Industry Committee on Oct. 19th, 2023

[The Chair, Liberal, Joël Lightbound]

I call this meeting to order.

Good afternoon, everyone.

Welcome to meeting number 90 of the House of Commons Standing Committee on Industry and Technology. Today’s meeting is taking place in a hybrid format, pursuant to the Standing Orders.

Pursuant to the order of reference of Monday, April 24, 2023, the committee is resuming consideration of Bill C‑27, An Act to enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act and the Artificial Intelligence and Data Act and to make consequential and related amendments to other Acts.

I’d like to welcome our witnesses today, from the Office of the Privacy Commissioner of Canada. First, we are hearing from Philippe Dufresne, Privacy Commissioner of Canada.

Thank you for joining us again today.

Next, we have Lara Ives, executive director, Policy, Research and Parliamentary Affairs Directorate, as well as Michael Maguire, director, Personal Information Protection and Electronic Documents Act, Compliance Directorate.

I thank all three of you for coming back. I'm confident that everything will go well today—I'm looking at my colleagues—and that we'll have a chance to have a normal meeting and benefit from your insights on Bill C‑27.

Without further ado, Mr. Dufresne, I'll give you the floor for five minutes.

[Philippe Dufresne, Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada]

Thank you, Mr. Chair.

Ladies and gentlemen members of the committee, I am pleased to be back to assist the committee in its study of Bill C‑27, Digital Charter Implementation Act, 2022, which would enact the Consumer Privacy Protection Act, the Personal Information and Data Protection Tribunal Act, and the Artificial Intelligence and Data Act.

When I previously appeared before the committee three weeks ago, I delivered opening remarks about the bill and presented my 15 key recommendations to improve and strengthen the bill. Today, I want to briefly highlight and respond to the letter the Minister of Innovation, Science and Industry sent to the committee on October 3, 2023, and to answer any questions that you may still have.

I welcome the minister's stated position on the amendments being developed with respect to the proposed CPPA, in which he seems prepared to agree with four of my office's 15 key recommendations, namely by explicitly recognizing privacy as a fundamental right; by strengthening the protection of children's privacy; by providing more flexibility for my office to use compliance agreements, including through the use of financial penalties; and by allowing greater co-operation between regulators.

I also note and commend his statement of openness to further amendments following the study by this committee.

I would like to take this opportunity to highlight other ways in which the bill should be strengthened and improved in order to better protect the fundamental privacy rights of Canadians, which are addressed in our remaining recommendations to the committee.

I will briefly highlight five of our recommendations that stand out in particular in light of the minister's letter, and I would be happy to speak to all of our recommendations in the discussion that will follow.

First, privacy impact assessments, PIAs, should be legally required for high-risk activities, including AI and generative AI. This is critically important in the case of AI systems that could be making decisions that have major impacts on Canadians, including whether they get a job offer, qualify for a loan, pay a higher insurance premium or are suspected of suspicious or unlawful behaviour.

While AIDA would require those responsible for AI systems to assess and mitigate the risks of harm of high-impact AI systems, the definition of harm in the bill does not include privacy. This means that there would be proactive risk assessments for non-privacy harms but not for privacy harms. This is a significant gap, given that in a recent OECD report on generative AI, threats to privacy were among the top three generative AI risks recognized by G7 members.

In my view, responsible AI must start with strong privacy protections, and this includes privacy impact assessments.

Second, Bill C‑27 does not allow for fines for violations of the appropriate purposes provisions, which require organizations to only collect, use and disclose personal information in a manner and for purposes that a reasonable person would consider appropriate in the circumstances. This approach would leave the federal private sector privacy law as a standout when compared with the European Union and the Quebec regime, which allow the imposition of fines for such important privacy violations.

If the goal is, as the minister has indicated, to have a privacy law that includes tangible and effective tools to encourage compliance and to respond to major violations of the law in appropriate circumstances—an objective I agree with—I think this shortcoming surely needs to be addressed for such a critical provision.

Third, there remains the proposed addition of a new tribunal, which would become a fourth layer of review in the complaints process. As indicated in our submission to the committee, this would make the process longer and more expensive than the common models used internationally and in the provinces.

