Industry Committee on Oct. 31st, 2023

[Jim Balsillie]

Sure.

That's the root of the contention between the EU and the U.S.—that you must have a sufficiency realm that the data is going to that maintains the European threshold or else they don't allow the data to be transferred. That's been the tremendous contention of the Europeans in standing up for European citizens.

If you have these rules here but they can move to another jurisdiction that has lower standards, then all of those protections are stripped. If it's boomeranging across, going from coast to coast in Canada, but it boomerangs through a node in the U.S., it's all stripped.

[Rick Perkins, Conservative, South Shore—St. Margarets, NS]

Thank you.

[The Chair, Liberal, Joël Lightbound]

Thank you very much.

Mr. Sorbara, go ahead.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Thank you, Mr. Chair.

Welcome, everyone.

Bill C-27 is a very important bill for consumers, for individuals and for businesses, both domestically and internationally. One of the things I've been able to glean just from the testimony today is the regulatory alignment that's needed between us and other jurisdictions, and also that we in Canada benefit, sometimes, from what's called a fiscal federation. Sometimes the provinces move first, and sometimes we do, but we need to be on the same page due to the importance of the material here.

This is for the Canadian Bankers Association.

In 2018, I was part of the finance committee when we did the statutory review on money laundering and terrorist financing. “Moving Canada Forward” was a report that we issued in November 2018. You've raised some good things and some potential amendments and so forth with regard to the CPPA in relation to money laundering and terrorist financing. Can you comment on that and add any more colour that you wish to add in that vein?

[Lorraine Krugel]

Thank you for the question.

With the money-laundering piece, certainly when we look at other jurisdictions, Canada is behind with respect to combatting money laundering and terrorist financing. Other case studies are already in play in Europe, Estonia, Netherlands and the U.K. There is also information sharing in the U.S. This allows those organizations to uncover networks of criminal organizations that are leveraging the fact that individual organizations in Canada have to report to the government, but they cannot follow up to see whether or not the transactions will go to another organization. That other organization may not be reporting to the government, so the government cannot see the whole piece of the puzzle with respect to those criminal networks.

This information sharing will allow for more targeted and effective reporting. We believe that it will actually increase the privacy of Canadians. Right now, when we look at the amount of reporting that goes from organizations to the government on a per capita basis, it's twelve and a half times more than in the U.S. and 96 times more than in the U.K.

The approach we're proposing is narrower than what the GDPR permits. Many organizations can leverage the legitimate interest provision in Europe to be able to do this type of sharing. Because the legitimate interest in the CPPA does not permit disclosures, we're proposing that it be linked to the proceeds of crime act to really limit that sharing.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Okay.

I would like to follow up. I believe the CMA commented that it enabled small and medium-sized businesses to compete in the global economy through Bill C-27 as it is. Can you elaborate on that? Bill C-27 is a pretty in-depth bill. I almost wish I had gone to law school to understand most of it, but we're trying to get through it. Could you comment on that aspect quickly?

Then I have a follow-up question for Mr. Balsillie, if I have time.

[Sara Clodman]

Thank you for the question.

The law is designed to be principles-based. It does take into account the size and type of business and the activities that an organization is engaged in. It is very different from the European law, which is very prescriptive, requires pages of box-ticking and needs privacy lawyers to help people even understand. Even privacy lawyers there have trouble understanding the requirements. For small businesses here, that would be impossible.

This bill is much more balanced.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

Mr. Balsillie, I had the pleasure of sitting with you when Mr. Breton, the European commissioner, was here. I believe it was last year or something like that. I think we were talking somewhat about the issues that we're talking about today.

The Europeans have been the first movers on a lot of aspects of the new economy or industrial revolution 4.0 or 5.0—whichever clichéd term we want to use. You have brought your views here in terms of what you think is wrong and why. I respect that, of course. We all do.

In terms of what Bill C-27 intends to do in relation to the modernization of privacy and how we deal with privacy and AI, are there aspects of the bill where we are going in the right direction? Is it just absolutely going in the completely wrong direction?

[Jim Balsillie]

It's like saying that my bucket has 25 holes in it and that's better than 30 holes, or if we get rid of 20 of the holes, then we'll only have 10 left. I think the nature of the digital economy and the knowledge economy is that it's non-linear in its harms from imperfection. It takes a small hole to drive a truck through, so you need relative completeness or somebody will escape through a small hatch.

[Francesco Sorbara, Liberal, Vaughan—Woodbridge, ON]

I will say that if we're getting rid of 20 of the 25 holes, I think we're making progress.

