Industry Committee on Oct. 31st, 2023

[Jim Balsillie]

I welcome your question.

Not to drop names, but I keep very close relationships with good friends on this, like Beeban Kidron, who is founder and chair of the U.K. 5Rights Foundation for kids, and Shoshana Zuboff, with whom I am very close and we'll be here together in Ottawa in February with many other developmental psychologists.

Fundamentally, when we were growing up, when something happened to you, you went into your bedroom and you licked your wounds for a couple of hours or a day, and you came back out. In this current process, where you cannot retreat and heal, there is a permanent record of this, and it undermines the healthy developmental process.

I could go on and on.

[Brad Vis, Conservative, Mission—Matsqui—Fraser Canyon, BC]

[Inaudible—Editor]

[The Chair, Liberal, Joël Lightbound]

Mr. Vis, I'm sorry. Your time's up, and there's something wrong with your microphone. Out of courtesy to the interpreters, we'll stop it there.

I'll now turn to Madame Lapointe.

[Viviane LaPointe, Liberal, Sudbury, ON]

Thank you, Mr. Chair.

My first question is for Ms. Krugel.

Some stakeholders have raised concerns about the fine balance we need in order to ensure that the privacy of Canadians is fully protected through this legislation, while also allowing for the positive benefits of online tools that use data to drive innovation. What is your perspective on how we can find that appropriate balance?

[Lorraine Krugel]

We believe that PIPEDA actually had a lot of elements around this. It already had organizations considering what was reasonable and what would be reasonable uses relating to personal information. That was in the Privacy Commissioner's guidance a lot. Now we see the CPPA taking those good things from PIPEDA and encoding the Privacy Commissioner's guidance around appropriate uses and reasonability.

When it comes to innovation, we believe there is a need for organizations to be able to leverage the information in a responsible way to be able to do this. We see this in some of the areas where there's more permission to use de-identified information for internal research and development and analytics purposes—again, in a responsible way.

We want to make sure that there are appropriate limits on some of this as well. We have a concern with respect to the prohibition on reidentifying information, because we believe that a lot of organizations, when they do their analysis and are looking for ways to innovate, will often de-identify information just to keep it safe. When you have a prohibition on reidentifying it, organizations won't do de-identification just for safeguarding. We think that's one area where an improvement can be made, but the use of de-identified information for internal purposes is very welcome.

[Viviane LaPointe, Liberal, Sudbury, ON]

Thank you.

My next question is for Ms. Clodman.

You mentioned in the opening statement that your organization serves many small and medium-sized enterprises. Can you tell this committee what the key considerations for SMEs would be in privacy law? In your view, does the consumer privacy protection act reflect these considerations?

[Sara Clodman]

I think the most important thing is take into account the variable capabilities of SMEs when they are collecting data, and I think the bill does achieve that. It needs a few tweaks in order to really help SMEs.

One of the most significant ones would be in the area of children's data. Careful consideration has to be made when thinking about what the rules should be. The simple provision that's in the bill right now is a very blunt instrument to deal with a very important topic.

For example, if a child goes to Canadian Tire to buy a mug, or if any person goes to Canadian Tire to buy a mug, with this provision, in the way it's written, Canadian Tire will have to determine whether that person is a minor. If so, the data will have to be bucketed separately. It's day-to-day transactions like that, not just for large organizations, but for small organizations. They would have to be able to keep track of which of their customers are minors. When they're not selling products to minors, or absent things where there are concerns, it's a lot of extra administrative work that is very costly for small businesses.

[Viviane LaPointe, Liberal, Sudbury, ON]

Can you tell us how the exceptions to consent in the consumer privacy protection act compare to the European Union's privacy laws?

[Sara Clodman]

Let me start by saying that consent and informed consent are extremely important in any privacy law. Those rules exist as well. The CPPA calls for clearer disclosure built on the existing rules, but the Achilles heel of disclosure is consent fatigue. In Europe, people have to consent to so much all the time that they don't carefully read the notices about what they're consenting to, so their consent becomes less well informed.

That is a major issue and it's something we'd like to avoid here.

[The Chair, Liberal, Joël Lightbound]

Thank you, Ms. Lapointe.

You have the floor, Mr. Villemure.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

Ms. Vipond, there are a lot of creators in my riding of Trois-Rivières.

Do you think that the part of the bill concerning artificial intelligence protects creators?

[Siobhán Vipond]

Thank you for the question.

This is a big concern that folks who work in the creative industries have, because, again, it's about the discussion. What does a compensation model look like? We're hearing that a lot in the media right now around performers and how their image can be looked at and used past the point.... Are they being compensated properly?

We also hear about creation, whether it's writing or the creation of art, and what happens to that afterwards. I don't think it's being addressed in an appropriate way, but we also aren't setting the table for those workers to be at the table to actually have those discussions so that we can be building it in the right way.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Mr. Balsillie, do you think this bill protects creators?