This is why we've recommended two options to resolve this problem. The first would be to have decisions of the proposed tribunal reviewed directly by the Federal Court of Appeal, and the second would be to provide my office with the authority to issue fines and to have our decisions reviewable by the Federal Court without the need to create a new tribunal, which is the model that we most commonly see in other comparable jurisdictions.

Fourth, the bill as drafted continues to allow the government to make exceptions to the law by way of regulations, without the need to demonstrate that those exceptions are necessary. This needs to be corrected as it provides too much uncertainty for industry and for Canadians, and it could significantly reduce privacy protections without parliamentary oversight.

Fifth, and finally, the bill would limit the requirement for organizations to explain, upon request, the predictions, recommendations or decisions that are being made about Canadians using AI, to situations that have a significant impact on an individual. At this crucial time in the development of AI, and given the privacy risks that have been recognized by the G7 and around the world, I would recommend more transparency in this area rather than less.

With that, I would be happy to answer any questions that you may have.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Dufresne.

Mr. Perkins, the floor is yours.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you, Mr. Chair, and thank you, Commissioner.

The protection and safeguarding of an individual's personal information in the digital world, and the artificial intelligence world we're evolving into, in my view must be protected from the abuse of businesses and what they may intentionally or unintentionally do with that information.

After eight years, this new Liberal privacy bill, which is flawed, introduced 18 months ago, sat for a year in the House before it was brought for debate. You are Canada's Privacy Commissioner, the guardian of privacy for individuals in this country. Did the Liberal government consult and involve you in the development of this bill before it was introduced in June 2022?

[Philippe Dufresne]

On this question, Mr. Perkins, the bill was introduced before I was formally in place as Privacy Commissioner. The bill was actually introduced the day the House of Commons approved my proposed appointment as Privacy Commissioner. I was not consulted or involved, certainly, before that with respect to Bill C-27, because I wasn't the commissioner.

I have since been making recommendations—

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Was your office consulted?

[Philippe Dufresne]

I know that there had been ongoing exchanges with my office and the department with respect to privacy matters. I don't know the extent of the details that would have been shared with my office prior to my arrival.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Perhaps you or your colleagues could tell me, if you did share your concerns or what the Office of the Privacy Commissioner of Canada desired, what should be in this legislation to update it.

What were the four or five key things that the office communicated, before this bill was introduced to the House, needed to be in this bill?

[Philippe Dufresne]

My office made a number of recommendations on the predecessor bill to Bill C-27. One of them included recognizing privacy as a fundamental human right. Some concerns were raised with some of the definitions of things like appropriate purposes or the ways information was conveyed. There was an extensive list of recommendations tabled by my predecessor. That is on the public record. A number of those were considered and led to Bill C-27.

There are outstanding ones. In my submissions, I have highlighted 15 key recommendations. In the annex, we made reference to previous recommendations that have been made.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

It appears, based on the fact that there are 15 things, many of which you say were on the public record in the previous iteration of this bill, that they were ignored by the government in drafting this bill.

Does the Liberal government ignore the Privacy Commissioner often in its recommendations on how to improve privacy law?

[Philippe Dufresne]

I view my role and the role of my office as promoting and protecting the fundamental privacy rights of Canadians and being an adviser to you, as parliamentarians, in making the decisions. With this in mind, I've made 15 recommendations. I have communicated this. My office did that, before I was commissioner, with its views. Some were taken up by parliamentarians, by the government, and some were not.

In this instance, as I indicated in my opening remarks, I'm happy to see that, at least until now, four of my 15 seem to have been taken up. I look forward and hope to be able to convince all of you, including the government, to take up the remaining ones.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

After the bill sat for a year, I presume there was some.... The minister said before the committee that he finally reached out and had some discussions with you, or the department did. Two weeks ago he came here and admitted that his bill is very flawed in key fundamental areas. He is proposing eight major amendments, which he has not shared with the committee so far after two demands by this committee to produce those documents.

Has he shared drafts of those amendments with you?

[Philippe Dufresne]

No, he has not. I have the same information you have, which is the letter that has been tabled at this committee.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

As the guardian of privacy in Canada, the Liberal minister was truly committed to having a bill that protected Canadians' privacy from the abuse of businesses in the massive data world that we live in. He wanted truly important and accurate legal wording to do what both you and your predecessor said on issues like fundamental rights being protected in proposed section 5.

