Industry Committee on Oct. 17th, 2023

[Mark Schaan]

The contemplation of the age of majority is one that is currently contemplated to be within the provincial purview. That said, I think there is ongoing engagement about the best way to ensure that there is an effective protection for minors, notwithstanding the fact that the age of majority is something that's determined at the level of the province.

[Ryan Williams, Conservative, Bay of Quinte, ON]

Why were our privacy impact assessments, PIAs, not made mandatory for all organizations when choosing to collect Canadian data?

[Mark Schaan]

I'll turn to my colleagues for more on this.

I think the fundamental recognition is that there are a number of elements of the privacy law that will require organizations to contemplate the privacy impacts of their actions, and there are a number of recourse mechanisms should they not.

I'll turn to my colleagues.

[Runa Angus, Senior Director, Strategy and Innovation Policy Sector, Department of Industry]

Thank you for your question.

In terms of the privacy impact assessments, the act, as Mark said, does incorporate a lot of the considerations. When they are developing privacy management programs, all Canadian companies have to develop privacy management programs where they have to consider the sensitivity of the information, whether there are better ways to collect it, minimization rules and things like that, which are principles that a privacy impact assessment would also include. In effect, it does take the approach of privacy by design or privacy impact assessment.

[Ryan Williams, Conservative, Bay of Quinte, ON]

I have a quick question, so I'm looking for a quick follow-up.

Would a PIA be similar to a privacy management plan?

[Mark Schaan]

I'll start, and then Runa can answer.

The answer is yes, in the sense that it will inform all privacy-related actions. It's actually broader than a privacy impact assessment, in the sense that all companies will be required to have a privacy management program for their use of personal information, which gets at all of the elements that were noted. In fact, in the case of small and medium-sized enterprises, we require the Office of the Privacy Commissioner to work for a certification that SMEs can live up to with respect to their PMPs.

[The Chair, Liberal, Joël Lightbound]

Ryan, you've taken two more minutes, and we're already short on time, so keep that goodwill in mind.

You're next, Tony, briefly.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Great, I'll be brief.

Thank you for being here.

What are the penalties for non-compliance with AIDA and CPPA?

[Mark Schaan]

They're a little bit different, and there are a number of functions that are important.

I'll start with the CPPA, and then I'll turn to AIDA. My colleagues will kick me under the table and join in if I get some of these elements wrong.

Under the CPPA, part of this bill fundamentally creates a robust enforcement regime that has a number of tools in the tool box related to how privacy infractions will be contemplated. One of the ones that are not a penalty per se is the order-making power that's granted to the Office of the Privacy Commissioner, which is an extraordinary power that allows the Office of the Privacy Commissioner and the Privacy Commissioner to order a firm to alter its privacy practices, including potentially the cessation of the collection, use or disclosure of personal information of Canadians.

Subsequently, though, there's also the capacity for the Privacy Commissioner to make a recommendation about administrative monetary penalties for violations of the law. He or she would make that recommendation to the new tribunal that's created in part 2, and the tribunal has the capacity to issue administrative monetary penalties that are the strongest in the world. Those penalties are a function of a maximum amount as well as a percentage of overall global revenue.

I'm going to turn to Samir to remind me of the specific numbers related to both of those.

[Samir Chhabra, Director General, Marketplace Framework Policy Branch, Department of Industry]

Yes, I'm happy to do that.

With respect to the CPPA, currently in the drafting, the Privacy Commissioner would have the ability to recommend administrative monetary penalties up to $10 million or 3% of global revenue, whichever is higher. The act also specifies a number of specific offences for egregious contraventions of the act, which carry higher penalties of up to $25 million or 5% of global revenues, whichever is higher. Some of the examples of an egregious offence would be an organization that disobeyed an order directly, an organization that obstructed investigation, an organization that retaliated or attempted to retaliate against a whistle-blower or one that did not inform the commissioner of a breach of privacy.

[Tony Van Bynen, Liberal, Newmarket—Aurora, ON]

Given the scope and scale of global enterprises today, how do you feel these fines would act if they were considered to be just a cost of business? “It's 3% of global revenue. Fine. We'll continue.” How do you stop that?

[Mark Schaan]

Thank you, Mr. Chair. I appreciate the question.

I think we tried to set an administrative monetary penalty limit that is and would be considered deeply meaningful. The 3% of global revenue—that is not 3% of global profit, but 3% of global revenue—we believe to be meaningful for even the largest of actors.

Moreover, the order-making power that is afforded to the Office of the Privacy Commissioner is such that should there be an ongoing violation of the CPPA insofar as a company has been ordered by the tribunal to pay but continues the privacy infraction practices, we have the capacity to shut down the intake and the continued usage of the personal information via the powers we have afforded to the Office of the Privacy Commissioner. I think that's deeply meaningful.

Go ahead, Samir.

[Samir Chhabra]

I'll just add to Mark's point that the administrative monetary penalties and the offence penalties I just identified would be the highest in the world, so I think we see them as very significant and meaningful potential financial hurdles.

[The Chair, Liberal, Joël Lightbound]

Thank you, MP Van Bynen.

Colleagues, we have a hard stop at six o'clock.

I understand I have granted you one minute, Monsieur Lemire. If you have one very pressing question, I'd let it go.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you. I have two quick questions.

Can an adult request that an organization dispose of data from when that individual was a minor? If personal information was collected when the person was a minor, can they, as an adult, have the information deleted?

[Runa Angus]

Thank you for your question.

The short answer is yes. That is actually a new right that has been provided for in the consumer privacy protection act. It's very much in line with the EU's GDPR.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Very good.

If organizations violate the law in relation to minors, are they liable to monetary penalties only? Can civil or even criminal actions be brought against them?

[Runa Angus]

Yes. Bill C‑27 also establishes a private right of action.

Obviously, regulatory recourse is available, going through the commissioner and so forth, but there are ways to initiate legal action against private organizations.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you very much.

[The Chair, Liberal, Joël Lightbound]

Thank you to the witnesses and members. I also want to thank our interpreters, analysts and clerk.

No doubt, we will see each other again very soon.

The meeting is adjourned.