[Jim Balsillie]

No, I do not. I think the mistake with the creators, particularly in relation to Ms. Vipond's comment on AI, is that the government put its shoes on first and is now trying to put on its socks, and we have to start over.

You begin with the consultation and the dialogue with the stakeholders. Then you create your white paper, and then you go to legislation. Now we're trying to figure out what to do with our socks without taking off our shoes. We just have to take them off and start over.

[René Villemure, Bloc, Trois-Rivières, QC]

Creators in my riding are very concerned and feel powerless.

What could we do to improve the bill and reassure creators?

[Jim Balsillie]

We have to understand that we live in a world of digital mediation that has economic and non-economic effects, but how we govern these is through social structures.

When the car was invented, we decided there should be speed limits in front of schools and blood alcohol limits. It's the same here. In economics, you begin with norms. You define what you value, and then you work back from there with an appropriate tool kit. We do have the tool kits to achieve our norms, but we have to put our norms up front, and then we have to be cognizant of what's an effective tool kit to manifest it.

I think you have all the power in the world to create historic legislation here. I just want to see that you actually manifest the norms that you care about.

[René Villemure, Bloc, Trois-Rivières, QC]

As an ethicist, I am very happy to hear you refer to norms and values that must be in harmony in order to create this act, which would be exemplary.

You've previously spoken out about the fact that political parties aren't subject to Bill C‑27. Would you please clarify that view a little further?

[Jim Balsillie]

Yes, in Europe, for adequacy—and don't assume this bill will get adequacy in Europe—the two most sensitive types of information are children's information and political party information, which were not included in Bill C-27.

There's a minimum standard in British Columbia, and the political parties under the budget bill are claiming that they trump that under a judicial review right now, which is effectively no oversight whatsoever. It shows that you're playing with our democratic structures, our global adequacy and what is a constitutional realm for the provinces and the federal level here. I don't know for what purpose. I don't see anything wrong with raising an appropriate standard and then putting together the proper tool kit to look after the country we all love.

[René Villemure, Bloc, Trois-Rivières, QC]

You mentioned Shoshana Zuboff earlier. Do you think that Bill C‑27 will encourage or stifle surveillance capitalism?

[Jim Balsillie]

Bill C-27 turbocharges surveillance capitalism. I talked to Shoshana last week, and we worked through this. She is coming here in February. This turbocharge is insane.

[René Villemure, Bloc, Trois-Rivières, QC]

That's very interesting. Thank you.

Ms. Fortin LeFaivre, do you think that Bill C‑27 should align with Quebec's legislation and that the latter should prevail?

[Catherine Fortin LeFaivre]

From what our members have told us, certain specific elements should be aligned with Quebec's Bill 25. I'm thinking of the word “minor”, for example. The age is set at 14 in Quebec. We think we should rely on that. I'm also thinking of the definition of “anonymize” and of the scope of the individual right of recourse. Several elements rely on the principle of interoperability.

Many businesses already comply with Bill 25, which was passed last year, and tell us we should adopt certain aspects of that legislation.

[The Chair, Liberal, Joël Lightbound]

Thank you very much, Mr. Villemure.

Go ahead, Ms. McPherson.

[Heather McPherson, NDP, Edmonton Strathcona, AB]

Thank you very much, Mr. Chair.

Mr. Balsillie, I have a question for you about the privacy tribunal—similar to the Competition Tribunal that exists—where decisions, rulings or potential orders of the Privacy Commissioner would be challenged by organizations or businesses. This has been demonstrated by the Competition Bureau's rejecting and reversing decisions of the competition commissioner in the case of Rogers' takeover of Shaw, for example.

Other countries do not have this additional quasi-judicial body that seems to obstruct what independent agencies have decided. Parties to these decisions of the Privacy Commissioner can always go to the Federal Court, as in other countries, if they disagree with the decision. In fact, they can go to the Federal Court even to appeal the decisions of the privacy tribunal.

What is your opinion of the privacy tribunal? Is this an extra layer that just delays function and will hinder the Privacy Commissioner's office from carrying out its necessary functions and enforcing its decisions?

[Jim Balsillie]

I don't know who came up with this idea of a tribunal. I think it's a mistake; it shouldn't be there. It undermines the courts. It undermines the commissioner. I think it just adds another layer, as you said. If you're a corporation trying to negotiate with the commissioner, you'll just shrug your shoulders and say, “I'll see you in the tribunal”, which is quasi-judicial.

Why do we need it when we have perfectly legitimate courts that are bound by all the jurisprudence? No other country in the world has it. Nobody asked for it. Who in the world inserted this and under what kind of consultation? When I saw it, I thought, “Who did this?”