Industry Committee on Oct. 26th, 2023

[Dr. Michael Geist]

I did highlight that in the opening remarks, but I'm happy to engage.

You're right. When we look at what we just saw most recently involving Rogers and Shaw, it's understandable why people would be skeptical about the creation of a tribunal that provides that kind of oversight.

With that said, one of the things we have seen over the years is that, because of the way the federal court treats Privacy Commissioner decisions on a de novo basis—if there are appeals, they go to the court, and the court then effectively starts from scratch—you are faced with a situation where it almost incentivizes challenging tough cases—and we've seen that—because you get another chance at it.

Creating a tribunal, provided it is viewed from an administrative law perspective as an expert tribunal that's going to be granted some deference for the decision by follow-on courts, if it does go to court, has the potential, in some ways, to strengthen the outcomes of that process, because there is some of that deference, but that requires ensuring that the tribunal is genuinely viewed as an expert tribunal and properly constituted.

The initial version of this bill didn't go anywhere near there, with just one privacy expert. We now have half.

Finding ways to ensure that public interest is well represented on the tribunal and that the tribunal has genuine expertise at least opens the door to the prospect that it might provide some advantages, although I recognize why some would say that these are already lengthy processes so we should just let the Privacy Commissioner handle it all.

[Brian Masse, NDP, Windsor West, ON]

Let me see if I have the summary of this right.

If we create a tribunal that is respected by the industry across the board, it might provide a better path to go forward. If it's not, it's going to lead to an opening for an initial test drive, in order to see whether we bring things to court.

I'm sorry. I'm trying to figure this out.

[Dr. Michael Geist]

It's not whether or not business respects the tribunal. I don't really care if business respects the tribunal.

[Brian Masse, NDP, Windsor West, ON]

Okay, that's fair enough. That's why I'm asking.

[Dr. Michael Geist]

I think it should be properly constituted and recognized as a credible authoritative tribunal. However, the question isn't whether or not business respects it. It's whether or not courts respect it.

[Brian Masse, NDP, Windsor West, ON]

Okay.

[Dr. Michael Geist]

What we want is for the courts to say that a decision that comes out of the tribunal is one they are prima facie going to respect.

At the moment, when the commissioner issues a decision, the courts start from scratch. They have the ability to start from the beginning, which is why we see.... The case of Cambridge Analytica has already been referenced a couple of times today. We still have Cambridge Analytica before the Canadian courts. We had the commissioner, then we had a first court decision, and now we have an appeal ongoing.

These are long processes and the courts play out potentially somewhat differently than the administrative side in terms of privacy itself. It's more about having the process of the Privacy Commissioner and the tribunal better respected by courts, especially given the kinds of penalties we're envisioning. I think we can well assume that, if the penalties are significant, we're going to see organizations that are facing those penalties appealing the decision through the courts.

[Brian Masse, NDP, Windsor West, ON]

Okay.

I've had a lot of confidence in a number of the last privacy commissioners we've had. However, if the tribunal is going to be politically appointed, and if it's not respected by the courts, then I see what you're saying, because their decision-making capability and evaluation will be based on the confidence the groups going through the complaint have in the process.

[Dr. Michael Geist]

I'm not an administrative law expert, but the way a mistrial works, in terms of the deference courts may give to tribunals, is linked to the expertise of a tribunal. Let's say it's the copyright context. It doesn't mean the decisions themselves are always followed. They're definitely not, but at least the starting point is that they recognize there has been expertise brought to bear.

Right now, however, even though I think we would all acknowledge the Privacy Commission has expertise, it's not viewed as an independent tribunal. Thus the courts have taken the position that they have the ability to start looking at a case from the beginning.

[Brian Masse, NDP, Windsor West, ON]

Okay, that's very helpful.

I know we have some guests online. I don't want to shut them out. To any of the guests online, please intervene. Is anybody interested in commenting on the creation of the tribunal for the Privacy Commissioner?

Please go ahead.

[Dr. Teresa Scassa]

Do you mean me?

[Brian Masse, NDP, Windsor West, ON]

Yes. I'm sorry. It's hard for us to see. Raise your hand or just pipe up. It's all good.

Thank you.

[Dr. Teresa Scassa]

I am less enamoured with the proposed privacy tribunal, for a number of reasons.

The first thing is that.... It's certainly true that the Federal Court, under the section 14 process in PIPEDA, specifically in the legislation, holds its hearings de novo. You can change that. You can keep the same framework, but you can require that it not be a proceeding de novo. It is currently part of the legislation, but that part could be changed without creating a whole new data tribunal.

Currently, the Privacy Commissioner doesn't make decisions. They don't have order-making powers. The commissioner makes findings. The process before the Federal Court is a process where either the commissioner or the complainant seeks an order, or the complainant is seeking damages. It's not an appeal proceeding. The organization, for example, doesn't have a mechanism through that process to go to the court. Again, you could certainly tinker with that formula, but it isn't really an appeal; it's a hearing de novo on this issue of whether an order should issue.

With the personal information and data protection tribunal, the tribunal is actually going to now have the authority not only to review orders of the Privacy Commissioner—because the commissioner will have new order-making powers—or to review recommendations for administrative monetary penalties, but also to hear appeals of any findings, because the commissioner can still make findings. Findings aren't orders. They're not binding. They're the commissioner expressing particular views about the law. Those can also be appealed to the tribunal.

