Evidence of meeting #90 for Industry, Science and Technology in the 44th Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was office.
A recording is available from Parliament.
Liberal
Francesco Sorbara Liberal Vaughan—Woodbridge, ON
If I understand this—and I apologize if I don't understand it; you'll have to forgive me for that—that is why it's important to list privacy as a fundamental right.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Listing privacy as a fundamental right is certainly part of it and certainly sends the interpretive message about how this is to be treated. Having a privacy impact assessment as an explicit legal requirement is helpful to organizations, because they know what they have to do. We can provide guidance through regulation or through my office, so that industry get this certainty and can thereby know why they're investing resources in doing this. It's to protect privacy, yes, but it's also because there is legislative backing.
Liberal
Francesco Sorbara Liberal Vaughan—Woodbridge, ON
Okay. When you mention industry, I take it one step back and I think of the individual having a right to their privacy to whatever degree, not just with industry. It's also the signal to industry about how they should treat the individual's privacy. I tie that back to the personal responsibility of the individual but also personal responsibility tied into industry.
In terms of your comments on trans-border data flows, we obviously work and are connected through an integrated world, as we see on a daily basis, sometimes for good and sometimes not for no good, unfortunately.
How does the trans-border data flow, in your view, and how should we be thinking about that?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
This is an issue that the international community is grappling with. In Bill C-27 you have provisions about making sure that other countries are providing similar levels of protections through contracts. Other regimes have more detailed rules about this, for instance, looking at the GDPR, which has the adequacy regime.
There are a number of models for that, and what's important is making sure that the privacy of Canadians is protected with the data that leaves Canada.
Liberal
Francesco Sorbara Liberal Vaughan—Woodbridge, ON
As somewhat of an accountant—I'm more of a finance person—I know that in accounting there is rules-based and principles-based accounting. With this type of legislation, is it better to go rules-based or principles-based?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
It's principles-based, because it needs to be technology neutral. It has to be legislation that will stand the test of time. It's 20 years old, and the Privacy Act in the public sector is even older, so we need this legislation to keep up with fast-moving technology. We're talking about principles, but we also need in legislation some specific obligations, so that organizations and Canadians know their rights.
For instance, we take the safety of travellers in airplanes very seriously. We have predeparture safety checks all the time to make sure that this is done, and done proactively, not after the fact. I see privacy impact assessments as being the same thing. By making sure that on the front end you're looking at privacy, you're treating it as a fundamental right, and you're mitigating those risks not only after the fact.
Liberal
The Chair Liberal Joël Lightbound
Thank you very much, Mr. Sorbara.
Mr. Lemire, you have the floor for six minutes.
Bloc
Sébastien Lemire Bloc Abitibi—Témiscamingue, QC
Thank you, Mr. Chair.
Mr. Dufresne, thank you for being here and for your constructive recommendations.
When you last appeared before the committee, you had this to say:
...I recommend strengthening the preamble and purpose clause to explicitly recognize privacy as a fundamental right...so that these important principles inform the interpretation of all aspects of the legislation.
However, as my Conservative colleague noted, the preamble does not have force of law.
Can you explain the motivation behind this recommendation?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Our recommendation is actually twofold. We feel that adding a preamble is a step in the right direction. It refers to international instruments and all sorts of things. You can look to the preamble in case of ambiguity, even if it doesn't have the binding force of a provision of a statute. So we recommended amending the preamble, but we also recommend amending section 5, which deals with the purpose of the act.
In the Federal Court of Appeal's decision in the case involving Google, where the application of the Personal Information Protection and Electronic Documents Act was at issue, the court explicitly said that it was in the purpose statement of a statute that the intent of the legislator could best be seen. So, yes, it's important that section 5 be amended.
Bloc
Sébastien Lemire Bloc Abitibi—Témiscamingue, QC
Do you feel that recognizing privacy as a fundamental right positions Canada as a leader in protecting human dignity around the world?
Of course, one of our goals is to achieve the highest standards internationally. Does this bring us closer to the European standards, for example?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, that brings us more in line with Europe's standards. In fact, the European Union's General Data Protection Regulation, or GDPR, explicitly recognizes that, as does Quebec's regime. In all my international meetings, there was a consensus: privacy must be considered a fundamental right. Yes, it's important for Canada on the world stage, but most of all, it's important for all Canadians. Not only is privacy, in and of itself, essential and fundamental—it's a vehicle for freedom—but it's also the foundation for other rights. It underpins voting rights, human rights, equality rights and so on. That's why clear recognition of privacy as a fundamental right is essential.
Bloc
Sébastien Lemire Bloc Abitibi—Témiscamingue, QC
The minister has acted on some of your recommendations to protect privacy, but you made a number of them—15, to be specific. Are there other recommendations you'd like to underscore today, to shine a spotlight on privacy concerns? I'm obviously talking about the recommendations the minister hasn't necessarily addressed thus far.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Yes, absolutely.
I have a list, in fact. The minister said he wanted to implement four of the recommendations, which leaves 11 of the 15 we put forward. Of those, I mentioned five, in particular.
The first recommendation is requiring PIAs for new technologies that can significantly impact Canadians, like generative AI. In my eyes, that is a major gap in the bill. PIAs are required for other types of harm and bias, but not for privacy harms. That seems contradictory, since it goes against an OECD finding: threats to privacy are the top third risk. Privacy absolutely has to be prioritized.
