Thank you, Mr. Chair.
Good afternoon, Mr. Chair, members of the committee, I am pleased to be here today to assist the committee in its study of Bill C‑27, the Digital Charter Implementation Act, which would enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act.
I am accompanied by Michael Maguire, Director of PIPEDA Investigations, and Lara Ives, Executive Director, Policy, Research & Parliamentary Affairs.
I would like to begin by saying that I welcome the introduction of this bill. I view its introduction as an encouraging sign, as the act must be modernized to face challenges and to seize the opportunities presented by major technological advances, including artificial intelligence.
My office has long advocated for a modernization of both the Personal Information Protection and Electronic Documents Act and the Privacy Act, which applies to the public sector. Canadians expect modern privacy laws that will protect their fundamental right to privacy while supporting the public interest and innovation.
The bill addresses a number of concerns that were previously raised by my office and by others. For example, it requires that information used to obtain consent be in understandable language, it provides my office with order-making powers and it includes an expanded list of contraventions to which administrative monetary penalties may apply in cases of violations.
The introduction of the AIDA, the artificial intelligence and data act, could make Canada one of the first countries to regulate AI, which is important, given the technology's potential risks. Although the AIDA does not specifically address privacy risks, the CPPA, the consumer privacy protection act, would apply to the processing of personal information within AI systems.
Bill C-27 is a step in the right direction, but it can and must go further to protect the fundamental privacy rights of Canadians while supporting the public interest and innovation. I've tabled with the committee our written submission, setting out 15 key recommendations with the changes needed to improve and strengthen Bill C-27.
These are based on the three themes of my vision for privacy, which are, one, that privacy is a fundamental right; two, that privacy supports the public interest and innovation; and three, that privacy is an accelerator of Canadians' trust in their institutions and in their participation as digital citizens.
I will now highlight a few of our recommendations, but would invite committee members to also consult the full submission as well as our 15 recommendations.
Under the theme of privacy as a fundamental right, I recommend strengthening the preamble and purpose clause to explicitly recognize privacy as a fundamental right, and highlight the need to protect children's privacy and the best interest of the child, so that these important principles inform the interpretation of all aspects of the legislation. I understood from the minister's testimony earlier this week that the government agrees with this recommendation, and I'm delighted to hear it.
We also recommend that an organization's purposes for collecting, using or disclosing personal information be specific and explicit, and that penalties be available in cases where the personal information of Canadians is collected, used or disclosed for inappropriate purposes. Given the importance of the rules concerning appropriate purposes, effective remedies should be available to ensure compliance.
Under the theme of privacy in support of the public interest, we recommend that organizations be required to implement privacy by design and that privacy impact assessments be prepared in high-risk cases. This would be an important and necessary protection that would apply to high-impact AI systems. We also recommend that the definition of “de-identified information” be modified to include the risk of re-identification and that the government’s authority to issue certain regulations be more narrowly defined. On this last point, I would note that the bill currently gives the government the unduly broad ability to completely remove activities from the scope of the act and to allow new exceptions to the consent requirement for business activities without having to show that those activities are necessary.
We also recommend that Canadians be given the right to request an explanation when an AI system makes a prediction, recommendation, decision or profiling about them.
Under the theme of privacy as an accelerator of Canadians’ trust, and in order to ensure that most cases can be resolved quickly and without the need for lengthy legal processes, we recommend that my office have more flexibility in negotiating and enforcing compliance agreements and in co-operating and communicating with other regulators. Here again, the minister's testimony earlier this week suggests agreement with these points. It will be important to see the details of those proposals. This is important in many areas, but it will be crucial when dealing with AI and generative AI.
We also recommend that challenges to decisions of the proposed new data protection tribunal be brought directly to the Federal Court of Appeal in order to ensure timely and cost-effective resolutions for all parties. We note that as an alternative solution to achieve these goals, reviews of my office’s decisions could be done by the Federal Court instead of the tribunal.
In the last budget, the government proposed temporary funding for my office of $6 million over two years to undertake more in-depth investigations of privacy breaches and improve response rates to privacy complaints, as well as $15 million over five years—this would be temporary funding—to operationalize new processes required to implement the proposed Consumer Privacy Protection Act. Should Parliament adopt Bill C‑27, it will be essential that my office be properly resourced to fully and effectively take on important new responsibilities, especially those focusing on prevention. Otherwise, these costs will be borne by Canadians and by businesses themselves.
While our recommendations focus on the CPPA, some of them would also be relevant to AIDA. For instance, I note that AIDA provides significant authority to the government to define key aspects of the law by way of regulation. This would include, for example, determining what does and does not constitute justification to an otherwise discriminatory AI decision for the purposes of the definition of biased output. The government could also establish criteria through regulation for the purposes of defining a high-impact system or determining measures with respect to the way that data is anonymized and how that data can then be used and managed.
Given that all of these could potentially have privacy implications, it will be important to ensure that there is a formal mechanism for my office to be consulted in the drafting of these regulations. Our recommendation to allow for greater coordination and collaboration between my office and other regulators would also be essential in dealing with the privacy impacts of AI.
In conclusion, privacy law reform is overdue and must be achieved. Our recommendations aim to ensure that Canadians have privacy laws that recognize their fundamental right to privacy while allowing them to participate fully in the digital economy, support innovation and position Canada as a leader in this important and evolving area.
I note that many stakeholders are also putting forward submissions and I thank the committee in advance for the critical work that it will do in its review of this important bill and in ensuring the protection and promotion of the privacy of Canadians.
Thank you for your time. I would now be happy to answer any questions that you might have.