Do you not think a reasonable person who is truly committed to that would seek the advice of the independent experts about what is the best way to do that?

[Philippe Dufresne]

I think we do have significant advice that we can offer. The ideal way would be for my office to be consulted as early as possible, as often as possible, with proposed privacy changes. I understand there are some issues about cabinet confidentiality as to what can and cannot be shared, but on the topics that are being considered—the themes, the issues—I agree with you that if we're able to give input at the front end, there's a greater chance for these issues to be resolved.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Draft regulations and input can always be shared publicly before going to cabinet, to make sure it's what is needed to achieve what it is without having to go through the bureaucracy of cabinet.

As for the fundamental right issue on proposed section 5, I don't buy that the preamble has any value since it's not part of the published statutes of Canada. The purpose section sets out the importance of the bill and what its goal is.

If the bill says a fundamental right of the protection of privacy is of equal value to an organization's ability to use that, isn't that putting the cart before the horse? Shouldn't an individual's privacy be more important than a business's ability to use it?

[Philippe Dufresne]

It should be. This is why I've recommended this explicit recognition.

As you know, up until now it was described sometimes as a privacy interest or as a right—there was some more tepid language, I suppose—and my strong recommendation was that we need to make this explicit. We need to recognize it is quasi-constitutional, as courts have said and as the international community has said, so that in the purpose clause—and I recommended adding it in the preamble as well as in the purpose clause, but you're right; the purpose clause is the key—if you use the words “fundamental right”, you are sending a signal to courts, to decision-makers, to me, that even when you are balancing this with other elements, such as the needs of organizations—which have to be considered; we have to have innovation at the same time—if there is a clear conflict, one should prevail, and it is the fundamental right that should prevail. This is why it's so important this is enshrined in the law.

I was encouraged by the statement of the minister that this is now the intent. It's certainly something I've been advocating for since day one.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Perkins and Mr. Dufresne.

Mr. Sorbara, go ahead.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Chair.

Welcome, Commissioner.

Commissioner, on October 3, two or three weeks ago I guess it was, you provided keynote remarks to the Big Data & Analytics Montréal Summit 2023. I've had a chance to go through your remarks. In one of the sections, entitled “Law reform and the regulation of AI in Canada”, you reference changes to the CPPA and also to the AIDA. You also comment about being “encouraged by the introduction” of the bill and—I'll use my own words—the tone and direction of the bill. One of the comments you make is about the protection of fundamental privacy rights.

In terms of reading your speech on Bill C-27, the direction of the bill, you are encouraged.

[Philippe Dufresne]

I've called it a step in the right direction, so I am encouraged. I see a possibility for further improvements, and those are the 15 recommendations that I am making, but I have said it is a step in the right direction.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

These are new terms, new lexicons, that are being introduced into our vocabulary on generative AI, if can use that term. If you had to contextualize the risk—and you use the word “risk” quite a bit—to privacy, where would you rate that?

[Philippe Dufresne]

Risks to privacy are significant in the context of generative AI. That's certainly my view. It's the view of the G7 ministers.

I pointed to a recent report of the OECD in September of this year, in which the OECD canvassed all of the G7 digital and tech ministers about the top risks of AI—not just the risks, but the top benefits as well, because there are benefits in terms of productivity and so on. The top three risks in this report included privacy. The first one was disinformation and misinformation. There were risks to copyright. The risks to privacy were third, and you had risks of exaggerated biases and discrimination. Those are the top risks. I would agree with that categorization.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you for that colour, because this bill in this committee is going to be a very good learning experience for me.

Would you state that Canada, with this legislation, is a first mover?

[Philippe Dufresne]

With AIDA Canada has the opportunity to be the first. There is legislation is Europe that is moving forward, and that is something that we've pointed out in our submission on Bill C-27. This is a positive step, and Parliament needs to get it right. What I'm highlighting in the context of AI, in particular, is that the AIDA bill would bring in significant proactive risk mitigation measures to deal with harms and biases. This is good, and these are important measures, but they leave out the proactive steps for privacy, which is in the top three risks. This is why I'm insisting on having a privacy impact assessment as a mandatory obligation in the privacy bill, to close this gap.