I think that requires another look in this context. Really, what you're doing is taking an independent regulator with the approach and interpretations that the independent regulator brings to their decision-making role. You then have an appointed tribunal that is going to review those decisions and findings, those approaches and interpretations that are not binding and that are the commissioner's approach to the law.

One of the things I've expressed concerns about.... The previous commissioner and the current commissioner have been working very collaboratively with the provinces that have private sector data protection laws, so Alberta, B.C. and Quebec. They have engaged in joint investigations. They have issued joint findings. They work in a way that is very collaborative to try to ensure some sort of consistency across the country with respect to interpretations of their laws, and to try to find cohesive shared interpretations of the laws.

We're going to move into a situation where the commissioner has less latitude, because the commissioner may agree with the provincial commissioners, who have order-making powers and are only subject to judicial review and not appeal before any kind of tribunal. The federal commissioner will perhaps agree with them in joint findings and then find those findings appealed to a tribunal that might rule otherwise, disrupting that collaboration among commissioners and the balance that might be found there.

I have quite a number of concerns about the tribunal structure and what implications it might have for how decisions are made about the interpretation and application of the legislation.

[Brian Masse, NDP, Windsor West, ON]

That's great. Thank you very much.

Thank you, Mr. Chair.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Vis, the floor is yours.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you, Mr. Chair.

Thank you to our witnesses here today.

I'm somewhat concerned about this bad bill before us today.

With Bill C-11, the Government of Canada had an opportunity to enshrine the fundamental right to privacy for children, to define what a minor is, to define perhaps an age of consent and do a whole bunch of stuff to ensure that children were protected. That bill died on the Order Paper.

Then, we had Bill C-27 when this Parliament opened up again. The minister again had an opportunity to enshrine the fundamental right for children to protect their privacy in some of the actions they may take online. Then the government had the opportunity to define what sensitive information is—likely in the context of a child. They had an opportunity to define what a socially beneficial purpose was in the context of a child.

The minister came before us a few weeks ago. He said, “I have this bill. It's going to do so much work to protect children, but we have to amend it.” Then we had to put a motion forward to get a copy of those amendments. We're here today. I am not going to relent on this until we have more clarification and I hear from as many witnesses as possible to ensure that children's rights are protected.

My question is open-ended. I'll start with you, Mr. Geist. What clauses of the bill do you believe need to be amended to ensure that a child's fundamental right to privacy and their online actions are not used in a way that will compromise them as adults, or at a future period of time in their life?

[Dr. Michael Geist]

I'll give you a brief answer, but Professor Krishnamurthy, who is one of the witnesses, has done studies and reports on this, so he's probably best suited to answer some of those particular questions. However, I will say two things in response to your opening comments.

First, to reiterate, I think there's general disappointment for many in the lack of prioritization of privacy over the last number of years. Bills, as you mentioned, get introduced and then seem to languish.

I'm glad that we're here now, but I'm inclined to agree with you that the best way to ensure that you get the best time out of witnesses and the best kind of study is to reflect on legislation as it's intended by the government. If we're left with this amalgam of a bill plus comments about where things are headed, that doesn't provide the best sort of study.

In terms of minors, specifically, I'll note that one of the real concerns arises in differing definitions of minors from province to province and the like. Therefore, one thing I think we need to include within the legislation—I know other witnesses have highlighted it—is the need for some sort of consistent definition here so that we know there is that consistency of protection.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you so much.

My colleagues tell me that I should be asking this question of Mr. Krishnamurthy. I apologize. I missed the opening statements. I was debating Bill C-34 in the House of Commons.

Would you like to comment, sir?

[Vivek Krishnamurthy]

Thank you very much.

I agree with Professor Geist's initial responses, but let me just take a step back.

There are certainly specific clauses of the bill that could be amended to improve the protection of children and minors. However, we need to consider the structure of the bill as a whole in protecting children—and adults, for that matter.

Several witnesses—not only Professor Scassa and Professor Bennett—spoke about the interaction between the legitimate interest exception and the implied consent provisions of this bill. When they are applied to minors, structurally speaking, those exceptions could be very problematic. I think we need a structural approach to this. All of these pieces of this bill interact together.

What are the exceptions to consent? What are the situations in which someone collecting or using data has to go through a process to justify that? That's a data protection impact assessment. What are the remedies?

Specifically, there are a few things I would like to highlight, which I think are easy amendments, relatively speaking. The first is the “best interest of the child” language, and that could be inserted into—

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Excuse me. Was that the language put forward by Mr. Therrien, the former privacy commissioner, in the last meeting?

[Vivek Krishnamurthy]

That is correct.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Thank you.

[Vivek Krishnamurthy]

I think that is a very good first amendment that could be made.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

Why do you think we need that amendment, specifically? Elaborate on that, please. This is a really crucial point.

[Vivek Krishnamurthy]

I think the amendment is important because it will influence the interpretation of all subsequent provisions of the bill.

Including language that says the best interests of the child need to be taken into consideration throughout the interpretation of the subsequent provisions means that if you're doing a legitimate interest analysis, that's going to impact that analysis by the company or other organization that's collecting and processing children's data.

That's a very good thing, and it's in line with what's happening internationally. This is a provision that we see in the U.K. It's in the California legislation. I expect to see this internationally in other jurisdictions as well.