Industry Committee on Oct. 24th, 2023

[Daniel Therrien]

Proposed section 12, which is actually the balancing exercise that actually occurs on a case-by-case basis, and proposed section 94, the penalty provisions, as a whole need to reflect the idea that privacy is a fundamental right. At this point, with the amendments tabled by the minister, we're doing well with proposed sections 2 and 5, but not with proposed sections 12 and 94.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

I would say that proposed sections 12, 15 and 18 are critical on the privacy part. I agree that AIDA is a blank slate, and we'll come to that another time—hopefully today.

Proposed section 12 sets out the purpose. Proposed section 15 talks about express consent and then, in proposed subsection 15(5), says that it's okay to use “implied consent”. Then proposed section 18 says that a business has “legitimate interest” to use an individual's data basically however it wants, even if it harms the individual.

To me, it places the emphasis. When you take proposed section 5 and then add proposed sections 12, 15 and 18 to it, it looks like big business and its right to use your data is being protected in this, even if it harms you.

Do you not need to amend all of those proposed sections, not just proposed sections 5 and 12?

[Daniel Therrien]

I think that proposed section 15 on consent does need to be amended, and I speak to this in the document that I left with you.

On the concept of “legitimate interest”, I would give the following advice. This is a concept that exists in European law, which is considered to be the gold standard internationally. I think it is possible to have a “legitimate interest” type of exception to consent, provided that the sum total of proposed sections 2, 5, 12 and 94 actually do protect privacy as a fundamental right. There's no inconsistency between “legitimate interest” and considering privacy as a fundamental right.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

However, without that—because the minister has not proposed that—

[Daniel Therrien]

Yes, we have a problem.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

—we have a problem, absolutely.

I'd just like to ask Mr. Fraser a question in the little bit of time that I have left.

I think that AIDA is a problem because AIDA actually doesn't set out a public policy framework, which is what legislation is supposed to do. It just says, more or less, “Trust us; we'll do it all in regulation.” However, you mentioned that it would be perhaps open to a charter challenge. I wonder if you could expand on why.

[David Fraser]

The conclusion I draw on that is that it's simply saying within the legislation, or saying within the bill, that it applies to artificial intelligence in connection with interprovincial activities. The federal Parliament has very little jurisdiction, for example, over a computer science researcher sitting at the University of Toronto. That's exclusively within provincial jurisdiction.

There are going to be scenarios in which federal jurisdiction may be triggered, but in the vast majority of situations, such as when a small company in Nova Scotia or a small company in British Columbia decides to implement an artificial intelligence system, it's not within the competence of the federal Parliament when they do it on that small scale. Therefore, there are going to be significant gaps with respect to where federal jurisdiction can apply and where provincial jurisdiction already applies.

[The Chair, Liberal, Joël Lightbound]

You're out of time. Thank you, Mr. Perkins.

I'll now turn to Madam Lapointe for six minutes.

[Viviane LaPointe, Liberal, Sudbury, ON]

Thank you, Mr. Chair.

Ms. Gratton, with this bill, will Canada's legislation be in step with international privacy rules and standards, especially the GDPR in the EU?

[Éloïse Gratton]

I think the bill is acceptable in that it really seeks to balance privacy protection and the interests of organizations that collect personal information for legitimate purposes. That said, the bill doesn't go as far as Europe's regulation, which is clearly more robust in a number of ways.

[Viviane LaPointe, Liberal, Sudbury, ON]

Previously, you had this to say about Canada's first privacy laws:Forty years later, this concept remains one of the dominant theories of privacy and the basis for privacy protection laws around the world, including [even our bill]. The “notice and choice” approach these laws impose is no longer realistic: individuals are overloaded with information in quantities that they cannot realistically be expected to process or comprehend.

The bill as drafted helps to foster the realization that privacy protection can no longer be the responsibility of individuals. Technology has advanced so much that the average person could never completely protect their privacy and information online. Do you think the bill adequately protects personal information by requiring corporations and businesses to assume responsibility for privacy violations?

[Éloïse Gratton]

I should probably start by clarifying that statement.

One of the underlying principles of privacy is that individuals retain control over their personal information. That idea goes back to the early 1970s, before the Internet came along. Things have obviously changed since then. Today, we are dealing with huge amounts of information and complex business models, not to mention partnerships. On top of that, privacy policies are very long, complex and detailed to ensure that individuals have all the information. However, they don't take the time to read all that information because it's so complex and burdensome.