The second recommendation is requiring organizations to be more transparent about decisions that are made using AI. As it stands, the bill sets out the right to an explanation, which exists in other regimes. That right, however, is limited to decisions that significantly impact people. I recommend removing that proviso, so that people have the right to transparency and an explanation whenever a decision about them is made, no matter how great the impact.
People in the AI world are worried. We are hearing that more and more. They need reassurance. There are huge benefits to AI. Personally, I think more transparency will help people understand what AI is and what it isn't, show them that they are protected by a robust privacy regime.
The third recommendation revolves around administrative monetary penalties. They are used only as a last resort. I'm not saying this because I want to see them used—I hope that won't be necessary—but I would like those penalties to incentivize decision-makers to make good decisions. There is a gap, though. Currently, one of the biggest violations in the bill is not subject to an administrative monetary penalty. I'm talking about contravening the provisions on legitimate business purposes. I think this is a major consideration.
The fourth recommendation deals with the broad regulatory authority being given to the government, specifically the ability to make exceptions to the act without having to demonstrate that those exceptions are necessary. That is overly broad, in my eyes. A provision in the bill even allows the government to make regulations to completely exclude an activity from the application of the act. That goes too far and must be rectified.
The fifth and final recommendation proposes the creation of a tribunal as another layer of review. This would lead to a longer more expensive process and require the creation of a new structure. This diverges from the regimes in Quebec, Europe and other jurisdictions. Here's what I recommend: if a tribunal is set up, its decisions should be reviewed directly by the court of appeal. That would add a layer of review while removing another. The other option is to follow other models by giving my office the authority to issue fines and making those decisions reviewable by the usual court, as is the case in most regimes.
Bloc
Sébastien Lemire Bloc Abitibi—Témiscamingue, QC
Quickly, can you tell me whether you would welcome non-monetary penalties?
I asked that question before, and the department officials seemed amenable to the idea.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Currently, the bill gives my office the authority to issue orders.
Most cases would probably involve the use of orders instead of administrative monetary penalties. The bill does a good job of prescribing the use of penalties. It lists the factors that must be taken into account, including the organization's approach and diligence, and whether it complied with a certification program. Whether the organization acted in good faith really matters, as do the efforts it made.
My office has the authority to issue orders, which is extremely important. I think the penalties are high enough, but with the use of orders, it's possible to put a halt to the activity and the collection of the information. Both of those are very important. Persuasion and negotiation are also tools, of course. That's why we recommended the use of compliance agreements, something the minister agreed to. That ability is also very important.
My preferred approach is to use dialogue and to encourage organizations to make the right decisions before they go astray.
NDP
Brian Masse NDP Windsor West, ON
Thank you, Mr. Chair.
Commissioner, thank you for being here.
I'm sorry if I ask a question a second time. We had technical problems on this end over here, so I missed some of the testimony and so forth.
I did ask this of officials. The Competition Tribunal recently issued a $9-million penalty on the Competition Bureau for doing its job. That's for the Competition Bureau doing what it thought was the right thing and exercising due diligence in looking at the takeover of Shaw by Rogers. I've been assured that this can't happen in this situation if such a tribunal were to be created. Is that accurate? I wanted to know if you had that same opinion.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
My understanding of the situation involving the Competition Bureau is that the tribunal made an order for legal costs and expenditures in the context of that litigation. That is an ability that courts have in litigation. That is an ability that I understand the tribunal would have. My colleagues can confirm, but there is a proposed provision that the tribunal be able to award costs. That would be the tribunal in this instance.
NDP
Brian Masse NDP Windsor West, ON
This is my problem with the government on this. I'm not even sure if they're serious about this bill anymore. We have a hard time getting in amendments. There's the drama that went around that. Maybe we'll get the amendments from your department tomorrow, if there's compliance. That's a thing that I asked directly. Hopefully we can have our own researchers and analysts test that out.
It almost makes it a moot point in many respects for the Competition Bureau and an independent public entity to be able to challenge the conglomerates and powers that be to go forward. In fact, the $9 million is a drop in the bucket, if that was for Rogers. It's a squeeze on the Competition Bureau and clearly sends a chill down the spine of basically anybody who's interested in consumer rights in Canada. You can basically be bullied into the corner by a legal process.
That's good to know. I had some reservations about the tribunal to begin with. If that's the case, then this is much more abhorrent.
With regard to your 15 recommendations, could we walk through the five that the minister has agreed to in terms of those recommendations? I want to make it clear for those who are here. Can you identify which 15 in what you've submitted here today are the ones the minister has agreed to?
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Certainly. On the previous question, it is section 20 of the tribunal act that would give the ability to award costs in accordance with the tribunal's rules.
In terms of the recommendations that the minister has signalled agreement with, the first is the recognition of privacy as a fundamental right. In the annex of his letter, as I understand it, he mirrors my recommendation in the sense of recognizing it in the preamble and recognizing it in the purpose provision. That's one.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
The second is recognizing strengthened protection for children's privacy. This is one where I had recommended amending the preamble. The minister agrees and goes further. He proposes to amend clause 12 on “appropriate purposes” to include children's privacy there. I am supportive of that additional recommendation.