, don't have the same formal rules as a court. Parties do not need to retain legal counsel. The more formal and procedural a setting is, the more need for legal counsel, so a tribunal really allows parties to access justice in a way that's cheaper and faster.

[Vance Badawey, Liberal, Niagara Centre, ON]

Again, I would underline those words: fairness and people. With respect to accessing justice and to be fair to the people, not everyone can afford the process of a court, especially if they're against a Goliath, and especially if that ends up in the court for decades against that Goliath. We can be talking hundreds of thousands of dollars, if not millions, for a person who just doesn't have it. Therefore, there is no fairness for the people.

There is more cost based on more time, versus a tribunal, which offers that fairness and offers, based on the cost, less time and, therefore, less cost. Is that fair to say?

[Samir Chhabra]

I think that's fair. I think it also offers an additional feature that we've referenced a few times. It centres the role of the Privacy Commissioner. It gives the Privacy Commissioner more authority, more weight.

As I pointed out earlier, if a company knows that they can go and get a fresh start with a court and impugn the commissioner's approach or the impartiality with which it was conducted, that certainly creates a challenge, whereas the tribunal has to give deference to the commissioner's findings. That makes the commissioner far more powerful.

[Vance Badawey, Liberal, Niagara Centre, ON]

Mr. Chairman, I'll end by saying this. Again, being new to the committee and taking all of this in within the last few days, I want to thank you. I want to thank the committee, quite frankly, and I want to thank all the witnesses.

The take that I walk away with, based on what I'm seeing and what I'm hearing, is based on those two points—fairness for the people. I think the tribunal does meet the outcome we're trying to achieve here as well as the expectations we're trying to meet on behalf of the people we represent.

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you, MP Badawey.

I'll now turn it over to Mr. Perkins.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair.

The comments about the CRTC being comparable, to me, are erroneous, because there is no body making a decision before that which then gets appealed to the CRTC. It's a single-issue commission making a decision. It's actually more relative to what we're proposing than what officials are proposing, but what's interesting.... I'm not surprised that the officials who drafted the bill are defending the bill.

For the two new members on the committee who, perhaps, didn't attend the 21 meetings with witnesses and the 10 meetings here.... We've now had six meetings over two clauses in which the Liberals have filled the air with two clauses.

I'll take my guidance from the current and former privacy commissioners on this issue. To help you, because you haven't heard the testimony, I'll read what they said. There was a bill that was essentially identical to this with regard to privacy and the tribunal in the last Parliament, called Bill C-11. The then-privacy commissioner, in his submission, said:

In our opinion, the design of the decision-making system proposed in the CPPA goes in the wrong direction. By adding an administrative appeals Tribunal and reserving the power to impose monetary penalties at that level, the CPPA encourages organizations to use the appeal process rather than seek common ground with the OPC when it is about to render an unfavorable decision. While the drafters of the legislation wanted to have informal resolution of cases, they removed an important persuasive tool...

That was about the last bill. To refresh your memory, this is what the Privacy Commissioner said in his testimony on this bill in meeting 90 on October 19, 2023:

Third, there remains the proposed addition of a new tribunal, which would become a fourth layer of review in the complaints process. As indicated in our submission to the committee, this would make the process longer....

Unlike MP Badawey, who thinks it would make it shorter, the Privacy Commissioner thinks it would make it longer and, by the way, more expensive. If you care about fairness and you care about the people, and you want it to be less expensive and quicker, I would rely on the Privacy Commissioner's testimony for fairness and people. He says this process will actually make it longer and more expensive.

Now, not to be outdone, I'll give you a little more from meeting 91, when the former privacy commissioner said:

The goal of these provisions should provide quick and effective remedies for citizens. In no other jurisdiction that I know of is there a tribunal such as that proposed in this legislation. In all other privacy jurisdictions, the original decision-maker, including with the power to make orders and set fines, is the data protection authority that is the equivalent of the Office of the Privacy Commissioner.

I hear concerns about the difficulty for the OPC to work with different roles.

We have an issue here with the government continuing to put the proposition out that, somehow, creating a privacy tribunal will speed it up, when that's not actually what the experts say. I would rely on the privacy commissioners.

