Industry Committee on Oct. 31st, 2023

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you for that.

Ms. Clodman, I hear your point about consent fatigue. I thought that was a really good point. I personally have experienced that, although obviously informed consent is very important.

I think the notion of norms came up earlier. In your opening remarks, you mentioned that consumers want protections. They also want services to be delivered intuitively. They also want to share data, and they kind of expect to receive discounts or expect that at least that data will help provide them with discounts—and often that is kind of implied. People also value personalization. I think many of us can probably agree that this is part of the norms that exist out there today in terms of consumers' behaviour and their relationships with different types of businesses.

From my perspective, based on your comments, it sounds as though it is contrary to what Mr. Balsillie said about it being a balance. Could you speak to that balance and getting it right a little bit more?

[Sara Clodman]

Absolutely. Thank you for the question.

It is very important to remember that this bill has two purposes. We believe both of those purposes can be fulfilled in harmony. One is to protect consumers' personal information, which is extremely important. The other is to enable businesses to succeed and innovate.

What we need, at the end of the day, is to make sure that, in a situation where a customer would not expect their data to be used in a certain way, that consumer has the opportunity to express consent and agree to the use of their data. However, in cases where a consumer would expect their data to be used in a certain way for regular business activities, they should not be asked to consent. That is when consent fatigue happens.

[Ryan Turnbull, Liberal, Whitby, ON]

I can see how that makes sense.

I can also see the flip side. There are some drawbacks to that, potentially. How do we know what consumers expect? We would need to have quite a lot of information about that.

Do you feel confident that this bill is getting it right, in terms of how it's defining “legitimate interest” in the various clauses? I think they imply some understanding of where those boundaries are.

[Sara Clodman]

The bill requires organizations—including not-for-profits looking to find funders and communicate with those funders—to make decisions about whether it is a regular activity. If they make the wrong decision, they are subject to significant fines under this bill, and to orders from the commissioner that can require them to stop collecting and using data. There is also reputational damage and the potential of a private right of action. Those are very significant incentives for companies to get it right.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you for that.

Mr. Boms, I think we haven't shown you enough love today. It seems as if the people in the room have gotten the preference. I want to ask you a question.

You described, in your opening remarks, some significant benefits to the right of data mobility and portability included in CPPA. Can you elaborate further on some of those? Is there anything you didn't have a chance to say in your opening remarks that you could put on the record?

[Steve Boms]

Thank you for the question.

Indeed, data portability in the financial services context bestows upon a consumer or an SME the ability to choose the tool, product or service that is best suited for them. There is not nearly as much competition in the financial services sector in Canada as there exists in multiple other jurisdictions. Because Canada does not have this data portability right, consumers and SMEs in Canada may find themselves stuck with their current service provider, which doesn't help push down fees or improve services, products and tools. It can also be a significant barrier to SMEs and consumers trying to improve their financial life if they can't find the tool or product that is best suited for them.

The data portability right, in our view, brings Canada on par with many other countries that have gone further than Canada has, so far.

[Ryan Turnbull, Liberal, Whitby, ON]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Turnbull.

Mr. Falk, you now have the floor.

Go ahead.

[Ted Falk, Conservative, Provencher, MB]

Thank you to all the witnesses for coming here.

Mr. Balsillie, I'd like to start with you.

In your comments and responses to questions, you talked a lot about personal privacy, surveillance and protecting prosperity. When you were the co-CEO of BlackBerry, you demonstrated that. I don't think there's anybody in this room who has been the custodian of more personal private data than you have been, so you're speaking from a position of authority, experience and knowledge. You prioritized individual security and privacy for people. Ten years ago, when I became an MP, BlackBerry was the only option we had for telephones because of the security aspect of it.

During COVID, this government, together with their NDP coalition partners and through the Public Health Agency of Canada, colluded with Telus to trample on Canadians' individual privacy by tracking them. Is that the kind of thing you're concerned about with this legislation, that it doesn't protect Canadians from that kind of behaviour? They did it without a judicial authorization.

[Jim Balsillie]

If I may, I'm going to answer this a little indirectly. I dialogue a lot at the subnational level with premiers who are grappling with issues of data and identity systems and so on. People like to talk about efficiency. I explain to them that they must first invest in trust in governance. Somebody can't build a 20-storey skyscraper in your backyard without talking to you. You are all politicians who go through policy discourse, yet when it comes to these digital realms, there's a tendency to bypass the trust in governance phase, yet the power and impact are profound.

The most important things are the elements of dialogue, the elements of transparency, the elements of governance, so that people know that they can trust what you're doing and that there's going to be democratic recourse if you slip over the line. That's okay, but if you come top-down or if you do it absent transparency or with sneaky carve-outs, it collapses trust, and that shuts down a lot of things.

Independent of the harms these things do, you lose the social licence to move ahead in an era when we need social licence because we can't ignore the potential of these digital technologies to help us in a pandemic. However, there's a proper way to do these things, and there's an undermining way to do these things.