Keeping that in mind, I think it's worthwhile to try to reduce the need for consent and to focus on situations that require the individual's consent, while introducing other legal grounds for protecting the individual, a bit like what Europe did with the GDPR. In that respect, with the exceptions to consent, I think the bill is definitely a step in the right direction.

Clearly, other safeguards are needed. For instance, in order for the legitimate interest exception to apply, the company has to document why it considers the collection or use of the information acceptable and carry out a risk assessment. There are safeguards. Companies have to do a bit more work to make sure that they are protecting individuals' right, and they are subject to penalties. Companies want to be compliant and good corporate citizens, of course, but they also want to avoid penalties. With the penalties, which are in line with what we see in Europe, the bill provides that incentive.

[Viviane LaPointe, Liberal, Sudbury, ON]

Could you give us your opinion on the measures that Bill C‑27 provides in terms of data protection?

[Éloïse Gratton]

Are you talking about security?

[Viviane LaPointe, Liberal, Sudbury, ON]

Yes, that's right.

[Éloïse Gratton]

There aren't that many changes, in the sense that the article dealing with protection and adequate security measures will still be technology-neutral. We're referring to current standards. As lawyers practising in this field, we will often rely on decisions handed down by privacy commissioners, who will cite the type of measures that were expected to be in place at the time, in the context and according to the given technology. I think it's right to keep that flexibility, to make sure we're relying on the security standards of the day, which are constantly evolving.

[Viviane LaPointe, Liberal, Sudbury, ON]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Ms. Lapointe.

Mr. Lemire, you now have the floor for six minutes.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you, Mr. Chair.

I thank the witnesses for their statements.

Ms. Gratton, even though clause 75 of the bill includes a prohibition on the use of de‑identified information to identify an individual, clause 39 will allow companies to disclose an individual's personal information without his or her knowledge or consent for socially beneficial purposes to organizations that are not subject to the law. How can we strike a balance between protecting personal information and facilitating this disclosure, especially when unregulated organizations are involved?

[Éloïse Gratton]

At the moment, clause 39 introduces an exception, but it goes in one direction only. Private sector companies can share information without restriction, but with public sector bodies. In my submission, I point this out and say that there should be protections in place, even if they are public sector bodies. My reasoning is that if it's good for the public sector, maybe it's also acceptable between private sector companies.

Obviously, there have to be security measures. For example, in Quebec, there may be exchanges in certain cases. You have to do a privacy risk assessment first, and then you have to file an agreement that has to include certain clauses. In my opinion, there's a way to strike a balance.

However, I think excluding private sector companies from the application of clause 39 here is shooting ourselves in the foot. Private sector companies have a lot of resources, ideas and data. Why deprive ourselves of this if we want to favour innovation?

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

There may be a loophole here, but what additional safeguards or measures should be put in place to ensure more responsible data exchange in such a case?

[Éloïse Gratton]

As I told you, there could be a privacy impact assessment. Risks would be identified and how to reduce them. Organizations wishing to exchange data could be required to provide this assessment to the Office of the Privacy Commissioner of Canada, allowing oversight of projects where data is exchanged. These organizations could also be required to enter into contracts that include minimum requirements for the implementation of security measures.

If we notify the commissioner, assess the risks, provide contractual clauses and ensure that data is properly secured and de‑identified in certain situations, I think we could strike an acceptable balance.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

In another connection, Bill C‑27 obviously raises the issue of the precedence of Quebec's recently updated private sector privacy legislation. As you know, Minister Champagne has made public a letter he sent to members of our committee to clarify the federal government's position in this regard. He acknowledges that the provisions of the Quebec legislation are essentially similar to those of the federal bill, and that they can take precedence. Do you agree with this analysis?

[Éloïse Gratton]

The Quebec and federal provisions are certainly similar. Those in Quebec are probably a little more stringent in some respects and include additional requirements, such as profiling in section 8.1 of the Quebec law, as well as the need to perform risk factor assessments before transferring data outside Quebec.

The analysis you mention is therefore certainly acceptable: if we compare the new Quebec requirements with the provisions of Bill C‑27, there is no doubt in my mind that Quebec would pass the test.

[Sébastien Lemire, Bloc, Abitibi—Témiscamingue, QC]

Thank you very much.

Mr. Therrien, Bill C‑27 emphasizes the need for informed consent by devoting an entire section to it. However, we have seen the rise of platforms favouring the use of opt-out formulas. These are the famous opt-out rather than opt‑in options. In your opinion, does this bill do enough to protect users of digital platforms from the pitfalls of these opt-out formulas?