[Jim Balsillie]

But you still have five holes in your bucket, so it's not a bucket. That's my point.

The point is that incompleteness is deeply harmful, with the nature of the knowledge economy and the data economy. That's why Canada is faltering with these prosperity and citizen wellness effects. We have to be complete.

[The Chair, Liberal, Joël Lightbound]

Thank you, Mr. Sorbara.

Mr. Villemure, the floor is yours.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much, Mr. Chair.

Ms. Vipond, if memory serves me, I believe you testified before the Standing Committee on Access to Information, Privacy and Ethics not long ago.

The minister discussed a voluntary code of conduct regarding the self-regulation of artificial intelligence. Do you think that's a realistic proposal?

[Chris Roberts, Director, Social and Economic Policy, Canadian Labour Congress]

Can you repeat the question?

[Siobhán Vipond]

Yes. I'm sorry. Can you repeat it?

[René Villemure, Bloc, Trois-Rivières, QC]

Yes.

Mr.Champagne proposed a voluntary code of conduct for businesses that would involve self-regulation. I'd like to know if you think that's a realistic proposal.

[Siobhán Vipond]

Thank you for the question. My apologies for making you repeat it.

I think that any time we go into voluntary we get into trouble, just as a fundamental approach to the work, so we do have major concerns there.

I would like to pass it on to my colleague, Chris, to flesh out our response on that.

[Chris Roberts]

It's just that: I think industry self-regulation in such an important area is precisely not what we need at the moment. We need clear statutory and regulatory rules around industry and clear expectations from industry.

[René Villemure, Bloc, Trois-Rivières, QC]

Thank you very much.

Mr. Balsillie, what do you think the foreseeable effects of Bill C‑27 will be based on jurisdictions and, in particular, in comparison to Quebec's Bill 25?

[Jim Balsillie]

To contrast it with bill 25 in Quebec and its effect on Quebec, I think the strategic approach of Bill C-27 will disproportionately harm Quebec, worse than any other region in Canada, for several reasons.

Number one, when you commodify social relationships and cultural properties and they can be exfiltrated and exploited, then you diminish the distinct social society in its control within the province.

Second, when you create ambiguities or different thresholds between the federal and the provincial, you'll naturally have lawyers go deeply into exploiting the lower threshold. You're seeing that happen with federal-provincial party data, where they're saying that the feds control federal political data even though law 25 says that's a provincial realm, but the position of the lawyers, in a judicial review happening in British Columbia now, is that it is not true.

Third, businesses will naturally arbitrage to the lowest jurisdiction. Picture a river between Quebec and another province. If there's a high environmental rule on the Quebec side of the river and a lower on the other side, the business will go to the lower part, even though it's all the same river.

The best way to protect Quebec, Quebec society and the Quebec economy is to make sure that every aspect of this bill is equal or superior to the principles that are in law 25, and currently that is not the case.

[René Villemure, Bloc, Trois-Rivières, QC]

In a report from last year, you discussed a concern about surveillance in connection with Bill C‑27.

Would you please clarify the concept of surveillance? What were your fears?

[Jim Balsillie]

Well, the nature of the contemporary economy, the data economy, is that you absorb data on people to manipulate them, and you use that data to do all kinds of things that benefit the keeper, the controller, of that data, who puts them into algorithms.

My view of this is that you need to deal with this ex ante. Who says you can collect that data? Who says you're allowed to manipulate me? I come here representing civil society, as a citizen. The harms of mismanagement here are deep and they are great, and they don't benefit Canada or Canadians in this model.

When I was young, teachers smoked cigarettes in the classroom. We are going to look back 10 years from now and say that it was remarkably absurd that we did this to our children and our society. This is your chance to be on the right side of history: what is good for society, the vulnerable and the country, and what is not.

[René Villemure, Bloc, Trois-Rivières, QC]

Do you think the bill will enable end users to understand how their data and consent will ultimately be used? Do you think users will be able to understand what they're consenting to?

[Jim Balsillie]

The answer is no, because so many of the people who consent are forced into a consent model or there's implied consent or there's no need to disclose there is consent. There are aspects of algorithms that who knows if you can contest if you don't know what's going on.

Look at the mental health crisis for our kids. What is driving this? What does that say about our society? This is a product of manipulation of vulnerable people, whether it's older people, younger people or marginalized people.

[René Villemure, Bloc, Trois-Rivières, QC]

So it's manipulation in every case.