[Ted Falk, Conservative, Provencher, MB]

Ms. Fortin LeFaivre of the Canadian Chamber of Commerce, you said that you really hadn't consulted with members as to how they would feel about the additional reporting requirements that this bill would demand of small businesses. What do you expect the response to be?

I know that when the CFIB recently came to my office and gave me responses from the members they had in my riding, they reported back that one of the biggest concerns that small businesses have is the reporting requirements and the red tape. Did you get the same feedback through your members?

[Ulrike Bahr-Gedalia]

I'd gladly jump in here. Thank you for the question, Mr. Falk.

As the Canadian Chamber of Commerce, we don't have a large number of small businesses that we represent. Though it is very diverse across sectors and across jurisdictions and industries as well, the few that we have engaged with haven't really commented on it, if I may say so.

We do engage in consultations with all of our members. I'm leading most of the innovation and digital economy files and committees through that. I haven't heard back in particular, I must say, from the portion of the small to medium-sized businesses. However, you may wish to define them. I think there was mention earlier of 100 employees or fewer. It depends sometimes on the jurisdiction. Having resided in Nova Scotia for a long time, I think it was even less than that.

They have not been proactively participating in the dialogue, but I can envision that there are great burdens that they would attach to any reporting and so forth. However, I can't comment, and shouldn't, on their behalf, as they haven't voiced it as such.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Villemure, the floor is yours.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you, Mr. Chair.

Mr. Balsillie, you discussed the difficult interoperability with Europe in the context of Bill C‑27. Could you be more specific on that subject?

[Jim Balsillie]

Absolutely.

First of all, I was commenting on adequacy. You have to maintain a threshold to interact with Europeans in the Canadian realm. When you look at the elements, very simply, of how you deal with children's data and how you deal with political party data, I don't believe that would survive a test.

Politicians can talk all they want, but if it goes to court and the judge says...just like they did in the Schrems II decision, you get shut down, and then you have to fix it in an emergency. Again, why not do it right the first time to protect Canadian business and Canadian citizens?

Just do it right.

[René Villemure, Bloc, Trois-Rivières, QC]

In its present state, do you think Bill C‑27 would be a good act when you consider generative artificial intelligence, better known as ChatGPT?

[Jim Balsillie]

No. I think what's happened since the original draft of this is that generative technologies have come to the fore. We used to think of data...and then you run an algorithm against it to get a result. Now you have data and an algorithm trains off it and says goodbye.

I will say—and this is beyond the scope of this committee—that you now have to think of what the infrastructure of a sovereign country is, because Europe has done what's called Gaia-X, a sovereign cloud. They're doing sovereign language models, because just to protect your data, but not control the rest of it.... In a sense, it'd be like us having our water treatment but not having our sovereign waste-water treatment. What is a sovereign country in an era of data and generative AI? We have to start thinking of what is national infrastructure and what is sovereign infrastructure. I chaired a panel on this subnationally, and I would extend it to the infrastructure, given what's developed in the past year, but our mandate was done a year ago. Yes, we have to get on with it.

Europe's been doing sovereign infrastructure with Gaia-X, with two billion euros for four years. They have their big summit next week in Spain. They have hundreds of companies. They have an interoperability framework. They have a permissions framework and an index of sharing. We should just draft right off it. We could do it federally and provincially. It's open-source. Infrastructure has to be talked about as part of this digital realm of data. It's there.

[René Villemure, Bloc, Trois-Rivières, QC]

You're talking about adequacy. As we all know, adequacy is a form of social capital.

Unless we act or perhaps completely redo Bill C‑27, do you think that social capital would be threatened?

[Jim Balsillie]

Yes. I chaired a panel on data authority for the Province of Ontario and I've been talking to them. In these elements of new privacy legislation and digital sharing protocols, it's a persistent structured form of consultation, including labour, including parents and including all kinds of communities, so that the licence has to be developed and maintained, because this moves laterally.

Yes, I think social licence needs to be a central part of the ongoing operating realm of data, in both public and private sectors.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Mr. Elder, you are a privacy law expert. In your opinion, when an average user clicks on “Accept”, does he actually understand the end use of his consent?

[David Elder, Head, Privacy and Data Protection Group, Stikeman Elliott LLP, Canadian Marketing Association]

I'm sorry. I missed part of that. I wasn't getting the volume.

I apologize.

[René Villemure, Bloc, Trois-Rivières, QC]

I'll repeat.

Do you think an average user understands the end use of his consent when he clicks on “Accept”?

[David Elder]

I think it depends very much on the scenario you're talking about. Sometimes there are some pretty simple data uses. We have to remember that this bill, for example, covers a wide range of industries and businesses, so certainly in more simple transactions, I would think that, in many cases, the answer would be yes. If you're talking about a more complicated transaction and use of algorithms, I'm not sure that the average user would always necessarily understand—

[René Villemure, Bloc, Trois-Rivières, QC]

For example, when a citizen or user clicks “Accept” on the website of Le Figaro, the newspaper, is he able to understand how his data will ultimately be used?

[David Elder]

I suppose it depends on whether they've read the document to which they're consenting and understand the privacy policy.