I would also say that in the case of the Competition Tribunal, which is probably the most comparable to this, you have a Competition Bureau, which does an investigation, and a Competition Tribunal, which doesn't have to follow evidentiary rules and only has two minor things that you can appeal. It's almost, but not quite, a final decision-making process. It actually makes for a very long and very expensive process, and it has actually never rejected anything that's been done in a merger.

I'm just trying to help our new members understand that, if they believe this makes it faster, the testimony we heard from privacy commissioners, both provincial and federal, over 21 meetings of witnesses, says the opposite. That's all I wanted to say.

[The Chair, Liberal, Joël Lightbound]

I understand that was not a question, but a comment. Thank you, Mr. Perkins.

I have MP Arya.

[Chandra Arya, Liberal, Nepean, ON]

Thank you, Mr. Chair.

I have a question for Mr. Chhabra.

You rightly pointed out that the presence of a tribunal, or the availability of the process of using a tribunal, motivates the parties to seek some sort of agreeable outcome at the commissioner's level. That is very important, especially given the background.

Before I go to that, you mentioned the behavioural process change. Was this what you were referring to when you mentioned that?

[Samir Chhabra]

Thank you for the question. It's a very important point to raise.

The tribunal has to give deference. Therefore, this notion that, somehow, companies would be motivated to go to the tribunal more so than they'd be motivated to go to a court—if you were to substitute a general court instead of the tribunal—doesn't hold up under scrutiny. The notion that a company would be more motivated to go to a tribunal they know is going to give deference to the commissioner's findings of fact just doesn't hold up.

[Chandra Arya, Liberal, Nepean, ON]

Especially with the fact that, in 70% of cases on Privacy Commissioner rulings challenged in the court, the Privacy Commissioner lost.... This is a unique feature that I don't think other countries have. Most G7 countries don't have a tribunal. With the changing circumstances, I think Canada has to take the lead.

Am I correct on that comparison regarding other G7 countries?

[Samir Chhabra]

As we've pointed out throughout our testimony over the last several days, there are a number of other G7 countries that have tribunals or tribunal-like approaches that help separate the investigatory and adjudicative functions. There's Australia, New Zealand, Singapore and the U.K., with a slightly different wrinkle. Ireland is very comparable as well.

The notion of separating investigation and adjudication is a bedrock principle of functioning democracies.

[Chandra Arya, Liberal, Nepean, ON]

The U.S. has the Federal Trade Commission. It's one big, huge bureaucracy. They don't have a tribunal, but they have a very complex process of handling these things.

Is that correct?

[Samir Chhabra]

The Federal Trade Commission doesn't operate in the space of privacy and data protection. It's also a commission by design, which means it's not a single individual taking a decision. Procedural fairness considerations there are baked into the fact that it's a commission or a group of people taking decisions.

[Chandra Arya, Liberal, Nepean, ON]

You mentioned expertise and how the members appointed to the tribunal will not only have a good background and expertise in this knowledge but can also continue to upgrade their knowledge in this. They can become much more specialized.

I remember when I was debating this bill in the Parliament. A question was asked. I explained that technologies are changing so much that we can't even define what data is. What are the contours of data? We can't even define what artificial intelligence is. When it comes to privacy, based on all these things, it will become very difficult for the courts to decide. The courts have to limit themselves to the law. Whoever decides—like a judge—cannot get that expertise or additional knowledge required with the changing circumstances and changing technologies.

What kind of workload do you expect, when the tribunal is formed, in the first two years?

[Samir Chhabra]

Thanks for the question.

As we noted earlier, it's somewhat difficult to give a point estimate or even a range estimate, frankly, on how much activity such a tribunal would see. There are a number of factors to consider. The commissioner would have significant new powers but also significant new opportunities to navigate through an individual case by taking a mediation approach or a compliance agreement approach. If the commissioner, for example, were to work through a case and find that making orders was sufficient, the case wouldn't necessarily need to go to the tribunal at all. It's difficult to give an estimate of exactly how many cases would be taken up.

We can look back and say, from memory, that there were about 46 cases between 2003 and 2024 that went to court on the basis of the Privacy Commissioner's finding, but that's a different set of circumstances, one where the commissioner does not have the ability to levy or recommend administrative monetary penalties or have order-making powers. We are talking about a completely new approach to providing the commissioner with significant enforcement powers. How much activity that would generate for the tribunal is difficult to say, but we are very confident in presenting the committee with the idea that it would be more efficient to have a tribunal in place, which would be more rapid and expert in its work.

[Chandra Arya, Liberal, Nepean, ON]

In general, do you think we will see an increase compared with the previous number of things that went to court?

[Samir Chhabra]

Given the new powers being vested with the commissioner and the increasing ubiquitousness of important data and privacy issues among Canadians—including because of the rising use of AI tools—I think it would be reasonable to assume that there would be more activity going forward. There may well be more demand for either a court or a tribunal to be engaged on those decisions.

[Chandra Arya, Liberal, Nepean, ON]

As you said, there's a possibility of more workload.

It does make the Privacy Commissioner's work efficient. Without the tribunal, all these cases will go to the courts. With the time required to get them dealt with, the resources required will be quite substantial.

[Samir Chhabra]

Thank you again for the question.

I think this is a really important issue to underline, noting that some previous witnesses have highlighted that they feel like the tribunal could add process and time. It's not entirely clear to me whether all the witnesses had the opportunity to be fully briefed on the functioning of the proposed bill on the idea of two elements in particular: first, that the tribunal would be required to provide deference to the commissioner's findings and, second, that the decisions could not be appealed. Those two pieces in concert provide a significant backstop against abuse of process, against processes being unduly extended and against multiple levels of appeal. As I pointed out earlier, it really centres and puts the spotlight on the Privacy Commissioner.

I cannot imagine a scenario in which any company with a reasonable amount of legal advice would rather go to a tribunal that has to pay deference to the commissioner versus this other approach, which apparently is going to a court and starting de novo. Any lawyer worth their salt advising a company would say they'd rather take their chances starting fresh at court and see if they can convince the court to see it differently versus, “You've got a tribunal in place that's going to pay deference to the commissioner's findings? Boy, your chances are a lot lower in that circumstance.”

On this notion that has come up a few times in the committee that somehow the tribunal slows things down and companies will be more motivated to go to the tribunal and less motivated to work with the Privacy Commissioner, I would have to say that represents a significant misunderstanding of the functioning of the bill.

[Chandra Arya, Liberal, Nepean, ON]

I agree with you on that point.

Have you looked at any scenarios for how many of the ones that are dealt with at the tribunal level will go to court?

[Samir Chhabra]

As we mentioned earlier, we looked at roughly the last 20 years of cases that have gone to court. About 46 decisions, I think it was, from the commissioner have been taken to court. In a minority of those, the commissioner was actually a primary appellant. In those cases, the commissioner lost 70% of the time before the courts. That, I think, gives a very clear demonstration of why companies might be motivated to go to court. They have a pretty good chance of winning.

Again, it's a pretty stark contrast between going to a court and doing a de novo proceeding, where the history has shown that courts tend to side with the companies, versus a tribunal that has to give deference to the commissioner. That changes the playing field entirely.

[Chandra Arya, Liberal, Nepean, ON]

Can you give any examples of any of the court cases that have gone previously to the court and took quite a long time to get settled?

[Runa Angus]

I can talk about a very recent case. A few years ago, actually, the OPC made a finding with respect to Meta and the Cambridge Analytica scandal. The commissioner issued its report of findings a few years ago. Meta disagreed with those findings and took the OPC to court on those. The OPC lost at Federal Court. The Federal Court actually sided with Meta to say that the OPC had not discharged its investigative burden and had not presented its evidence.

Now, I'll just make a connection here to what my colleague said. Again, because they're not showing any deference to the Privacy Commissioner, it's a de novo proceeding. This would not be the case with a tribunal, which would have to accept the commissioner's finding of fact unless there were a palpable error.

That decision was appealed by the Privacy Commissioner last summer. We're still waiting for a decision from the Federal Court of Appeal. I think we can assume that the decision would be appealed to the Supreme Court as well, because of the parties involved. It's going to take years to get to a final resolution.

Again, that would not be the case in this new system, where a tribunal's decisions are final and can only be judicially reviewed, which is a much narrower standard of review and which means it's much more difficult to make the case. The parties would know that and again, to echo my colleague's comments, would therefore perhaps be more motivated to pursue alternative dispute resolution mechanisms or compliance agreements.